I-Wi-Fi yezivakashi isaqhubeka nokusebenzisa umzila omkhulu: yinikeze indlela yayo yokuphuma

Udale inethiwekhi yezivakashi, wengeza umzila wayo, futhi izivakashi zisaqhubeka nokuphuma ngoxhumano lwakho olujwayelekile lwe-inthanethi. Umhubhe uyasebenza, i-LAN eyinhloko iyasebenza, futhi amadivayisi ezivakashi abika ikheli elisendaweni oyinikezile, ngakho akukho okubonakala kukhona okugqekeziwe. Okujwayelekile ukushoda akukhona umzila kepha isikhethi: i-router inquma indlela ngaphambi kokucabangela ukuthi iphakethe langena ngaluphi uxhumano, futhi ngaphandle uma okuthile kuhambisana ngokusobala nokuhamba kwezivakashi, lokho kuhamba kuzothola okumisiwe. Isixazululo isigaba, umthetho wenqubomgomo kanye nendlela yempendulo, ngokulandelana lokho.

Uphawu: izivakashi zisaqhubeka nokuphuma nge-WAN

Inkomba ikheli lokuphuma. Idivayisi yesivakashi efinyelela i-inthanethi ngomhubhe izobika ikheli lomhlinzeki womhubhe, kanti leyo ethole okumisiwe izobika uxhumano lwakho olujwayelekile. Qhathanisa ndawonye idivayisi yesivakashi nedivayisi ye-LAN eyinhloko, ngoba icala elithakazelisayo yilapho zehluka kulokho okulungiselelile futhi zihambisana.

Uphawu lwesibili ukungabi khona kokuhamba ku-interface yomhubhe ngenkathi izivakashi ziphequlula. Uma izibali zinganyakazi, inqubomgomo ayikaze isetshenziswe, futhi ukulungisa umhubhe uqobo akukusize.

Isinyathelo 1: isigaba sangempela, hhayi igama kuphela

Igama le-SSID alidali ukwehlukaniswa. Hlola ukuthi inethiwekhi yezivakashi iphela ku-interface yayo, i-VLAN noma ibhuloho, nokuthi ibanga lamakheli lehlukile kwi-LAN ethembekile. Ezindaweni eziningi zokufinyelela zabathengi, i-SSID yezivakashi ixhunyaniswa ngebhuloho esigabeni esifanayo nakho konke okunye, okwenza umsebenzi osele ungenzeki kuze kube yilapho lokho kulungisiwe.

Bese uqinisekisa ibanga lezivakashi kanye neseva yayo ye-DHCP, futhi gcina izilungiselelo zesixazululi zixhunyiwe kuleso sigaba hhayi kuyo yonke i-router. I-subnet yezivakashi ekhona kuphela njengombhalo kumthetho we-firewall ayisona isigaba, futhi i-router ngeke ibe nayo i-interface yokuqhathanisa nayo.

Ungaxhumanisi izivakashi ngebhuloho ku-LAN eyinhloko ukuze kube lula ukulungisa i-VPN. Lokho kushintshanisa ukwehlukaniswa obukufuna nendlela emfushane yokuhambisa, futhi yisona sizathu esijwayelekile esenza inethiwekhi yezivakashi igcine inokufinyelela kuphrinta naku-NAS.

Isinyathelo 2: khetha umhubhe ngomthombo

Amathebula okuhambisa akhethwa ngendawo ekuyiwa kuyo, ngakho umthetho othi «thumela i-0.0.0.0/0 emhubheni» usebenza kubo bonke. Ukuhambisa ngomgomo kwengeza isilinganiso sesibili: khetha ithebula ngekheli lomthombo. Ku-router esekelwe ku-Linux, lokho kungumthetho owengeziwe kanye nethebula elikhethekile, futhi ukulandelana kubalulekile ngoba umthetho wokuqala ohambisanayo uyawina:

ip rule add from 192.168.60.0/24 lookup 100 priority 1000
ip route add default dev wg0 table 100
ip route get 1.1.1.1 from 192.168.60.10

Lowo myalo wokugcina uphendula umbuzo ngqo: iyiphi i-interface leli thombo elizoyisebenzisa kule ndawo. Yisebenzise ngaphambi nangemva koshintsho futhi uzokwazi ukuthi inqubomgomo isebenzile ngaphandle kokuthinta isiphequluli.

Iningi lama-firmware e-router liveza into efanayo njengomthetho we-interface noma ukukhetha kwesango okususelwe emthonjeni. Noma yiluphi uhlelo lolimi olusetshenziswa yipulatifomu yakho, umgomo uyafana: hambisa ne-interface yokungena noma isiqalo somthombo, bese ushitsha umzila kulokho kuhambisana kuphela. Umthetho ohambisana nendawo ekuyiwa kuyo awukwazi ukuhlukanisa isivakashi nedivayisi yasekhaya.

