I-NAT isesiphakeli se-VPN noma kuse-router? Kokubili kungasebenza

Ukumaka uxhumano njengendlela ezenzakalelayo kukhompyutha ephathwayo yisinyathelo wonke umuntu asikhumbulayo, futhi yisona esingashintshi lutho kusango. Iklayenti manje ithumela izicelo ze-inthanethi emhubheni; ukuthi ziyaphuma esakhiweni noma cha kuncike ekudluliselweni phambili, endaweni yokuhumusha kanye nendlela yokubuya efinyelela ikheli langasese leklayenti. Izinhlelo ezimbili zinganikeza kukho kathathu, zibeka umsebenzi ezindaweni ezihlukene, futhi zombili ziyahluleka ngendlela efanayo ethule lapho kungekho muntu ophethe isiqondiso sempendulo. Ukukhetha phakathi kwazo umbuzo wokuthi ubani okufanele abone ichibi lamaklayenti.

Inkolelo: indlela yeklayenti yakha indlela yokuphuma

Ukuhamba ngomhubhe okuphoqelekile kuyinqubomgomo ohlangothini lweklayenti: inquma ukuthi ithrafikhi iya ku-adaptha ye-VPN esikhundleni seyomzimba. Imibhalo ye-Microsoft yokuhlelwa kwendlela ye-VPN ichaza lokho kwehlukanisa nokuziphatha okuphoqelekile, futhi iyisitatimende mayelana nethebula yezindlela yeklayenti, hhayi mayelana nemithetho yokudlulisela yesiphakeli. Ngokombono weklayenti umhubhe yindawo lapho i-inthanethi ihlala khona; ngokombono wesango iphakethe lafika livela ekhelini okungekho muntu phezulu owake wezwa ngalo. Alukho uhlangothi olumiswe kabi lodwa, futhi yingakho ukwehluleka kubonakala njengesiphakeli esiphukile kumuntu oseduze kwekhompyutha ephathwayo.

Lokho kungafani kuyinkinga yonke ekhulunywa yingxenye esele yalesi sihloko. Kufanele kube khona okwenza ikheli langasese leklayenti libuyiseke, futhi ukukhetha kukulapho.

Qala ngokudweba indlela yokubuya

Bhala indlela ngamakheli angempela ngaphambi kokuthinta noma yisiphi isilungiselelo, bese umaka izindawo ezimbili zokuhumusha ezingaba khona kuyo. Lelebhu isebenzisa ichibi le-VPN lika-10.70.0.0/24 elineklayenti elilodwa ku-10.70.0.37, ikheli le-LAN lesiphakeli ku-172.16.40.10, i-router ku-172.16.40.1 kanye nomnyango womphakathi ku-203.0.113.40.

client 10.70.0.37 -- tunnel --> RRAS 172.16.40.10 -- LAN --> router 172.16.40.1 --> 203.0.113.40
                                  (translate here?)                             (or here?)

Isiphakeli esivele sibhrowsa i-inthanethi sifakazela indlela yaso kuphela. Iphakethe elidluliselwa phambili egameni leklayenti yisinqumo esihlukile, esithathwa inqubomgomo yokudlulisela kumshini ofanayo, futhi yisona esivame ukungabikho. Ukumaka izindawo ezintathu zesinqumo kumdwebo kugcina ingxoxo mayelana nesisodwa sazo ngesikhathi.

Inketho A: humusha esiphakelini se-VPN

Lapha isiphakeli sihumusha umthombo weklayenti sibe yikheli laso le-LAN ngaphambi kokunikeza iphakethe ku-router, futhi i-router isebenzisa ukuhumusha kwayo okuvamile ekukhulumeni. Empendulweni, imephu ye-router ibuyisela ikheli lesiphakeli, kanti imephu yesiphakeli ibuyisela ikheli leklayenti. Ukuhumusha okubili okunesimo ngokulandelana kuvamile futhi kuyasebenza, inqobo nje uma kokubili kurekhodiwe; i-router ayilokothi idinge indlela eya echibini, futhi yilokho okuhehayo kulesi senzo.

