I-OpenVPN client yayo yonke i-LAN ku-OpenWrt: ukulandelana kokusebenza

Imisebenzi emine ezimele yenza yonke i-LAN ye-router ibe ngemuva komhubhe owodwa. Idivayisi yomhubhe idinga umnikazi, isifunda se-firewall, umkhombandlela wokuhumusha obheke phezulu kuxhumano kanye nokuhamba ngokukhethekile kwedilesi yomthombo uma abanye abaklayenti kufanele bahlale ngaphandle kwe-VPN. Umhubhe oxhumayo kodwa kungena lutho kuwo ngokuvamile uswele okunye kwalokhu kune. Ukusebenza ngokulandelana kwemincikwe zisho ukuthi ukwehluleka ekugcineni kungokwesinyathelo osanda kusishintsha. Isinyathelo ngasinye ngezansi siphetha ngento ongayibona, futhi lokho kuvimbela esilandelayo ekubeni ukuqagela.

Nquma ukuthi yini eyabelana ngomhubhe

I-router esabalalisa i-Wi-Fi ne-DHCP ingayiqhuba yona iklayenti. Lokho kubeka yonke idivayisi exhunyiwe ngemuva komhubhe ngaphandle kokulungiselela idivayisi ngayinye, futhi lokho yikuhlelwa izindawo ezincane eziningi ezikufunayo. Futhi yikho okunomthelela obanzi kakhulu lapho umhubhe uwela, ngoba yonke idivayisi ilahlekelwa indlela yayo ngesikhathi esisodwa. Akukho lutho ku-LAN olugcina indlela yokuphuma esebenzayo.

I-router yesibili ngemuva kweyokuqala, eqhuba iklayenti nge-subnet yayo siqu, ikhawulela umhubhe emadivayisini ayo kuphela. Kulula ukuyisusa futhi kulula ukuyichaza kulowo oyizuzayo. Intengo ukutholakala phakathi kwezinhlangothi ezimbili ngaphandle komzila noma ukudluliswa kwembobo.

Kungakhathaliseki, yenza ama-subnet e-LAN ahluke. Amazinga afanayo enza uhlangothi olulodwa lubonakale luxhumeke ngqo, futhi umgodi omnyama ovelayo ubonakala njengephutha le-VPN amahora amaningi.

Nikeza umhubhe umnikazi

Memezele umhubhe njenge-interface yenethiwekhi enegama, idivayisi futhi engenayo iphrothokholi yayo. Khona-ke uhlelo lwenethiwekhi lwakha futhi luphethe idivayisi, futhi konke okulandelayo kubhekisela ku-interface ngegama hhayi ngedivayisi. Yikho okwenza isifunda sikwazi ukuyithola.

Ungakhi idivayisi efanayo ezindaweni ezimbili. Umhubhe owenziwe ngesandla eduze kwe-interface emenyezelwe wenza idivayisi ekhona kodwa engekho esifundeni, noma eyanyamalala lapho ilayishwa kabusha. Kokubili kubonakala njengokwehluleka kweklayenti, futhi akukho okukhipha iphutha elisho imbangela yangempela. Khetha indlela yokumemezela bese ususa eyenziwe ngesandla.

Gcina igama lifana kukho konke ukulungiselelwa kwenethiwekhi, se-firewall ne-VPN. Isifunda sibala izethiwekhi ngegama, ngakho iphutha lokuthayipha lishiya umhubhe ngaphandle kwesifunda ngasinye ngenkathi i-interface ngokwayo ibonakala inempilo. I-interface enempilo engenawo umgomo yisimo esinzima kakhulu ukusibona.

Faka esifundeni, bese udlulisela kuso

Isifunda se-firewall yindawo okuhlala kuyo inqubomgomo: ukufaka, ukuphuma, ukudlulisela kanye ne-masquerade. Umhubhe ongekho esifundeni silawulwa yizinto eziyisisekelo ongazikhethanga, futhi lokho akuvamile ukuba yikho okudingwa yiklayenti ye-router. Amabhulokhi ngezansi amemezela i-interface, ayifaka esifundeni futhi avumela ukuhamba kwe-LAN ukuba kungene kuleso sifunda.

config interface 'vpn'
    option device 'tun0'
    option proto 'none'

config zone
    option name 'vpn'
    list network 'vpn'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option masq '1'

config forwarding
    option src 'lan'
    option dest 'vpn'

Kuzinguqulo ezindala kune-21.02 umugqa ofanayo we-interface ubhalwa njenge option ifname, ngakho hlola ukuthi iyiphi ifomu i-firmware efakiwe eyiqondayo ngaphambi kokunamathisela. Ibhulokhi yokudlulisela iyimvume evumela ukuhamba kwe-LAN ukusebenzisa umhubhe nhlobo. Ngaphandle kwayo idivayisi ivuliwe, iklayenti lixhunyiwe, futhi akukho isibungu se-LAN esifinyelela umhubhe. Lesi yisikhalo esivame kakhulu sokuxhumeka kodwa kungena i-inthanethi kubaklayenti be-router.

