hostapd ne-OpenVPN ku-Pi eyodwa: umgwaqo ozenzakalelayo ngowakabani?

hostapd neklayenti le-OpenVPN kungabelana nge-Pi eyodwa uma ibhuloho ligcina umgwaqo walo ozenzakalelayo futhi ithumbu ligcina indlela eya kuseva yalo. Imiyalo nokuhlehlisa.

Amaphoyinti axhuma endaweni yokufinyelela, athola ikheli, bese engafinyeleli lutho ngokushesha lapho ithumbu likhuphuka. hostapd ngokuvamile uyaphila kuleso simo, futhi OpenVPN nayo; okugqashukayo umgwaqo ozenzakalelayo, okungenzeka ukuthi awukaze ube khona ebhulohweni noma ithumbu lawushintsha ngaphandle kokushiya indlela eya kuseva ye-VPN uqobo. Le ncwadi yokuhola ibuyisela lowo mgwaqo endaweni yawo futhi ifakazela umphumela kusuka kuklayenti hhayi ku-Pi. Isinyathelo ngasinye singahlehliswa, futhi akukho lutho lapha okushintsha ukulungiselelwa kwethumbu kuze wazi ukuthi yikuphi ukuthutha okufunayo ngaphakathi kwalo.

Bhala uhlu lwamaphuzu okuxhumana ngaphambi kokuhlela noma yini

Ukuhlelwa okujwayelekile kubeka umsakazo ongentambo kanye nembobo enentambo ngaphakathi kwe-br0, kuqalise i-hostapd ngokumelene nebhuloho futhi kusabalalise izivumelwano ezivela ku-dnsmasq, kuyilapho iklayenti le-OpenVPN lidala i-tun0. Khona-ke izimfuno ezintathu ezihlukene zibonakala njengeyodwa: amaklayenti endawo yokufinyelela adinga i-Pi njengesango lawo, i-Pi idinga umgwaqo oya ku-inthanethi ukuze ifinyelele iseva yayo, futhi ibhuloho lidinga ikheli lesango amaklayenti lawo angalisebenzisa.

Funda isimo samanje ngaphambi kokusishintsha, ngoba le miyalo emine yehlukanisa inkinga yamaphuzu okuxhumana nenkinga yomgwaqo.

ip -br addr
ip route show
ip link show master br0
bridge link show

Uma i-br0 inekheli kodwa ingenayo imigwaqo ozenzakalelayo, amaklayenti afinyelela ku-Pi futhi akafinyeleli lutho ngale kwayo. Uma umgwaqo ozenzakalelayo ukhomba ku-tun0 ngenkathi ithumbu liphansi, i-Pi ayinayo indlela esebenzayo nhlobo, futhi uphawu lweklayenti lubonakala lifana ncamashi. Zombili izimo zibonakala zifana ngocingo, yingakho ithebula lemigwaqo kufanele lifundwe ngqo.

Nikeza ibhuloho umgwaqo ozenzakalelayo ongowalo

I-Raspberry Pi OS ivamise ukushiya ibhuloho lingenawo umgwaqo ozenzakalelayo uma ibhuloho lavela ngemuva kokubhalwa kwefayela lamaphuzu okuxhumana. Ibhloku ingeye-/etc/dhcpcd.conf, futhi kufanele isho i-router ephezulu hhayi i-Pi.

interface br0
static ip_address=192.168.50.2/24
static routers=192.168.50.1
static domain_name_servers=192.168.50.1

Kuleso sibonelo i-192.168.50.1 iyirouter ekhona futhi i-192.168.50.2 iyikheli lebhuloho le-Pi kusubnet efanayo, ngakho faka uhlelo lwakho esikhundleni sokukopisha izinombolo. Amalungu ebhuloho nawo akufanele acele ama-router, kungenjalo i-Pi izosala nemigwaqo ezenzakalelayo eqhudelanayo onqobayo encike kumethrikhi nesikhathi hhayi enjongweni.

Ngemuva kwe-systemctl restart dhcpcd, i-ip route show default kufanele ibonise i-br0 kanye futhi kungabi nakuphindwa okuvela embotsheni enentambo. Qinisekisa ukusesha hhayi ithebula, ngoba umbhalo omdala ungahlala eceleni kombhalo onqobayo: i-ip -4 route get 203.0.113.10 kufanele isho i-br0. Leyo kheli ivela kububanzi bemibhalo ye-TEST-NET-3, ngakho ayikwazi ukushayisana neseva yangempela ngenkathi ufunda lokhu.

