I-VPN ye-Pi enamarutha amaningi: beka umzila ngamunye kudivayisi enqumayo
I-rutha engaphansi yengeza isubnet yesibili yeklayenti, futhi idivayisi ngayinye kwezine inesinqumo esisodwa. Beka imizila, hlola umthombo, bese uhlola kusukela kuklayenti langempela.
Ukubeka ibhokisi le-Wi-Fi ngemuva kwe-Pi kuguqula isinqumo esisodwa sokuhamba kwendlela sibe ezine, futhi uhlelo luyaphuka lapho zine zizonke zenziwa kudivayisi eyodwa. Umbuzo wokuqala awukona ukuthi iyiphi indlela okufanele yengezwe. Ukuthi ibhokisi elisha liyahlanganisa noma liyahamba ngendlela, ngoba leyo mpendulo inquma ukuthi zingaki izisubneti ezikhona nokuthi yiziphi izinto okufanele zifunde ngazo. Khetha imodeli yokuxhuma kuqala; wonke umzila uvela kuyo.
Ibhuloho noma ukuhamba kwendlela: ukukhetha okunquma inani
Ibhuloho libeka amaklayenti amasha kuleyo subnet i-Pi esivele iyisebenza. Isubnet eyodwa, igunya le-DHCP elilodwa, futhi akukho ukudluliswa okufanele kuhamba ngendlela. Lolu wuhlelo olulula futhi olulungile lapho inethiwekhi yeklayenti ehlukile ingakaze ibe yisidingo. Isixhumanisi esihamba ngendlela siwumklamo ohlukile: ibhokisi ligcina isubnet yalo, futhi leyo prefix kufanele ithwalwe yonke indawo lapho uhamba khona.
Ingxenye esele yohlelo igcina irutha engaphansi futhi ivikela amakheli omthombo wamaklayenti. Umgomo iwunethiwekhi eyodwa ye-VPN yangasese, hhayi indlela ephelele yokuphuma ku-inthanethi. Bhala imodeli ngaphambi kwamakheli, ngoba uhlu olungezansi luyisibonelo kuphela sokuxhuma okuhamba ngendlela.
client subnet 10.41.0.0/24
client gateway 10.41.0.1
router-to-Pi link 192.168.71.2
Pi on that link 192.168.71.1
private target 10.72.9.0/24Ubani unquma ini
| Decision owner | Entry that encodes the decision | Failure when the entry is missing |
|---|---|---|
| Pi VPN host | Return route for 10.41.0.0/24 via 192.168.71.2, and a tunnel route for 10.72.9.0/24 | Replies to downstream clients die at the Pi |
| Owner of the remote network | A path for 10.41.0.0/24 over the permitted tunnel | Replies stop at the first unaware hop |
| LAN router behind the Pi | Specific route for 10.72.9.0/24 via 192.168.71.1, or a suitable default | Clients never send private traffic to the Pi |
| Client machine | Default via 10.41.0.1, or a specific entry for 10.72.9.0/24 | The private network is unreachable from the client |
Idivayisi ngayinye ithatha isinqumo esisodwa, futhi akukho eyodwa engathatha esinye sakwamukela esikhundleni sayo. I-Pi idinga amabhokisi amabili, hhayi elilodwa, futhi indlela yokubuya yiyo abantu abayikhohlayo. Ithrafikhi edluliswayo ifinyelela inethiwekhi yangasese ngendlela efanele bese ifa endleleni yokubuya, ngoba i-Pi ayazi ukuthi i-10.41.0.0/24 ihlala kuphi. Lokho kubonakala njengenkinga yomlilo futhi empeleni kuwumzila ongekho.
Uhlangothi olukude lona ludinga umzila wakhona. Uma isevisi ekupheleni okukude ingazi ukuthi i-10.41.0.0/24 iyafinyeleleka ngomhubhe wakho, izimpendulo ziyama esigabeni sokuqala esingenayo impendulo. Engeza izinhlangothi zombili ngaphambi kokufunda izihlungi zamaphakethe.