I-masquerade esifundeni se-VPN ihlanganisa yonke idilesi ye-LAN ibe idilesi yomhubhe we-router ngaphambi kokuba iphakethe liphume. Lokho kususa isidingo somzila wokubuyela ku-subnet yakho ohlangothini olunye.

Uma uhlangothi olunye seluqondisa i-LAN yakho, ukucisha i-masquerade kugcina amadilesi omthombo ebonakala futhi kwenza amalogi eklayenti ngalinye abe nencazelo. Khetha eyodwa bese ubhala ukuthi iyiphi, ngoba izinketho ezimbili ziletha imibuzo yosekelo ehlukene kamuva. Ukususa ukudlulisela okuyisisekelo kusuka ku-LAN kuya ku-WAN yisinqumo esihlukile esinomphumela waso. Uma uyisusa, ukufinyelela kwe-inthanethi kwe-router uqobo kuhamba nayo.

Qamba umgwaqo wangenhla wangempela ku-NAT

Ku-firmware lapho umthetho wokuhumusha ubhalwe ngesandla, i-interface ephumayo yiyona nkambu ehlulekayo. Umthetho oqamba vlan2 awenzi lutho lapho iseshini iphelela ku ppp0. Umthetho ongenayo i-interface nhlobo ungahumusha ukuhamba obekufanele kuhlale kuyimfihlo. Akukho kwalawa maphutha akhuluma ngawo, ngoba umhubhe uyaqhubeka usebenza.

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

Shintsha ppp0 kulo mthetho nge-interface evela ku ip route noma ohlwini lwama-interface asebenzayo, bese ubheka isibali ngesikhathi isibungu se-LAN silayisha ikhasi. Ku-router enomhlinzeki oyedwa, umthetho owodwa we-masquerade womgwaqo wangenhla ngokuvamile wanele. Umthetho wesibili we-interface yomhubhe awuyona indawo yowokuqala.

Bese wengeza izinketho zeklayenti ezinquma okungena emhubheni. Umyalelo we-redirect-gateway uthumela ukuhamba kwe-inthanethi kweklayenti nge-VPN, futhi ngaphandle kwawo umhubhe uthwala imizila kuphela eqhutshwa yiseva. Hlola ithebula lemizila elivelayo ngaphambi kokuthinta i-DNS.

Hlukanisa i-Wi-Fi ngethebula lesibili

Ithebula elilodwa lokuhamba alikwazi ukuthwala izinto eziyisisekelo ezimbili. Ngakho i-SSID yesibili okufanele yeqe umhubhe idinga i-subnet yayo kanye nethebula layo. Nikeza i-SSID yomhubhe ibanga layo, bese uqondisa lelo banga kuphela emhubheni ngomthetho okhetha ithebula.

Amaphakethe okuhamba ngomgomo ku-OpenWrt akhombisa leyo nhlanganisela ngqo. Kungenzeka futhi ngesandla, ngomthetho womthombo kanye nethebula okusisekelo salo sikhomba kudivayisi yomhubhe.

Hlola ukwehlukaniswa kuzo zombili izethiwekhi. Iklayenti eliku-SSID yomhubhe kufanele likhombise idilesi yokuphuma ye-VPN, futhi iklayenti eliku-SSID evamile kufanele likhombise eyedivayisi yomhlinzeki. Lapho kokubili kubonakala kufana, umthetho uhlangana nomthombo ongafanele noma ithebula alibuzwa nhlobo. Hlola futhi ngemuva kokuxhumeka kabusha, ngoba umthetho oncike egameni le-interface uyaphuka lapho idivayisi inikezwa inombolo entsha.

Sola iwashi kanye nefulegi ledivayisi

Ifulegi persist-tun lishiya idivayisi yomhubhe endaweni yayo phakathi kokuqalisa kabusha. Lokho kulungela iseva futhi kudida iklayenti okufanele lakhiwe kabusha isimo salo kusukela ekuqaleni. Lisuse ngesikhathi uxazulula iklayenti le-router, ngoba idivayisi esindayo ekuxoxisaneni okuhlulekile ifihla ukuthi yisiphi isinyathelo esaphukile ngempela. Libuyisele lapho iklayenti lixhumeka ngokuthembekile, hhayi ngaphambili.

Iwashi kungezinye izehluleko ezithule. I-router engenawo iwashi lebhethri iqala kusukela enkathini, okusho ukuthi ukuhlolwa kwesitifiketi kuyahluleka kuze kufike i-NTP. Qhathanisa izimpawu zesikhathi zelogi nesikhathi sangempela ngaphambi kokuthinta isitifiketi, ngoba iklayenti elixhumeka ngemva komzuzu wokuqalisa ngokuvamile lilinde ukuvumelanisa isikhathi.