Ithrafikhi yendlela eyodwa ngemva kokucisha i-SNAT yesubneti ye-Tailscale

Cisha i-NAT yomthombo kurotha yesubneti ye-Tailscale, ithuneli liyaqhubeka nokusebenza kuyilapho ukuxhumana okudlula kulo kuma. Izicelo zifika endaweni okuyiwa kuyo zinekhasi le-overlay lomthengi okude uqobo, okuyiyo njalo injongo yalolu shintsho, futhi izimpendulo manje zidinga indlela i-LAN engazange idinge ukuyazi. Ngaphandle kwaleyo ndlela amaphakethe ehla, izimpendulo ziphuma ngegedi elijwayelekile, futhi ukwehluleka kubonakala njengenkinga ye-firewall okungekho mthetho we-firewall oyichazayo. Ithuneli linempilo; ingxenye yokubuyela ayikho.

I-SNAT yayifihla ini

Uma i-SNAT ivuliwe, irotha ibhala kabusha ikheli lomthombo labe yikheli layo le-LAN ngaphambi kokudlulisela kusubneti, ngakho indawo okuyiwa kuyo iphendula kusibungu esivele sazi ukuthi singafinyelelwa kanjani futhi akukho okunye okudinga ukulungiselelwa. Ukuyicisha kugcina umthombo wangempela, futhi indawo okuyiwa kuyo ibona ikheli ngaphakathi kwebanga le-overlay esikhundleni somakhelwane osewini yayo. Lelo kheli lingempela futhi lingahamba kulo lonke i-tailnet, kodwa alifinyeleleki lisuka ku-LAN ngegedi elizenzakalelayo. Isishintshi esibhalwe phansi yi---snat-subnet-routes=false, esisetshenziswa kurotha yesubneti ye-Linux uqobo.

Lokhu kuwukuhlelwa okuhlala njalo hhayi isishintshi sephakethe ngalinye, ngakho umzila wokubuyela kufanele ube khona kuyo yonke inethiwekhi yendawo okuyiwa kuyo esetshenziswa yileyo rotha. Yikho lokhu okwenza ushintsho lube yisinqumo sokusabalalisa hhayi ibhokisi lokumaka. Konke okusetshenziswa yileyo rotha kuzuza isidingo ngesikhathi esifanayo.

Umzila wokubuyela ungahlala kuphi

Izindawo ezintathu zivamile, futhi zihluka ngobubanzi hhayi ngokunemba. Umzila oqinile kusibungu sendawo okuyiwa kuyo uwona oqondile futhi ongandisi kakhulu, ngoba idivayisi ngayinye idinga ikhophi yayo. Ithebula lezindlela ku-VPC noma kurotha yesayithi limboza yonke inethiwekhi ngesikhathi esisodwa, futhi ukukhetha kwe-DHCP okuthwala imizila eqinile engenazo izigaba kufinyelela kumakhasimende ngokuzenzakalela kodwa kwehluleka buthule kumadivayisi akuyinalela.

ip route add 100.64.0.0/10 via 192.168.1.10
ip route get 100.64.0.5

Noma yikuphi ukubekwa okukhethayo, ukugxuma okulandelayo yikheli le-LAN lero tha futhi akusilo neze ikheli layo le-tailnet. Isibungu se-LAN asikwazi ukufinyelela i-overlay kuze kube sinayo le mzila, ngakho ukugxuma okulandelayo ngaphakathi kwe-overlay kuyindilinga futhi akuthumeli iphakethe ndawo. Lelo phutha elilodwa lichaza iningi lamalungiselelo abonakala elungile kodwa ahluleke, futhi liyasinda kukho konke ukuhlola okufunda ithebula lero tha kuphela. Bhala phansi ukuthi wakusebenzisa kuphi ukubekwa, kungenjalo umuntu olandelayo uzohlola okungalungile.

