Vumela Iklayenti Elilodwa le-OpenVPN ukuthi lifinyelele kwelinye nge-SSH ngaphandle kokuvula ichibi

Shiya i-client-to-client ivaliwe, vumela umgogodla ukuthi udlulise umfudlana owodwa, bese ushiya ingxenye esele yechibi ivaliwe. Imithetho emibili kuseva kanye neyodwa endaweni okuyiwa kuyo.

Iklayenti elilodwa lidinga ukufinyelela isevisi ye-SSH yelinye iklayenti, futhi ingxenye esele yechibi kufanele ihlale yehlukene njengamanje. Isishintshi esihehayo yi-client-to-client, esivula ukufinyelela phakathi kontanga kubo bonke ngesikhathi esisodwa futhi sinikeza isinqumo ku-OpenVPN esikhundleni somgogodla. Impendulo emnene igcina leso sishintshi sicishiwe futhi ivumela umzila kanye nesihlangu-mlilo seseva uqobo ukuthi sithwale umfudlana owodwa ncamashi.

Indlela yokusebenza ibaluleke kakhulu kunombhalo womthetho, ngoba izindlela ezimbili zibeka iphakethe ezindaweni ezihlukene. Ukwazi ukuthi iyiphi oyikhethile kuchaza kokubili umthetho obonakala ungenzi lutho kanye nontanga oxhumayo ngaphandle kwawo.

I-client-to-client ihambisa iphakethe kuphi

Lapho i-client-to-client ivuliwe, iseva idlulisa iphakethe nontanga ngaphakathi esikhundleni sokuliphindisela ngaphandle ngedivayisi yomhubhe, ngakho iphakethe alifiki emzileni wokudlulisa womgogodla. Lokho kulula futhi kusho nokuthi isihlangu-mlilo sakho asikaze sibone umfudlana okufanele siwugade. Shiya inketho ivaliwe futhi iseva iqondisa iphakethe liphindele ngaphandle ngohlaka olufanayo, okulibeka phambi kwe-netfilter. Uhlaka olufanayo luyangena, olufanayo luyaphuma, futhi uchungechunge lwe-FORWARD luthola ivoti.

Ukushintshana kucacile: uthola iphuzu elilodwa lenqubomgomo futhi uthatha umsebenzi womzila nokudlulisa owawenziwa yisifinyezo kuwe. Lowo msebenzi mncane kumfudlana owodwa futhi uyakhula ngakho konke ukwehluka okwengezayo. Bala ukwehluka manje, ngoba isethi yemithetho iyindawo lapho inqubomgomo phakathi kontanga ihlala khona ngempela.

Indlela iphakethe nontanga eliyihambayo ngempela

Cabanga ngesevisi ye-Linux Community OpenVPN 2.6, ukucubungula kwe-TUN endaweni yomsebenzisi esikhundleni se-DCO, itopoloji yesubnet, tun0, kanye nechibi le-10.44.0.0/24 elineklayenti A ku-10.44.0.21 neklayenti B ku-10.44.0.37. Ngetopoloji yesubnet, ikheli kanye nemaski yokwakha eye yatholwa ngu-A isivele ihlanganisa ichibi, ngakho u-A uthumela iphakethe kudivayisi yomhubhe ngaphandle kokudinga umzila owengeziwe ophushiwe. Hlola umzila osebenzayo ku-A esikhundleni sokucabanga owodwa.

Kuseva iphakethe lifika likhethelwe u-B, okuwona ikheli lendawo, ngakho liyadluliswa. Ukudluliswa kwe-IPv4 kufanele kuvuliwe ukuze lokho kwenzeke nhlobo, futhi ukusesha komzila kufanele kuthumele iphakethe liphindele ngaphandle ngokusebenzisa i-tun0. Ngakho isihlangu-mlilo sibona umfudlana odlulisiwe onohlaka olufanayo ezinhlangothini zombili, futhi yilowo mniningwane amasethi amaningi emithetho awuwuthathelayo. Lapha akukho ukuhunyushwa komthombo okudingekayo, futhi ukugcina ikheli lika-A lingenakulimala yikho okwenza u-B asebenzise umthetho wakhe osuselwe emthonjeni.

Imithetho emibili kuseva, ngokulandelana lokhu

Imithetho emithathu ithwala yonke imvume: ukudlulisa, ukwehluka kukabhangqa, kanye nokulahla okuzenzakalelayo kukabhangqa womhubhe. Umthetho wokwamukela usho ubhangqa nesevisi, ngakho imvume iyasinda echibini elikhulayo. Yibeke ngaphambi kwanoma yikuphi ukwenqatshwa okujwayelekile kothungo lomhubhe-kuya-komhubhe, ngoba ukufana kokuqala kuyanqoba:

sysctl -w net.ipv4.ip_forward=1
iptables -A FORWARD -i tun0 -o tun0 -s 10.44.0.21 -d 10.44.0.37 -p tcp --dport 22 -j ACCEPT
iptables -A FORWARD -i tun0 -o tun0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i tun0 -o tun0 -j DROP

Lemiyalo iyisibonelo futhi ingeyendlela umphathi wakho asebenzisa ngayo ukugcina imithetho; ukufakwa ngesikhathi sokusebenza kuyanyamalala ekubhuthweni okulandelayo. Umthetho onesimo yiwo ovumela izimpendulo zika-B kanye nokuxhawana kwe-TCP ukuthi kubuye ngaphandle kokwamukelwa kwesibili okufanayo.

Hlola izibali ngemuva kwalokho esikhundleni sohlu lwemithetho, ngoba umthetho ongafani nhlobo ubukeka ufanayo nowosebenzayo. Uma izibali zihlala zinguziro, iphakethe alihambi ngomzila ocabangayo.

Yini u-B okusafanele ayivumele

U-B ugcina isevisi ye-SSH, ngakho u-B unquma ukuthi kukhona yini okulalelayo ekhelini lomhubhe nokuthi isihlangu-mlilo sakhe somphathi siyamukela yini umthombo. Imvume yenethiwekhi kuseva ayiyona imvume yanoma iyiphi i-akhawunti ku-B, futhi ukuqinisekiswa kokhiye womphathi nokuqinisekiswa komsebenzisi kusasebenza njengakuyo yonke enye indawo.

Hlola icala elihle kuqala: uxhumano olusha lwe-SSH olusuka ku-A luya ekhelini lomhubhe lika-B, lwamukelwe ngokhiye womphathi olindelekile. Bese uhlola omunye untanga noma enye imbobo bese uqinisekisa ukuthi uyenqatshwa, ngoba imvume evumela ngokuthula yonke into ayihlukaniseki kuleyo esebenzayo kuze kube yilapho ibalulekile. Zombili izingxenye zalolo hlolo ziyadingeka, futhi eyesibili yiyo abantu abayigxumayo.

Bhala amakheli abelwe, imizila esebenzayo kuwo womabili amaklayenti kanye nemithetho eqondile kuseva nakwa-B. I-ping ephumelelayo eya esangweni noma imbobo evuliwe kuseva akufakazeli lutho kulokhu, ngoba kokubili kungaba yiqiniso kuyilapho ukudluliswa phakathi kontanga kusavinjiwe. Bhala lezo zinombolo ngesikhathi umhubhe uphakeme, ngoba ikheli iklayenti elilithola ngemuva kokuphinde lixhumeke lingaba lelithile.

Izihloko ezihlobene