I-router ye-LAN nekhasimende le-VPN: amadivayisi amabili, amathebula amabili emizila

Amadivayisi amabili adlulisela iphakethe futhi ngalinye ligcina ithebula lalo. I-router ye-LAN iyazi ukuthi isiqalo esikude singesekhasimende le-VPN, futhi ikhasimende le-VPN liyazi ukuthi singafinyelelwa kanjani leso siqalo ngomzila waso weshubhu. Hlela ithebula lokuqala kuphela futhi iphakethe lifika emshinini ongenawo umzila ohambisanayo, ngakho liphuma futhi ngomzila ozenzakalelayo. Leyo yiyo yonke inkinga, futhi ohlangothini lwe-LAN ibonakala njengendilinga yokuhambisa imizila, ngoba icishe ibe njalo.

Dweba ukugxuma okubili ngaphambi kokuthinta umzila

Thatha isakhiwo esiyisibonelo: izibungu ze-LAN ku-192.168.50.0/24, i-router evamile ku-192.168.50.1, ikhasimende elikhethiwe ku-192.168.50.15, kanye ne-LAN ekude ku-10.60.0.0/24 efinyeleleka kuphela ngeshubhu eliphethwe yilelo khasimende. Akukho kwalezi zindawo ezimbili eziyimfihlo okuhlanganayo nenye, futhi ishubhu linohlelo lwalo lwamakheli.

Zombili izindawo eziyimfihlo zibalulekile ngoba zinquma ukuthi iyiphi idivayisi engaphendula. Uhlangothi olukude luzobona iphakethe liza lisuka ekhelini leshubhu lekhasimende, futhi impendulo yalo kufanele ithole indlela yokubuyela ku-192.168.50.0/24. Uma kuhlelwe kuphela indlela yokuphuma, isicelo singasebenza kuyilapho impendulo inyamalala.

Isinyathelo 1: khomba i-router ekhasimendeni, hhayi eshubhwini

Ku-router ye-LAN, engeza umzila wendawo okuyiwa kuyo lapho ukugxuma okulandelayo kuyikheli le-LAN lekhasimende:

ip route add 10.60.0.0/24 via 192.168.50.15
ip route get 10.60.0.55

Leyo rekhodi ithi “yilethe emshinini ongakwazi ukwenza ishubhu”. Ayisho lutho mayelana nokuthi ishubhu lakhiwa kanjani, futhi ayithathi indawo yomzila wekhasimende uqobo. Ku-router elawulwayo, okulinganayo kuhlala ekhasini lemizila eqinile yedivayisi; ku-router ye-Linux kungokwakho kokucushwa kwesixhumi esiphethe i-LAN, hhayi ku-shell ozoyivala.

Hlola impendulo yomyalo wesibili. Uma ibika ikhasimende njenge-gateway kanye nesixhumi se-LAN njenge-device, ukugxuma kokuqala kulungile futhi umsebenzi osele usemshinini omunye.

Isinyathelo 2: nika ikhasimende umzila walo eceleni kweshubhu

Ikhasimende manje lamukela iphakethe le-10.60.0.0/24 futhi libheka ithebula lalo. Uma ukucushwa kweshubhu lakho kufake umzila waleso siqalo, iphakethe liyaqhubeka lishifriwe. Uma kungenjalo, iphakethe lihambisana nokujwayelekile futhi libuyela ku-192.168.50.1, elilithumela futhi ekhasimendeni.

Bheka ngaphambi kokwengeza noma yini:

ip route show table all | grep -E "10\.60\.0\.0/24|default"
sysctl net.ipv4.ip_forward

Ukungabikho komzila wesiqalo kuwo wonke amathebula yikho okutholayo okufunayo. Kufaka ngokucushwa kweshubhu uqobo, ukuze ukuxhumeka kabusha okulandelayo kulifake futhi; i-ip route add yandla iyanyamalala nasesikhathini futhi ibuyisele inkinga ngesikhathi esingafanele neze. Ukugxuma okulandelayo isixhumi seshubhu noma ikheli i-VPN eyabela lona njengomlingani wayo, kuye ngekhasimende, futhi ikheli lomlingani kufanele livele kuphrofayela yamanje hhayi kunothi elidala.

