Yenza ukudluliswa kwe-IPv4 kuqhubeke ngemva kokuqalisa kabusha isango le-VPN

Ukupinga isango kuyasebenza kodwa ukufinyelela noma yini engemva kwalo akusebenzi, futhi lokhu kuwukuma kwenkinga yokudlulisa hhayi inkinga yomhubhe. Ukulethwa kwendawo esangweni kufakazela ukuthi umhubhe wakhuphuka nokuthi ukwabiwa kwekheli kwasebenza; akusho lutho mayelana nokuthi ingqikithi izodlulisa iphakethe isuka komunye uxhumano iye komunye. Ngaphambi kokuthinta noma iyiphi i-sysctl, qinisekisa ukuthi umshini uhloselwe ukuhambisa le traffic futhi thola umongo wenethiwekhi ogcina uxhumano olubheke ikhasimende. Bese ufunda inani lapho, hhayi lapho umhlahlandlela wokugcina owufundayo wabheka khona ngengozi.

Ukufinyelela isango akufani nokudlulisa

Ngaphakathi kwengqikithi kwenziwa izinqumo ezimbili ezihlukene. Ukulethwa ekhelini lendawo kuphelisa uhambo lwephakethe; ukudlulisa kuyiphinda iyiphumele ngolunye uxhumano, futhi leso sinqumo sesibili silawulwa ngasinye isikhala samagama senethiwekhi. Isango lingafinyeleleka ngokuphelele ngesikhathi ukudlulisa kucishiwe, futhi kusuka kumusho we-ping ukwehluleka kokubili kubonakala kufana.

Bhala ukuthi iphakethe lekhasimende lingena kuluphi uxhumano nokuthi indlela elandelayo iphuma ngaluphi uxhumano. Kokubili kungokwesikhala samagama esisodwa, futhi isilungiselelo esibalulekile sikuleso sikhala samagama.

Funda inani lapho amaphakethe akhona ngempela

Esangweni elihambisa esikhaleni samagama somgcini, umyalo owodwa uphendula umbuzo: sysctl net.ipv4.ip_forward. Uma indlela yokungena nelandelayo ihlala esikhaleni samagama esinegama, buza leso sikhala samagama: ip netns exec vpn-gw sysctl net.ipv4.ip_forward. Inani lomgcini alithathi indawo yelani lesikhala samagama, futhi ukuba kube kanye kumgcini akusona ubufakazi balutho.

Akuzona zonke izimo zokuhambisa ezinombhalo ongayinikeza ku-ip netns. Izindawo zokusebenza zamakhonteyina nezinsizakalo zakha izikhala zamagama ezingalokothi zibhaliswe ngaphansi kwegama elingumngane, futhi kulezo usebenzisa amathuluzi okuhlola endawo yokusebenza. Shintsha i-vpn-gw ngegama langempela, noma ngendlela yendawo yokusebenza efinyelela umongo ofanayo, futhi uyeke ukuqagela ezingeni lomgcini.

Nikeza isilungiselelo umnikazi oyedwa

Esangweni lomgcini le-systemd elivamile, isimo esihlala njalo yifayela le-drop-in elinegama elikhethwe umlawuli njenge-/etc/sysctl.d/60-vpn-forwarding.conf, eliqukethe i-net.ipv4.ip_forward = 1. Bhala ifayela, bese ulayisha lelo fayela ngqo ukuze nesimo esiphilayo sishintshe: sudo sysctl -p /etc/sysctl.d/60-vpn-forwarding.conf, bese ufunda futhi uhlole. Igama lefayela liyisibonelo hhayi indlela ye-VPN egciniwe, futhi inombolo yokuqala ibalulekile ngoba amafayela ahlelwa kamuva ayawina.

