I-hub eyodwa ye-OpenVPN, ama-LAN amathathu: uhlelo lwamakheli namafayela e-iroute

Ama-LAN amathathu azimele angahlangana ku-hub eyodwa ngaphandle kokuthi noma isiphi isayithi sidinge ukwazi ukwakheka kwangaphakathi kwezinye, futhi wonke umklamo uncike ezinqumweni ezine ezimfushane zokucushwa. Okukwenza kusebenze akusona isici sephrothokholi esingajwayelekile, kodwa uhlelo lwamakheli okungekho muntu okudinga ukuluqagela, kanye nemizila yeklayenti ngalinye etshela i-hub ukuthi yiliphi igatsha eliphethe i-prefix iphi. Uma okukodwa kwalokhu kungalungile, ithaneli isaphuma, futhi yikho kanye okwenza ukwehluleka kube nokudideka.

Landela izinyathelo ngokulandelana. Isinyathelo ngasinye sincike ohlelweni lwesinyathelo esandulelayo, futhi asikho esidinga isiphathimandla esisha sesitifiketi.

Qala ngohlelo okungekho muntu okudinga ukuluqagela

Bhala phansi ama-prefix amane ahlukene ngaphambi kokuthinta ifayela lokucushwa: i-LAN ye-hub uqobo, i-LAN yegatsha ngalinye, kanye neqoqo elinikezwa amaklayenti ahambayo. Ukungahlangani yikho okugcina konke okunye kulula, ngoba izigaba ezigqagqene zishintsha ukuhlelwa kwemizila kube indida yokufanisa ende kunazo zonke okungekho kucushwa kweklayenti ngalinye okungayilungisa. Bese uqinisekisa ukuthi iyiphi imshini eyisango elizenzakalelayo le-LAN ngayinye, ngoba umhambisi wegatsha okungeyona isango le-LAN yalo uqobo kumele afake imizila ekude kwenye indawo ngokuphelele. Ekugcineni, misa amagama aqinisekisiwe akhomba igatsha ngalinye, ngoba lawo magama ayizikhiye okuseshelwa ngazo amafayela eklayenti ngalinye.

Uhlelo oluyisibonelo lugcina iqoqo likude nama-LAN amathathu. Olwakho luzohluka, futhi umthetho oqinile owodwa ukuthi awekho amazinga amabili ahlangana.

Hub LAN        172.20.0.0/24
Branch A LAN   172.21.0.0/24
Branch B LAN   172.22.0.0/24
VPN pool       10.77.0.0/24

identity branch-a owns 172.21.0.0/24
identity branch-b owns 172.22.0.0/24

Tshela i-kernel ye-hub ukuthi amagatsha akuphi

I-hub idinga ulwazi olubili ngegatsha ngalinye: umzila we-kernel othumela i-prefix kudivayisi yethaneli, kanye nokufakwa kwe-iroute okutshela inqubo ye-OpenVPN ukuthi ikuphi iklayenti eliyiphethe. Umzila we-kernel wedwa uletha amaphakethe ethaneleni bese ume lapho, ngoba i-daemon kusamele inqume ukuthi iyiphi i-peer okufanele iwamukele. Ukufakwa kwe-iroute kwedwa kushiya lawo maphakethe kwi-kernel ngaphandle komzila wokulandela. Yomibili imigqa ingeyokucushwa i-daemon ewulayisha ngempela, futhi kufanelekile ukuqinisekisa lokho ngaphambi kokulungisa noma yini enye.

dev tun
topology subnet
server 10.77.0.0 255.255.255.0
disable-dco

route 172.21.0.0 255.255.255.0
push "route 172.20.0.0 255.255.255.0"
client-config-dir /etc/openvpn/ccd
route 172.22.0.0 255.255.255.0

Gcina i-client-to-client ivaliwe lapho i-kernel kufanele ibe yindawo yokuphoqelela imithetho. Leyo nketho idlulisela ithrafikhi phakathi kwama-peer ngaphakathi kwe-daemon, okuyinto elula futhi futhi isho ukuthi imithetho yakho yokudlulisela ayiwuboni neze lowo mgudu. Konke okungezansi kucabanga ukuthi i-kernel ibona iphakethe ngalinye phakathi kwamagatsha.

Nikeza igatsha ngalinye imizila eliyidingayo

Igatsha ngalinye lidinga imizila eya kwamanye amagatsha nase-LAN ye-hub, futhi alidingi eya kwi-LAN yalo uqobo exhunyiwe. Sunduza ama-prefix akude kusuka ku-hub esikhundleni sokuwancamathisela kumhambisi ngamunye, ukuze isayithi lesine kamuva sisho ifayela elilodwa elisha leklayenti esikhundleni sezinguquko ezine. Ifayela leklayenti ngalinye liphinda liphathe umugqa we-iroute, ogcina ubunikazi nesimemezelo endaweni eyodwa. Yenza incwadi kanye namafayela ayo afundeke ngokuvumelana nemodeli yamalungelo eseva, kungenjalo ukusesha kuhluleka ngaphandle komyalezo.

# /etc/openvpn/ccd/branch-a
iroute 172.21.0.0 255.255.255.0
push "route 172.22.0.0 255.255.255.0"

Isayithi lesine silandela iphethini efanayo: igama eliqinisekisiwe elihlukile, i-prefix ephethwe, umzila we-kernel ku-hub, ukufakwa kwe-iroute, kanye nezimemezelo eziya kuphela ezindaweni ezigunyaziwe ukufinyelela kuso.

Hlola kuzo zombili izinhlangothi ngaphambi kokusho ukuthi kuphelile

Vula ukudlulisela kwe-IPv4 kubo bobathathu abahambisi, bese uqinisekisa ukuthi i-firewall ivumela imigudu ehlosiwe kuzo zombili izinhlangothi, ngoba ukuhlolwa kohlangothi olulodwa kudlula nomzila wokubuya ophukile kaningi kunalokho umuntu akulindele. Phakathi kwezindawo akudingeki ukuhumusha ikheli lomthombo, futhi ukugcina umthombo wangempela yikho kanye okuvumela igatsha ngalinye ukusebenzisa inqubomgomo yalo esicelweni.

Hlola kusuka kusibungu ku-LAN yegatsha elilodwa kuya ensizakalweni kwelinye, bese uguqula uhlangothi, bese uhlola kusuka egatsheni kuya ku-LAN ye-hub. Leyo miphumela emithathu iyizinto zobufakazi ezihlukene, futhi akukho okukodwa okusho ezinye. Uma umhambisi wegatsha kungeyona isango elizenzakalelayo le-LAN yalo, faka ama-prefix akude esangweni langempela futhi ufake neqoqo lapho amaklayenti ethaneli edinga ukuqala ukuxhumana singene kuleyo LAN.

Rekhoda uhlelo, amafayela eklayenti ngalinye kanye nemithetho ye-firewall njengedokhumenti eyodwa, ngoba ukwengezwa kwesayithi okulandelayo kuzohlulelwa ngokuvumelana nakho.

Umklamo uhlala ndawonye ngoba isendlalelo ngasinye sinomsebenzi owodwa: uhlelo lugcina ama-prefix ehlukile, umzila we-kernel uhambisa amaphakethe, i-iroute ibiza umnikazi, futhi i-firewall inquma okuvunyelwe. Lapho kukhona okwephukayo, lolo hlu luyindlela futhi yokuhlola.