Isiphathi esisodwa esivulekile se-VPN newebhu: indlela yokuhlukanisa izindima

Umshini owodwa unganelisa izidingo zontathu ngasikhathi sinye: ukuqeda amathuneli, ukuphendula i-HTTPS nokudlulisela phakathi kwama-LAN amabili ayimfihlo. Ukuthi lokho kunengqondo yini kuncike ezintweni ezintathu ongaziquma ephepheni: ukuthi ikheli elivulekile lingokabani, ukuthi ipharethi ngalinye nombhalo kungokabani, nokuthi iyiphi inqubo evunyelwe ukudlulisela amaphakethe. Uma lezi zilungile, isiphathi esabiwe asinalutho olukhethekile. Uma zingalungile, uzochitha impelasonto kusevisi eqala ngokuhlanzekile futhi engaphenduli neze.

Okulandelayo inqubo yokunquma, hhayi iphepha lokwakha. Isinyathelo ngasinye siphetha ngokuhlolwa okufakazela ukuthi indima osanda kuyengeza ihlukaniswe ngempela.

Khetha umnikazi wekheli ngaphambi kwamapharethi

Indawo yokuphela yethuneli neseva yewebhu kungabelana nge-kernel eyodwa; ukwabelana ngekheli elilodwa, ipharethi nombhalo ngasikhathi sinye yikho okuhlulekayo. I-WireGuard ngokuvamile ithatha i-UDP 51820, OpenVPN ithatha i-UDP 1194 noma i-TCP 443, kanti iseva yewebhu ithatha i-TCP 443. Ipheya elibuhlungu i-OpenVPN phezu kwe-TCP 443 eceleni kwe-HTTPS, ngoba zombili zifuna isokhethi efanayo futhi i-kernel iyinikela lowo oxhume kuqala. Isihlukanisi esingaphambili kuphela, njenge-sslh noma iphrokhisi eyazi i-TLS, esivumela ukuthi babelane ngalelo pharethi, futhi sengeza ingxenye okungasebenzi kahle kwayo kubonakala njengenkinga yefirewall ngqo.

Bheka abanikazi ngaphambi kokushintsha noma yini: ss -lntup iphrinta ikheli lendawo, ipharethi kanye nenqubo yesokhethi ngayinye elalelayo. Imigqa emibili ekhombisa 0.0.0.0:443 isho ukuthi iseva yesibili ayizange ixhumane, kungakhathaliseki ukuthi iskripthi sayo se-init sasijabulile kangakanani. Ibhuloho liphinda lihambise umnikazi. Uma eth0 ihlangana ne-br0, i-IP idlulela ku-br0 futhi wonke umthetho wefirewall osho eth0 uyeka ukuqondana, ngakho bopha amasevisi ebhulohweni bese uqinisekisa nge-ip -br addr.

Umthetho ofanayo wobunikazi uchaza isimanga esivela kumamshini angokoqobo. Iseva yethuneli esebenza ngaphakathi kwesivakashi kuyo leyondawo ye-LAN igcina ikheli lesivakashi, ngakho ukuxhumana okuqondiswe ekhelini lomphathi uqobo kuhlala kumphathi futhi ithuneli lesivakashi alikuboni neze, kungakhathaliseki ukuthi iphrofayela yeklayenti ithini.

Hambisa phakathi kwama-LAN amabili noma yenza i-NAT ohlangothini olulodwa

Ama-LAN amabili angabonani angaqhweba isiphathi esivulekile, bese sidinga ukudlulisela phakathi kwamathuneli. Leso sakhiwo esihambisiwe sidinga izinto ezintathu: ukudlulisela kuvuliwe, umzila oya kuyo yonke imvume ekude kanye nenqubomgomo yokudlulisela evumela ukudlula. sysctl -w net.ipv4.ip_forward=1 ihlanganisa eyokuqala, ip route add 10.20.0.0/24 dev wg1 eyesibili, kanti umugqa we-nftables ofana ne-nft add rule inet filter forward iifname "wg0" oifname "wg1" accept uhlanganisa eyesithathu.

I-NAT yomthombo ilula ukuyengeza futhi inzima ukuyilungisa. I-masquerading ibhala kabusha ikheli leklayenti, ngakho uhlangothi olukude lubona ihabhu esikhundleni somphathi wangempela, futhi imithetho yayo yokufinyelela namalogi ayo ayisasebenzi ekunikezeni umsuka. Uma womabili amanethiwekhi kungawakho, hambisa. Uma uhlangothi olulodwa lungolomunye umuntu ongeke wengeze umzila wokubuya, i-NAT iyindlela ephumayo kuleliviki. Noma kunjalo, bhala uhlelo lwamakheli, ngoba ama-/24 amabili anqwabelanayo awakwazi ukuhambiswa yinoma yikuphi ukulungiselela.

