I-NAT ye-LAN nge-tun0 esangweni le-VPN ye-OpenBSD

Onjiniyela ababili abanesango elifanayo le-OpenBSD bavame ukukunikeza amasethi amabili ahlukene emithetho yokufinyelela inethiwekhi ekude, futhi womabili angavikelwa. Ukukhetha phakathi kokuhumusha komthombo nomzila wokubuya akusona neze isicelo sokwakheka kolimi. Konke kuncike kulokho uhlangothi olude olukwaziyo nge-192.168.88.0/24 nalokho okudinga ukukugcina emibhalweni yakho. Yenza iphutha lapha futhi umugqa we-nat-to uzobonakala ulungile ngokuphelele ngenkathi izimpendulo zinyamalala esangweni elijwayelekile elikude.

Ukuhlela umzila nokubhala kabusha kuphendula imibuzo ehlukene

Ithebula lokuhlela umzila linquma ukuthi i-172.20.0.0/16 iyafinyeleleka nge-tunnel, futhi leso sinqumo senzeka ngaphambi kokuba kubuzwe noma yikuphi ukuhumusha kwe-pf. Ukuhumusha komthombo kube sekushintsha ikhanda lephakethe ukuze uhlangothi olude lubone ikheli le-tun0 lesango esikhundleni se-host ye-LAN. Akukho ndlela eyodwa ethatha indawo yomunye: umthetho we-nat awukwazi ukudala umzila, futhi umzila awukwazi ukukholisa umhleli womzila okude ongakaze ezwe ngesizinda sakho esiyimfihlo. Lapho uhlangothi olude lungenayo indlela yokubuya, izimpendulo ziyalahlwa noma zidluliselwe esangweni laso elijwayelekile, futhi akukho kulungiswa kwemithetho okukulungisayo lokho.

Ngamazwi alula, ukudlulisela kuphendula ukuthi ithrafikhi iyaphi, kanti ukuhumusha kuphendula ukuthi kubonakala sengathi ivela kuphi. Gcina kokubili ezintweni zomqondo ezihlukene ngenkathi uklama isethi yemithetho.

Imibandela emithathu enqumayo

Buza imibuzo emithathu ngokulandelana futhi umklamo uvame ukuzikhethela wona. Ingabe inethiwekhi ekude inomzila oqinile okhomba ekhelini le-tunnel le-192.168.88.0/24, noma umphathi wayo ulawula abahleli bomzila kulowo mzila? Uma kunjalo, vumela amakheli e-LAN ukuthi ahambe engashintshiwe futhi weqe ukuhumusha ngokuphelele. Ingabe udinga ukubona iklayente ngayinye ohlangothini olude, kungaba kwenqubomgomo yokufinyelela noma umkhondo wokucwaninga? Uma udinga, ukugcina umthombo kufanelekile umsebenzi wokuhlela umzila. Ingabe ikheli ltunnel lizinze ngokwanele ukuthi lingabhalwa kumzila okude, noma liyashintsha phakathi kokuxhuma kabusha?

Uma noma iyiphi impendulo ingu-cha noma ingaziwa, i-nat-to iyinketho esebenzayo, futhi iyona futhi engabuyiselwa. Umthetho wokuhumusha uyaphuma ngomugqa owodwa lapho uhlangothi olude lwengeza umzila ofanele. Umzila wokubuya ongakaze ufakwe uzokubiza intambo eyodwa yokusekelwa isikhathi ngasinye lapho othile ebuza ukuthi kungani i-tunnel isebenza ohlangothini olulodwa kuphela.

Beka isiqephu ukuze i-pf sihlole ngempela

Isiqephu esingezansi sithatha ukuthi i-LAN yi-192.168.88.0/24, inethiwekhi ekude yi-172.20.0.0/16, futhi isixhumi se-tunnel ytunnel. Akukho lutho kuso okukhetha isinyathelo esilandelayo. Sibhala kabusha umthombo kuphela kumaphakethe asevele ephuma nge-tun0.

match out on tun0 inet from 192.168.88.0/24 to 172.20.0.0/16 nat-to (tun0)
pass in on em0 inet from 192.168.88.0/24 to any keep state

Imininingwane emibili kulowo mugqa wokuqala ithwala ingxenye enkulu yesisindo. Izibiyelo ezizungeze i-tunnel zitshela i-pf ukuthi ifunde ikheli lesixhumi njalo lapho lakha umbhalo wesimo, okubalulekile lapho i-tun0 inikezwa izinombolo kabusha ngemva kokuxhuma kabusha. Igama elithi match lisho ukuthi umthetho uyabhala kabusha bese uwela phansi, ngakho umthetho we-pass ohlukile kusamele uvume ukugeleza. Isixhumi esishiwo kumugqa we-match kufanele futhi sibe yisona esikhethwa yithebula lokuhlela umzila, ngaphandle kwalokho i-pf izohlola umthetho emzileni ophumayo ohlukile kunalowo othathwa yiphakethe ngempela.

