Iseva ye-VPN yasekhaya noma iseva yefu: iyiphi efinyelela i-NAS yakho?
Ithungo liyaphuma, kodwa i-NAS yasekhaya ihlala ingafinyeleleki. Khetha indawo ye-endpoint ngokusekelwe kumthombo okufanele uwuthinte, bese uhlola umzila.
Ithungo liyaphuma, iklayenti likhombisa ichashazi eliluhlaza, futhi ssh 192.168.1.20 isalenga kuze kuphele isikhathi. Ngahlangabezana nalokhu ngqo ngemuva kokuqasha i-instance encane yefu futhi ngabeka i-WireGuard kuyo: ukuxhawulana kuhle, i-DNS ikahle, kanti i-NAS phezu kwetafula lami ayifinyeleleki njengokungathi isenyangeni. Ithungo lalingenalo iphutha. I-endpoint yayimi kunethiwekhi engenawo umzila oya ekhaya lami. Indawo ye-endpoint inquma ukuthi yimaphi amanethiwekhi aseduze, ngakho yikhethe ngokusekelwe kumthombo okufanele uwuthinte kuqala bese uqhathanisa i-hosting kamuva.
Ithungo lifinyelela kuphela amanethiwekhi i-endpoint engawuhambisa kuwo
I-VPN inika iklayenti lakho ikheli ngaphakathi kwesizinda sokuhambisa se-endpoint uqobo. Uma iklayenti lithumela iphakethe ku-192.168.1.20, i-endpoint kufanele yazi ukuthi liyaphi. Ithebula le-VM yefu lazi ama-subnet e-VPC omhlinzeki; nge-LAN yakho alizange lizwe. Ukuxhumekile nokufinyeleleka kuyimibiko emibili ehlukene, futhi ukudideka okukhulu phakathi kwekhaya nefu kuvela ekuthatheni okokuqala njengobufakazi besibili.
Umyalo owodwa uyanquma. Ku-endpoint ip route get 192.168.1.20 kungaba igama le-interface ye-LAN noma kukhombisa umzila ozenzakalelayo. Emakethini asekhaya impendulo iwuhlangothi lwe-LAN. Ku-instance yefu iphakethe liphuma liye kwi-inthanethi bese liyafa. Ukuvula net.ipv4.ip_forward=1 nokwengeza umthetho we-MASQUERADE akukushintshi lokho, ngoba akukho lapho kudluliselwa khona kuze kube yilapho okuthile ohlangothini lwasekhaya kuqeda ukuxhumana okuya efwini.
Icala lasekhaya linengxenye yesibili: indlela yokubuya. Amaphakethe aphuma ku-LAN ngokusebenzisa ibhokisi lethungo enziwa i-NAT, noma i-LAN idinga umzila oqinile obuyela ku-subnet yethungo. Uma kusebenza uhlangothi olulodwa kuphela, hlonza sysctl net.ipv4.conf.all.rp_filter. Ukuhlunga okuqinile kwendlela ephambene kukhipha izimpendulo ezifika ku-interface ehlukile kunaleya umzila oyibikezelayo, futhi uphawu lubukeka njengomthetho wodonga lomlilo.
Funda uphawu ngaphambi kokuthinta ukulungiselelwa
Ithungo alisuki: okhiye, ikheli le-endpoint noma i-UDP port evinjiwe. Ithungo liphezulu kodwa amahost e-LAN afile: ukubekwa nokuhambisa. Ithungo liphezulu kodwa ukuphequlula kufile: ukudlulisela, i-NAT noma i-DNS. Lezo zingqimba ezintathu nokuhlola okuthathu okuhlukene, futhi ukubhala kabusha ukulungiselelwa obekulungile kakade kuchitha usuku.
| Symptom | First suspect | Check |
|---|---|---|
| Handshake fails, no transfer | Keys, endpoint port, UDP blocked | wg show, then the port from outside |
| Peer pings, LAN host times out | No route to the LAN | ip route get on the endpoint |
| Tunnel up, name resolution fails | DNS options in the peer config | Resolve a name from the client |
| Large transfers reset the connection | MTU | Lower the tunnel MTU and retry |
Ukufinyeleleka kokungena okuvela ekhaya kufanele kuhlolwe ngokwako, ngoba yikho okunquma ukuthi i-hosting yasekhaya ingenzeka yini nhlobo. Qhathanisa ikheli le-WAN elibikwa yi-router yakho nekheli elibonwa i-host yangaphandle. Uma liwela ku-100.64.0.0/10, noma womabili engavumelani, usemuva kwe-NAT yomhlinzeki futhi akukho ukudlulisela kwephothi okuyosebenza. Izinketho zangempela i-relay, isixhumanisi sefu esishaya siphume sisuka ekhaya, noma ukuhambisa i-endpoint.
I-hosting yasekhaya ikunikezani, futhi ibiza malini
Ikhaya yilona kuphela indawo ngokwezinga elingaphakathi kwe-LAN, futhi yiso sonke isizathu sokubeka iseva lapho. Amadivayisi aphendula kuphela kusegimenti yasendaweni, njengamaphrinta namakhasi okuphatha e-NAS anqaba ama-subnet angewona asendaweni, asebenza ngaphandle kokuhambisa okwengeziwe. Futhi usebenza umshini, i-router nokuxhumana okuphezulu ngokwakho.