Ukugxuma okulandelayo kuvela ekuxhumaneni
Ukugxuma okulandelayo kufanele kube ikheli kunethiwekhi idivayisi engafinyelela kuyo ngempela. Ikheli lomphakathi le-VPN peer alikona ukugxuma okulandelayo kwe-subnet yangasese, futhi inethiwekhi yesevisi ekude ayikona neze ukugxuma okulandelayo. Umzila oya esangweni elingafinyeleleki ubonakala ulungile ohlwini futhi ulahla iphakethe ngalinye. Hlola ukuthi isango liyaphendula ngaphambi kokusola indawo oya kuyo.
Gcina i-VPN peer yangaphandle ye-Pi ifinyeleleka ngomzila wayo wangaphansi. Lokho kufakwa kuhlukile emizileni yomthwalo, futhi ukuzihlanganisa kunikeza umhubhe ongakwazi ukusungulwa kabusha ngemuva kokushintsha kwendlela.
Imibhalo yemizila eqinile icacisa umehluko phakathi kwendawo oya kuyo nesango, nakuba ipulatifomu ngayinye ibiza amamenyu ayo ngendlela ehlukile. Funda imibhalo yedivayisi ephambi kwakho esikhundleni sokukopisha isikrini somunye umthengisi. Imiyalo engezansi ibonisa ukuma kwamabhokisi ku-Linux.
# on the Pi
ip route add 10.41.0.0/24 via 192.168.71.2
ip route add 10.72.9.0/24 dev tun0
# on the downstream router
ip route add 10.72.9.0/24 via 192.168.71.1Ukuhumusha kwenzani emthombeni
Uma irutha engaphansi isivele ihumusha amaklayenti ayo ekhelini lokudlula, i-Pi ibona umthombo owodwa ohumushiwe esikhundleni sekheli ngalinye leklayenti ngayinye. Lona umklamo ohlukile kuleyo egcina umthombo ngenhla. Ishintsha inqubomgomo esekelwe emthombeni, ukuloga, nokuthi yiluphi uhlangothi olungaqala ukuxhuma. Yomibili imiklamo iyasebenza; iphendula imibuzo ehlukile.
Uma isevisi ye-VPN ephezulu inqaba ukuhambisa i-prefix yeklayenti emuva, ukuhumusha okuncane endaweni yokuphuma yomhubhe we-Pi kungaba yisixazululo esisemthethweni sesikhashana. Lokho akubona ubufakazi bokuthi umzila ongekho wawungadingekile. Rekhoda ukuthi iyiphi ikheli inethiwekhi ekude eliyibona ngempela nokuthi iyiphi indlela yokubuya evelayo.
Ukukhethwa komzila, imvume yokudlulisa kanye nokuhumusha komthombo kuhlala kuyimisebenzi emithathu ehlukene. Ukukhipha uchungechunge lwe-NAT olwabiwe noma ukuvumela yonke i-interface ngenxa yokuthi iklayenti elilodwa elinentambo liyasebenza yiyo indlela okwenza ucwaningo olusebenzayo lube umdlulisi ovulekile.
Kufakazela lokho kumsini weklayenti
Thumela isicelo kumsini oku-LAN engaphansi, bese ulandela umthombo waso ngaphandle nangemuva. I-ping ethunyelwe yi-Pi ayisebenzisi neze umzila wokubuya ongaphansi, yingakho i-ping ephumelelayo ifakazela okuncane kunalokho okubonakala. Engeza ucwaningo lwesibili kusukela kuklayenti elinentambo ku-LAN ye-Pi uqobo ukuze imizila emibili iqhathaniswe. Phinda kokubili ngemuva kokuqalisa kabusha noma iyiphi idivayisi.
Imizila eyengezwe ngesandla kanye nokuhumusha okungakaze kugcinwe kuyanyamalala ndawonye. Khona-ke ipheya libonakala njengento entsha ephukile hhayi umsebenzi ongakaqedwa.
Gcina imodeli yokuxhuma kanye nemizila, isevisi yangasese evunyelwe kanye nanoma yikuphi ukuhumusha kwenothi elilodwa. Yilowo nothi ovimbela umuntu olandelayo ekubukeni ukubekwa okungenantambo njengombuzo wenqubomgomo yomzila.