I-OpenVPN yomhubhe ogcwele: engeza indlela yokuphuma kwi-inthanethi ohlangothini lweseva

Iklayenti liyazifakazela, lithola ikheli kuchibi futhi lifinyelela izinsizakalo kusizingathi se-VPN, kodwa yonke indawo yomphakathi igcina ngokuphelelwa yisikhathi. Yile ndlela umhubhe ongenakho ukuphuma obukeka ngayo, futhi uhlala unjalo kuze kube yilapho izinto ezine ezihlukene ziqinisile. Iklayenti kufanele lamukele umzila ozenzakalelayo, iseva kufanele idlulise, umdiyo womlilo kufanele uvume ukudlula, futhi izimpendulo zidinga indlela yokubuyela echibini. Zonke lezi zehluleka zine uphawu olulodwa, ngakho shintsha into eyodwa ngomzamo ngamunye bese ubhala umphumela.

Phusha umzila ozenzakalelayo futhi uqinisekise ukuthi iklayenti lifake ini

Umugqa ohlangothini lweseva mfushane, futhi uthinta kuphela amaklayenti amukela izinketho eziphushwayo. Ifomu le-def1 lifaka imizila emibili enguhhafu ozenzakalelayo esikhundleni sokususa ozenzakalelayo okhona, okugcina uxhumano lwamanje luphila futhi lusabamba yonke indawo.

push "redirect-gateway def1"

Ngemva kokuphinda uxhume, funda ithebula lomzila leklayenti esikhundleni sokuthemba iphrofayela. Ku-Linux imibhalo emibili ye-/1 ivela eceleni kuka-ozenzakalelayo wangempela, futhi i-Windows ikhombisa lelo bhangqa njengo-0.0.0.0/1 no-128.0.0.0/1. Iklayenti elingazinaki izinketho eziphushwayo, noma elilungiselelwe ukuzila, ligcina umzila walo wakudala futhi alikaze lithumele uhambo lwe-inthanethi emhubheni. Xazulula lowo mbuzo ngaphambi kokushintsha noma yini kuseva, ngoba awukho umthetho ohlangothini lweseva ongakwazi ukunxephezela.

Ukudlulisela kuyisilungiselelo seseva, hhayi isilungiselelo se-VPN

Funda ifulegi lokudlulisela ngaphambi kokuthinta umzila. Uziro lapho usho ukuthi i-kernel yamukela iphakethe leklayenti futhi iyenqaba ukulidlulisela phambili, okubonakala njengokuvinjwa komdiyo womlilo kusuka ekugcineni okude. Setha inani ngokusebenzisa indlela yokucubungula yesistimu ukuze lihlale likhona ngemva kokuqalisa kabusha.

sysctl net.ipv4.ip_forward
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-vpn-forward.conf
sudo sysctl --system

Okulandelayo, qinisekisa ukuthi isizingathi ngokwaso sinomzila osebenzayo oya ekuphumeni kwe-inthanethi. Isicelo esivela kugobongo lweseva sibonisa ukuthi indlela ephezulu iyasebenza futhi asisho lutho ngokudlulisela iphakethe leklayenti, ngakho zithathe njengezivivinyo ezimbili ezihlukene. Uma iseva ingakwazi ukufinyelela indawo, alikho inani lokucubungula kokudlulisela elizosiza.

Vumela ngqo lokho kudlula okuhlosile, futhi akukho okunye

Amaphakethe adlulisiwe adlula emzileni we-forward; uhambo olubhekiswe kusizingathi se-VPN ngokwaso ludlula ku-input. Lezi izinqumo ezihlukene, futhi ukuvula indlela ye-input akuvumeli ukudlula emshinini. Ukuzihlanganisa kuyisizathu esivamile sokuthi umdiyo womlilo ubonakale uvumela konke kuyilapho amaklayenti asaphelelwa yisikhathi.

Inqubomgomo encane yamukela ukuxhumana okusha kusuka echibini kuye kusixhumanisi sokuphuma futhi yamukela izimpendulo eziyingxenye yemigudu esunguliwe. Yibeke kumnikazi weqoqo lemithetho elisetshenziswa ukusabalalisa kwakho, esikhundleni sokwengeza umthetho ophindwe kabili ekugqaliseni ngakunye; imithetho ephindwe kabili iyanqwabelana futhi izibali ziyeke ukusho okuthile.

sudo iptables -A FORWARD -i tun0 -o eth0 -s 10.90.0.0/24 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o tun0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Ukushintsha yonke iketanga ukuze yamukele kwenza isivivinyo sidlule futhi kususe isizathu sokuba khona komdiyo womlilo. Gcina ubukhulu echibini nasemgxenyeni wokuphuma, futhi ushiye ukudlulisela okungahlobene.

Nika izimpendulo indawo yokuya

Amakheli echibi awaseyona ekuwona, ngakho iseva yomphakathi ayikwazi ukuletha impendulo ngqo kuwo. Mhlawumbe isizingathi se-VPN sihumusha ikheli lomthombo ekuphemeni, noma idivayisi ephezulu igcina umzila wokubuyela echibini.

sudo iptables -t nat -A POSTROUTING -s 10.90.0.0/24 -o eth0 -j MASQUERADE

Engeza ngqo isendlalelo esisodwa sokuhumusha. I-NAT yesibili ephezulu ifihla ekuqaleni futhi yenza kokubili amarekhodi abe cishe awusizo lapho okuthile konakala kamuva. Uma umhleli wendlela ophezulu usuvele uhambisa ichibi emuva, ukwengeza ukuhumusha kusizingathi kungaphezulu, futhi indlela yokubuyela ke incike ekucubunguleni kwalowo mhleli hhayi okwakho.

Izimo zamafu zengeza elinye isango, ngoba ezinye izinkundla zilahla amaphakethe akheli lomthombo lawo okungewona awesimo ngaphandle uma lokho kuhlolwa kwehlisiwe. Leso silungiselelo singaphandle kwesivakashi futhi kulula ukusikhohlwa lapho umshini wokuhlola wasekhaya usebenza.

Kufakazele kusuka eklayentini, hhayi kugobongo lweseva

Qala ngesicelo se-IPv4 sezinombolo, bese kuba ukusesha igama, bese kuba uhlelo lokusebenza. I-ping ifakazela ukudlulisela nokuhumusha;ayifakazeli lutho mayelana nokuxazululwa, ngoba izinketho ze-DNS ziqala ukusebenza lapho ukuhlanganiswa kweklayenti kuzifaka.

curl -4 -m 5 http://198.51.100.10/
dig +short example.com

Bhala izinguquko kanye nesinyathelo sokuhlehlisa njengoba uqhubeka, ukuze inqubomgomo yokuphuma ibuyiswe ngesenzo esisodwa lapho isivivinyo sehluleka. Le ndlela ihlanganisa kuphela i-IPv4; bhala uhlu lwe-IPv6 ngokwehlukile ngaphambi kokusho ukuthi ukusatshalaliswa kuthwala konke ukuhamba.