Indlela yokwakha inqubomgomo ye-VPN failover kurutha ngaphandle kokuvuza
Nquma ukuthi ithrafikhi kufanele yenze ini lapho umhubhe okhethiwe uwile: umhubhe wesipele, i-WAN evamile noma ukuvimba. Bese uyakha futhi uyihlole kurutha.
Ukushintshwa kwesipele kwasebenza ngqo njengoba kwakulungiselelwe, futhi lokho kwakuyinkinga. Lapho umhubhe oyinhloko uwile, irutha yahambisa umzila ozenzakalelayo yaya kumodemu yekhebula, amakhompyutha aphathekayo aqhubeka nokuphequlula, futhi akekho oshayile ucingo. Ezinsukwini ezimbili kamuva othile wabona ukuthi isabelo sezezimali sasifinyeleleka ngomzila ovulekile we-inthanethi amahora ayisithupha. Inqubomgomo ye-VPN failover kurutha akuwona iqhinga lokuhambisa imizila; isinqumo sokuthi ithrafikhi kufanele yenze ini lapho indlela ekhethiwe ingasekho, futhi leso sinqumo kufanele sibe khona ngaphambi kokuba indlela inyamalale.
Nquma umphumela ngaphambi kokukhetha isitholi
Ngokuvamile kunemiphumela emithathu etafuleni: ukuthumela amaklayenti athintekile ngomhubhe wesipele, ukuwavumela ukuba asebenzise i-WAN evamile, noma ukuwavimba ngokuphelele. Bhala ukuthi yikuphi okusebenza kuyiphi i-VLAN, i-SSID noma isigaba sedivayisi. Umthetho owodwa oyisicaba othi «shintshela ku-WAN» yiwona owenza ukuthi isabelo sezezimali esingenhla siphelele emzileni womphakathi.
Lokhu kuthathu akushintshani. Ukubuyela ku-WAN kugcina ideski losizo liphendula izingcingo kodwa kuveza amagama angaphakathi kusisombululi sendawo. Umhubhe wesipele ugcina inqubomgomo kodwa ungase uhlale ekhelini lokuphuma uhlangothi olukude olungalamukeli. Ukuvimba kulungile kwi-VLAN yamaholo futhi akulungile kunethiwekhi yezivakashi engakaze isebenzise umhubhe.
| Outcome | Right for | What breaks |
|---|---|---|
| Backup tunnel | Policy must hold, remote access required | New exit address, return route, slower rekey |
| Plain WAN | Guest or public-only traffic | Internal names, DNS and IPv6 exposure |
| Block | Payroll, admin, anything VPN-only | Users lose all access and call you |
Hlanganisa isitholi nokwehluleka okwesabayo ngempela
Isimo sokuxhawula, isimo se-interface kanye nokudlulisela okusebenzisekayo kungamaphawu amathathu ahlukene, futhi okokugcina kuphela okubalulekile kumsebenzisi. I-WireGuard peer ingakhombisa ukuxhawula kwakamuva ngenkathi umkhakha ophezulu womhlinzeki ulahla amaphakethe. Iklayenti le-OpenVPN lingahlala «lixhunyiwe» ngemva kokuba umzila eliwucindezelayo uyekile ukuxazululeka.
Ku-pfSense ilungiselelo elisebenzayo iqembu lama-gateway eliphakelwa i-dpinger, elihlola ikheli lokuqapha futhi limake i-gateway njengephansi lapho ukulahleka noma ukulibaziseka kudlula imikhawulo yalo. Khomba lokho kuqapha entweni engaphandle komhubhe, njengomsingathi kwi-LAN ekude noma ikheli lomphakathi olifinyelela ngalo. Ukulikhomba ekhelini le-peer lomhubhe uqobo kukala ingxenye osewazi ukuthi iyaphila.
Akha iqembu ukuze isipele sihlale siyindlela yokugcina
Sebenzisa izigaba esikhundleni sohlu olulodwa lwamalungu. Okoyinhloko kusigaba 1, umhubhe wesipele kusigaba 2, i-WAN kusigaba 3 kuphela kuma-VLAN inqubomgomo yawo evumayo. Ku-pfSense lokhu kungaphansi kwe-System > Routing > Gateway Groups: engeza womabili ama-gateway, wanikeze izigaba ezihlukene, setha i-Trigger Level kube ilungu liphansi kanye nokulahleka kwamaphakethe, gcina, bese usebenzisa iqembu njengokujwayelekile kwe-interface noma kunkambu ye-Gateway yemithetho ye-firewall eyidingayo.
