I-Hairpin NAT: kungani iphoyinti lokugcina le-VPN lihluleka ngaphakathi

Iseva ye-VPN ephendula isuka kunethiwekhi yeselula kodwa yehluleka isuka kusofa ngokuvamile ayiyona inkinga yesitifiketi. Iklayenti elingaphakathi ku-LAN licela i-router ukuthi lihumushe iphakethe okungukuthi indawo yalo iyikheli lomphakathi le-router uqobo, okusho ukuthi iphakethe kufanele liphume bese liphinda lingene ngokushesha. Leli qhinga libizwa nge-hairpinning, futhi ama-router amaningi akusebenzi nhlobo noma akwenza kuphela uma ibhokisi lokuhlola livuliwe. Ukuphumelela kokuhlolwa kwangaphandle yikho okwenza kudideke, ngoba kufakazela ukuthi isilaleli nomthetho wokudlulisa kulungile.

Iphakethe liyaphuma bese liphinda lingene

Landela iphakethe. Iklayenti lixazulula igama lomphakathi, lixhuma kukheli lomphakathi, futhi i-NAT yendawo ye-router ibhala kabusha indawo iye kuseva yangaphakathi. Impendulo yeseva ibhekiswe kukheli le-LAN leklayenti, ngakho ibuyela emuva ngesixhumi esibonakalayo se-LAN se-router ngaphandle kokudlula emthethweni we-NAT owawuzohumusha umthombo emuva.

Manje iklayenti lithola iphakethe elivela kukheli elingakaze lithumele lutho kulo, bese liyalilahla. Lokho kungalingani yikho konke ukwehluleka.

I-RFC 4787 ichaza ukuziphatha okulindelekile ku-NAT kuleli cala, futhi inguqulo emfushane ukuthi empeleni kungokuzikhethela ngisho lapho kuchazwe khona ngokombono. Amanye ama-router abiza lesi silungiselelo nge-NAT loopback, amanye awubiza nge-hairpin NAT noma i-NAT reflection, futhi amanye awakhombisi lutho. I-router engenakho akakalungiswanga kabi; yenza into evamile, futhi ukulungisa kungokwakwenye indawo. Ungaphethi ngokuthi ukuhlolwa kwasekhaya okwehlulekile kusho ukuthi umthetho wokudlulisa womphakathi awulungile.

Ukuhlola 1: hlola izindlela ezimbili ngokuhlukana

Ngaphandle kwe-LAN, xhuma ngephrofayela efanayo umsebenzisi wangempela angayisebenzisa bese uqinisekisa ukuthi isikhathi sokuhlangana siyasungulwa. Ngaphakathi, xhuma kukheli lomphakathi ngephrofayela efanayo bese ubhala iphutha eliqondile kanye nesikhathi.

Ukuhlola kwasekhaya okunembile kugcina igama lomsingathi futhi kushintsha ikheli kuphela: curl -v --resolve vpn.example.com:443:203.0.113.10 https://vpn.example.com/ kuthumela isicelo kukheli lomphakathi kuyilapho kusabonisa igama leseva elifanele. Lokho kuhlukanisa inkinga yokuxazulula amagama nenkinga yokuhumusha, okulula ukukudida uma igama elifanayo lisebenza lisuka enkantini yetiye. Qaphela ukuthi iklayenti lehluleka ekuxhumaneni kwe-TCP noma kamuva ku-TLS, ngoba eyokuqala ikhomba ukuhumusha kanti eyesibili ikhomba ubunikazi.

Ukuhlola 2: funda lokho iseva ekubonayo

Ukwaziswa okuwusizo kakhulu umbono weseva. Qalisa ukubamba kumsingathi we-VPN okuhlungwe kukheli le-LAN leklayenti nakukheli le-LAN le-router, bese uphinda umzamo wasekhaya. Uma kungafiki lutho, iphakethe alizange lisinde ekuhumusheni.

Uma ukuxhumana kufika kukheli le-LAN le-router esikhundleni salelo leklayenti, i-hairpinning iyenzeka futhi umthombo ubhalwe kabusha. Lokhu kuwukuhlelwa okusebenzayo, hhayi ukwehluleka.

Ukuhlola 3: lungisa ngaphandle kokuthinta indlela yangaphandle

Kunezindlela ezintathu ezisekelwayo, ngokulandelana kokwanda komthelela. Eyokuncane kakhulu i-DNS ehlukanisiwe: shicilela irekhodi langaphakathi ukuze igama leseva elifanayo lixazululwe likheli langaphakathi kumaklayenti ase-LAN, lokhu okugwema ngokuphelele indlela yomphakathi. Okulandelayo ukuvula inketho ye-loopback noma i-reflection ebhalwe phansi ye-router, uma ikhona, nokuyisebenzisa kule sevisi kuphela. Eyona ebanzi umthetho we-source-NAT kwi-router obhala kabusha ithrafikhi esuka ku-LAN iye kuseva ukuze impendulo ibuye ngomthetho we-router; ku-router ye-Linux lowo umthetho MASQUERADE ku- POSTROUTING ohambisana nekheli nechweba leseva. Zontathu zishiya indlela yangaphandle ingathintekile, futhi leso yisici okufanele sigcinwe.

Ungandisi ukudluliswa kwechweba okungahlobene ukuze indlela yasekhaya ifane neyangaphandle, futhi ungayisusi isevisi iye kwelinye ichweba ukuze ugweme inkinga. Zombili izinguquko zishintsha lokho umhlaba wangaphandle ongakufinyelela ukuze kulungiswe into ebonwa umhlaba wangaphakathi kuphela.

I-DNS ehlukanisiwe inedokhi elilodwa okufanele lishiwo. Ukushintsha igama lomsingathi nge-IP engakhethiwe kushintsha lokho iklayenti elikuqinisekisayo, ngakho irekhodi langaphakathi kufanele lisahambisana negama elikusitifiketi.

Ukuhlola 4: qinisekisa zombili izindlela ngemuva kwalokho

Phinda umzamo wangaphandle usuka ngaphandle kwe-LAN, phinda umzamo wangaphakathi ngephrofayela efanayo, futhi uqinisekise ukuthi ilogu yeseva ikhombisa izingqungquthela ezimbili eziphumelelayo ezihlukene hhayi impumelelo eyodwa nokuthula okukodwa. Bese uhlola ukuthi amanye amaklayenti asafinyelela isilaleli nokuthi izindlela eziya kumithombo yangasese azishintshanga.

Gcina irekhodi lifushane: yiliphi iklayenti elisebenzise iliphi ikheli, yini iseva eyibonile, futhi yikuphi ekulungiseni okuthathu okusetshenzisiwe. Izimfuno ze-hairpinning ze-RFC 4787 ziyireferensi yalokho okulindelekile ku-NAT lapha, futhi zichaza ukuthi kungani i-router engenaso lesi sici iziphatha ngendlela evamile. Ukwehluleka kwasekhaya umhlaba wangaphandle ongakwazi ukukulingisa kuwumbuzo wokuhumusha kuze kufakazelwe okuhlukile, ngakho kuhlola kanjalo.