Indlela iklayenti le-OpenVPN elingemuva kwe-NAT eliba ngumgudu wokuphuma ku-inthanethi

Amahosthu amathathu e-Linux, umklamo owodwa: ihabhu le-OpenVPN elifinyeleleka emphakathini, ikhompyutha ephathwayo yomsebenzisi kanye nomshini wokuphuma ongemuva kwerutha yasekhaya evamile engadluliseli lutho ngaphakathi. Umgudu wokuphuma uzishayela ngokwawo uye ehabhini. Bese ithrafikhi ye-inthanethi yomsebenzisi ingena kuthumbu kukhompyutha ephathwayo futhi iphume ngoxhumano lwangenhla lomgudu wokuphuma uqobo. Konke okumangazayo kulesi sakhiwo kuvela emininingwaneni eyodwa: umgudu wokuphuma uqale ukuxhumana, ngakho indlela yokungena isivele ikhona futhi akudingeki ukudluliswa kwembobo ukuyenza.

Okulandelayo kulandelela indlela yephakethe hhayi ukulandelana kokulungiselelwa, ngoba ukulungiselelwa kunengqondo kuphela uma wazi ukuthi iyiphi ingxenye ephethe isinqumo sini. Isendlalelo ngasinye siphethe isinqumo esisodwa ngqo, futhi amaphutha anqwabelana lapho izendlalelo ezimbili zithathwa njengesisodwa.

Izigaba ezimbili zokuthutha, indlela eyodwa yangaphakathi

Ihosti ngayinye igcina uxhumano lwayo lwangaphandle oluya ehabhini, futhi alukho olwazi ngolunye. Ithrafikhi yomsebenzisi eya ku-inthanethi iwukugeleza kwangaphakathi okuhlukile okwenzeka ukuthi kuthwalwe ngaphakathi kuthumbu lomsebenzisi bese kukhishwa futhi kusuka kuthumbu lomgudu wokuphuma. Ihabhu kufanele lihambise lokhu kugeleza kwangaphakathi, futhi umgudu wokuphuma kufanele ukudlulisele.

outer: consumer --TLS--> hub
outer: exit     --TLS--> hub
inner: consumer --tun--> hub --internal--> exit --tun--> uplink

Njengoba kokubili ukuxhumana kwangaphandle kuphuma ohlangothini lweklayenti, irutha yomgudu wokuphuma ayikaze ibone i-SYN engenayo futhi ayikaze idinge umthetho we-NAT wendawo ekuyiwa kuyo. Kufanele igcine ukuthutha okusunguliwe kuphila, lokho eyakwenza kakade kunoma yikuphi ukuxhumana okude. Akukho lutho ku-inthanethi yomphakathi okudinga ukufika kumgudu wokuphuma kuqala, yingakho ikheli eliguqukayo kulowo xhumano lwangenhla akuyona inkinga. Irutha kusafanele ivumele isigaba sokuphuma, kodwa lokho kuyimvume efanayo esetshenziswa isiphequluli.

I-iroute ifaka ini ngempela ngaphakathi kwiseva

Ihabhu iyona kuphela idivayisi enquma ukuthi iyiphi ibhanga eliphethe iyiphi indawo ekuyiwa kuyo, futhi ithatha leso sinqumo kuthebula layo lokuhambisa lendawo yomsebenzisi, hhayi kwelakho kwe-kernel. Umbhalo we-client-config-dir womgudu wokuphuma ogama lingu-exit-node ungafuna isiqalo esizenzakalelayo lapho:

# /etc/openvpn/server/ccd/exit-node
iroute 0.0.0.0 0.0.0.0

Lolo mugqa utshela inqubo yeseva ukuthi "amaphakethe angaphakathi anoma iyiphi indawo ekuyiwa kuyo ngawomsebenzisi". Awunezi indlela ezizenzakalelayo kuhlelo lokusebenza lwehabhu futhi awenzi ihabhu libe isango le-inthanethi. Incwadi yereferensi ye-OpenVPN 2.6 igcina ukuhambisa kwangaphakathi okuqondene neklayenti nokuhambisa kwe-kernel njengezindlela ezihlukene, futhi lokho kwahlukanisa yikona okwenza lo mklamo usebenze ngaphandle kokuthinta indlela ezenzakalelayo yehabhu.

Umsebenzisi udinga umyalelo oyisibuko, olethwa njenge-push, ukuze ithrafikhi yakhe ingene kuthumbu esikhundleni sokuphuma ngesango lendawo. Ngokwakheka kwenethiwekhi encane, ichibi liyindlela exhunyiwe kudivayisi ye-tun yomgudu wokuphuma, ngakho indlela yokubuya ayidingi push eyengeziwe; into umgudu wokuphuma okufanele ungayitholi ukuhlanjululwa okungezansi, okungabuyisela ithrafikhi yayo yoxhumano lwangenhla kuthumbu elizama ukulusebenzisa. Kuyithumele kumsebenzisi kuphela futhi ufunde izindlela ezisetshenzisiwe kuklayenti esikhundleni sokwethemba ukuthi ifayela le-CCD likhethiwe.

