I-Masquerade noma ukuhlela umzila ngomgomo: ithrafikhi ye-LAN ngokusebenzisa isango le-VPN

Ukubeka yonke i-LAN ngemuva komhubhe we-VPN ingxenye elula; ukunquma ukuthi uhlangothi olukude lubona kanjani labo khasimende akulula. I-masquerade ibhala kabusha umthombo ngamunye we-LAN ekhelini lomhubhe wesango, ngakho uhlangothi olukude luphendula ku-peer eyodwa. Ukuhlela umzila ngomgomo kugcina amakheli okuqala futhi kudinga ukuthi uhlangothi olukude lwazi ukuthi lufinyelela kanjani kuwo. Kokubili akuyona imvamisa; ukukhetha kuncike ekutheni ubani ongowakwamanye amazwe nokuthi ubunikazi besidlali ngasinye sibalulekile yini.

Izinhlelo ezimbili zithembisa izinto ezihlukene

I-masquerade inciphisa i-LAN ibe yisibungu esisodwa esibonakalayo: isango. Inethiwekhi ekude iphendula kulelo kheli elilodwa, futhi isango lihumusha izimpendulo zibuyele kukhasimende oqale ukugeleza. Ohlangothini olukude akudingeki umzila oya kumafikisi akho ayimfihlo, yingakho lo mklamo uphila ngisho nomhlinzeki oyenqabayo ukuwuthwala. Isango liphinde libe umthombo wakho konke ukuxhumana, ngakho uhlangothi olukude alukwazi ukuhlukanisa amakhasimende amabili.

Ukuhlela umzila ngomgomo kugcina ikheli likakhasimende ngamunye lingaphelele. Inethiwekhi ekude ibona umthombo wangempela futhi ingawubhala phansi, isebenzise umthetho ngasinye isibungu noma ithumele impendulo ngqo kulelo kheli. Lokho kubonakala kuyiyo yonke inhloso, futhi kuza nomthwalo: uhlangothi olukude kumele lube nomzila wesandiso se-LAN obuyela emuva ngomhubhe. Hlela lowo mzila ngaphambi kokuvula umthetho, ngoba umhubhe uzokhuphuka noma kanjani futhi kuzophuthelwa izimpendulo kuphela.

Izindlela zokwehluleka zihluke ngendlela efanayo nezithembiso. Umthetho we-masquerade ongekho ukhiqiza amaphakethe aphuma nemithombo eyimfihlo futhi angabuyi neze. Umzila wokubuya ongekho unikeza uphawu olufanayo ekuhleleni umzila ngomgomo, kodwa ukulungiswa kungokomhleli womzila okude hhayi owesango.

I-Masquerade: i-peer eyodwa ohlangothini olukude

Umzila we-masquerade unokulandelana okubalulekile. Ukudlulisela kumele kuvulwe ngaphambi kokuba noma yimuphi umthetho we-NAT ube nomsizo, ithebula lokuhlunga kumele livumele ukudlula kuzinhlangothi zombili, bese kuthi ngemva kwalokho ukuhumusha kusebenza kusixhumi somhubhe.

sysctl -w net.ipv4.ip_forward=1
iptables -A FORWARD -i eth1 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

Amakhasimende asadinga umzila oya esangweni. Mhlawumbe isango liyisihleli somzila sawo esimisiwe, noma athwala umzila othile wesandiso esikude; uma isihleli somzila esihlukile sihlala siyisimisiwe, leso sihleli sidinga umzila oqinile oya ezindaweni zomhubhe, ngaphandle kwalokho iphakethe liya eqhulwini elingalungile ngaphambi kokuba isango liyibone.

I-DNS isinqumo esihlukile. Isixazululi ohlangothini olukude siphendula kuphela uma impendulo yaso ingabuyela kukhasimende. Ngaphansi kwe-masquerade umbuzo ubonakala usuka esangweni, ngakho umzila wokubuya wesixazululi usugcwalisiwe; ngaphansi kokuhlela umzila ngomgomo isixazululi sidinga umzila wokubuya ofanayo nowanoma yiluphi olunye usizo olukude.

