I-NAT inquma ukuthi iyiphi ikheli lomthombo iseva yakho ye-VPN elibonayo ngempela

Ucabanga ukuthi iseva ye-VPN ifunda ikheli lelaptop yakho epaketheni bese ilibhala kungobo yomlando. Ekilifundayo yilokho okufakwe ukugxuma kokugcina kwe-NAT esihlokweni sangaphandle, futhi ocingweni olusetshenziswa njenge-hotspot lokhu kuvame ukuba ikheli elabiwe namakhulu abanye ababhalisile. Ikheli lomshini wakho uqobo 192.168.x.x aliweli neze i-inthanethi kuleso sihloko, futhi ikheli lomhubhe linikezwa iseva ngemva kokuba uxhumano selukhona. Ngakho uma umlando wesiseva kanye ne-ip addr kuyi-laptop kungavumelani, akukho okuphuthayo; kuchaza izingqimba ezahlukene zesikhathi esisodwa.

Amakheli amathathu, futhi kunelilodwa kuphela emlandweni

Ukudideka kuvela ekuhlanganiseni amakheli amathathu abe elilodwa. Ngalinye linomnikazi ohlukile, lihlala esihlokweni esihlukile futhi lifinyelela iseva ngendlela ehlukile.

Umugqa ophakathi kuphela ongaziwa ngesikhathi sokuxhuma. Iseva iwubhala kuthebule yabalingani, kufayela lesimo noma kungobo yokugeleza kuye ngokuthi i-daemon: i-WireGuard iwubiza ngokuthi iphoyinti lokugcina, ifayela lesimo le-OpenVPN liwumaka ngokuthi Real Address, futhi i-strongSwan iwubika njengosokhaya okude we-IKE_SA. Lelo nani liyavuselelwa njalo uma iphakethe lifika livela komunye umthombo, ngakho liyashintsha ngaphandle kokuthi othile aqale kabusha noma yini.

Umugqa ophansi yilokho abantu abakufunda ngokungalungile njengesimangalo sobunikazi. Umarka indawo ekulungiselelweni kweseva, hhayi umuntu, ngoba iseva iyikhethile emthonjeni wayo. Abasebenzisi ababili bangathola ikheli lomhubhe elifanayo ngezinsuku ezihlukene, futhi oyedwa angaba namabili kusuka kumadivayisi amabili.

Kungani i-tuple erekhodiwe ishintsha ngenkathi umhubhe uhlala ukhona

Ukuhumusha amakheli yithebula enesibali sikhathi, hhayi ukuhlanganiswa okungapheli. Irotha yasekhaya igcina imephu yayo ye-UDP isikhathi ngemva kwephakethe lokugcina, isango lomhlinzeki lisebenzisa kabusha izimbobo ngokohlelo lwalo, futhi ifoni edlula ku-Wi-Fi iya ku-LTE ibuya nomthombo ohluke ngokuphelele. Lapha amanani okuzenzakalela e-conntrack ku-Linux ayisilinganiso esiwusizo: nf_conntrack_udp_timeout yimizuzwana engama-30 kanti uhlobo lokusakaza lungama-120, ngakho umhubhe othule ungase ulahlekelwe imephu yawo kudala ngaphambi kokuba umsebenzisi abone.

Umhubhe uyasinda ngoba iphrothokholi iqinisekisa umlingani, hhayi ikheli. I-WireGuard ayinasimo ngemva kokuxhawulana, ngakho noma iyiphi iphakethe eqinisekisiwe ibuyekeza iphoyinti lokugcina eligciniwe futhi ukuxhuma kabusha kuyalulama kwiphakethe elilandelayo; yingakho i-persistent-keepalive = 25 ikhona, ukuze imephu ihlale ifudumele ngenkathi ingasebenzi. I---float ye-OpenVPN yenza umsebenzi ofanayo futhi ivumela iklayenti eliqinisekisiwe ukuthi liqhubeke likusuka kukheli nembobo okusha. Kumakhiwo e-2.4 ne-2.5 lapho i-float icishiwe khona ngokuzenzakalela, ukuxhuma kabusha kusetha kabusha isikhathi futhi iklayenti lixhuma futhi.

I-IPsec ifinyelela lapho ngezingxenye eziningi ezinyakazayo. I-IKEv2 ibona ukuhumusha ngokuqhathanisa ama-hash omthombo nendawo ekuyiwa kuyo kumithwalo yokuthola i-NAT, ishintshela ekufakweni kwe-UDP 4500, futhi ilandela i-keepalive kuya ku-tuple entsha. Uma ama-keepalive evinjiwe, i-SA ihlala ikhona ephepheni ngenkathi ithrafikhi kwelinye icele ithula inganqamuki.

