Indawo ye-VPN ku-OpenWrt, ukudlulisela ne-masking: iyiphi edingekayo?
Ukufakwa kwendawo, ukudlulisela ne-masking kuphendula imibuzo ehlukene. Nquma ukuthi ukuhamba kwe-VPN yakho kudinga ini ngaphambi kokuvula indawo ye-WAN.
Izinguquko ezintathu zihlangana ndawonye njalo lapho i-VPN ihlangana ne-OpenWrt: ukuvula iphothi, ukuvumela ukudlulisela nokuvula i-masking. Ziphendula imibuzo ehlukene, futhi ngokuvamile kube yinye kuphela edingekayo ngempela. Ukufunda isilawuli ngasinye ngokwendima yokuhamba esiyilawulayo kushintsha ukuqagela kube isinqumo, futhi kukutshela nokuthi yiluphi uphawu okufanele ulindele lapho ushintsho lungalungile. Qala ngokusho igama lendima ehlulekile, hhayi ibhokisi lokuhlola olikhumbulayo.
Shono indima yokuhamba ngaphambi kokuthinta isilawuli
Ukufakwa kwendawo kunquma ukuthi yini engafinyelela ku-router uqobo. Ukuphuma kwendawo kuhlanganisa ukuhamba okwenziwa yi-router uqobo, ukudlulisela kwendawo kuyinani elizenzakalelayo lokuhamba okudlula endaweni, futhi i-masking inquma ukuthi ikheli lomthombo liyaphinda libhalwe lapho liphuma. Le yimibuzo emine ehlukene, futhi inqubomgomo yendawo iphendula yonke ngasikhathi sinye ngenani elifanayo, yingakho ukushintsha endaweni yonke kuyithuluzi eliqinile. Umthetho oqanjwe ngegama ungaphendula owodwa wabo ngaphandle kokuthinta eminye.
Imephu ewusizo ingeyendima yokuhamba, ngoba yikho ongakubona lapho okuthile kuhluleka. Indima ngayinye ngezansi inesilawuli esisodwa esiyinqumayo kanye nophawu olulodwa olukhombisa kuyo:
| Traffic role | Control that decides it | Where it lives in the config | Symptom when it is wrong |
|---|---|---|---|
| A client reaching a listener on the router | Input policy of the zone that carries the connection, or a rule for the port | option input in the zone stanza, or a named rule | The handshake never completes and the tunnel log says nothing |
| A tunnel client reaching the router itself | Input policy of the tunnel zone | option input in the VPN zone | A ping to the gateway fails |
| A tunnel client reaching another LAN host | Forwarding from the tunnel zone to the LAN zone | config forwarding plus the zone assignment | The gateway answers and the file share times out |
| The router's own traffic leaving the WAN | Output policy, and translation if the far side needs it | option output and option masq | The tunnel never establishes, or replies vanish |
Umhlanganyeli ku-router udinga umthetho wokufakwa omncane oyedwa
Iseva ye-OpenVPN ku-router ithola ukuhamba okuqondiswe ku-router, ngakho ukuxhumana kwayo kwangaphandle kuncike kunqubomgomo yokufakwa yendawo eyithwalayo. Vumela ukuthutha nephothi okulungiselelwe futhi ushiye konke okunye kuleyo ndawo kunqatshiwe. Umthetho oyedwa wephothi ushintsho oluncane kakhulu kunokuvumela indawo yonke, futhi yiwo ongakwazi ukuwuchaza ngisho ngemva konyaka.
Izinto ezimbili zenza lowo mthetho uphephe ukugcinwa: usho iphothi isevisi eliyisebenzisa ngempela, futhi umi eduze kwencazelo yendawo ukuze umuntu olandelayo abone ukuthi kungani ukhona. Imigqa ngezansi iyisimo kuphela, iphothi limele okulungiselelwe kuseva. Shintsha lelo phothi kuzo zombili izindawo lapho isevisi ifuduka, ngoba umthetho ohlala kwelidala awubonakali kuze kube ukuhlolwa.
config zone
option name 'wan'
option input 'REJECT'
option forward 'REJECT'
option output 'ACCEPT'
option masq '1'
config rule
option name 'allow-openvpn'
option src 'wan'
option proto 'udp'
option dest_port '1194'
option target 'ACCEPT'Qinisekisa ngaphambi kokulayisha kabusha, ngoba iphutha lesakhiwo efayeleni le-firewall lingashiya i-router ingenayo isethi yemithetho esebenzayo. Ekukhishweni okusebenzisa i-fw4 ukuhlola kuwumyalo ohlukile, futhi kwehluleka ngomsindo esikhundleni sokwamukela ibhlokhi eyephukile buthule. Layisha kabusha kuphela ngemva kokuba ukuhlola kudlulile, futhi gcina ifayela eledlule lapho ungayibuyisela khona.
