Amaklayenti e-LAN awanaki i-VPN yerutha kuze kuvulwe ukuhamba ngepolitiki

Irutha lifinyelela ku-inthanethi ngomhubhe walo, kuyilapho ikhompyutha ephathekayo engemuva kwayo isabika ikheli le-ISP. Ukwengeza imithetho yokwamukela akusizi, futhi lokhu kwehluleka kuyafundisa: ukuhlunga kuphendula ukuthi iphakethe lingadlula yini, hhayi ukuthi liya kuphi. Ukukhethwa kwe-interface sekwenziwe ukusesha komzila okungazi lutho ngohlu lwakho lwamaklayenti. Lungisa ukusesha, futhi i-firewall ayisayona esisolwayo.

Umthetho wokuhlunga awukwazi ukukhetha i-interface

Ukugeleza kwamaphakethe kurutha le-Linux kwenza isinqumo somzila kuqala bese kudlula ihuku le-forward. Lapho umthetho ufana nedivaysi yomhubhe ephumayo, i-kernel isivele inqume ukuthi umhubhe uyindlela yokuphuma. Uma ithebula eliyinhloko lisakhetha umzila ozenzakalelayo we-WAN, iphakethe lisendleleni eya ku-ISP futhi umthetho wokwamukela oyisanda kuwubhala awuliboni neze. Leli qiniso elilodwa lokulandelana lichaza ukuthi kungani ikhasi lemithetho emisha ye-firewall lingashintshi lutho.

Isibonelo esingezansi sisebenzisa i-LAN engu-192.168.8.0/24 ku-br-lan, idivaysi yomhubhe i-tun0, kanye nebhokisi le-set-top elilodwa ku-192.168.8.23 okufanele lisebenzise umhubhe.

Funda ukusesha ngaphambi kokuhlela imithetho

Cela i-kernel ukuthi ixazulule umzila egameni lalelo klayenti. Impendulo ihlanganisa idivaysi ephumayo nekheli lomthombo elizokhethwa, futhi yilokho kuphela okudingayo ukuqinisekisa ukuxilongwa. Uma impendulo isho idivaysi ye-WAN, iphakethe alizange libe nethuba lokufinyelela kumthetho wakho.

ip -4 route get 198.51.100.7 from 192.168.8.23

Phinda umbuzo kuklayenti okufanele lihlale emzileni ojwayelekile. Uma zombili izimpendulo zisho idivaysi elilodwa, awukho umthetho osuselwe kumthombo osebenzayo, futhi ukulungiswa kungokwokuhamba kwemizila hhayi ukuhlunga.

Xhumanisa ithebula namaklayenti ofuna ukuwuhlanganisa

Ukuhamba ngemithetho kufaka ukusesha komthetho ngaphambi kwethebula eliyinhloko. Yakha ithebula umzila walo ozenzakalelayo kungumhubhe, bese uxhuma lelo thebula nesikhethi: i-interface yokufaka, ikheli lomthombo noma uphawu lwe-firewall. Ukubaluleka kunquma ukulandelana, futhi ithebula eliyinhloko lihlala phansi kakhulu ohlwini ku-32766, ngakho umthetho onenombolo ephansi ubhekwa kuqala. Izikhethi ze-interface zihlanganisa wonke amaklayenti ebhulohweni; izikhethi zamakheli zihlanganisa umshini owodwa.

ip -4 route add default dev tun0 table 200
ip -4 rule add iif br-lan lookup 200 priority 200

Izikhombimsebenzo ze-firmware zivame ukukhombisa izinto ezifanayo nekhasi lokuhamba ngemithetho noma ipolitiki ye-VPN. Uhlu lwamadivaysi lapho lulula ukuyinakekela kunemithetho ebhalwe ngesandla futhi luvame ukusinda ekuthuthukisweni okushintsha isintaksi yemithetho.

Khetha isikhethi ngamabomu. Umthetho we-interface mfushane futhi uqinile ekusaseni, kodwa ubamba nethrafikhi yokuphatha yerutha uqobo efika kulelo bhuloho. Umthetho womthombo unembile futhi udinga ukuhlelwa njalo lapho uhlu lwamadivaysi lushintsha. Bhala phansi ukukhetha, ngoba umuntu olandelayo ozobuza ukuthi kungani idivaysi eyodwa iziphatha ngendlela ehlukile uzokudinga.

Gcina izindawo zangaphakathi zingaphandle komhubhe

Ithebula elisha lazi imizila oyifakile kuphela. Isiqalo se-LAN asikho, ngakho ithrafikhi yephrinta ne-NAS ibingalandela umzila ozenzakalelayo womhubhe bese inyamalala. Umzila we-throw uqeda ukusesha kuleli thebula futhi ubuyisela isinqumo ethebuleni eliyinhloko.

ip -4 route add throw 192.168.8.0/24 table 200

Uma weqa lowo mzila, ukwabelana kwangaphakathi kuyaphuka, futhi isikhathi sokuphatha serutha uqobo singanyamalala uma isikhethi sibanzi kunalokho obekuhlosiwe. Bese uxazulula indaba yomthombo: amaphakethe omhubhe asaphethe amakheli e-LAN adinga ukuthi uhlangothi olukude lwazi umzila wokubuya, kuyilapho i-masquerading kumhubhe isusa leso sici futhi isuse nobunikazi beklayenti obuzobonwa uhlangothi olukude.

Imithetho nemizila engezwa ngesikhathi sokusebenza iyanyamalala ngemuva kokuqalisa kabusha noma ukubuyekezwa kwe-firmware. Yengeza emshinini wokuqalisa werutha, qalisa kabusha kanye, bese uhlola futhi kusuka kuklayenti: ikheli laso lomphakathi, iklayenti lesibili okufanele lihlale ku-WAN, kanye nezibali zomhubhe ngesikhathi sokuxhumana okusha.