Ukuhambisa iseva ye-VPN iye ku-IP yomphakathi entsha: yini okufanele ihlolwe kuqala

Ukunikeza ikheli kabusha kuthatha umzuzu owodwa. Iviki elilandelayo yilapho ukuhambisa kuphuka khona, futhi akuvamile ukuba kube lapho ikhonsoli yomhlinzeki iphakamisa khona. I-IP yomphakathi entsha ibalulwa ezindaweni ezine: isokhethi i-daemon elalela kuso, i-ankile yokuthembela amaklayenti ayiqinisekisayo, wonke umthetho osho ikheli elidala, kanye nerekhodi le-DNS elibahlanganisayo. Ukuhambisa okubili kubukeka kufana kupanele yokulawula kodwa kuziphatha ngendlela ehluke ngokuphelele: ukunikeza ikheli kabusha emshinini owusebenzisayo, noma ukumisa i-endpoint yesibili bese uhambisa amaklayenti kuyo. Izihlolo ezingezansi zibeka izingqinamba ezishibhile kuqala, futhi isigaba ngasinye sisho ukuthi sihambelana nakuphi ukuhambisa.

Ukushintsha endaweni nokweqa ngokulinganayo kuyimisebenzi ehlukene

Ukushintsha endaweni kugcina umsingathi, okhiye, ithebula lomzila kanye nohlu lwabasebenzisi; ikheli kuphela elishintshayo. Yilokho okwenziwa ukunikezwa kabusha kwe-IP entantayo, futhi kubahlinzeki abaningi isivakashi asiqapheli nakancane, ngoba ukuhumusha kwenzeka phambi kwesibonelo. Ukwakhiwa kabusha noma ukunikezwa kabusha ngumhlinzeki kunzima kakhulu: isivakashi sibona ushintsho, futhi konke obekugcine inani elidala kusilondolozi kuyafunda ngaso leso sikhathi.

I-endpoint engqondanayo ingumsingathi wesibili owenza umsebenzi ofanayo. Yakhayo, yihlole ngephrofayela eyodwa, futhi uvumele endala iphendule kuze kube yilapho entsha izibonakalisa ngayo emzileni wangempela. Intengo yisimo. Ngaphandle kwama-peer entry abiwe, ukuhoxiswa nokuloga, unezokuxhumana ezimbili ezabelana ngegama ngengozi.

Thola yonke indawo lapho ikheli elidala libhalwe khona

Qala ngokusesha kombhalo, ngoba amafayela okucushwa ayingxenye elula. Sesha kukucushwa kwe-daemon, izingcezu ze-firewall, izinhloso zokuqapha kanye nanoma iyiphi inqwaba yeklayenti eyakhiwe kudiski. Faka nekheli le-IPv6 uma ushicilela elilodwa; ukuhambisa okulandela irekhodi A kuphela kushiya amaklayenti aneziteki ezimbili emzileni wakudala.

OLD=203.0.113.10
grep -RIn -- "$OLD" /etc /root
ss -lunpt | grep -F "$OLD"
nft list ruleset | grep -F "$OLD"
iptables-save | grep -F "$OLD"
wg show all endpoints

Bese uhlola i-kernel, ngoba uhlelo olusebenzayo lugcina ikheli ezindaweni okungekho fayela elikhuluma ngazo. Umthetho we-NAT womthombo oqinile, i-entry ye-ipset, ikheli le-bind kanye ne-entry ye-conntrack ziphila isikhathi eside kunoshintsho lokucushwa olwazisusa, futhi ezinye zidlula nokuqalisa kabusha ngoba zibuya kusethi yemithetho egciniwe. Izinga elilodwa phezulu, amaqembu okuphepha omhlinzeki, izinhloso ze-load balancer kanye nezihlolo zokuqapha azikho nhlobo kuhlelo lwakho lwamafayela.

Bhala uhlu lwezimpahla ngaphambi kokushintsha noma yini; lusebenza futhi njengombhalo wokubuyela emuva.

Amaklayenti anegama lomsingathi ayasinda; amaklayenti ane-IP yombhalo athula

Uma amaklayenti efinyelela iseva ngegama lomsingathi, ukweqa kuyinkinga ye-DNS ikakhulukazi, futhi i-TTL oyibeke izolo yiyo enquma ukuthi kuzoba kubi kangakanani. Izixazululi ziyagcina, izixazululi ze-stub ziyagcina futhi, futhi amaklayenti amaningi afuna igama kuphela ekuxhumekeni okusha, ngakho umhubhe osungulwe kakade ugcina ikheli lawo lokuqala.

Uma i-endpoint iyikheli lombhalo, akukho okuxazululwa kabusha futhi akukho okubhala isikhalo. I-WireGuard igcina ikheli lesokhethi elixazululiwe: i-Endpoint = vpn.example.net:51820 iba i-IP ngesikhathi i-wg-quick up isebenza futhi ihlala iyileyo IP kuze kube yilapho uyishintsha. OpenVPN ibekezelela kakhulu: ixazulula igama lomsingathi remote ngesikhathi sokuxhumana futhi, nge-resolv-retry infinite, izama i-DNS futhi lapho ixhumana kabusha. Nge-IP yombhalo, zombili ziyaqhubeka zishayela umshini ongasekho.

