Awekho iswishi yokukhipha lolu hlelo: nikeza inqubo umthombo wayo

Uhlelo olulodwa kufanele lusebenzise ukuxhumana okuvamile kuyilapho konke okunye kuhlala kumhubhe, futhi iklayenti ayinayo iswishi yalokho. Asikho nesigaba esifihliwe okufanele sitholakale. Umzila ukhethwa emikhakheni engaphakathi kwephakethe, futhi iphakethe lithwala amakheli namachweba, hhayi ubuwena benqubo eyilithumbile, ngakho ukukhipha kufanele kuvezwe komunye yaleyo mikhakha. Landela iphakethe kanye futhi izinketho ezitholakalayo ziyeka ukuba yimfihlakalo.

Kungani iklayenti lingakwazi ukukunikeza

Ukuhlela umzila ngendawo okuyiwa kuyo kuqhathanisa ikheli lendawo okuyiwa kuyo neziqalo futhi kugcina ukufana okude kakhulu. Ngaleso sikhathi iphakethe ngalinye libukeka lifana, kungaba yini elilithumbile. Ukuhlela umzila ngomgomo womthombo kwandisa ukuqhathanisa kuya ekhelini lomthombo, futhi lokho kuyisihloko esisetshenziswa yiso sonke isixazululo esisebenzayo: shintsha umthombo, futhi olunye uhlu luyafaneleka.

Amachweba awasizi. Ukukhipha ngechweba bekufanele kuhlolwe ngaphambi kokufunwa kwendawo okuyiwa kuyo, futhi ichweba alinayo ingxenye kuleso sinqumo. Konke okukhangiswa njengokukhipha okusekelwe echwebeni empeleni kukhipha ngomunye umkhakha futhi kukuchaza ngokuxega.

Ukuhlela umzila kwangempela ngohlelo lukhona lapho inkundla yengeze imishini yalokho, njengezingcingo zesihlungi ku-Windows noma ukuxhunyaniswa kwensizakalo ye-VPN ku-Android. Isibonelo sedesikithophu se-OpenVPN asilethi lutho kulokho, futhi ayikho ifulegi yokuhlela eyisungulayo.

Linux: maka inqubo, bese uhlela umzila wophawu

Indlela ehlanzekile kakhulu ibophela isinqumo enqubeni ephethe isokhethi. Ukufana kwe-owner kusebenza kuthrafikhi ekhiqizwe endaweni kuketanga le-OUTPUT, ngakho uphawu olusetshenziswe lapho lungakhetha uhlu oluhlukile:

iptables -t mangle -A OUTPUT -m owner --uid-owner 1001 -j MARK --set-mark 0x1
ip rule add fwmark 0x1 table 200
ip route add 192.168.1.0/24 dev eth0 src 192.168.1.0 table 200
ip route add default via 192.168.1.1 dev eth0 table 200

Amaphakethe avela kumsebenzisi 1001 abe esebona uhlu 200 futhi aphume ngesango elivamile, kuyilapho uhlu oluyinhloko lusathumela konke okunye emhubheni. Ukufana kwe-owner kusebenza kuphela kumaphakethe akhiqizwe endaweni, okuyiyo kanye ithrafikhi ebalulekile lapha, futhi ayikwazi ukuhlukanisa amaphakethe adluliselwa kwenye inkambi. Qinisekisa ngamathuluzi, hhayi ngenhloso: ss -tnp ikhombisa ikheli lasendaweni nenqubo engumnikazi yokuxhumana okusunguliwe, futhi ip route get 1.1.1.1 mark 0x1 ikhombisa ukuthi uphawu lukhetha luphi uhlu.

Isikhala samagama senethiwekhi siyimpendulo eqinile kakhulu yohlelo oluzimelayo, ngoba yonke isokhethi eyakhiwe ngaphakathi kulo iboshelwe kulo ngokwakhiwa, ngakho izinqubo ezisizayo nokuxhumana kwengane zithola ukuziphatha ngaphandle kokuhlukaniswa nhlobo. Izindleko ziwumsebenzi wamapayipi: ipharisidi le-veth, ikheli emaphethelweni womabili, nomzila wokuzenzela ngaphakathi kwesikhala samagama okhombisa emuva enambeni.

ip netns add novpn
ip link add veth-host type veth peer name veth-ns
ip link set veth-ns netns novpn
ip addr add 10.200.0.1/24 dev veth-host
ip netns exec novpn ip addr add 10.200.0.2/24 dev veth-ns
ip netns exec novpn ip route add default via 10.200.0.1

Windows: indawo okuyiwa kuyo isanquma

I-Windows ikhetha uxhumano lokuphuma kusuka endaweni okuyiwa kuyo, ngakho uhlelo olufuna enye indlela kufanele lushintshe okuthile isiteki esikubuza ngaphambi kwalokho kukhetha. I-ForceBindIP ihlanganisa ingxenye yokuqala: iqalisa uhlelo ngamasokhethi asevele eboshelwe ekhelini lasendaweni olishoyo. Lokho kuphela akukushintshi ukuthi iphakethe liphuma ngakuphi uxhumano, ngoba umzila usakhethwa yindawo okuyiwa kuyo. Bophela umthombo kukhompyutha ephathwayo umzila wayo wokuzenzela okhombisa emhubheni, futhi iphakethe lisaya emhubheni.

Uphawu lunokwakheka okufundekayo uma usuqwazi. Kusebenza ekhelini le-LAN uxhumano olukhethiwe olufinyelela kulo ngqo, futhi kuyahluleka kukho konke ku-inthanethi umzila wakho okhombisa emhubheni. Kubonakala futhi kusebenza kuze kube yilapho uhlelo lunikeza umsebenzi kumsizi, ngoba umsizi ovula isokhethi yakhe akakaze atshelwe ngokuboshelwa.

Hambisa isinqumo lapho inqubo eyodwa iyiyunithi engalungile

Uma isidingo sangempela kuyithuluzi hhayi uhlelo, libeke ku-SSID noma i-VLAN yalo futhi uvumele isiphathi-mzila sinqume: lowo mthombo uthatha indlela evamile kuyilapho eminye imithombo isebenzisa umhubhe. Umshini wesango ozinikele ungenye indlela eqinisekile: ugcina i-VPN futhi wamukela kuphela izindawo okuyiwa kuzo ezithunyelwa isiphathi-mzila. Ku-VLAN inqubomgomo ihlanganisa konke ukugeleza okuvulwa yithuluzi, kuhlanganise nezinqubo ezisizayo ezephule indlela ye-Windows. Ukushintshana kungububanzi: izinhlelo ezimbili kulelo thuluzi azisakwazi ukuphathwa ngendlela ehlukile.

Kokubili imigomo yomthombo noma yendawo okuyiwa kuyo enobubanzi ongabusho ngomusho owodwa. Akukho ngisho okukodwa okungokohlelo ngalunye, futhi umklamo ozikhangisa njengowohlelo ngalunye uhluleka okokuqala lapho uhlelo lunikeza umsebenzi waluzo kwenye inqubo.