Amaklayenti e-hotspot ku-Pi awafinyeleli i-LAN yasekhaya nge-TUN VPN

Amaklayenti endawo e-Wi-Fi ne-Ethernet axhuma ku-hotspot ye-Pi, athola ikheli kububanzi bayo be-DHCP futhi alayishe amakhasi e-inthanethi ngaphandle kwezikhalo. Lawo maklayenti afanayo abe esephelelwa isikhathi lapho evula ukwabelana kwamafayela noma isixhumanisi sewebhu ku-LAN yasekhaya, kuyilapho i-Pi ngokwayo ifinyelela leyo LAN ngomhubhe. Akukho okugqekile ohlakeni olungenantambo. Okushodayo isivumelwano esihlelisiwe: i-prefix ye-hotspot kufanele ilethwe ku-interface ye-TUN, futhi okuthile ohlangothini lwasekhaya kufanele kwazi ukuthumela izimpendulo emuva lapho. Izingxenye zombili kufanele zibe khona ngaphambi kokuba iphakethe elilodwa liqede uhambo lokuya nokubuya.

Izixhumanisi ezintathu ezinemisebenzi emithathu ehlukene

Ibhuloho le-Ethernet le-Linux lidlulisela amafreyimu ngekheli le-MAC lendawo ekuyiwa kuyo. OpenVPN kumodi ye-TUN ithwala amaphakethe e-IP futhi ayinayo nhlobo ingqimba ye-MAC, ngakho ukwengeza ibhuloho lendawo akulokothi kubhalise umhubhe njengembobo. imibhalo ye-kernel ye-TUN/TAP ichaza lokho kwehlukana: idivayisi ye-TAP ibukeka njenge-interface ye-Ethernet, idivayisi ye-TUN ayibukeki kanjalo. Idizayini ehlanganisa amachweba amabili endawo bese ihlela indlela iyi-router, noma ngabe amagama e-interface athini.

Lokho kwehlukana kunquma ubunikazi. Isubneti yamaklayenti, i-gateway yawo ezenzakalelayo kanye negunya le-DHCP lalolo bubanzi kungokohlelo lwendawo lwe-Pi. Ukusakazwa kwe-DHCP yasekhaya akweqi umhubhe ohlelisiwe, futhi akukho sethi yebhuloho esikushintshayo; ukuqondisa amaklayenti kuseva ye-DHCP yasekhaya idizayini ye-relay ehlukile futhi eyenziwe ngamabomu enezindlela zayo zokwehluleka.

Gcina imodem ngaphandle kwebhuloho lamaklayenti futhi. Ukuxhumana kwe-PPP akusona idivayisi ye-Ethernet enelinye ilebula, futhi umqondo wendlela ezenzakalelayo we-pppd obhalisiwe usebenza ngemuva kwengxoxo ye-IPCP futhi uhoxisa indlela yawo lapho lolo xhumano luwa. Ukukopisha ithempulethi ye-DHCP nokuqamba kabusha yonke usb0 ibe ppp0 akufakazi lutho nge-gateway, imethrikhi noma umjikelezo wokuphila.

Khetha ama-prefix ngaphambi kokuhlela noma yikuphi ukulungiselelwa

Ama-prefix anqabelanayo asebenzisa ubusuku obuningi kunemithetho ye-firewall, ngoba ukunqabelana kuthumela ukusesha kwendlela ku-interface okungeyona ngisho lapho umhubhe uphilile. Qala ngokubala lokho okukhona kakade ku-Pi, bese ufunda umphumela njengamachibi amane ahlukene.

ip -4 addr show scope global
ip -4 route show table main
ip -4 route get 192.168.77.10

Ichibi lokuqala ikheli le-underlay u-opharetha alinikeza imodem; kufanele lihlale lingaphandle kwanoma yiluphi uhlelo olubheke kumaklayenti. Lesibili isubneti yomhubhe ekhethwe iseva, ngokuvamile /24 yayo yangasese. Lesithathu ibhuloho le-hotspot, futhi lesine i-prefix yasekhaya ofuna ukuyifinyelela. Kulolu hambo i-hotspot ithola 172.28.90.0/24 nebhodlela ku-172.28.90.1, futhi i-LAN yesevisi yasekhaya igcina 192.168.77.0/24, okuvimbela okuzenzakalelayo 192.168.1.0/24 kanye no-10.0.0.0/24 okulethwa ama-router abathengi kanye nobubanzi bopharetha 100.64.0.0/10.

Kumemezela ikheli lebhuloho njenge-gateway kububanzi be-DHCP be-hotspot futhi akukho okunye. Ungalokothi unikeze amaklayenti e-hotspot ikheli lasekhaya njenge-gateway; awanayo indlela yengqimba yokuxhumana eya kuleyo ngxenye.

Hlela indlela yohlangothi ngalunye ohlangothini olunalo

I-Pi idinga indlela eya ku-prefix yasekhaya ngomhubhe. Amaseva asemodini yeseva ngokuvamile acindezela leyondlela, ngakho qinisekisa kuqala ukuthi ukudlulisela kuvuliwe nokuthi i-kernel ixazulula ikheli lasekhaya lisuka ku-tun0.

sysctl net.ipv4.ip_forward
ip route add 192.168.77.0/24 dev tun0
ip -4 route get 192.168.77.10

Uma i-ip route get isabika i-interface ye-underlay, ma kube lapho; akukho okunye phambili endleleni okungalungisa ukusesha okungalungile.