Ukuhlela umzila ngomgomo: gcina umthombo, engeza umzila wokubuya

Ukuhlela umzila ngomgomo kuqala ngethebula nomthetho owukhethayo. Ithrafikhi engena kusixhumi se-LAN ithunyelwa ethebuleni elikhethekile, futhi lelo thebula lithwala umzila osimisiwe ngomhubhe. Ithebula eliyinhloko lihlala lingathintwanga, ngakho ithrafikhi edalwa yisango uqobo ingalandela omunye umzila.

ip rule add iif eth1 table vpn
ip route add default dev tun0 table vpn

Ngemva kwalokho uhlangothi olukude kumele luhlele isandiso se-LAN libuyele ngomhubhe. Lokho kuwukuhlelwa kusihleli somzila esikude, hhayi kulesi sango. Isango kumele futhi lamukele izimpendulo ezifika kusixhumi esihlukile kunaleso ithebula eliyinhloko elingakulindela; ukuhlunga okuxegayo komzila ophambene (i-rp_filter isethwe ku-2) ukulungiswa okuvamile lapho imodi eqinile ilahla lawo maphakethe.

Lapho imihubhe emibili isebenza, maka ukugeleza ngakunye lapho kungena futhi vumela umaka ukuthi ukhethe ithebula. Umthetho obheka kuphela isixhumi sokufaka uthumela ithrafikhi yemihubhe yomibili ethebuleni elifanayo, ngakho umhubhe wesibili weba ukugeleza kowokuqala. Hlola lowo maka ngokuxhumana okumelana nokuxhumana kabusha, ngoba yilapho umgomo oxubile uvela khona.

Nquma ngobunikazi nangokuthi uhlangothi olukude lubhala ini

Uma umhubhe uphela kumhlinzeki, sebenzisa i-masquerade. Lowo mqhubi ngeke ahlele izigaba zakho ze-LAN eziyimfihlo, futhi akanasizathu sokuhlukanisa amakhasimende ngawodwana ngemuva kwesango lakho. I-peer eyodwa ebonakalayo iyona kuphela imodeli umgomo wakhe owusekelayo, ngakho mnike lokho futhi gcina ukuhumusha emkhawulweni wakho. Umhlinzeki ubona i-peer eyodwa, okuyikho kanye lokho umgomo wakhe okulindele, futhi amakhasimende akho azuza lowo bunikazi obubodwa.

Uma izinhlangothi zombili zingezakho futhi izinsizakalo ezikude zisebenza ngamakheli emithombo, ukuhlela umzila ngomgomo kufanele umzila wako owengeziwe. Imithetho yodonga lomlilo, ukufinyelela kommsebenzisi ngamunye namarekhodi okucwaninga kungabe sekuwahlukanisa amakhasimende. Uma uhlangothi olukude ludinga kuphela ukufinyeleleka, i-masquerade ilula futhi isusa isigaba sonke samaphutha omzila wokubuya.

Izinhlelo ezixubile zivamile: ukuhlela umzila ngomgomo ngaphakathi kwenethiwekhi yakho, i-masquerade emkhawulweni womhlinzeki. Okubalulekile ukubhala phansi ukuthi yikuphi ukugxuma okuhumushayo nokuthi yikuphi ukugxuma okuhlelayo, ngoba umthetho we-NAT owengezwe ngephutha kukhasimende oyedwa ufihla umthombo kukho wonke amakhasimende ochungechungeni olufanayo.

Qinisekisa kukhasimende oyedwa, bese kukhasimende lesibili

Gijima isivivinyo lapho ithrafikhi iqala khona. Hlola umzila osetshenziswa yisibungu, bheka iphakethe livela kusixhumi somhubhe, futhi hlola i-conntrack yokuhumusha. Lokho kulandelana kufakazela ukuthi iphakethe lathatha umzila owawuhloswe, hhayi ukuthi lafika ndawana thize.

Phinda isivivinyo ngemva kokuxhumana kabusha. Umthetho we-masquerade osho isixhumi uyaphila ekhelini elisha lomhubhe; umthetho osho ikheli elidala awuphili. Bese uhlola isibungu sesibili se-LAN, ngoba umklamo osebenza emshinini owodwa uvame ukuncika emzileni wawo lowo mshini hhayi kumgomo wesango.

Bhala phansi imodeli ekhethiwe, umthombo ohunyushiwe noma ogciniwe, kanye nomnikazi womzila wokubuya emibhalweni yesango. Ngaphandle kwalokho umuntu olandelayo owengeza ikhasimende noma umhubhe uzokuqagela, futhi ukuqagela yiyo indlela ukuhlelwa kwe-LAN-kuya-VPN okusebenzayo okuba ngokwengxenye.