Ungakhohlwa uhlangothi lwe-kernel. Ukudlulisela kwe-IPv4 kufanele kuvulwe, futhi imithetho ye-pass enesimo ye-tunnel ne-LAN kufanele ibe khona ngaphambi kokuba konke lokhu kube nomqondo. Isigaba se-PF NAT ku-FAQ ye-OpenBSD siyisihloko esifanele sokulandelana kwamagama asemqoka lapha.

Qinisekisa isethi yemithetho ngaphambi kokwethemba ithrafikhi

Qala ngokuhlola ukwakheka kolimi nge-pfctl -nf /etc/pf.conf, okuhlaziya ifayela ngaphandle kokulifaka. Bese ufaka inqubomgomo futhi ufunde lokho i-kernel ekugcinayo ngempela, ngoba umthetho ohlaziywe kahle usengase ufihlakale noma unamathiselwe esixhumini esingalungile. I-pfctl -sn iphrinta imithetho yokuhumusha ngesimo sayo esifakiwe, futhi i-pfctl -sr iphrinta imithetho yokuhlunga ngokulandelana kokuhlola.

Bese ubheka intambo. Esangweni, i-tcpdump -ni tun0 'host 172.20.0.10' ikhombisa ukuthi ikheli lomthombo eliphuma ku-tunnel likheli ltunnel noma le-host ye-LAN. I-netstat -rn -f inet esheshayo iqinisekisa ukuthi indawo okufunekayo ixazululeka kusiphi isixhumi. Lapho ithrafikhi iqala ukugeleza, i-pfctl -ss ibala imibhalo yesimo; uma ukugeleza kungazange kudale simo, iphakethe alizange lihlangane nomthetho oyidalayo.

Uma uhlangothi lwe-tunnel lubonakala lulungile kodwa izimpendulo zingafiki, yeka ukuhlela i-pf. Ukwehluleka okusele kusemhleli womzila okude, lapho impendulo ithunyelwa khona ekhelini eliyimfihlo uhlangothi olungakwazi ukulufinyelela.

Lapho ukuhumusha kubiza ngaphezu kwalokho okukonga

Ukuhumusha kufihla amaklayente, futhi kwesinye isikhathi lokho kuyinto eyiyo yokushintshana engalungile. Izizinda ezigqagqene ziyisimo esisodwa: uma uhlangothi olude lusebenzisa ne-192.168.88.0/24 ngaphakathi, ukwethula ama-host e-LAN njengesango kwenza ukungqubuzana kube kubi kakhulu esikhundleni sokukuhlela. Izinqubomgomo ze-IPsec ezikhetha ithrafikhi ngezinketho zamakheli ziyisinye isimo, ngoba isizindalwazi senqubomgomo yokuphepha siqhathaniswa ngaphambi kokuhumusha futhi asikaze sibone iphakethe lakho elibhalwe kabusha. Noma yikuphi ukusetshenziswa okukhokhisa, okunciphisa noma okucwaninga ngomsebenzisi ngamunye nakho kulahlekelwa ubuwena elikudingayo ngomzuzu lapho umthombo uwohloka waba ikheli elilodwa.

Izinto ezizakhiwe ze-pf eziphathwayo ziwugibe oluhlukile. Imikhiqizo ekhiqiza amafayela ayo emithetho ilindele ukuthi i-NAT ilungiselelwe ngesixhumi sayo, futhi iziqephu ezihlelwe ngesandla ziyabhalwa phezulu ekufakweni okulandelayo. Amasethi emithetho akopishwe emihlahlandleleni eyabhalwa ngaphambi kokuba igama elisemqoka elithi match libekhona ngeke alayishwe ku-kernel yamanje, ngakho yisa ukwakheka kolimi bese ufunda iphutha esikhundleni sokuqagela.

Umthetho wesinqumo ophila ngemva kokuxhumana namanethiwekhi angempela mfushane: faka umzila wokubuya lapho ukwazi, humusha lapho ungakwazi, futhi ubhale ukuthi yimuphi kule mithathu imibandela okwenze wakhetha kanjalo. Lowo mbhalo wonga omunye umuntu ingxenye yosuku.