# /etc/openvpn/server/ccd/consumer-01
push "redirect-gateway def1"

Ukudlulisela kwenza i-kernel yomgudu wokuphuma

Ngaphakathi komgudu wokuphuma, iphakethe elivela kumsebenzisi lifika kusixhumanisi se-tun likhonjiswe kuhosti ye-inthanethi ethile. I-kernel ibheka ithebula layo lokuhambisa, ithola uxhumano lwangenhla lwangempela njengokufana okungcono kakhulu bese isebenzisa izinqubomgomo ezimbili ezizimele: ingabe leli phakethe lingadluliselwa nhlobo, nokuthi ingabe lingaphuma ngalowo sixhumanisi nalelo kheli lomthombo. Ukudlulisela kuyi-sysctl, futhi kucishiwe ngokuzenzakalela ezindaweni eziningi zokusabalalisa.

Ngakho umgudu wokuphuma udinga ukudlulisela kwe-IPv4 okuvuliwe njalo, umthetho ovumela imithombo yethumbu lomsebenzisi ukuya kuxhumano lwangenhla, kanye nendlela yempendulo ebuyayo nge-tun. Ukuvula ukudlulisela kuyo yonke ihosti kushintsha futhi indlela yokuziphatha kwakho konke okunye okuhambiswa ngayo, ngakho umthetho kufanele usho imithombo nezixhumanisi esikhundleni sokwamukela konke.

Indlela yokubuya ithengwa ukuhumusha komthombo

Ihosti ye-inthanethi ayinayo indlela eya kukheli 10.90.0.x, ngakho izimpendulo bezizolahlwa ngaphambi kokuba zifike kumgudu wokuphuma. Ukubhala kabusha umthombo lapho iphakethe lishiya uxhumano lwangenhla kuyalungisa lokho, futhi ukulandelela ukuxhumana kubuyisela emuva lokho kubhala kabusha endleleni yokubuya.

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -s 10.90.0.0/24 -o enp1s0 -j MASQUERADE
ip -4 route get 10.90.0.9   # run on the exit: must point at the tun

Umthetho ongenhla uyindawo yokuqala yokusixhumanisi esisodwa soxhumano lwangenhla, hhayi inqubomgomo yodonga lomlilo. Nciphisa umthombo kufike ezigabeni ozigunyazile ngempela, futhi gcina inqubomgomo yokungenayo yomgudu wokuphuma ihlukile, ukuze ukufihla kwethrafikhi yethumbu kungavezi ngasese izinsizakalo zasendaweni. Kuhosti enekheli loxhumano lwangenhla eliguqukayo, ukufihla kukusindisa nasekulandeleleni ikheli ngesandla.

Lapho ihabhu lingaphoqelela khona nalapho lingakwazi khona

Nge-client-to-client kanye nendlela yedatha yendawo yomsebenzisi evamile, ihabhu lidlulisela amaphakethe angaphakathi phakathi kwabalingani ngaphakathi kwenqubo yeseva. Awehlukanisi umucu we-FORWARD we-kernel yehabhu, ngakho umthetho we-kernel lapho awukwazi ukukhawulela ukuhamba phakathi kwabalingani, noma ngabe ubhalwe ngokucophelela kangakanani. Ukuphoqelela kufanele kuhlale kunqubomgomo yeseva uqobo: ubani ovunyelwe ukuxhumana, iyiphi ifayela le-CCD alitholayo, nokuthi ubunikazi obuzenzakalelayo bomgudu wokuphuma bunikezwa yini.

Yingakho i-iroute ezenzakalelayo iyisinqumo sokwethemba esibanzi. Umgudu wokuphuma kufanele wamukele ngokusemthethweni ithrafikhi yokubuya evela kumakheli e-inthanethi angahleliwe, futhi kufanele kube umshini owulawulayo, ohlaziyayo futhi oqaphelayo. Ukunikeza ubunikazi obufanayo kubhanga ongayikunikeza irutha yilona phutha umklamo ohambisa kulo.

Ubulungu yibona kulawula ngempela. Noma iyiphi iklayenti ekwazi ukulungisa izindlela zayo ingazama ukusebenzisa umgudu wokuphuma, ngakho ukukhawulela ukuthi ubani angaxhumana, noma ukuthi imiphi imibhangqwana umgudu wokuphuma uzoyisebenzela, kuyingxenye yomklamo hhayi umcabango wangemva.

Ukwehluleka ngokuphephile lapho umgudu wokuphuma unyamalala

Cisha umgudu wokuphuma bese ubunikazi bangaphakathi obuzenzakalelayo bunyamalala kanye nesigaba sawo. Okungafanele kwenzeke ukuthi ihabhu libe ngumgudu wokuphuma ongena esikhundleni buthule: akukho ndlela ezenzakalelayo esuka echibini le-VPN iya kuxhumano lwangenhla lwehabhu, futhi akukho mthetho obanzi wokufihla osehabhini ongadlulisela ngokuzithandela leyo thrafikhi efanayo. Hlola lokho kwehluleka ngamabomu, bese uhlola ukululama ngokugeleza okusha hhayi ngekhasi ebelivele livuliwe.

# on the consumer, with the exit up and then down
ip -4 route get 1.1.1.1
curl -sS -o /dev/null -w '%{http_code}\n' https://example.com

Uma ithrafikhi yomsebenzisi isafika ku-inthanethi ngemuva kokuba umgudu wokuphuma usuhambile, kukhona okunye oyithwalayo futhi umngcele owawuqonda awukho. Phatha i-DNS ne-IPv6 njengezinqumo ezihlukene: indlela ye-IPv4 kanye nokufihla akusho lutho ngenhla yethrafikhi ye-AAAA, futhi isixazululi esicindezelwa ihabhu sizophendula sisuka lapho umbuzo uphuma khona ngempela.