Iklayenti le-OpenVPN lifinyelela iseva kodwa hhayi izingaba ze-LAN: uhlu lokuhlola

Iklayenti lithi lixhunyiwe, ikheli lethuneli liphendula i-ping, futhi akukho lutho ku-LAN yasehhovisi oluphendulayo. Ngibona lokhu ngemva kwakho konke ukuthuthukiswa kweklayenti, futhi umuzwa wokuqala ukuvula i-firewall, okuvamise ukuba yisinyathelo esingalungile: ithuneli lilungile, futhi ukuphuka kukwelinye lamagxathu amathathu okufanele iphakethe liwadlule. Hamba umzila ngokulandelana okuthathwa yiphakethe, okokuqala umzila weklayenti, bese ukudluliswa kuseva, bese uhambo lokubuya, futhi uzothola umnikazi wephutha phakathi namaminithi ambalwa.

Isinyathelo sokuqala: bheka isinqumo somzila seklayenti

Ngaphambi kokuthinta iseva, fakazela ukuthi iklayenti lithumela iphakethe ethunelini. Buza i-kernel ukuthi iyiphi i-interface eyayizoyisebenzisa kwingaba eyodwa ye-LAN, esikhundleni sokufunda ithebula lonke:

ip route get 192.168.50.10

Uma impendulo isho i-adaptha yakho yomzimba kanye nesango lehhovisi, akukho shintsho ohlangothini lweseva olungasiza. OpenVPN lihlinzeka ngemizila kuphela lapho iseva iwacindezela, ngakho funa push "route 192.168.50.0 255.255.255.0" ekucushweni kweseva, bese uxhuma iklayenti futhi ngemva kwalokho. Iningi lamaklayenti lisebenzisa imizila ecindezelwe ngesikhathi sokuxhuma, hhayi lapho ulayisha kabusha iphrofayela.

Ku-Windows umbuzo ofanayo unomyalo ohlukile. Find-NetRoute -RemoteIPAddress 192.168.50.10 liprinta i-interface kanye negxathu elilandelayo elingakhethwa isitaki, futhi route print -4 likhombisa ukuthi isiqalo esicindezelwe sikhona yini.

Isinyathelo sesibili: qinisekisa ukuthi iseva izodlulisa iphakethe

Uma umzila weklayenti ulungile, iphakethe lifinyelela iseva futhi iseva kufanele ivume ukulidlulisa. Isishintshi se-kernel siyisango lokuqala, futhi sysctl net.ipv4.ip_forward kufanele libuyisele u-1. Ukulibeka nge-echo 1 > /proc/sys/net/ipv4/ip_forward kusebenza kuze kube ukuqalisa kabusha okulandelayo, futhi yikho kanye okubangela ukuthi isikhalazo esifanayo sibuye emasontweni.

Kubhale endaweni ephila ngaphaya kokuqalisa kabusha:

echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-openvpn-forward.conf
sysctl --system

Isango lesibili ithebula lokuhlunga. Ingaba ene-Docker efakiwe ivamise ukuba nenqubomgomo ye-FORWARD ethi DROP, futhi ithuneli lizuzwa njengefa leso sinqumo. iptables -L FORWARD -v -n likhombisa inqubomgomo kanye nezibali zamaphakethe; uma inqubomgomo iyi-DROP, ukudlulisa kudinga imvume ecacile yendlela esuka ethunelini iya ku-LAN kanye neyinye yempendulo.

Isinyathelo sesithathu: landela iphakethe ku-LAN futhi ufune impendulo

Bheka izinhlangothi zombili zeseva ngesikhathi esisodwa. Thwebula ethunelini naku-interface ye-LAN, uhlunga ngeklayenti elilodwa nangengaba eyodwa ukuze umphumela uhlale ufundeka:

tcpdump -ni tun0 host 192.168.50.10
tcpdump -ni eth0 host 192.168.50.10

Izikhalo ezivela ku-tun0 bese ziphinde zivele ku-eth0 ngomthombo we-10.8.0.x, bese kuba nokuthula, zisho ukuthi iphakethe lafika futhi impendulo yaya kwenye indawo. Ingaba ye-LAN iphendula isango layo elizenzakalelayo, lelo sango alinawo umzila wethangi le-VPN, futhi impendulo ifela kumzila we-LAN. Ukwenza i-ping engabeni ye-LAN kusuka kuseva akufakazeli lutho ngalo mzila, ngoba leyo traffic ayiweli neze ithuneli.

Isinyathelo sesine: khetha phakathi kokuhumusha nomzila wokubuya

Ukulungisa okubili kuvala imbobo, futhi ukukhetha kunemithelela engaphezu kokuthi i-ping iyasebenza. Ukuhumusha komthombo kwenza iseva ibe ngumthumeli obonakalayo:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Khawulela umthetho ethangini naku-interface ye-LAN, bese uwenza uhlale njalo, kungenjalo ukulayisha kabusha kwe-firewall okulandelayo kuzosusa ukulungisa kwakho buthule. Intengo ubunikazi: iklayenti ngalinye libonakala njengesiseva se-VPN kumalografi e-LAN nasemthethweni wokufinyelela, futhi per-client policy becomes guesswork.

Umzila oqinile we-10.8.0.0/24 kumzila we-LAN, okhomba kuseva ye-VPN, ugcina amakheli eklayenti abonakala futhi uyimpendulo engcono yesikhathi eside uma lowo mzila ungowakho. Iziza eziningi zisebenza kokubili isikhashana, i-NAT yokulungisa ngokushesha nomzila uma inqubomgomo ye-firewall isibhaliwe. Uma iseva ingethangi kodwa ingumlingani wendawo-ngendawo, uhlangothi lweseva ludinga futhi i-iroute yesizinda esikude, kungenjalo umzila womlingani ukhona kodwa i-traffic yeklayenti ayixhunyaniswa nawo neze.

Isinyathelo sesihlanu: qinisekisa kusuka kuklayenti futhi ubhale okushintshile

Vala umjikelezo kusuka kuklayenti, hhayi kusuka kuseva. Xhuma kusevisi yangempela engabeni ye-LAN, bese uqinisekisa ukuthi izibali zokuhumusha zinyakazile nge-iptables -t nat -L POSTROUTING -v -n, ngoba umthetho ongenamaphakethe awuwona umthetho owake wahlangana. conntrack -L -s 10.8.0.5 likhombisa ukugeleza kanye nesimo salo lapho udinga ubufakazi bokuthi indlela yokubuya ilandelwa.

Shiya inothi ekucushweni kweseva: yisiphi isizinda, iyiphi i-interface, uwuphi umthetho, nokuthi umzila we-LAN unayo indlela yokubuya. Ngokulandelayo lapho ukuthuthukiswa kweklayenti kususa umzila ocindezelwe, lelo nothi liguqula isikhathi sokucisha umlilo sibe ukulungisa komugqa owodwa.