Isinyathelo 3: indlela yempendulo nokuhunyushwa

Iphakethe eliphuma ngomhubhe kufanele libuye. Mhlawumbe umlingani womhubhe uyazi indlela ebuyela esiqalweni sezivakashi, noma i-router ihumusha umthombo wezivakashi ekhelini lomhubhe. Khetha okukodwa futhi ukubhale phansi, ngoba izimo zokwehluleka zibonakala zihlukile: indlela yokubuya engekho inikeza uxhumano olusungulwayo olungaphenduli neze, kuyilapho ukuhunyushwa okungekho kaningi akukhiqizi lutho.

nft add rule ip nat POSTROUTING ip saddr 192.168.60.0/24 oifname "wg0" masquerade

Uma ukhetha ukuhunyushwa, khumbula ukuthi umlingani manje ubona ikheli elilodwa kusivakashi ngasinye, ngakho inqubomgomo yeklayenti ngayinye ekugcineni okukude iyanyamalala. Uma ugcina amakheli, zombili iziphetho zidinga isiqalo sezivakashi ekuhambiseni nasekuphathweni kwazo, okuwumsebenzi omningi futhi okulindelekile kakhulu.

I-IPv6 idinga umthetho wayo. Inqubomgomo ebhalelwe i-IPv4 ayihlanganisi omunye umkhakha, futhi idivayisi yesivakashi ene-IPv6 esebenzayo izoyisebenzisa ngokukhululeka ngenkathi umzila wakho we-IPv4 ohambiswe ngokucophelela uhleli ungenzi lutho. Hambisa imikhakha yomibili noma khubaza i-IPv6 esigabeni sezivakashi, kodwa ungacabangi ukuthi umthetho ohlanganisiwe owubhalile uhlanganisa lokho idivayisi ekwenzayo ngempela. Hlola neklayenti elinemikhakha yomibili ivuliwe, ngoba yiso leso simo umklamo okufanele umelane naso. I-laptop ethanda i-IPv6 ibonakala ilungile ekuhlolweni kwe-IPv4 kuphela futhi iyavuzwa kwelangempela.

Hlola ukwehlukaniswa, hhayi ukuphequlula kuphela

Ukuphequlula kufakazela ukuthi indlela yokuphuma ishintshile. Akufakazeli ukuthi isigaba sihlukanisiwe, futhi ukwehlukaniswa yisona sizathu sokuba inethiwekhi yezivakashi ikhona. Kusuka kudivayisi yesivakashi, zama ukufinyelela i-interface yokuphatha ye-router, umsingathi we-LAN ethembekile kanye nensizakalo okufanele yenqatshwe; zontathu kufanele zehluleke, futhi ukwehluleka kufanele kube isinqumo senqubomgomo hhayi isikhathi sokulinda okungekho muntu ongasichaza.

Bese uhlola idivayisi ye-LAN eyinhloko futhi uqinisekise ukuthi indlela yayo yokuphuma ayishintshanga. Yikho lokho kuhlehla umklamo obangela kona kaningi: umthetho obanzi ohloselwe izivakashi, osetenziswa kuyo yonke i-interface ngoba ukuhambisana kwabhalwa endaweni ekuyiwa kuyo.

Ekugcineni, nquma ukuthi kwenzeka nini uma umhubhe wehla. Izivakashi zingase zingabi ne-inthanethi noma zibuyele emzileni oyivumayo, futhi ukukushiya kungagqamile kusho ukubuyela buthule kuxhumano olujwayelekile, okuyiyo kanye impumputhe okwakufanele ivinjelwe inqubomgomo yezivakashi. Iresiphi yokuhambisa ukuhamba kwe-inthanethi idlula ekukhethweni komzila okufanayo ku-router esekelwe ku-pfSense.

I-DNS evela ku-router yiso simo esimangaza abantu ekugcineni. Uma izivakashi zisebenzisa i-router njengesixazululi sazo, imibuzo ye-router uqobo ilandela umzila we-router hhayi umthetho wezivakashi, ngakho ukusesha kungaphuma ngoxhumano olujwayelekile ngenkathi ukuhamba kohlelo lokusebenza kungaphumi. Gcina isigaba, isixazululi kanye nenqubomgomo yokwehluleka kunothi elilodwa, futhi umuntu olandelayo uzokwazi ukuhlola zontathu ngaphandle kokukhipha umklamo kabusha.