Lungisa ukungqubuzana kwekheli le-IP yasendaweni ngemva kokuxhuma ku-VPN

Yonke le mibiko izwakala ifana kodwa isho okuhlukile: ikhompyutha ikhala ngokungqubuzana kwekheli, kodwa ngezinye izikhathi kuphela, futhi ikakhulukazi lapho i-VPN ivuliwe. Izinkinga ezintathu ezihlukene zikhiqiza lowo mlayezo: ikhopi langempela kusixhumanisi sakho, ukugqagqana lapho inethiwekhi ekude isebenzisa ububanzi be-LAN yakho futhi akukho okukopishiwe, kanye nethuneli elinikeze ikheli elilodwa kuma-peer amabili. Ukulungisa kuyahluka esimweni ngasinye, futhi okungalungile kuhambisa uphawu esikhundleni sokulususa. Ngakho nquma ukuthi yisiphi isimo osinaso ngaphambi kokushintsha noma yini.

Izinkinga ezintathu ezabelana ngomlayezo owodwa wephutha

Ikhopi lisho ukuthi imishini emibili esigabeni esisodwa ifuna ikheli elilodwa. I-kherneli iyabona lokho ngoba impendulo yokuhlola kwayo ivela ku-MAC ehlukile, futhi okwenzekayo ngemva kwalokho kuncike ku-stack: i-Linux iyayibhala kwi-log, i-Windows ivimba i-interface futhi ibhala ingeno ku-log yesistimu, futhi iklayenti le-DHCP lingasenqaba isiphakamiso.

Ukugqagqana akukopishi ikheli nhlobo. I-LAN yakho yi-192.168.1.0/24, inethiwekhi yasehhovisi nayo yi-192.168.1.0/24, futhi manje umzila oya ehhovisi ukhomba kumakheli nawo ayiphrinta yakho ne-NAS yakho. Akukho okungqubuzanayo ngomqondo we-ARP; iphakethe limane liya kudivayisi engalungile komunye wemibuthano emibili.

Ukungqubuzana esichibini kuyiphutha lethuneli ngokwalo. Ama-peer amabili ahlelwa noma anikezwa ikheli lefana lethuneli, ngakho iseva ayikwazi ukwehlukanisa lapho ithumela ithrafikhi ebuyayo. Elinye lama-klayenti amabili libona ukuxhawula okusebenzayo futhi kungekho datha, okubonakala njengenkinga yomzila kodwa akusiyo.

Ukuhlola 1: ingabe ikhopi lisegabeni lakho?

Qala ngokubala lokho ikhompyutha yakho enakho ngempela, hhayi lokho okukhumbula ukuthi wakuhlela. Ikheli le-adaptha ye-VPN lingeyakho yedwa ithuneli futhi alifani nekheli elibonwa amasayithi wewebhu, ngakho ukuphuma komphakathi okwabiwe akuwona ukungqubuzana.

ip -br addr
ip neigh
ip route show table all | grep -E 'wg|tun|ppp'

Ku-Windows ulwazi olufanayo luvela ku-ipconfig /all naku-Get-NetIPAddress, kanti ikheshi yomakhelwane iseku-arp -a. Uma ikheli eliphikisanayo liku-adaptha yomzimba futhi isikhalo sivela ngaphandle kokuthi i-VPN isebenze, i-VPN iyibukeli nje futhi kufanele uyeke ukuyixazulula.

Ukuze ufakazele ikhopi esikhundleni sokuqagela, hlola ikheli kudivayisi engalinaki. I-arping -D ithumela ukuhlola ngekheli lomthombo eliyiziro, ngakho impendulo evela ku-MAC engalindelekile ifakazela ukuthi enye ihosithi isivele iphendula lelo kheli.

sudo arping -D -I eth0 -c 3 192.168.1.50

Bese uthola umnikazi ngomphathi wenethiwekhi esikhundleni sokuzikhethela elinye ikheli. Izabelo eziqinile ezihlala kuphela emanothini othile, amaphrinta anekheli eliqinile kanye nokubekelwa eceleni kuseva ye-DHCP yizona zisulu ezijwayelekile, futhi idivayisi evaliwe isanomnikazi wokuqashisa kwayo.

Ukuhlola 2: ingabe imibuthano emibili iyagqagqana?

Qhathanisa isiqalo esikunikezwa ithuneli neziqalo ezisemikhakheni yakho. Uma ububanzi obukude bulingana ne-LAN yakho noma buyiqukethe, iphutha ingukugqagqana, futhi okukudalulayo ukuthi ihosithi efinyeleleka ngaphandle kwe-VPN iyanyamalala, noma iphrinta yakho iphendula ekhelini lasehhovisi.

ip route get 192.168.1.10
ip -br addr show

Ukusesha komzila kukutshela ukuthi i-kherneli izosebenzisa yiphi i-interface, futhi leyo mpendulo iwukuxilongwa konke. Uma ithi ithuneli ekhelini elingeliphrinta yakho yasendaweni, unokugqagqana futhi akukho ukuvuselelwa kokuqashisa okungakushintsha.