Izindleko zingokwenyama. Ukulayisha kwasekhaya yikhona okuphezulu kubo bonke amaklayenti ngesikhathi esisodwa, ngakho ukushaya kwevidiyo nokulondoloza kuyancintisana ngepayipi elilodwa. Ugesi, ukuguga kwediski, amaphakethe, ikheli elishintshayo elidinga DDNS, i-router okufanele idlulisele i-UDP ngaphakathi, kanye ne-NAT ephindwe kabili kuwela kuwe. Insonto abantu abayishiyayo ukubuyisela: uma ibhokisi lifa ungekho, indlela yakho eyodwa yokungena ekhaya ifa nalo. Gcina idivayisi yesibili enokhiye afanayo, noma okungenani uhlelo lokufinyelela ngokwenyama.
Uma ufuna ukufinyelela kwe-LAN ngaphandle kwebhokisi lasekhaya, akha isixhumanisi esikhundleni sokwenza sengathi. I-endpoint yefu iba yi-router: ithungo elisuka ohlangothini lwasekhaya eline-AllowedIPs = 192.168.1.0/24 ku-peer yefu, kanye nokudlulisela ne-NAT kubhokisi lefu. Umhlahlandlela wokudlulisela we-strongSwan uhamba ingxenye yokubuya yalokho kulungiselelwa, futhi yilapho iningi lale mizamo lihluleka khona. I-peer yasekhaya manje kufanele ibe phezulu ukuze noma yini isebenze, ngakho ushintshile ukuncika okukodwa ngenye futhi kufanele ukubhale lokho.
I-endpoint yefu iyenzelwe ini ngempela
I-endpoint yefu ishintsha indlela yakho yokuphuma yomphakathi. I-traffic iphuma ebangeni lamakheli omhlinzeki, futhi amasayithi abona lelo kheli esikhundleni sekheli lasekhaya. Yilokho okubalulekile, futhi yingakho i-VPN yefu ingakunikezi i-NAS: ushintshile indlela yokuphuma, hhayi i-LAN.
Usasebenza isistimu yesivakashi, isevisi ye-VPN nezifakazelo zayo ngenkathi umhlinzeki esebenza i-hypervisor nenethiwekhi yenyama, futhi lokho kwahlukanisa kubalulekile uma okuthile kuhhaha phansi ngo-2 ekuseni. I-endpoint yomphakathi ihlolwa njalo, ngakho gcina iphothi lokuphatha livaliwe, vumela iphothi le-VPN kuphela, futhi ufake amaphakethe ngokohlelo. Amaqembu okuphepha nezindonga zomlilo zomhlinzeki kufanele avume lelo phothi, futhi amanye amafu alahla i-traffic edlulisiwe ngaphandle uma ulungisa ukuhlolwa komthombo nendawo okuyiwa kuyo ku-instance.
I-instance encane ikhava idlanzana lamaklayenti, kodwa ukubethela kungumsebenzi we-CPU, futhi i-instance ye-burstable ephelelwe amakhredithi iziphatha ngendlela engalingani ngaphansi komthwalo oqhubekayo. Bheka indlela oyisebenzisayo ngempela, hhayi iphepha lezincazelo.
Isinqumo ongasibhala phansi
Umsebenzi unquma indawo, hhayi ilebula elisebhokisini. Uma udinga idivayisi ku-LAN yasekhaya, impendulo elungile eshibhile i-endpoint yasekhaya; ibhokisi lefu lisebenza kuphela ngemva kokuba uswakhe isixhumanisi sokubuya. Uma udinga enye indlela yokuphuma yomphakathi, impendulo ifu futhi umbuzo we-LAN awuveli nhlobo. Ukufuna kokubili kusemthethweni, kodwa kusho ama-endpoint amabili, amasethi amabili okhiye nemizila emibili ebhaliwe.
| What you need | Endpoint location | What else must exist |
|---|---|---|
| Reach a NAS or printer on the home LAN | A box on that LAN | Port forward or relay, DDNS, recovery plan |
| Browse from an exit unrelated to home | Cloud instance | Firewall and egress rules, patching |
| Both, reliably | Two endpoints, or cloud plus a link home | Separate keys, routes, documented failure modes |
Qinisekisa kusuka kuklayenti ngokulandelana: ukuxhawulana, ikheli le-peer, i-host ye-LAN, bese kuba yi-IP yokuphuma. curl -s https://ifconfig.me kukhombisa lokho i-inthanethi ekubonayo, futhi ip route get 192.168.1.20 kukhombisa lokho i-endpoint ekukholelwayo. Uma ukuhlolwa kokuphuma kudlula futhi ukuhlolwa kwe-NAS kulenga, usunayo impendulo mayelana nendawo; ukulungisa i-AllowedIPs kuklayenti ngeke kudale umzila. Umugqa ohlukanisiwe njenge-10.8.0.0/24, 192.168.1.0/24 ugcina i-traffic ye-LAN ngaphakathi kwethungo kuphela uma lowo mzila ukhona ngempela.