Ukufinyelela ku-LAN nge-OpenVPN kudilike? Hlola izifunda, imizila kanye nendlela yokubuya

Ithunge lilibika uxhumano oluphumelele, ikhasi le-router ngokwalo liyafaka, kodwa ukumephwa kwedrayivu kumshini ongemuva kwayo kusagcina ngesikhathi. Akukho okungqubuzanayo kule nhlanganisela: i-router iphendula njengayo ngokwayo, futhi ukufinyelela noma yini engemuva kwayo kuyisinqumo esihlukile esithathwe kwenye indawo. Yenza izivivinyo ezingezansi ngokulandelana futhi ume ekwehlulekeni kokuqala, ngoba ngakunye kusekelwe kwangaphambilini. Uma zine zidlula, iphutha lisingaphezulu kwethunge hhayi ngaphakathi kwalo.

Yisiphi isihlungi esibona iphakethe eliya ku-LAN

Iphakethe elibhekiswe ku-router lidliwa endaweni; iphakethe elibhekiswe kumsingathi ongemuva wayo kufanele lidluliswe, futhi izindonga zomlilo zihlulela lezi zimo ezimbili ngokwehlukana. Ngakho imvume yokufinyelela i-router ayisho lutho mayelana nemvume yokuyidlula. I-firmware efihla amasethi ayo emithetho isisebenza kokubili, ngokuvamile njengesikhethi esinikeza i-LAN, i-inthanethi noma kokubili. Uma isikhethi sishiya i-LAN ngaphandle, akukho sivivinyo sakamuva esizobaluleka.

I-OpenWrt yenza lokhu kwehlukanisa kuhlolwe, futhi umehluko ufanele ukufundwa kanye. Isifunda esiphetha ithunge sidinga umthetho wokudlulisa obheke esifundeni se-LAN, kuyilapho umthetho wokungena ulawula kuphela izinsizakalo eziku-router uqobo. Ikhasi lokuphatha elisebenzayo eceleni kwe-LAN efile liwumphumela ojwayelekile walowo mthetho wokudlulisa ongekho.

uci show firewall | grep -E "zone\[[0-9]+\]\.(name|input|forward|output)"

Bheka umgomo wokudlulisa wesifunda esithwala ithunge: i-accept iyona edingwa yisitebhisi, futhi i-reject ichaza konke ukuphela kwesikhathi ngezansi. Izilungiselelo ezimbili eziseduze zikhiqiza uphawu olufanayo, ngakho zikhiphe ngesikhathi usulapha. Ukuhlukanisa okungenantambo kufihla imisingathi enezintambo kubaklayenti abangenantambo, futhi i-router ethatha imisingathi ye-LAN engasebenzi njenge-offline ingalahla izimpendulo ngisho ngemuva kokuba ukudlulisa kusebenza.

Kungani ithunge elihlukanisiwe lidinga isiqalo esiphushelwe

Iklayenti elithumela yonke into ngethunge isivele inesiqalo se-LAN ngomzila waso wokuzenzakalela, ngakho akukho okumele kwengezwe. Ithunge elihlukanisiwe yisimo esidinga ukuba isiqalo sishiwo ngokusobala, ngoba akukho okunye ekulungiselelweni okusikhulumayo. Engeza umyalo ekulungiselelweni kweseva bese ulayisha kabusha insizakalo.

push "route 192.168.50.0 255.255.255.0"

Amaphrofayili aqukethe route-nopull ayawashaya indiva imizila ephushwayo, ngakho isiqalo esifanayo kufanele sibe kufayela leklayenti. Noma kunjalo, qinisekisa ukuthi ukungena kufikile esikhundleni sokucabanga, ngoba ukushintshwa okuthulile kubukeka kufana ncamashi nenkinga yodonga lomlilo.

ip route show | grep 192.168.50

Umlingani wesayithi-kuya-sayithi ucela okungaphezu kokupusha. Iseva kufanele ifunde ukuthi yiziphi iziqalo ezingemuva kwalowo mlingani, okuyinto eyenziwa umugqa iroute efayeleni layo le-client-config-dir, futhi ithebula layo ngokwalo lidinga umzila ohambisanayo ongena ethungeni.

Impendulo idinga ikheli engalifinyelela

Ukudlulisa isicelo kuyingxenye kuphela yokushintshana, ngoba umsingathi we-LAN kufanele uphendule ikheli elisesiqongweni sethunge. Ama-router amancane ngokuvamile akulungisa lokho ngokuthi ahumushe umthombo esifundeni sethunge, ngakho impendulo ibhekiswe ku-router futhi ayidingi kulungiselelwa kwenye indawo. Susa lokho kuhumusha futhi umsingathi uzodinga umzila wawo oya esiqongweni, awuthola mahhala uma i-router iyisango layo lokuzenzakalela. Umsingathi onekheli elisethwe ngesandla nesinye isango uphendula ngaso leso sango, futhi iklayenti libona isikhathi sivuleka bese sima.

tcpdump -ni tun0 host 192.168.50.20

Gijima lokhu ku-router ngenkathi iklayenti liphinda isicelo salo, futhi funda indawo eya kuyo impendulo hhayi isicelo uqobo. Impendulo ebhekiswe esiqongweni isho ukuthi indlela yokubuya iyasebenza nokuthi iphutha lisekujuleni. Ukungabikho kwempendulo nhlobo kusho ukuthi umsingathi awuzange wamukele iphakethe, okukubuyisela emuva kusethi yemithetho.

Isitebhisi esiphela endaweni efanele

Izivivinyo ezine zithola isigaba, futhi ngasinye siwumyalo owodwa hhayi isahlulelo. Zigijime ngokulandelana futhi ume ekwehlulekeni kokuqala. Ukulandelana kubaluleke ngaphezu kwemiyalo, ngoba isinyathelo sakamuva esidlulayo sifihla isizathu sokwehluleka kwesangaphambili.

ping -c1 10.8.0.1
ping -c1 192.168.50.20
nc -vz 192.168.50.20 445
getent hosts nas.local

Amagama angesiqondiso sokugcina sitesitebhisi, hhayi nhlobo ekuqaleni. Ukwabelana okuphendula njengo-192.168.50.20 kodwa hhayi njengo-nas.local kukhombisa ukuxazululwa kwamagama noma isijobelelo sokusesha, futhi ukuhlelwa kodonga lomlilo akukwazi ukushintsha nakukodwa kwalokho.

Bhala isinyathelo sokuqala esihlulekile, bese unikeza amachweba ezinsizakalo umjikelezo wawo, ngoba isilaleli nemvume yomsingathi kuyizimfuneko ezihlukene. Ukwabelana ngamafayela, idesikhithophu ekude kanye nokugeleza kwamakhamera kudinga kokubili, futhi udonga lomlilo lomsingathi olwethemba inethiwekhi encane ye-LAN kodwa hhayi isiqongo sethunge luyolahla iklayenti ngenkathi i-ping isaphumelela. Uma zonke izivivinyo zidlula futhi uhlelo lusahluleka, iphutha lingaphezulu kwethunge: insizakalo eboshelwe ku-interface eyodwa, noma i-proxy elungiselelwe kuklayenti.