Amadivayisi asekhaya awanayo indlela eya ku-172.28.90.0/24, ngakho izimpendulo zawo zilandela i-gateway ezenzakalelayo futhi zifela ku-router. Kunezixazululo ezimbili ezisekelwayo. Noma engeza indlela emile ku-router yasekhaya eqondisa i-prefix ye-hotspot ekhelini le-LAN leseva ye-VPN, noma lapho iseva iyona ngokwayo iyi-gateway, bhalisa i-prefix yeklayenti kuthebula lendlela yeseva ngokwayo. Kumodi yamaklayenti amaningi ye-OpenVPN, umkhombandlela oqondene neklayenti uthwala lokho kuhlotshaniswa: ifayela eliqanjwe ngokwegama elijwayelekile lesitifiketi seklayenti, eliqukethe i-iroute 172.28.90.0 255.255.255.0 kanye nomugqa ohambisanayo we-route owufaka ku-kernel yeseva. Indlela ye-kernel eqanjiwe kuseva ayisona isitatimende esifanayo nokutshela iseva ukuthi iyiphi iklayenti engumnikazi we-prefix.

Ungayithuthukisi insizakalo ye-DHCP yenethiwekhi yasekhaya iye kuseva ye-VPN ukuze lokhu kusebenze. Ukushintsha i-gateway ezenzakalelayo yendlu yonke ukuguqulwa okukhulu kakhulu kunokwengeza indlela eyodwa yokubuya yangasese, futhi kudonsa i-DNS, ukubekelwa kwamakheli kanye nayo yonke idivayisi engayinaki incwadi entsha yokuqasha ekwehlulekeni.

Vula ukudlulisela ngaphandle kokuqagela i-firewall

Ukudlulisela okuvuliwe akusho ukuthi iphakethe livunyelwe ukudlula. Ithrafikhi esuka ebhulohweni iya emhubheni isahlangana nemithetho yokuhlunga, futhi inqubomgomo yokudlulisela ezenzakalelayo ethi drop ilahla ithrafikhi ye-hotspot kuyilapho ithrafikhi ye-Pi ngokwayo iqhubeka isebenza, lokho okukhiqiza ngqo uphawu oluhlukanisiwe olungenhla.

iptables -S FORWARD
iptables -t nat -S POSTROUTING
nft list ruleset

Funa umthetho wokwamukela osuka ku-br0 uya ku-tun0 kanye nendlela yempendulo ehambisanayo, kanye nomthetho we-postrouting ongase ubhale kabusha umthombo. Uma inqubomgomo yeketanga ingu-drop futhi akukho mthetho ohambisanayo, engeza ukwamukela okuncane bese uphinda uhlole esikhundleni sokuphendula inqubomgomo ibe accept.

Ukuhumusha kuwukukhetha kwenqubomgomo, hhayi imfuneko. I-NAT yomthombo ebheke ku-LAN yasekhaya yenza iklayenti ngalinye le-hotspot libonakale njengekheli lomhubhe we-Pi, lokho okulahlekelwa ukunikezwa kweklayenti ngayinye kumarekhodi asekhaya futhi kuphula izinsizakalo ezilindele umthombo wangempela. Ukuhlela indlela ngaphandle kwe-NAT kugcina amakheli amaklayenti ebonakala kodwa kuncike endleleni yokubuya engenhla. Khetha eyodwa futhi uphathe i-DNS ne-IPv6 ngendlela efanayo, ngoba indlela ye-IPv4 esebenzayo eduze kwendlela ye-IPv6 ephukile isafundwa njengengxenye ephukile kusiphequluli.

Qinisekisa uhambo lokuya nokubuya, bese ulwephula ngamabomu

Hlola kusuka kuklayenti le-hotspot, hhayi neze kusuka ku-Pi, ngoba ithrafikhi ye-Pi ngokwayo yeqa kokubili indlela yokuya nendlela yokubuya. Buka zombili izixhumanisi ngesikhathi iklayenti elilodwa lizama ukufinyelela insizakalo yasekhaya.

tcpdump -ni br0 host 192.168.77.10
tcpdump -ni tun0 host 192.168.77.10
ping -c 3 192.168.77.10

Funda kokubili ukuthwebula ndawonye. Izicelo ku-br0 ezingalokothi zivele ku-tun0 zisho ukuthi i-Pi ayidlulisi noma indlela ikhomba kwenye indawo. Izicelo ku-tun0 ezingenazimpendulo zisho ukuthi uhlangothi lwasekhaya alunayo indlela yokubuya noma iseva ihlunge iphakethe. Izimpendulo ku-tun0 ezingalokothi ziphinde zivele ku-br0 zisho ukuthi umthetho wokuhlunga ohlanekezelwe awukho, lapho umhubhe ubonakala uphelele futhi iklayenti lisabona lutho.

Bese wephula indlela ngamabomu. Yehlisa ukuxhumana kwemodem bese ukhuphula futhi ugijime kabusha izihlolo zendlela nokuthwebula; indlela esinda emhubheni kodwa enyamalalayo lapho kuxhunyaniswa kabusha ingeyephrofayela yokuxhumana, hhayi eyomyalo wesisodwa. Qinisekisa ukuthi ukuthuthwa komhubhe kusaphuma nge-underlay hhayi ngokwaso, umjikelezo ojwayelekile lapho indlela ezenzakalelayo ecindezelwe yamukelwa ngaphandle kwendlela yomsingathi eya kumlingani.

Yamukela idizayini kuphela lapho iklayenti le-hotspot likwazi ukuxazulula igama lasekhaya, livula insizakalo ye-TCP futhi ligcina isikhathi sokusebenza siphila phakathi kokuxhumana kabusha kwemodem okukodwa. Uma uhlelo lokusebenza ludinga ngempela ukutholwa kwezinga le-Ethernet engxenyeni yasekhaya, khetha idizayini ye-Layer 2 esekelwayo esikhundleni sokuchaza ibhuloho lendawo njengeliboshiwe bese ulinda ukusakazwa kuvele.