Idivayisi eyodwa nge-VPN yerutha idinga imithetho emithathu, hhayi iswishi

Ku-VPN yerutha akukho swishi yedivayisi ngayinye; iswishi oyifunayo iyisifinyezo esibhala imithetho yokuhlela kwemigomo esikhundleni sakho. Ngesikhathi ilaptop eyodwa, ububanzi beminyango eyodwa, uhlu lwamakheli olulodwa noma ingxenye ye-LAN eyodwa kufanele isebenzise ithumbu ngenkathi konke okunye kusala ku-WAN, wakha umzila womgomo hhayi ukuthi uvula isici. Umsebenzi unezingxenye ezintathu ezin yakazayo, futhi ngayinye yehluleka ngendlela ehlukile: ithebula elimakwe elingenamzila libonakala njengokuthula, uphawu olubekwe ochungechungeni olungalungile lubonakala sengathi akukho okwenzekile, futhi umthetho we-NAT ongekho ubonakala njengethumbu elixhumayo elingahambi ngalutho. Ezinye izingxenye ezimbili zilahleka ngoba azikaze zivele kumthetho we-mangle, futhi lezo yi-DNS ne-IPv6.

Inganekwane: ithumbu liyisilungiselelo sekhasimende

Ikhasimende le-VPN ohlangothini lwerutha lenza into eyodwa eqinile kahle: lifaka i-0.0.0.0/0 kuthebula eliyinhloko lokuhlela futhi liyibhekisa ethumbeni. I-WireGuard ikuthola ku-AllowedIPs, OpenVPN futhi ikuthola ku-redirect-gateway eqhutshwa iseva, futhi zombili zishintsha indlela yayo yonke into engemuva kwerutha. Ukunciphisa i-AllowedIPs noma ukwengeza i-route-nopull kushintsha lokho ikhasimende elikufakayo. Akushintshi ukuthi lokho kufakwa kuthinta ubani, ngoba ikhasimende alikaze libone amadivayisi. Libona amaphakethe kuphela.

Ukukhetha ngomthombo noma ngendawo okuyiwa kuyo kuyisinqumo sokuhlela, ngakho kungaphansi kwengqimba yomgomo werutha: umthetho we-mangle kanye nethebula lesibili ku-RouterOS, i-MARK kanye ne-ip rule ku-OpenWrt noma i-DD-WRT, noma umthetho we-firewall ogethiweyo walo kuyithumbu ku-pfSense. Iresiphi yekhasimende le-WireGuard yakwa-Netgate iwona okufanele uwufunde ngaphambi kokuqagela, ngoba kulelo platform igethiweyo yomthetho, ukwabiwa kwesixhumanisi kanye nokufakwa kwe-NAT ephumayo kufanele kuvumelane ngaphambi kokuthi ikhasimende elilodwa lisebenzise ithumbu.

Ingxenye yesibili yenganekwane yirutha yesibili. Ukuthenga elinye ibhokisi, noma ukuhambisa idivayisi ku-SSID yezivakashi, kuvame ukusebenza, futhi isizathu akukhona ihadiwe: kubeka idivayisi ku-subnet yayo, okukunikeza isikhethi somthombo osekuvele siqondwa yi-firmware. Uma ungachaza leyo ngxenye kurutha yakho, ibhokisi elengeziwe lixazulula inkinga ongenayo.

Ingxenye yokuqala: ithumbu elingewona umzila ozenzakalelayo

Ku-RouterOS, engeza ikhasimende ngaphandle komzila ozenzakalelayo bese unikeza ithumbu ithebula lalo. Umzila wokuqala uwona ozenzakalelayo omakwe; owesibili uyingxenye yokuhluleka.

/ip route add dst-address=0.0.0.0/0 gateway=VPN_GATEWAY_IP routing-mark=vpn distance=1
/ip route add dst-address=0.0.0.0/0 type=unreachable routing-mark=vpn distance=2

Umzila ongafinyeleleki yiwo isizathu sokuthi ithebula elimakwe linqobe uhlu lwezihluzo kuthebula eliyinhloko. Uma ithumbu liwa, amaphakethe amakwe athola ngokushesha ukungafinyeleleki esikhundleni sokubuyela ku-WAN ngokuthula, ngakho ukuhluleka kubonakala kumlayezo wephutha wohlelo lokusebenza hhayi ekhasini lendawo eliwuhlola ngemuva kwehora.