Iseva ingakunikeza ini, futhi ingakunikezi ini

Inganekwane efanele ukubulawa ukuthi ukuhumusha kukufihla kumhlinzeki. Kushintsha ilebula, hhayi ukubhekwa. Isango elingemva kwe-NAT yomhlinzeki libona isikhala se-100.64.0.0/10 noma ikheli lomphakathi elilodwa elabiwe ababhalisile abaningi, futhi lisengaxhumanisa ukugeleza nesihloko sesitifiketi, ukhiye womphakathi we-WireGuard, ikheli lomhubhe elinikeziwe, izibali zamabhayithi nesikhathi esithile. Akukho kulokhu okudinga ikheli lakho le-LAN.

Imingcele ihamba ngakolunye uhlangothi futhi. Ikheli elabiwe emlandweni likhomba isango, hhayi ikhaya; izikhathi ezimbili ezivela kukheli oluhunyushiwe elifanayo ezimbobeni ezihlukene ngamadivayisi ahlukene; ikheli elifanayo ngezinsuku ezimbili ezihlukene kungaba ababhalisile ababili abangahlobene uma imbobo isetshenziswe kabusha. Iseva erekhoda kuphela okhiye babalingani ayikwazi ukuxhumanisa oyedwa nekhasimende ngaphandle kwedathabhezi yama-akhawunti, futhi iseva erekhoda kuphela amakheli ayikwazi ukwehlukanisa i-laptop nefoni ngemva kwerotha elifanayo.

Qhathanisa iziphetho zombili esikhundleni sokuqagela

Ukuze uthole ukuthi kwenzekeni, thatha uxhumano olufanayo kuzo zombili iziphetho ngesikhathi esifanayo futhi uqhathanise i-tuple, hhayi ikheli. Kuklayenti, ngaphambi kwanoma yikuphi ukuhumusha:

ss -uapn 'dport = :51820'
ip -4 route get 203.0.113.10
wg show wg0 endpoints

Bese ufunda umugqa wokuhumusha kurotha noma esangweni le-CGNAT, kanye nalokho okufinyelela iseva ekugcineni:

conntrack -L -p udp --dport 51820
tcpdump -ni eth0 udp port 51820

Amaphethini amathathu achaza ukungavumelani okuningi. Imbobo yomthombo kuseva ihlukile kunembobo yasekhaya ngenkathi indawo ekuyiwa kuyo ivumelana: ukuhumusha kwezimbobo okuvamile. Ikheli lomthombo kuseva lingelwebhlokhi le-ISP okungewakho: okungenani izingqimba ezengeziwe ze-NAT. Amaphakethe ayama ngemva kwesikhathi sokungenzi lutho bese eqhubeka ngembobo entsha: imephu iphelelwe yisikhathi, hhayi iphutha lokuhamba kwendlela. Uma izitembu zesikhathi zihlukene ngaphezu kwesekhondi elilodwa noma amabili, uqhathanisa imizamo emibili ehlukene.

Lapho umehluko wenza izinto ziphuke

Iziphazamiso ezibukeka njengeziphutha zesiseva zivame ukuqala lapha. Umthetho wokufinyelela oboshwe ekhelini lakho lasekhaya wehluleka ngemva kokushintsha kwesivumelwano se-ISP. Umthetho we-fail2ban ohambisana nekheli elihunyushiwe uvimba bonke ababhalisile ngemva kwalelo sango ngasikhathi sinye. Umlingani we-site-to-site onekheli elikude eligxilile uyeka ukuvuselela okhiye ngemva kokushintsha kwesixhumanisi esingamantanti. Iphrothokholi yomhubhe yayilungile; umcabango nge-tuple yangaphandle wawungewona.

Ukudideka okufanayo kuvela ohlangothini lweseva. Uma ibhokisi le-VPN ngokwalo lingemva kwe-NAT udinga ukudluliswa kwembobo kanye nendlela yokudlulisa esebenzayo; umhlahlandlela wokudlulisa we-strongSwan uhlanganisa leso simo se-IPsec. Iseva efinyeleleka kuphela kukheli langasese ayikwazi neze ukubona i-tuple ehumushiwe elethwa amaklayenti ayo, futhi lokho kuyinkinga ehlukile ekuhunyushweni kwamaklayenti.

Yenza lezi zihlolo ezine ngokulandelana futhi ume kokokuqala okwehluleka:

• Thatha kuzo zombili iziphetho ngesikhathi esifanayo; qinisekisa ukuthi imbo yomthombo, imbobo yendawo ekuyiwa kuyo kanye nezitembu zesikhathi ziyavumelana.
• Funda ohlwini lwabalingani besiseva ikheli elinalo manje, hhayi lelo obulilindele.
• Hlola ithebula le-conntrack noma le-NAT ngomugqa nempilo yawo esele.
• Qinisekisa ukuthi ikheli lesixhumi somhubhe kuklayenti lihambisana nalelo elinikezwe iseva, hhayi ikheli le-LAN.

Uma kokubili ukuthwebula kuvumelana nge-tuple futhi umhubhe usahluleka, ukuhumusha akusiyo inkinga yakho; qhubeka ekuxhawulaneni nakuthebula yokuhamba kwendlela ngaphakathi komhubhe.