Ukubaluleka kuqala yilapho ukuqina kuphuka khona buthule. Hlola kokubili isilayishi sokuhambisa kanye ne-drop-in yakho, ngoba i-procps sysctl --system ekugcineni ifunda futhi i-/etc/sysctl.conf, kuyilapho ukuhleleka kwe-sysctl.d ye-systemd kuwukulandelana okuhluke ngokuphelele. Ukwabiwa kamuva kungabuyisela lolo khiye ngqo, kushiye ifayela lakho lilungile kodwa inani elisebenzayo lingalungile. Ungabhali phezu kwefayela lomlawuli elikhona ukuze uwine leyo ngxabano; thola umnikazi bese ushintsha lapho.

Isikhala samagama esakhiwe ngemva kokuqalisa asilawulwa nhlobo yi-drop-in yomgcini. Isilungiselelo saso singesalokho okusakha, kungaba indawo yokusebenza yamakhonteyina noma iyunithi yokuhlinzeka yesikhala samagama. Ukunikeza ikhonteyina amalungelo abanzi omgcini ukuze ugweme umbuzo kuwukuhwebelana okubi kakhulu kunokuchitha imizuzu eyishumi ukuhlonza umnikazi ofanele.

Yazi ukuthi iswishi ibiza malini ngaphambi kokuyiphendula

I-ip_forward akusi-boolean engenangozi. Imibhalo yengqikithi iphawula ukuthi ukuyishintsha kubuyisela amanye amapharamitha e-IPv4 ambalwa kumazinga okuzenzakalela omgcini noma omhambisi, ngakho ukuphendula kokuxilonga kungalahla ukulungiswa okwenziwe kwenye indawo futhi kungakusho nhlobo. Kuphathe njengoshintsho lokucwangciswa olunemiphumela eseceleni hhayi njengokuhlola ongakugijima ngokunganaki.

Lokho futhi kususa ukukucisha nokukuvula njalo lapho ikhasimende lingakwazi ukufinyelela umgcini. Uma inani selivele likanye, iphutha likwenye indawo endleleni, futhi ukubhala futhi lolo khiye okwesithathu ngeke kulususe.

Fakazela ukuqina, bese uhlola ingxenye esele yendlela

Funda inani futhi ngezikhathi ezine: ngqo ngemva koshintsho, ngemva kokuvela koxhumano lwe-VPN, ngemva kokuxhuma futhi, nangemva kokuqalisa kabusha okuhleliwe. Inani elibuyela emuva kunoma yiliphi lalawa maphuzu linomnikazi wesibili, futhi okunye ukubhala kwesikhathi esisodwa kukufihla kuphela kuze kube ukuqalisa kabusha okulandelayo.

Ukudlulisa okunika amandla kusashiya izinto ezintathu okufanele ziqinisekiswe. Ikhasimende lidinga indlela eya endaweni ekuyiwa kuyo, isango lidinga indlela elandelayo kanye nemvume yokuyisebenzisa, futhi indawo ekuyiwa kuyo idinga indlela yokubuyela ekhelini lomhubhe wekhasimende. I-LAN yangasese ehambisiwe ayidingi i-NAT ngokuzenzakalela, ngakho ungangezi i-masquerading ngaphambi kokwazi ukuthi iyiphi kwezintathu engekho, futhi uhlole kusuka ekhasimendeni okuhloswe ngalo hhayi esangweni uqobo, ngoba isicelo esiqale esangweni asikaze sithinte indlela yokudlulisa oyivule yona manje. I-IPv6 inenqubomgomo yayo yokudlulisa nokuhambisa, ngakho ukuhlola kwe-IPv4 okusebenzayo akusho lutho ngayo.

Gcina ndawonye ku-runbook indlela ye-drop-in, umnikazi wesikhala samagama kanye nomyalo wokufunda futhi. Noma ubani ozothatha lokhu ngokulandelayo kufanele akwazi ukufunda inani, abone ukuthi ngubani umnikazi, futhi anqume phakathi nomzuzu ukuthi inkinga ingukuqina noma ingxenye esele yendlela.