I-NIC eyodwa noma ezimbili? Ukunquma ukuhlelwa kwezixhumanisi zeseva ye-VPN

I-adaptha eyodwa ebonakalayo yanele kumaseva amaningi e-VPN, futhi lokhu akusona isisombululo somhlaba wonke. Uxhumano olubethelwe lufika kuleyo adaptha, inqubo ye-VPN iyalususa ukubethela, bese ukuhamba kwangaphakathi kuphuma ngesixhumanisi esibonakalayo ngaphambi kokufika enkonzweni yasendaweni noma ku-LAN ehambisiwe. Ukuthi lokhu kuyasebenza yini kuncike emibandeleleni emithathu: lapho okuyiwa khona kukhona, ukuthi i-LAN inendlela yokubuyela eqoqweni lamaklayenti, nokuthi isixhumanisi esisodwa esabiwe sibonakalayo sikunikeza yini ukwehlukanisa okukushoyo. Phendula leyo mithathu, inani lamadaptha lizolandela.

Imibandela emithathu enqumayo

Umbandela wokuqala yindawo okuyiwa kuyo. Inkonzo ekusebeni ye-VPN uqobo ifinyeleleka kuphela ngesixhumanisi sethaneli, kuyilapho iseba eliku-LAN lidinga ukudluliswa nendlela yokubuyela. Umbandela wesibili yileyo ndlela yokubuyela, ngoba idivayisi ye-LAN kufanele yazi ukuthi ingafinyelela kanjani eqoqweni lamaklayenti, kungaba ngomzila noma ngokuhumusha kuseva.

Umbandela wesithathu ukwehlukanisa. I-adaptha eyodwa isho ukuthi iphakethe ngalinye, elibethelwe noma cha, labelana ngesixhumanisi esisodwa futhi ngokuvamile uchungechunge lwenqubomgomo olulodwa, ngakho isimangalo sokwehlukanisa esincike ehadiniwe ehlukile asigcwaliseki ngesixhumanisi esisodwa. Lokho kuyiqiniso mayelana nendlela, hhayi mayelana nokuthi uhlelo lokusebenza luhlelwe kanjani. Usengakwazi ukuhlunga ukuhamba kwethaneli, kodwa awukwazi ukumangalela umngcele ongenawo.

Akukho kulokhu kuthathu okumayelana nenani lezimbobo kukhabethe. Kumayelana nokuhambisa, ubunikazi bamakheli, nokuthi umklamo uncike kangakanani ekuhlukaniseni okubonakalayo.

Amadaptha amabili aseyikho ukukhetha okusemthethweni lapho izindawo ezibonakalayo, izixhumanisi eziphakeme ezihlukile, umthamo wokudlulisa noma indlela yokubuyisela engaphandle kwebhendi kukufanelekela. Lezo yizimfuno eziqondile, futhi kufanelekile ukuzisho ngaphambi kokuba othile aode ihadiwe.

Lapho inkonzo isebenza kuseba ye-VPN

Icala elilula kakhulu alidingi ukudluliswa nhlobo. I-daemon yamukela amaphakethe eklayenti kusixhumanisi sethaneli bese iwanikela kusokhethi yasendaweni, futhi impendulo ibuya ngaso leso sixhumanisi. Kuseba, ikheli eliseqoqweni lamaklayenti likheli langempela lasendaweni.

Izinto ezimbili noma kunjalo kufanele zibe ngqo: inkonzo kufanele ilalele ekhelini ithaneli engalifinyelela, futhi udonga lomlilo lweseba kufanele lwamukele ukuhamba okufika kusixhumanisi sethaneli. Kokubili kuyabonakala emiyalweni engezansi.

ss -lntup | grep -E "5432|8080"
ip -brief addr show
ip route get 10.8.0.6 from 10.8.0.1

Ukubopha inkonzo ekhelini lomphakathi kuphela, noma ukuhlunga isixhumanisi sethaneli ngephutha, kukhiqiza uxhumano olufika kuseba bese lufa. Lokho kubonakala njengokuhluleka kwe-VPN futhi ngokuvamile kuyisinqumo sesokhethi noma sodonga lomlilo.

Lapho indawo okuyiwa kuyo iku-LAN

Lapha umklamo we-adaptha eyodwa uthola idumela lokuba nzima. Iseva kufanele idlulisele amaphakethe eklayenti ngase-LAN, futhi idivayisi ye-LAN kufanele ithumele izimpendulo zibuyele eqoqweni lamaklayenti. Kungaba uthwala lelo qoqo njengomzila ku-LAN, noma uhumushe ikheli lomthombo kuseva ukuze izimpendulo zibuyele kuseva uqobo.