Get-RemoteAccess | Select-Object VpnS2SInterface, RoutingDomain
Get-NetNat | Select-Object Name, InternalIPInterfaceAddressPrefix

Sebenzisa lezi zifundo ukubona ukuthi isiphakeli senzele ini kakade esikhundleni sokucabanga ukuthi i-NAT ikhona. Umthetho we-masquerade we-Linux okopishwe kubhulogi awusiwo umiselo we-Windows, futhi imvume kufayela elingumthombo yomphakathi yomlaleli we-VPN akuyona inqubomgomo efanayo nemvume yokudlulisela isicelo seklayenti phambili. Qinisekisa indima yokudlulisela yesiphakeli kusuka endaweni yaso yokuphatha, bese ubheka ukuhumusha ngokwehlukana, ngoba kokubili kuvame ukunikezwa amandla izingxenye ezihlukene zokusetshenziswa.

Inketho B: hambisa ichibi ku-router

Esakhiweni sesibili isiphakeli sidlulisela ikheli langempela lomthombo weklayenti, futhi i-router iyalihumusha. Lokho kugcina ichibi lamaklayenti libonakala emaphethelweni, okusiza uma i-router iyindawo lapho inqubomgomo yethrafikhi, ukuloga noma ukuhlola kukhona. Kusho futhi ukuthi i-router idinga indlela yokubuya ye-10.70.0.0/24 ekhomba ku-172.16.40.10, kanye nenqubomgomo ye-inthanethi ehlanganisa ngempela leso siqalo; umthetho obhalelwe i-subnet ye-LAN awunwebi ngokuthula uye echibini.

Khetha lokhu lapho idivayisi yomphetho iyumnikazi ohlosiwe wenqubomgomo futhi ingamukela esinye isiqalo kumathebula ayo okuhlela nokuhumusha. Khetha ukuhumusha ohlangothini lwesiphakeli lapho ichibi kufanele lihlale lingabonakali phezulu futhi i-router ingaphathwa yiqembu elifanayo. Ayikho inketho eboniswa yinoma yisiphi isikhombisi ekhelini leklayenti, futhi ayikho eyodwa ephephile kakhulu ngokujwayelekile; zibeka ukubonakala nokunakekela ezindaweni ezihlukene.

Yenza i-DNS, i-IPv6 nokwamukelwa kucace

Ukuhumusha amakheli akulungisi ukuxazululwa kwamagama. Iklayenti lingasebenzisa isixazululi esinikezwe nephrofayili ye-VPN, isixazululi sangasese sezindawo zamagama ezithile, noma esomphakathi esigunyaziwe, futhi isixazululi esingafinyeleleki ngaphansi kwaleyo nqubomgomo sizoqhubeka nokuhluleka ngemva kokuba ukuhlela kusebenza. Hlola igama nekheli ngokwehlukana ukuze ukuhluleka okubili kungahlangani kunanini embikweni owodwa.

I-IPv6 idinga isigaba sayo ekuklameni. Ukuhumusha kwe-IPv4 okusebenzayo akusho lutho mayelana nokuthi amaklayenti e-IPv6 anendlela, umthombo womphakathi ovumelekile noma inqubomgomo ewavimbayo lapho umhubhe uwa. Ukushiya lokho kungashiwo kusho ukuthi uhhafu wamaklayenti udlula ngokuthula esangweni kuyilapho enye ingxenye isebenza.

Ukuze kwamukelwe, landela isicelo seklayenti esivunyelwe nesiphendulo saso kuwo womabili amaphethelo, futhi ubhale ukuthi yiliphi ikheli okufanele libonwe yilowo nalowo mphethelo ngaleso sikhathi. Lelo rekhodi yilona elenza ushintsho lwechibi olulandelayo lube ukuhlela kwemizuzu emihlanu esikhundleni sengxabano yokuthi ubani onendlela yokubuya elahlekile. Gcina irekhodi nephrofayili yeklayenti hhayi etikithini, ngoba iphrofayili yiyo into uminjiniyela olandelayo azoyithola kuqala.