fw4 check
service firewall reloadIsicelo sekhasimende sidlula ekudluliseleni, hhayi ekufakweni
Ngemva kokuqinisekisa, isicelo sekhasimende lethuneli sesivisi ye-LAN sidala ukugeleza okudlulisiwe, ngakho isilawuli esinqumayo yibudlelwano bokudlulisela phakathi kwendawo yethuneli nendawo ye-LAN. Yabela i-interface yethuneli endaweni oyifunayo, bese umemezela indlela, imithombo nesevisi. Ukwabelwa kwendawo yikho okunikeza umthetho wokudlulisela incazelo, futhi kokubili kuqondakala kuphela uma kufundwa ndawonye. Ubudlelwano bokudlulisela obusho indawo yethuneli njengomthombo nendawo ye-LAN njengendawo eya kuyo bufundwa njengesinqumo esisodwa esenziwe ngamabomu, kuyilapho ukuvumela kabili endaweni yonke kufundwa njengengozi.
Ukufinyelela ku-router uqobo kusasebenzisa indlela yokufakwa, yingakho i-ping eya ku-gateway ingasho lutho mayelana nokwabelana kwamafayela okungemuva kwayo. Lezo zingqinamba ezimbili zihlala kubhlokhi ezehlukene futhi zilungiswa ngezinguquko ezehlukene. Bhala zombili izindlela ngokwehlukana ngaphambi kokushintsha noma iyiphi.
I-masking iyisinqumo somzila, hhayi imvume
I-masking ibhala kabusha ikheli lomthombo lokuhamba okuphumayo okukhethiwe. Ingasindisa umklamo wokuphuma lapho uhlangothi olukude lungenayo indlela yokubuyela, futhi ifihla namakheli amakhasimende ngamanye kunoma iyiphi isevisi erekhoda noma evumela ngokwekheli. Ukuyicisha yisinqumo somzila mayelana nendlela yokubuyela, hhayi iswishi yokuphepha evala imbobo yokungena. Ithuneli esebenza lapho ukuhunyushwa kuvuliwe futhi yehluleka ngomzuzu wokucishwa kwako ngokuvamile iswele indlela yokubuyela, hhayi umthetho we-firewall.
Enye indlela elandelisa umzila idinga indlela yokubuyela ohlangothini olukude esikhundleni sokuhunyushwa. Akukho kwezi zinketho okunikeza imvume ye-firewall noma i-akhawunti yohlelo lokusebenza, yingakho ukucisha i-masking cishe akulokothi kulungise ikhasimende lethuneli elingafinyeleli ndawo. Phatha futhi inqubomgomo ye-IPv4 ne-IPv6 ngokwehlukana, ngoba isilungiselelo esisodwa sokuhunyusha asichazi imindeni yomibili.
Fakazela isinqumo ngesicelo esivunyelwe nesenqatshiwe
Thumela isicelo esisodwa okufanele sivunyelwe nesinye okufanele sinqatshwe, bese ukhomba isilawuli esenze isinqumo ngasinye. Ikhasi elilayishwe ngengozi akusona ubufakazi; ubufakazi umthetho oqondanayo, ochungechungeni lapho uqondana khona. Ukunqatshwa kubaluleke njengempumelelo, ngoba kukhombisa ukuthi inqubomgomo yenza okuthile esikhundleni sokuthi konke kuvunyelwe.
Imiyalo emibili ikunikeza lobo bufakazi ekukhishweni kwamanje. Isibali sikhathi emthethweni oqondanayo siyanyakaza lapho isicelo samukelwa, futhi ilogi ikhombisa ukulahla uma uvule ukuloga kwalowo mthetho:
nft list chain inet fw4 forward_wan
logread -f | grep -i -E 'DROP|REJECT'Gcina indlela yokuphatha osengayisebenzisa ngaphambi kokushintsha noma iyiphi inqubomgomo ye-firewall, futhi landela inqubo yokuqinisekisa nokubuyisela yomnikazi wokulungiselelwa. Ushintsho olukukhiya ngaphandle kwe-router akusona umphumela wokuhlola, kuyisigameko sesibili. Bhala indawo nendima yokuhamba eduze kokubona ngakunye, ukuze izimbiwa zombili zichaze inqubomgomo esikhundleni sokuchaza ukulayishwa kwekhasi elinenhlanhla.