Indilinga, uma yenzeka, empeleni ayipheli: i-TTL yehla njalo lapho kudlula futhi iphakethe liyafa ngomlayezo wesikhathi esidlulile. Yingakho i-traceroute ephindwayo ingaphakamisa umjikelezo kuyilapho ikhasimende elingadlulisi lilahla iphakethe elifanayo buthule.

Isinyathelo 3: vumela ukudlulisela futhi ukhethe umzila wokubuya

Ukwamukela nokudlulisela kuyimvume ehlukene. I-net.ipv4.ip_forward=1 kukhasimende ivumela ukudlula ezingeni le-kernel, futhi umthetho we-firewall usafanele ukuvume phakathi kwesixhumi se-LAN neshubhu. Umthetho ovumela ukufinyelela ekhasini lokuphatha lekhasimende uqobo ngeke uvume ukudlula ukuya ku-LAN ekude, futhi umehluko kulula ukuwushiya lapho isibungu esifanayo siphendula ama-ping endaweni.

Uhlangothi olukude lunenkinga yesibuko. Kufanele kwazi ukuthi i-192.168.50.0/24 iyafinyeleleka ngale khasimende eligunyaziwe. Nge OpenVPN lokhu ngokuvamile kusho umzila wokhasimende ngamunye ophushwa ukucushwa kweseva, noma ifayela eliqondile lekhasimende kuseva elikhuluma i-LAN engemuva kwekhasimende. Ngaphandle kwalokho, i-LAN ekude iyalahla impendulo noma iyithumele ku-gateway yayo ezenzakalelayo, okuyi-inthanethi.

Ukuhumusha komthombo kuyindlela ehlukile lapho isiqalo se-LAN singakwazi ukumenyezelwa. Umthetho we-masquerade onomkhawulo kukhasimende ubhala kabusha umthombo ube yikheli leshubhu, futhi izimpendulo zibuyela ngokwemvelo. Futhi kufihla ukuthi iyiphi idivayisi ye-LAN eyenza isicelo, futhi ngokwako akuvumeli uhlangothi olukude ukuba luqale ukuxhumana lungene. Khetha lokho kushintshana ngamabomu esikhundleni sokwengeza i-masquerade ephelele bese uthola umphumela oseceleni kamuva.

Isinyathelo 4: yenza zombili izinqumo zihlale njalo, bese uhlola umzila wangempela

Wonke umzila unomnini, futhi umnini wukho ukucushwa okukhiqizwa kabusha lapho kuqalwa noma lapho kuxhunyanwa kabusha. Ku-router kungaba irekhodi lomzila oqinile; kukhasimende kungaba iphrofayela ye-VPN, i-NetworkManager noma i-systemd-networkd. Qinisekisa ngokuxhuma kabusha ishubhu nokuqalisa kabusha ikhasimende, bese ufunda ithebula futhi esikhundleni sokwethemba ukuhlela.

Gcina umzila ozenzakalelayo ophethe ukuxhumana kwangaphandle kweshubhu ungangeni. Uwushintsha ukuze “wenze lula” ukusethwa kwephula umzila oshifriwe ngaphambi kokuba noma yikuphi ukuhamba kwangaphakathi ukusebenzise, futhi uphawu ishubhu elingasakhi kabusha ngemva kwalokho kushintsha.

Hlola kusuka kusibungu se-LAN esijwayelekile, hhayi kusuka kukhasimende, ngoba isicelo esiqala kukhasimende asikaze sisebenzise ukugxuma kokuqala kwe-router. Letha isevisi ekhona kuphela ku-LAN ekude futhi uqinisekise umzimba wempendulo, bese ubheka izibali noma amarekhodi ekhasimende ukuze ubone ukudlula kwenzeka. I-traceroute yangaphakathi ekhombisa ukugxuma okuyimfihlo ifakazela ukudlulisela, hhayi ukushifra: umzila wangaphandle uwukubona okuhlukile, futhi izibali zesixhumi seshubhu uqobo kuphela ezikhombisa okwaphuma ngalo.