I-pfSense NAT ephumayo: funda kuqala imithetho ekhiqiziwe

Vula i-Firewall, bese i-NAT, bese i-Outbound, futhi ufunde imodi ngaphambi kokwengeza noma yini. Kumodi ye-Automatic, i-pfSense ikhiqiza imithetho yezixhumi ze-WAN futhi, phakathi kwazo, yamanethiwekhi e-VPN okufinyelela kude, ngakho ichibi ozimisele ukulengeza ngokuvamile selivele limboziwe. Ukungabikho komugqa obhalwe ngesandla akusona ubufakazi bokuthi ukuhunyushwa akukho. Ukulandelana ngezansi kukuvimbela ekuguquleni i-firewall yonke ibe ngu-Manual ukuze uxazulule ichibi elilodwa.

Imodi inquma ukuthi ubani ogcina ukuhunyushwa kwayo yonke enye inethiwekhi kudivayisi, futhi lokho kuyisinqumo esikhulu kunokuhluka okukodwa kwe-VPN.

Imodi ye-Automatic isivele ihlanganisa ichibi le-VPN

Imodi ngayinye inomnikazi ohlukile. I-Automatic ikhiqiza imithetho yezixhumi ze-WAN futhi ifaka amanethiwekhi e-VPN okufinyelela kude phakathi kwemithombo yayo. I-Hybrid igcina leyo mithetho ekhiqiziwe futhi ikuvumela ukwengeza eyokwenziwa ngesandla eceleni kwayo. I-Manual iyeka ukukhiqiza noma yini, ngakho konke ukuhunyushwa ku-firewall kuba umsebenzi wakho, kuhlanganise nalokho ongakubhalanga. Isilungiselelo sesine sivimba ngokuphelele i-NAT ephumayo. Umugqa obonakala ubhalwe ngesandla awufakazi lutho kuze kube uyazi ukuthi iyiphi imodi esebenzayo.

Ku-Automatic ne-Hybrid ikhasi likhombisa futhi imithetho ekhiqiziwe. Yifunde ngaphambi kokunquma ukuthi ichibi le-VPN alinakho ukuhunyushwa: bheka inethiwekhi yechibi kukholomu yomthombo kanye nesixhumi se-WAN kukholomu yesixhumi.

Khetha i-Hybrid kuphela kokuhluka okubuyekezwe

Ukuhluka okubhaliwe kusenzeka lapho inqubomgomo yokuphuma ihluke ngempela. Cabanga ngeseva elisabalalisa i-10.90.0.0/24, lapho i-firewall kufanele inikeze ukuphuma kwe-inthanethi nge-IPv4 futhi umzila usuvele ukhetha i-WAN. Ukuguqulwa okulindelekile ukuthi umthombo 10.90.0.23 ubhalwe kabusha kukheli lwe-WAN. Hlola ukuthi ngabe umthetho okhiqiziwe usevele wenza lokho kulokho kuphuma; uma kungenjalo, i-Hybrid igcina ukumboza okuzenzakalelayo futhi yengeza umthetho wakho obuyekezwe.

Sebenzisa ichibi langempela le-VPN njengomthombo, noma igama elihlukile elisekelwayo ngalo, futhi ungalokothi ukhethe ikheli elingahlobene ngoba nje igama lesifanekiso se-OpenVPN lingekho esikhethini. Gwema umthombo any, ophinda futhi uhunyushe ithrafikhi ekhiqizwa i-firewall uqobo.

Ungayihambisi i-firewall yonke ku-Manual ngenxa yechibi elilodwa. Leso sinqumo sabela kabusha ukunakekelwa kwayo yonke inethiwekhi yangaphakathi nakho konke ukushintsha kwe-WAN esizayo.

I-NAT ayikhethi ukuphuma

Umzila ukhetha isixhumi sokuphuma; umthetho we-NAT ephumayo uchaza kuphela ukuthi umthombo ubhalwa kabusha kanjani ngemva kokuba iphakethe liphumile. Ukumephu kwe-WAN akukuphoqi iphakethe umzila olithumele kwenye indawo ukuba lidlule nge-WAN, yingakho ukwengeza i-NAT kungenakulungisa umzila ongafanele. Hlola futhi ama-entry e-NAT 1:1 asebenzayo nokuhluka, ngoba ukulandelana kubalulekile futhi umugqa omusha awunqobi ngempela. Futhi ikhasi lokuphuma akulona ikhasi lokuhlunga.

Umthombo ohunyushiwe awusona imvume yokufinyelela yonke indawo. Amaklayenti asadinga umzila odlula emhubheni kanye nomthetho we-firewall ovumela ithrafikhi yawo, futhi ukuphuma okukhethiwe kudinga indlela yokubuya esebenzayo. Gcina ukufinyelela kwe-LAN kuphela kuhlukanisiwe nemvume yokuphuma ku-inthanethi.

Fakazela ukuguqulwa kuxhumano olusha

Ngemva koshintsho olugunyaziwe, hlola ngoxhumano olusha olugunyaziwe esikhundleni sokusebenzisa olukhona, ngoba izimo ezisunguliwe zigcina ukuguqulwa kwazo kwangaphambili. Qinisekisa ikheli lomthombo eliphuma ngempela ku-WAN nokuthi impendulo ibuya ngesimo esifanayo. Ungasuli ithebula lonke lezimo njengenyathelo lokuqala; lokho kufihla ukuthi yimuphi umthetho oshintshe umphumela. Bhala imodi, umthetho, ichibi nokuphuma kuthikithi yoshintsho.

Lesi sibonelo sihlanganisa kuphela ukuphuma kwe-IPv4. Akusho lutho mayelana nokuhunyushwa noma inqubomgomo yokuhlunga ye-IPv6, futhi umklamo odinga lokho kufanele ukusho ngokwehlukana. Irekhodi eliqediwe libala ithrafikhi yeklayenti evunyelwe, isixhumi esiyithwalayo, nesizathu sokuthi kungani umthombo udinga ukubhalwa kabusha.