Ukufunda ukwehluleka njengethrafikhi yendlela eyodwa

Isibonakaliso silula ukusibona kunesizathu: isevisi iphendula kurotha ngokwayo futhi ithule kumthengi okude. Ukuthwebula endaweni okuyiwa kuyo kubonisa izicelo zifika nezimpendulo ziphuma, okubonakala njengempumelelo kuze kubonakale ukuthi lezo zimpendulo ziya kuphi. Ziya egedini elizenzakalelayo, okusho ukuthi ingxenye yokungena yasebenza kodwa eyokubuyela ayizange isebenze.

Thwebula kurotha esikhundleni salokho, ngoba ibona izinhlangothi zombili zokushintshana okukodwa futhi ikhombisa ukuthi impendulo yafika yini. Uma impendulo ibonakala endaweni okuyiwa kuyo kodwa ingabonakali kurotha, umzila awukho noma awulungile ohlangothini lwendawo okuyiwa kuyo. Uma ibonakala kurotha futhi ima lapho, inkinga iqhubekela phambili futhi ingeyolunye uphenyo.

sudo tcpdump -ni any host 100.64.0.5
ip route get 100.64.0.5

Ingabe ikheli langempela lifanele umzila

Ukugcina i-SNAT kuhlala kuyimpendulo elula lapho inethiwekhi yendawo okuyiwa kuyo ingakwazi ukulungiselelwa kabusha, futhi izindleko zazo yikuthi ikhasimende ngalinye libonakala njengero tha kumalogo nasemgomeni wendawo okuyiwa kuyo. Ukuyicisha kuyafaneleka lapho uhlelo ludinga ikheli langempela lomthombo noma lapho umgomo wenethiwekhi kufanele uhlukanise amakhasimende abelana ngerotha eyodwa. Kokubili kuyizizathu ezisemthethweni futhi akukho okukodwa okumahhala. Inzuzo kufanele ifanele ukugcinwa komzila kuyo yonke inethiwekhi yendawo okuyiwa kuyo, kanye nokubuyekezwa kwe-firewall okuchazwe ngezansi.

Ku-LAN encane eyodwa ukushintshana kuvame ukukhokha, kuyilapho kumadivayisi amaningi angakwazi ukuthatha umzila oqinile kuvame ukungakhokhi. Bhala isinqumo nesizathu eceleni kokuhlelwa kwerotha, ukuze umlawuli olandelayo azi ukuthi ikuphi ukuziphatha okwenziwe ngamabomu. Okuzenzakalelayo okungabhalwanga muntu akuhlukaniseki nokunganaki.

I-firewall, ukuloga kanye nendima ephindwe kabili

Wonke umthetho owawuhambisana nekheli le-LAN lero tha manje uhambisana nomthombo ohlukile, kuhlanganise imithetho yokuvumela nanoma iyiphi inkambu yelogi eyayibhala iro tha njengekhasimende. Funda leyo mithetho ngaphambi kokuhlolwa kokuqala hhayi ngemva kokwehluleka kokuqala, ngoba umthetho ovumela ikheli lero tha kuphela uvimba ngokuphelele umthombo omusha. Nciphisa ukufakwa esikhundleni kumakhasimende namachweba azidingayo, bese uqinisekisa ukuthi awamukeli buthule yonke i-tailnet.

sudo nft list ruleset | grep -n '100\.64'
sudo iptables-save | grep -n '100\.64'

Inodi eyodwa esebenza njengenodi yokuphuma kanye nerotha yesubneti ngesikhathi esisodwa iyisimo esibhalwe phansi esingalahla ithrafikhi ephezulu uma i-SNAT yesubneti icishiwe. Ukuhlukanisa lezo zindima kumanodi ahlukene kususa leso sixwayiso futhi kunikeza umzila ngamunye nomgomo we-firewall umnikazi oyedwa. Uma izindima kufanele zihlale ndawonye, lindela lokho kuziphatha futhi ukuhlole ngaphambi kokusola ikhasimende. Gcina umzila, ukuhlelwa kwesishintshi nokwabiwa kwezindima embhalweni owodwa, ngoba kufundwa ndawonye lapho ukuxhumana okulandelayo kwehluleka.