Kunezindlela ezintathu ezithembekile zokuphuma, futhi ngokuvamile eyodwa kuphela etholakalayo kuwe. Uhlangothi olukude lungafihla ithrafikhi yesubneti egqagqanayo, ngakho iklayenti lakho libona kuphela ikheli lethuneli leseva. Ithuneli lingathwala isiqalo esikude esincane esingashayisani ne-LAN yakho. Noma iklayenti lingahamba ngokwekheli lomthombo ngemithetho yenqubomgomo, okusebenzayo kodwa okuntekenteke futhi okunzima ukukunikeza uzakwethu.

Ukushintsha izinombolo zenethiwekhi yasehhovisi akuvamile ukuba kube yisinqumo sakho. Ukushintsha izinombolo ze-LAN yakho ukuze ugweme ukungqubuzana kuwushintsho olukhulu kunalokho abantu abaningi abakulindele lapho kukhona amaphrinta, amakhamera namahosithi aqinile.

Ukuhlola 3: ingabe ithuneli lanikeza ikheli elilodwa kabili?

I-WireGuard ayinayo ichibi lamakheli. I-peer ngayinye ibonakala ngokhiye wayo womphakathi nangeziqalo eziku-AllowedIPs, ngakho ikhopi livela lapho ikheli lefana lethuneli libhalwa kumingeno emibili ye-peer noma lapho ukhwele olufanayo lufakwa emishinini emibili.

wg show all allowed-ips
wg show wg0 latest-handshakes
wg show wg0 transfer

Izibali zethrafikhi ziyikholomu ewusizo lapha: i-peer ekhombisa ukuxhawula kwakamuva kodwa kungekho ukudluliswa, kungenzeka inekheli elingalungile noma ifihlwe enye ingeno efuna isiqalo esifanayo. Beka isiqalo ku-peer eyodwa kuphela futhi unikeze idivayisi ngayinye ukhwele lwayo.

OpenVPN inechibi, futhi ukungqubuzana okuvamile iphrofayili yeklayenti eyabiwe enomugqa oqinile we---ifconfig okopishwe kumshini wesibili. Womabili ama-klayenti abese ecela ikheli lefana lethuneli, futhi iseva yamukela iseshini eyiqala ukuyicubungula. Ukuphela kwechibi nge---duplicate-cn kuveza umphumela ofanayo lapho amaseshini amaningi esitifiketi esisodwa encintisana ngengeno eyodwa.

Kulokhu funda ilogi yeseva hhayi ilogi yeklayenti. Iseva iyazi ukuthi iyiphi iseshini ethathe ikheli elithile, futhi amakheli aphindwayo akhona abonakala njengezexwayiso ezingafiki neze kuklayenti.

Lungisa emthonjeni, bese uhlola kabusha womabili amadivayisi

Ukulandelana kubalulekile. Qala ngokulungisa ikhopi kwi-LAN, ngoba iklayenti elingakwazi ukugcina ikheli ngeke likwazi ukugcina ithuneli. Bese ulungisa ukuhlinzeka ohlangothini lwe-VPN, ngoba ukushintshwa kweklayenti esabelweni sechibi kuyasuswa ekuxhumekeni okulandelayo. Ekugcineni, bhekana nobunikazi obuphindiwe: amakhwele ahlukene ku-WireGuard, izitifiketi ezihlukene noma okungenani amaphrofayili ahlukene ku-OpenVPN.

Kuklayenti ingxenye yomshini imfushane. Khulula futhi uvuselele ukuqashisa kwe-DHCP, noma cela ukuthi ikheli lishintshwe kuseva ukuze libekelwe eceleni. Ungabhali ikheli elingahleliwe elibonakala lingenamuntu.

sudo dhclient -r eth0 && sudo dhclient eth0
ipconfig /release && ipconfig /renew

Bese uqinisekisa kuzo zombili iziphetho, hhayi esisodwa. Qinisekisa isango, bese kuba yisevisi oyidingayo ngempela, bese uxhuma futhi uphinda. Uma amadivayisi amabili ebambe iqhaza, hlola womabili: ukuhambisa ikheli elilodwa kushiya elinye linamangeno agedile omakhelwane noma ukuqashisa okudala okuyophinda kuvele kamuva.

Okungekho okufanele ukwenze endleleni

Ungawuthulisi uphawu. Ukutholwa kwamakheli aphindiwe yikho okukuvimbela ukuthi ungathathi ikheli eselivele lisetshenziswa, futhi ukukucisha kuguqula ukungqubuzana okubonakalayo kube ukulahleka kwamaphakethe ngezikhathi ezithile okunzima kakhulu ukukulandelela. Kuyafana nokwamukela isexwayiso sesitifiketi esivela kuhosithi engalindelekile: lokho akusiyo inkinga yekheli nhlobo, futhi ukuchofoza ngaphesheya kwaso kufihla enye inkinga.

Futhi ungazishintshi ngokwakho izinombolo zenethiwekhi elawulwayo. Bhala phansi isilungiselelo sokuqala, buza umnikazi lapho ikheli labelwa khona endaweni eyodwa, futhi gcina ushintsho luncane ngokwanele ukuthi lungahlehliswa. Imithetho yokuthola ukungqubuzana kwamakheli ye-RFC 5227 ichaza ukuthi ukuhlola okulungile kufakazelani, okufanele ukwazi ngaphambi kokuthi uthi ukungqubuzana kungokoqobo.