Akukho lutho ekusebenziseni ibhokisi njengendawo yokuphuma ye-inthanethi yelaptop okuvimbela lelo bhokisi ukuthi liqede amathuneli angenayo. Yamakheli anqwabelanayo kuphela avimbelayo, futhi yingakho uhlelo lwamakheli ilona idokhumenti ebalulekile.

Hlola ukwehlukaniswa ngenkathi izindima ezimbili zimisiwe

Ukuhlolwa okusizayo ukukhipha: misa izindima ezimbili bese uqinisekisa ukuthi eyesithathu isaphendula. Isicelo sewebhu kufanele siphele ngenkathi isevisi yethuneli ivaliwe, futhi ukuxhawula kwethuneli kufanele kuphele ngenkathi iseva yewebhu imisiwe. Uma kokubili kusebenza kuphela lapho konke kusebenza, unokuncika okungahlosiwe, njengetafula lefirewall elabiwe, umzila olahlekile noma igama elikhomba ekhelini elingalungile.

Imiyalo emithathu yenza lokho kuhlola kube sobala. curl -sk --resolve example.test:443:203.0.113.10 https://example.test/ kufakazela ukuthi isilaleli sendawo siyaphendula ngaphandle kwe-DNS yangaphandle, wg show kuklayenti kufakazela ukuthi ukuxhawula kuphelile, futhi tcpdump -ni any port 51820 kuhabhu kuhlukanisa inkinga yokuhambisa enkingeni yokhiye. Ukuxhawula okungaveli nakancane ekuthunjweni kwafa ngaphambi komphathi: ifirewall yomhlinzeki, ikheli elivulekile elingalungile noma umthetho we-NAT endleleni.

Phinda ukukhipha kuma-LAN adluliselwayo. Uma i-peer elilodwa linqanyuliwe, i-ping enqamula ihabhu kufanele yehluleke; uma lixhunywe futhi, i-ping kufanele ilulame ngaphandle kokuthinta umthetho. I-ping elulama kuphela ngemva kokuqalisa kabusha ithuneli ikhomba kunqubomgomo hhayi ekufinyelelekeni, futhi lokho kungukulungiswa okuhlukile.

Gcina isethi yemithetho ifundeka ngenkathi ukhipha izindima. nft list ruleset kufanele ikhombise umthetho owodwa wokwamukela uhlangothi ngalunye oludinga ngempela, futhi uchungechunge lokudlulisela olwamukela konke akukona ukwehlukanisa, kuwumbukiso osebenzayo.

Imigqa yokufinyelela ye-IPv6 kuphela namasevisi e-IPv4

Eminye imigqa yokufinyelela inikeza ukufinyeleleka kwe-IPv6 kuphela, futhi amasevisi kusamele ashicilelwe nge-IPv4. Ithuneli ngokwalo lihamba ngomndeni osadlulisa ithrafikhi, kanti isevisi eshicilelwe ihlala ekhelini elingaphakathi kwethuneli. Lokhu kuhlanekezela umcabango ojwayelekile futhi kwephula ukuqapha buthule: umthetho wefirewall noma ukuhlolwa kwesikhathi sokusebenza okubhalelwe umzila we-IPv4 manje uqapha isixhumi esingathathi lutho.

Hlola umndeni ngamunye ngokwehlukana nge-curl -4 ne-curl -6, ngoba isicelo esisodwa esiphumelelayo asisho lutho ngomzila ongawuzamanga. Ubunikazi bepharethi abushintshi phakathi kwemindeni, kodwa isilaleli siyashintsha: ss -lntup ibala amasokhethi e-IPv4 ne-IPv6 emigqeni ehlukene, futhi 0.0.0.0:443 ayiwuhlanganisi [::]:443 ngaphandle uma inqubo icele isokhethi ye-dual-stack.

Isevisi ephendula kumndeni owodwa futhi inqabe kwelinye ngokuvamile inkinga yesilaleli, hhayi yokuhambisa. Ngaphambi kokumemezela ukuthi isakhiwo siphelile, qinisekisa ukuthi indima ngayinye inekheli noma ipharethi layo, ukudlulisela kuvuliwe futhi kuvunyelwe, futhi indima ngayinye isaphendula ngenkathi ezinye ezimbili zimisiwe.