Isango lisingatha ikhasi lalo lokuphatha: ikheli langaphakathi noma langaphandle

Ikhasi lokuphatha liphendula livela ocingweni olusedatheni leselula futhi liphelelwa yisikhathi livela kukhompyutha ephathekayo ejoyine i-VPN. Akukho okonakele emhubheni, ngoba isicelo asingeni kuwo. Igama lomphathi lixazululwa libe ikheli langaphandle lesango, futhi lelo kheli lifinyeleleka kuphela ngaphandle komhubhe owuqedayo. Ukulungisa lokhu kusho ukunikeza isevisi umnyango wangasese, hhayi ukuhambisa iphuzu lokugcina langaphandle.

Ikhasi lilayishwa livela ngaphandle hhayi ngomhubhe

Kubhekwa izicelo ezimbili ezihlukene. Kusukela kudatha yeselula isiphequluli sifinyelela ngqo ekhelini langaphandle. Ngaphakathi komhubhe igama elifanayo lixazululwa libe yikheli elifanayo langaphandle, futhi iphakethe manje kufanele liphume ngomhubhe ukuze lifinyelele ikheli ohlangothini olukude lomhubhe uqobo. Igama elifanayo, ikheli elifanayo, izindawo ezimbili ezihluke kakhulu.

Umzila wendawo okuyiwa kuyo ukhetha ikheli, hhayi imbobo. Akukho okwaziwa kuthebula lokuhambisa ukuthi imbobo 443 ingeyokuphatha futhi imbobo 1194 ingeyokuthutha, ngakho zombili zithathwa njengendawo eyodwa.

Yingakho ikhasi kwesinye isikhathi lisebenza futhi kwesinye singasebenzi, kuncike egameni nasekuxhumaneni okusetshenziswe yiklayenti. Le nkinga yomzila, hhayi inkinga yokuqinisekisa. Womabili amaklayenti aqinisekisa kahle.

Gcina iphuzu lokugcina langaphandle lifinyeleleka

Amaphrofayili omhubhe ogcwele adinga umzila wokuhlukile womkhawulo we-VPN, futhi inketho ye-redirect-gateway ye-OpenVPN ibhala khona kanye lokho: umkhawulo okude ugcina umzila odlula esangweni ebelivele likhona ukuze umhubhe ungahambisi phakathi kuwo. Susa lokho kuhlukile futhi ukuthutha okubethelwe kulandela umhubhe, okuphetha isikhathi kumjikelezo. Lokho kuhlukile yikona okwenza ikheli lomkhawulo lihlale lifinyeleleka ngaphakathi komhubhe.

Umphumela uwukuthi ikheli langaphandle lihlala lifinyeleleka kusukela kuklayenti, yingakho futhi isicelo sesiphequluli kulelo kheli singalandela lokho kuhlukile futhi siphume singangenanga emhubheni. Ukuhlukile kwenza umsebenzi wakho, futhi igama yilona elenza umonakalo.

Ngaphambi kokushintsha noma yini, funda isinqumo somzila hhayi uhlu lwezixhumi. Imiyalo engezansi iphrinta isinqumo hhayi uhlu lwezinto. Yisebenzise kusukela kuklayenti ehlulekile.

ip -4 route get 203.0.113.77
ip -4 rule show
ip -4 route show table all

Uma ukusesha kukhombisa umzila womkhawulo odlula esangweni elibonakalayo, ukuziphatha kulungile futhi ikhasi lokuphatha limane luthunyelwa emzileni ongafanele. Yilapho ukuxazululwa kwamagama kuba ukulungisa.

Nikeza isevisi igama langasese

Isevisi idinga igama elixazululwa libe yikheli lesango ngaphakathi komhubhe, kuyilapho igcina incazelo yesitifiketi negama lomphathi elilindelwe uhlelo. Irekhodi lesifunda langasese legama lokuphatha iyimpendulo evamile, futhi ishiya igama lokuthutha lingathintwanga.

Ungaqondisi kabusha igama lokuthutha ekhelini langaphakathi, ngoba ukusungulwa komhubhe okulandelayo kuzozama ukufinyelela ikheli elikhona kuphela ngaphakathi komhubhe. Lelo phutha likhiqiza i-VPN esebenza kanye kuphela.

Hlola futhi zombili imindeni yamakheli, ngoba irekhodi le-AAAA elishiywe ngemuva lingathumela isiphequluli endaweni ucebo langasese olungakaze lufinyelele kuyo.

dig +short admin.hq.internal
dig +short -t AAAA admin.hq.internal
curl -sS -o /dev/null -w '%{http_code} %{remote_ip}\n' https://admin.hq.internal/

Vumelanisa inqubomgomo nendawo lapho inqubo isebenza khona

Inqubo yomdabu elalela esangweni ifinyelelwa ngomzila wokungena wasendaweni, ngakho uchungechunge lokungena nokubopha kwesokhethi kunquma ukuthi isicelo samukelwa yini. Imithetho yokudlulisa nokudlulisa kwe-IP ayikwenzi isilaleli sasendaweni siphendule. Vumela imithombo yomhubhe kunqubomgomo yokungena futhi uqinisekise ukuthi inqubo iboshelwe ekhelini umhubhe ongafinyelela kulo.

Isitsha esishicilelwe embotsheni yomsingathi silandela umzila ohlukile, ngoba iphakethe lihunyushwa ngendawo okuyiwa kuyo bese lidluliswa. Leso sicelo sihlangana nenqubomgomo yokudlulisa yomsingathi kanye nemithetho ye-Docker uqobo, yingakho isilaleli somdabu esisebenzayo singaba khona kanye nesitsha esenqaba leyo mbobo.

Ukulandelana kokuqala kubalulekile kuzo zombili izimo, ngoba ukubopha ekhelini elivela kuphela ngemuva kokuthi umhubhe ukhuphuke kwehluleka ngokuthula ngesikhathi sokuqalisa.

Hlola ukufinyelela kwangasese nomzila wangaphandle owenqatshiwe

Yenza isicelo esisha esinegama kusukela kuklayenti egunyaziwe ngokugcina ukuhlolwa kobuwena kohlelo uqobo kungaphazamisekile. Bese uzama leyo sevisi ngaphandle komhubhe futhi uqinisekise ukuthi ayiphenduli. Igama langasese liwusizo hhayi umkhawulo, futhi isilaleli esisaboshelwe ekhelini langaphandle sisobala. Lokho kuhlola kokugcina yikona okushiwo izibuyekezo eziningi zikushiya.

Funda ukubopha nesimo sesihlungi hhayi igama lomphathi abalitholile abasebenzisi. Ukubonakala kuyisici sesokhethi hhayi segama. Lowo mehluko uyaphila kukho konke ukushintsha kwe-DNS.

ss -lntp | grep ':443'
nft list ruleset | grep -n 443
curl -sS -m 5 -o /dev/null -w '%{http_code}\n' https://203.0.113.77/

Lapho isicelo sangaphakathi sibuyisela ikhasi futhi isicelo sangaphandle siphelelwa yisikhathi, isevisi inomzila oyedwa wangasese owenziwe ngamabomu futhi ukuthutha kuhlala kufinyeleleka. Lapho isicelo sangaphandle sisaphendula, isilaleli noma ingeno yesitsha esishicilelwe kufanele incishiswe ngaphambi kokuba othile achaze isevisi njengengaphakathi kuphela.