pfSense OpenVPN: ukufinyelela inethiwekhi engemuva komunye umhambisi
Ik layenti lidinga isiqalo esiphushelwe, i-pfSense idinga igxathu elilandelayo elifinyelelekayo, futhi umhambisi okude udinga indlela ebuyela echibini. Abanikazi abathathu, imizila emithathu.
I-laptop yakho ifinyelela i-LAN ye-pfSense nge-VPN futhi yehluleka ukufinyelela isevisi engxenyeni ejulile ngamagxathu amabili, futhi umehluko yisinqumo esisodwa sokuhamba kwendlela kumnikazi ngamunye. Amathuluzi amathathu kufanele avumelane ngaphambi kokuba iphakethe liqede uhambo lwalo lokuhamba nokubuya: iklayenti, i-firewall nomhambisi ongumnikazi wangempela wenethiwekhi yendawo ekuyiwa kuyo. Uma uphuthelwa ngisho eyodwa yazo, uphawu lubonakala lufana.
Landela iphakethe elilodwa kulezo zinqumo ezintathu ngaphambi kokushintsha umthetho, ngoba umnikazi ngamunye unokulawula okuhlukile nendlela ehlukile yokwehluleka.
Iphakethe elilodwa, izinqumo ezintathu zokuhamba kwendlela
Iklayenti linquma ukuthi indawo ekuyiwa kuyo ingeyethu yini kumhubhe, futhi linganquma kuphela ngokolwazi elinalo: umzila ophushelwe, umzila wasekhaya noma umzila ozenzakalelayo osevele uhlanganisa konke. I-pfSense inquma ukuthi iphakethe lizothunyelwa kuphi ngokulandelayo, futhi enethiwekhi engemuva komunye umhambisi lokho kusho umzila omile ngokusebenzisa isango elifinyelelekayo kusixhumi esifanele. Umhambisi ongaphansi unquma ukuthi uyawazi yini umzila obuyela echibini le-VPN, futhi uma ungawazi, impendulo iyalahlwa noma ithunyelwe endaweni engenamsebenzi. Isinqumo ngasinye sizimele kwezinye ezimbili.
Ukwehluleka kwanoma yisiphi sazo kunikeza umbiko ofanayo womsebenzisi. Yingakho ukulandelana kokulungisa amaphutha kubaluleke kakhulu kunezinsimbi.
Nika iklayenti isiqalo, hhayi ukuqagela
Kuseva ye-pfSense SSL/TLS enenethiwekhi yomhubhe ye-IPv4 enkulu kune-/30, inkambu ye-IPv4 Local network(s) isabalalisa imizila kumaklayenti lapho exhuma. Engeza isiqalo esingaphansi lapho esikhundleni sokuthembela ekutheni iklayenti lizozakhela esaso. Bese ufunda ithebula langempela leklayenti ngemva kokuxhuma, ngoba iphrofayela ene-route-nopull noma isihlungi somzila ingayishaya indiva into ethunyelwe yiseva. Iseva ingase ilunge ngokuphelele kuyilapho iklayenti lingafaki lutho.
Ezinye izindlela zeseva namatopololoji zinemingcele ehlukile, futhi inqubomgomo yeklayenti ngayinye noma yoxhumano ingashintsha lokho iklayenti elithile elikutholayo. Qinisekisa kuklayenti elibalulekile, hhayi kulelo ovele walihlola kuqala.
Khombisa i-pfSense kumhambisi wangaphakathi
Umzila omile ku-pfSense udinga isango elichaziwe nelifinyelelekayo, futhi isixhumi esikhethelwe lelo sango kufanele kube yileso esifinyelela kulo ngempela, njengoba incwadi ye-Netgate yemizila emile ichaza. Kusakhiwo esiyisibonelo, isixhumanisi sokudlula siku-192.168.77.1 kwi-firewall kanye no-192.168.77.2 kumhambisi wangaphakathi, futhi inethiwekhi yesevisi iku-172.16.30.0/25 ngemuva kwayo. Bese umzila usho isiqalo negxathu elilandelayo, hhayi ikheli lesevisi. Ukusebenzisa ikheli elivela kunethiwekhi ekude njengesango kuyindlela evamile yokwakha umzila obonakala ulungile futhi ongadlulisi ndawo.
Ukunika isixhumi igama akuchazi izinethiwekhi ezingemuva kwaso. Umzila omile uyisicoco salokho.
Uhlangothi olukude kufanele lwazi ichibi
Umhambisi ongaphansi udinga umzila wokubuya wechibi, kulesi sibonelo i-10.55.0.0/24 nge-192.168.77.1, ngaphandle uma umzila ozenzakalelayo noma iphrothokholi esebenzayo isivele ihlinzeka ngomunye. Isango lomphathi wesevisi ngokwakhe kufanele likhombise kulo mhambisi, lokho kuvame ukuba yiqiniso lapho umhambisi kuyisango lakhe elizenzakalelayo futhi kube amanga lapho umphathi walungiswa ngesandla. Ukuhamba kwendlela ngomgomo ku-firewall nakho kungadlula ithebula kuthrafikhi ethile, ngakho hlola ukuthi umthetho ukhetha elinye isango yini ngaphambi kokuphetha ngokuthi umzila awulungile.
Lokhu kuklanywa akudingi ukuhumusha, futhi ukushiya ikheli lomthombo leklayenti libonakala kuvumela inethiwekhi engaphansi ukuthi isebenzise inqubomgomo yayo.
Ukuze kwamukelwe, landela isicelo esisodwa esisha ngokungena komhubhe, ukuphuma kwangaphakathi kwe-firewall kanye nempendulo evela endaweni ekuyiwa kuyo. Uma kunalokho kusetshenziswa ukuhumusha ngenhloso, rekhoda umthombo onethiwekhi engaphansi ewubonayo nokuthi impendulo kulindeleke ukuthi ibuye kanjani.
Gcina uhlelo lwabanikazi abathathu eceleni kohlelo lokusebenza oluvunyelwe, ukuze umlawuli olandelayo akwazi ukwakha kabusha umzila esikhundleni sokuphinda awuthole.