I-RouterOS 7 ihlukanisa lokho i-6.x eyayikubambe ndawonye: uthembisa ithebula nge-/routing table add name=vpn fib, bese ubhekisela kulo ngegama emzileni nangomthetho we-mangle. Isiqephu se-6.x esibhala i-routing-mark ngaphandle kokuchaza ithebula siyafakwa ngokuhlanzekile futhi asihambisani nalutho. Okunye okujwayelekile izingxenye ezimbili ze-0.0.0.0/1, noma ozenzakalelayo ababili ebangeni elifanayo kuthebula elilodwa: ingqikithi ikhetha eyodwa, futhi ukuziphatha kungashintsha ngemuva kokuqalisa kabusha.

Ingxenye yesibili: maka ngaphambi kokusesha umzila

Isikhethi sinquma ukuthi imaphi amaphakethe angena kulelo thebula. I-RouterOS ivamise ukuqala ngohlu lwamakheli lomgomo wendawo okuyiwa kuyo, noma ngekheli lomthombo lomgomo wedivayisi:

/ip firewall mangle add chain=prerouting src-address=192.168.88.50 action=mark-routing new-routing-mark=vpn
/ip firewall mangle add chain=prerouting dst-address-list=via-vpn action=mark-routing new-routing-mark=vpn
/ip firewall address-list add list=via-vpn address=203.0.113.10

I-firmware ye-Linux yenza okufanayo ngophawu lwe-netfilter nomthetho oholela amaphakethe amakwe kuthebula olike waligcwalisa:

iptables -t mangle -A PREROUTING -p tcp --dport 27000:27050 -j MARK --set-mark 0x200
ip route add default dev tun0 table 100
ip rule add fwmark 0x200 table 100

Uchungechunge akusona isinqumo sesitayela. Uma iphakethe lifinyelela ku-FORWARD ukusesha komzila sekwenzekile, ngakho i-MARK noma i-DROP lapho kungabhalwa kabusha noma kulahlwe kuphela. Uphawu kufanele lube ku-PREROUTING kuthrafikhi edluliswayo naku-OUTPUT kuthrafikhi eyakhiwa yirutha ngokwayo, lapho kuhlala khona i-DNS, i-NTP kanye nokuhlolwa kokubuyekezwa kwerutha. Leyo ndlela yokuphuma iyisizathu esijwayelekile sokuthi ukuhlelwa okugcwele ethumbeni kusaphendula kusuka kusixazululi se-ISP ekuhloleni kokuvuza.

Umgomo wedivayisi udinga ukufana okungagudluki. Gcina ikheli ku-DHCP, noma fanisa isixhumanisi nengxenye ezinikezelwe; ikheli elithuthela kwenye idivayisi kamuva lisebenzisa ithumbu ngokuthula kukhasimende elingalungile. Ibhuloho le-SSID ngayinye eline-subnet yalo liyinguqulo eqinile yombono ofanayo, futhi linikeza imithetho ye-IPv6 indawo yokuhlala nayo.

Ingxenye yesithathu: i-NAT, i-DNS kanye nokukhishwa kwe-LAN

Ithrafikhi ephuma ethumbeni idinga ikheli lomthombo okuzophendulwa yilona ohlangothini olunye. Khawulela ukuhunyushwa kusixhumanisi sethumbu: i-out-interface=VPN_NAME ku-RouterOS, i--o tun0 ku-Linux, ukufakwa kwe-NAT ephumayo okufanayo ku-pfSense. Umthetho we-masquerade ongenaso leso sikhawulelo ubhala kabusha ithrafikhi obuwuhlosile ukuyiyeka, futhi uphawu ukuthi idivayisi engekho ethumbeni ilahlekelwa ikheli layo lomphakathi.