Okukhohlisa abantu yisithombe sesibuko. Iklayenti eselikhomba ekhelini elisha, ngesikhathi isilaleli esidala sisaphendula, lidlula zonke izivivinyo ozenza kusuka etafuleni lakho. Nami ngakhohliswa yilokho: i-endpoint entsha yenyuka ocingweni ngomzamo wokuqala, futhi iklayenti elinephrofayela endala lavela kuphela lapho isilaleli esidala sicishwa isikhathi eside kamuva.

Ukuthembela akuhambi nekheli

I-WireGuard ihlukanisa ubunikazi nokufinyeleleka, okwenza ukuhambisa ikheli kube cishe mahhala. Ama-peer akhonjwa ngokhiye womphakathi, futhi i-endpoint iyindawo nje okaya kuyo amaphakethe okwamanje; umsingathi ubuyekeza i-endpoint ye-peer kusuka ekhelini lomthombo lephakethe lokugcina eliqinisekisiwe. I-peer engasebenzi isidinga isizathu sokukhuluma nendawo entsha, futhi ifunda ikheli kuphela lapho isikhathi sayo siguga futhi imizamo ye-handshake ihluleka endaweni ebonakalayo. Isiqalo esisheshayo se-WireGuard sihlanganisa inkambu ye-endpoint.

Amaseva asekelwe ku-TLS ayisimo esiphambene. Isitifiketi siboshelwe egameni, futhi iklayenti elishaya ikheli liqhathanisa elikushayile namagama angamanye omxoxi. Xhumana nge-IP nesitifiketi esiphethe i-SAN ye-DNS kuphela futhi ukuqinisekisa kuyahluleka: igama elisetshenziswe yiklayenti alikho esitifiketini. Ukukhipha kabusha nge-SAN ye-IP kulungisa lokho kuxhumana okukodwa futhi kwenza ukuhambisa okulandelayo kube kubi kakhulu. Ukugcina igama lomsingathi kuphrofayela nokushiya i-verify-x509-name endaweni yayo kugcina isihlolo siqinile ngesikhathi ikheli elingezansi lishintsha.

Bese uhlola ukuthi i-daemon iboshelwe kokuthini; isokhethi eliboshelwe ekhelini elidala lihluleka buthule. Iseva ye-OpenVPN eqalwe nge-local 203.0.113.10 iyenqaba ukuphakama lapho lelo kheli lingasekho, kuyilapho isilaleli esiku-0.0.0.0 silandela ushintsho mahhala. I-NAT ihlukana ngendlela efanayo: i-MASQUERADE ilandela noma yiliphi ikheli umshini onawo manje, futhi i-SNAT --to-source 203.0.113.10 eqinile iyaqhubeka ibhala kabusha iye ekhelini ongalinayo, ngakho ukuthunywa okubuyayo kuyanyamalala. Uma ikheli elisha liza nesango le-upstream elihlukile, hlola i-rp_filter: ukuhlunga komzila ophambene kulahla ukuthunywa okubuyayo okufika kusixhumi esingakulindelanga i-kernel.

Ukulandelana kokweqa kanye nobufakazi bokuthi kwasebenza

Yehlisa i-TTL ngosuku olulodwa ngaphambili, misa isilaleli esisha, futhi usibonise ngephrofayela onayo wedwa. Isivivinyo esivela ngaphakathi kwesixhumi esifanayo asibonisi cishe lutho, ngakho sebenzisa ucingo kusixhumi esisetshenziswa umakhalekhikhini futhi uhlole into okufanele umhubhe uyithwale esikhundleni sokushaya i-ping kuya ku-endpoint.

Bheka zombili izikheli isikhathi sonke. I-wg show all latest-handshakes kumsingathi omusha, noma ifayela lesimo le-OpenVPN, likutshela ukuthi bangaki ama-peer ashintshe ngempela. Uma i-endpoint entsha inama-peer owalindele futhi endala inabasalele kuphela, hoxisa isilaleli esidala, khipha umthetho we-NAT wakudala futhi khipha ikheli ku-firewall yomhlinzeki. Ukukhipha isilaleli esidala yisinyathelo esigqitshwayo, futhi kuvala isikhala lapho iphrofayela endala isafinyelela khona kusixhumi sakudala.

Bhala phansi isicuphi sokubuyela emuva ngaphambi kokuqala: uma i-endpoint entsha ingenayo i-handshake evela kuklayenti langempela ngisho elilodwa ngemva kwesikhathi okuvunyelwene ngaso, buyisela ikheli elidala futhi uyeke ukusabalalisa amaphrofayela. Phinda usebenzise ukusesha ngemva kwalokho futhi uqinisekise ukuthi asikho isilaleli esisaboshelwe ekhelini elihoxisiwe. Izinto ezimbili zidlulela ekuhambiseni okulandelayo: igama lomsingathi kuphrofayela yeklayenti ukuze ushintsho olulandelayo lube ukuhlela kwe-DNS, kanye nohlu lwezimpahla olugcinwe eduze kwamanothi okubuyisela iseva.