Vimbela ithumbu ukuba lingeba indlela eya kuseva yalo

Iklayenti le-OpenVPN elamukela i-redirect-gateway lithatha umgwaqo ozenzakalelayo futhi ulikhomba ethumbini. Lokho kulungile lapho wonke amaklayenti endawo yokufinyelela kufanele asebenzise i-VPN, futhi akulungile lapho kufanele kube izindawo ezithile kuphela. Kunoma yikuphi, ukuxhumana kwe-Pi uqobo neseva akufanele kuhamba ngaphakathi kwethumbu elisakha. I-OpenVPN yengeza umgwaqo womsingathi oya kude ngokusebenzisa isango lokuqala lapho ihlehlisa umgwaqo ozenzakalelayo, futhi yilokho kanye ukuziphatha okugcina ukuthutha kuphila; uma lowo mgwaqo ungekho, ithumbu liwa ngokushesha lapho lisungulwa.

Ukuqhathanisa ngokushesha kwalowo mgwaqo wokuthutha ngaphambi nangemuva kokuxhuma kufanele leyo mizuzu eyishumi. I-ip -4 route get 203.0.113.10 kufanele isho idivayisi engaphansi kuzo zombili izimo, kushintsha imethrikhi kuphela. Uma isho i-tun0 ngemuva kokukhuphuka kwethumbu, umgwaqo womsingathi awukaze ufakwe futhi ukuxhuma kabusha okulandelayo kuzohluleka.

Lapho kufanele kudlule iziqalo ezikhethiwe kuphela ethumbini, sebenzisa i-route-nopull futhi ungeze imigwaqo oyifunayo ngesandla, noma uthumele iqoqo elincane kusuka kuseva. Kuleso sakhiwo ibhuloho ligcina umgwaqo ozenzakalelayo, futhi i-DNS iba isinqumo esilandelayo: ukudlulisela i-dnsmasq ku-resolver yasekhaya kunengqondo kuphela kumagama ahlala khona ngempela.

Nquma indaba yokudlulisela ne-NAT

Ithumbu eligcwele lidinga ukudlulisela okuvuliwe ku-Pi kanye nesango ohlangothini olukude elizimisele ukuhambisa isubnet yendawo yokufinyelela. Hlola ukudlulisela ngaphambi kwanoma yini enye, ngoba uziro wenza zonke izinguquko zomgwaqo zingabi nandaba.

sysctl net.ipv4.ip_forward
sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -s 192.168.50.0/24 -o tun0 -j MASQUERADE

Umthetho we-NAT uyisinqamuleli esisebenzayo lapho iseva ingeke yamukele isiqalo sendawo yokufinyelela, ngezindleko zokuthi wonke iklayenti livele njengekheli lethumbu le-Pi kumarekhodi ohlangothini olukude. Ukuhambisa isiqalo ngaphandle kwe-NAT kugcina amakheli ebonakala futhi kuncike kumgwaqo wokubuya we-192.168.50.0/24 ohlangothini lwasekhaya.

Bhala ukukhetha eceleni kwemithetho ye-firewall, ngoba umthetho we-NAT ongabonakali kusakhiwo uba nokungachazeki ngemuva kwezinyanga eziyisithupha. Gcina i-IPv6 esinqumweni esifanayo; umgwaqo we-IPv4 osebenzayo eceleni komgwaqo we-IPv6 ophukile usafundwa njengophuke ngengxenye kusiphequluli.

Qinisekisa kusuka kuklayenti, bese uhlehlisa ngokuhlanzekile

Hlola ngokulandelana lokhu kusuka ocingweni noma ku-laptop endaweni yokufinyelela: isivumelwano esivela ku-dnsmasq, i-ping eya ekhelini lebhuloho, bese kuba indawo ohlangothini olukude lwethumbu. Isinyathelo ngasinye sihlukanisa isendlalelo esisodwa esikhundleni sokukhiqiza ukwehluleka okukodwa okungenamsebenzi.

ip -4 route get 203.0.113.10
ping -c 3 -I br0 203.0.113.10

Bese uqinisekisa ukuthi i-Pi isenayo indlela yayo yokuphuma: i-ip route get 203.0.113.10 kufanele isho idivayisi engaphansi, futhi i-ping -c 3 -I br0 203.0.113.10 kufanele iphendule uma iseva ivumela i-ICMP. Uma izinyathelo ezimbili zokuqala zeklayenti zidlula kanti owesithathu uyahluleka, iphutha lisekudluliseni noma ku-NAT. Uma isinyathelo sesibili sihluleka, ibhuloho noma i-DHCP akukapheleli.

Ukuhlehlisa kuwukuhlela ifayela okukodwa nemiyalo emibili: susa ibhloku, qala kabusha i-dhcpcd, futhi ushintshe umgwaqo ozenzakalelayo ngokusobala nge-ip route replace default via 192.168.50.1 dev br0. Kwenze lokho ngaphambi kokuthi iwindi lokulungisa livalwe hhayi ngemuva, ngoba i-Pi elahlekelwe umgwaqo wayo ozenzakalelayo ayifinyeleleki kunethiwekhi obuzoyisebenzisa ukuyilungisa.

Izihloko ezihlobene