Kwisimo seklayenti le-OpenVPN ku-pfSense 2.5 nangemuva, isilungiselelo se-Default Gateway sesimo sinquma ukuthi umhubhe ushintsha umzila ojwayelekile wesistimu noma cha. Ukuhambisa imizila ngomthetho kuziphatha ngendlela okulindele ngayo kuphela lapho umzila ocabangayo ukhona ngempela. Ngemva koshintsho hlola Status > Gateways esikhundleni sokuthemba isithonjana sesimo somhubhe.
Izilungiselelo ezimbili zibangela iningi lokudlidlizela. Esinye isikhathi sokuhlola esifushane kunokuhlangana kabusha komhlinzeki uqobo. Esinye iqembu lapho okoyinhloko nokwesipele babelana ngesigaba, ngakho kokubili kuhlala kufanelekile ngaso sonke isikhathi. Engeza i-hysteresis ngemikhawulo yokulahleka nokulibaziseka ngaphambi kokuba abasebenzisi bazwe ukushintsha esikhundleni sakho.
Vala izindlela umhubhe ongakaze ube nazo
Okokuqala ukuvuza kwe-DNS. Isisombululi siqhubeka siphendula ku-WAN futhi sidlulisele ngaphandle kuyo, ngakho amagama aqhubeka exazululwa nge-ISP ngenkathi ithrafikhi iboshelwe emhubheni. Khawulela ama-interface okuphuma esisombululi, sindisa isisombululi sangaphakathi kumaklayenti, futhi uvimbe imbobo 53 kukho konke okunye kuma-VLAN e-VPN kuphela.
I-IPv6 idinga isinqumo sayo. I-LAN eneziteki ezimbili ingalahlekelwa umhubhe kodwa igcine umzila ojwayelekile we-IPv6 womhlaba osebenzayo, ngakho iziphequluli zikhetha i-IPv6 futhi ziphume nge-WAN ngenkathi i-IPv4 ibonakala ivalwe ngokuphelele. Kungaba hambisa i-IPv6 emhubheni noma uyeke ukumemezela isiqalo somhlaba ngenkathi umhubhe uphansi. Inqubomgomo engxenye imbi kunokungabi nayo, ngoba ibonakala isebenza.
Bese kuba indlela yokubuya. Uma ukuphuma kwesipele kusebenzisa ikheli lomthombo elihlukile, uhlangothi olukude kufanele lwazi ukuthi ithrafikhi iyibuyisela kanjani kulo, futhi zonke izimo eziboshelwe ekhelini elidala sezifile. Amaseshini avulwe lapho okoyinhloko wawa awafuduki; ayama kuze kuphele isikhathi bese uhlelo lunquma ukuthi lwenzeni.
Hlola ukuwa, ukudlidlizela nendlela yokubuya
Khipha okoyinhloko ngenkathi ithrafikhi engenabungozi ihamba, bese ufunda izinto ezine: Status > Gateways ngezimo zamalungu eqembu, pfctl -ss ngezimo ezisaboshelwe ku-gateway endala, i-traceroute evela kuklayenti yendlela yokuphuma, kanye nombuzo wesisombululi ukubona ukuthi iyiphi iseva ephendulile.
Manje yenza idlidlize. Phakamisa okoyinhloko imizuzwana engamashumi amathathu, yehlisa emashumi amathathu, kabili. Uma ithrafikhi ilandela konke ukushintsha, imikhawulo iqinile kakhulu noma izigaba azilungile. Lungisa lokho ngohlelo lwakho, ngoba uma kungenjalo umhlinzeki uzokwenza ngolwakhe.
Ekugcineni, qinisekisa ukuthi usakwazi ukuphatha irutha. Gcina indlela engaphandle kwebhendi njengekhebula lekhonsoli, i-VLAN yokuphatha noma imodemu yeselula. Ukuhlolwa kokushintshwa okukuvalela ngaphandle kungukuhlolwa ongakwazi ukukuqeda, futhi irutha engafinyeleleki ayikwazi ukuzibuyisela yona.
Ngaphambi kokuthi inqubomgomo isiphelile, kufanele ukwazi ukuphendula imibuzo emine ngaphandle kokuvula itheminali: yimaphi ama-VLAN angasebenzisa i-WAN ngenkathi umhubhe uphansi, isitholi siqapha ini futhi silinda isikhathi esingakanani, yimaphi amaseva amagama nemizila ye-IPv6 ehamba nendlela, futhi ubuya kanjani uma nesipele sehluleka. Uma noma iyiphi impendulo ithi «noma yini obekujwayelekile», inqubomgomo iseyeyase-rutha hhayi eyakho.