Zombili izimpendulo zisemthethweni futhi zihluleka ngezindlela ezihlukile. Umzila wokubuyela ugcina ikheli lokuqala leklayenti libonakala kuyo indawo okuyiwa kuyo, okuyinto enhle kumarekhodi futhi embi emithethweni yodonga lomlilo ecabanga amakheli e-LAN. Ukuhumusha kugcina i-LAN ilula futhi kufihla ubunikazi beklayenti endaweni okuyiwa kuyo.

sysctl net.ipv4.ip_forward
nft list ruleset | grep -A4 'chain forward'
ip route show table main | grep 10.8.0

Indlela engalingani yisibonakaliso esijwayelekile: isicelo seklayenti siyafika, impendulo iphuma ngomunye umhambisi, futhi uxhumano luphelelwa isikhathi ngaphandle kwephutha kuzo zombili iziphetho. Thwebula kokubili izinhlangothi ngaphambi kokuphetha noma yini mayelana nethaneli.

Kungani i-alias ingadali indawo yesibili

Ukungeza ikheli lesibili ku-adaptha efanayo, noma ukwakha isixhumanisi se-dummy esilingisa imbobo yesibili, kushintsha okuncane kakhulu. Amaphakethe asaphuma ngesixhumanisi esifanayo esibonakalayo, imbobo efanayo yeswishi futhi ngokuvamile uchungechunge olufanayo lodonga lomlilo, ngakho awukho umngcele omusha phakathi kwabo. Lokho kuwukulunga kokuhlela, hhayi ukuhlukanisa izigaba. Ukukuthatha njengomngcele wendawo yindlela isimangalo sokwehlukanisa esisinda ngayo ephepheni kuphela.

Indawo ehlukile idinga ukwehlukanisa kwangempela endleleni, futhi leso sidingo siyagcwaliseka nge-adaptha yesibili. Uma umthetho uncike ekutheni ukuhamba okubheke i-VPN akukaze kwabelane ngesizinda sokusakaza nokuhamba okubheke i-LAN, ikhebula elilodwa alikwazi ukunikeza leyo mpawu, kungakhathaliseki ukuthi iseba likheliwe kanjani.

Lapho umkhiqizo ubhala i-topology yezixhumanisi eziningi yemodi ethile, landela imibhalo yalowo mkhiqizo esikhundleni sokwakha indlela yokugwema. Abadayisi nabo bashintsha ama-topology asekelwayo phakathi kwezinguqulo, okuyisinye isizathu sokufunda umhlahlandlela wamanje hhayi isithombe sesikrini somqondisi wakudala.

Hlola ukuhlelwa uma kuqhathaniswa nokuhamba okuvumelayo

Bhala izigaba zokuhamba okufanele iseva sizithwale: iklayenti kuya kuseba, iklayenti kuya ku-LAN, iseba liya ku-LAN, noxhumano lwangaphandle olubethelwe. Isigaba ngasinye sinomthombo, indawo okuyiwa kuyo nesixhumanisi, futhi ukuhlelwa kufanele kugcwalise kozine ngasikhathi sinye. Umklamo osebenza kwezintathu zazo ngokuvamile yiwo okhiqiza amathikithi.

Bese uqinisekisa izixhumanisi zangempela nokuthwebula kwangempela, hhayi umdwebo osemibhalweni yomklamo. Imiyalo engezansi iphrinta kokubili ukubuka.

ip -brief addr
ip route
tcpdump -ni any udp port 51820 -c 5
tcpdump -ni tun0 -c 5

Uma ukuthwebula kwangaphandle kubonisa ukuhamba okubethelwe futhi ukuthwebula kwangaphakathi kubonisa ukuhamba okususwe ukubethela kusixhumanisi sethaneli ngenkathi i-adaptha ebonakalayo ithwala kokubili, i-NIC eyodwa yenza umsebenzi. Uma ukuthwebula kwangaphakathi kungenalutho, inkinga isethaneli noma emithethweni yokudlulisela, hhayi enanini lamadaptha. Nquma i-topology kuleyo mithwebula emibili nangetafula yemizila, futhi ushintsho olulandelayo luzoba nokuziqhathanisa nakho.