Ukukhishwa kwe-LAN kubangela izindikimba zokusekela eziningi kunalethumbu ngokwalo. Uma ithebula elimakwe linomzila ozenzakalelayo kuphela, indawo yephrinta noma ye-NAS evela kudivayisi ekhethiwe ifanisa lowo ozenzakalelayo bese ilahleka ethumbeni. Engeza umzila we-LAN kulelo thebula elifanayo, noma khipha i-subnet yasendaweni kusikhethi; kokubili kuyasebenza, futhi ukukhipha kulula ukukugcina kufanele uma kamuva wengeza ama-VLAN.

I-DNS ithatha indlela ehlukile. Imibuzo edluliswa yirutha ivela kurutha futhi ilandela i-OUTPUT, hhayi uphawu oludlulisiwe, ngakho ilaptop egcwele ethumbeni isengakwazi ukuxazulula amagama nge-ISP. Qondisa amakhasimende kusixazululi esifinyeleleka nangethumbu, noma maka ithrafikhi ye-port-53 yerutha uqobo, bese uhlola ikheli elixazululiwe esikhundleni sokucabanga ukuthi impendulo yahamba noma isicelo sewebhu.

Uma umthetho ufana kodwa uhlelo lokusebenza lusasebenzisa i-WAN

Uhlu lwezindawo okuyiwa kuzo luguga ngokushesha. Igama lixazululeka ekhelini elingekho ohlwini, ngakho isicelo sithatha i-WAN ngenkathi zonke izivivinyo ozenzile ekhelini elisohlwini bezisebenza. Vuselela uhlu kusixazululi esisodwa esisetshenziswa yikhasimende, futhi ukhetha isikhethi esisekelwe kumthombo uma ufuna ngempela yonke ithrafikhi evela kudivayisi eyodwa.

I-IPv6 iwukudlula okuthulile. Idivayisi inomndeni wesibili wamakheli onomzila wawo ozenzakalelayo kanye nesethi yayo yemithetho, futhi ukufanisa ikheli le-IPv4 kuphela kuyingxenye yomgomo. Sebenzisa isikhethi esifanayo ku-ip6tables noma kokulingana ne-nftables, noma vala i-IPv6 kuleyo ngxenye ngamabomu hhayi ngengozi.

Nokuxhumana okusekiwe kubalulekile. Ukufakwa kwe-conntrack okwakhiwe ngaphambi koshintsho kuyaqhubeka kulandela indlela endala kuze kuphele isikhathi, ngakho isiphequluli esahlala sivuliwe ngesikhathi sokuhlela sibonakala sifana ncamashi nomthetho ongakaze usetshenziswe. Vula ukuxhumana okusha, noma khipha isimo, ngaphambi kokwahlulela umgomo.

Qinisekisa ngamadivayisi amabili nokuqalisa kabusha

Hlola idivayisi okufanele ibe ethumbeni nedivayisi okungafanele ibe khona, bese uqhathanisa i-hop yesibili esikhundleni senombolo yesivinini. I-traceroute kusukela kuyo ngayinye ikhombisa igethiweyo yethumbu noma igethiweyo ye-ISP ku-hop yesibili; uma zombili zibonakala zifana, uphawu noma ithebula akwenzi lokho okusho umthetho. Sebenzisa ukuxhumana okusha esivivinyweni.

Bese uqalisa kabusha. Ukulandelana kokuqalisa yindawo lapho umgomo osebenzayo wonakala khona, ngoba ikhasimende kufanele livuke ngaphambi kokufakwa komzila ongafinyeleleki, futhi isithombe esigciniwe esibuyisela isethi endala yemithetho sizobhala phezu kwethebula lakho. Hlola ukuthi wonke umthetho usekhonfigurashini egciniwe nokuthi lokho ozenzakalelayo okumakwe kukhona ngemuva kokuqalisa, hhayi kuphela ngemuva kokuthi ukubhalile.

Uma okuthile kwehluleka, khipha uphawu kuqala bese ubheka ukuthi ithrafikhi ejwayelekile iyabuya yini, bese ukhipha ithebula. Lokho kulandelana kukutshela ukuthi ujaha inkinga yokuhlela noma eye-firewall, futhi kushiya umuzi unephrinta esebenzayo ngesikhathi uqeda umsebenzi.