I-PiVPN handshake iyasebenza, amakhasi ayama: hlola i-MASQUERADE

Ifoni yakho ibonisa ithumela njengelixhunyiwe, iklayenti libika ikheli langasese, kodwa ikhasi lokuqala lisalenga phakathi nokulayisha. Le nhlanganisela ithumela iningi labantu ezilungiselelweni ze-cipher kanye nezinga lokushisa le-CPU, lapho empeleni kungenabutho obonakalayo. Ithumela lakhuphuka, okusho ukuthi izingxoxo zaqedwa; okwehlulekile yisinyathelo esilandelayo, lapho iseva izama ukunikeza amaphakethe eklayenti ku-inthanethi. Landela indlela efanayo amaphakethe lawo ahamba ngayo, futhi ukungafani kuvame ukubonakala emugqeni owodwa wethebula le-NAT.

Qala ngalokho iklayenti elingakufinyelela nokungakufinyeleli

Kusuka kuklayenti elixhunyiwe, layisha ikhasi eliseku-inthanethi yomphakathi futhi uphawule ukuthi lihluleka ngokushesha noma liyahlaba phakathi nendawo. Bese uvula insiza ekhelini langasese leseva ye-VPN uqobo futhi uqhathanise imiphumela emibili.

Ikheli lethumela eliphendula i-ping ngenkathi amasayithi omphakathi ephelelwa yisikhathi kuwuphawu lwenkinga yokudlulisa noma yokuhumusha, hhayi i-handshake ephukile. Iphaneli yesimo yeklayenti uqobo ayikwazi ukwehlukanisa lezi zinto, ngoba iyazi kuphela ukuthi isiteshi sokulawula sikhuphukile. Hlola kuseva i-interface yethumela ngalokhu: ip -br addr show tun0 bese uqinisekisa ukuthi ikheli elinikezwe iklayenti liwela ngaphakathi kweqoqo olilungisile. Uma iqoqo nekheli leklayenti kungahambisani, lungisa lokho kuqala, ngoba wonke umthetho ongezansi ufana neqoqo.

Okulandelayo, buza iseva ukuthi iyiphi i-interface ezoyisebenzisa ukufinyelela ikheli lomphakathi. ip route get 203.0.113.9 iphrinta idivayisi nesixuku okukhethiwe emugqeni wayo wokuqala. Bhala igama lalolo divayisi, ngoba yilona nani umthetho we-NAT okufanele ube nalo.

Funda umthetho onquma ukuthi amaphakethe ayaphuma yini

I-MASQUERADE ibhala kabusha iphakethe kuphela lapho iphakethe liphuma nge-interface eshiwo emthethweni. Umthetho oboshwe kudivayisi enentambo awenzi lutho kutrafikhi ephuma nge-Wi-Fi, futhi iphakethe ligcina ikheli laso lomthombo langasese lize lifike kuyo i-router ephezulu. Leyo router ayinayo indlela yokubuyela eqoqweni lethumela lakho, ngakho ilahla impendulo, futhi iklayenti libona uxhumano oluvulayo bese lufa. Uphawu lukhula ngokuthi malini wekhasi elifikayo ngaphambi kokuthi kudingeke impendulo yokuqala.

Bhala ithebula elikhona futhi ufunde ikholomu ye-interface ephumayo esikhundleni sokufuna nje igama elithi MASQUERADE. Ukuphuma kwesimo sokwengeza kulula ukuqhathanisa kunohlu oluhlelelwe ukubonwa:

ip -br addr show tun0
ip route get 203.0.113.9
sudo iptables -t nat -S POSTROUTING

Ku-Raspberry Pi eyayisebenzisa i-Ethernet futhi manje esebenzisa i-Wi-Fi, igama eliphelelwe yisikhathi cishe njalo liyindaba yonke. Umfaki wabhala ukuthi iyiphi idivayisi eyayikhona ngesikhathi sokulungiselela, futhi isethi yemithetho egciniwe iyayiphinda embonini ngayinye. Qhathanisa idivayisi evela ekufuneni umzila naleyo esemthethweni ngaphambi kokushintsha enye into. Uma zifana, i-interface ayiyona inkinga yakho futhi kufanele uye ezibalini engxenyeni yokugcina. Uma zihlukile, ukulungisa ukushintshwa kwegama elilodwa efayeleni lokuqhubeka.

Lungisa isethi yemithetho egciniwe, hhayi kuphela leyo esebenzayo

Ukuhlela ithebula elikhona kuphela kuhlala kuze kube ukuqalisa kabusha okulandelayo, okuyisikhathi esanele ukukuqinisekisa ukuthi inkinga isixazululiwe. Imithetho ebuyayo ekuqaliseni ihlala efayeleni elilayishwa kabusha iphakethe lokuqhubeka le-firewall. Ezithombeni ze-Pi ezisekelwe ku-Debian lelo fayela ngokuvamile /etc/iptables/rules.v4.

Thatha ikhophi ngaphambi kokulithinta, bese ushintsha i-interface ephumayo emugqeni we-MASQUERADE ngedivayisi oyibhalile, isibonelo -o wlan0 esikhundleni se- -o eth0. Shiya ububanzi bomthombo njengoba bunje, ngaphandle uma iqoqo lakho lamaklayenti lishintshile. Layisha kabusha futhi uqinisekise ukuthi umthetho manje usho idivayisi efanele:

sudo cp /etc/iptables/rules.v4 /root/rules.v4.bak
sudo iptables-restore < /etc/iptables/rules.v4
sudo iptables -t nat -L POSTROUTING -v -n

Izilungiselelo ezimbili eziseduze kulula ukuzikhohlwa. sysctl net.ipv4.ip_forward kufanele kubike u-1, futhi i-router ephezulu akumele ihlunge ngokwayo amakheli omthombo angasese.

Fakazela ukuthi umthetho uyasebenza, bese uhlukanisa okusalokhu kunensayo

Izibali ziwubufakazi obuthembekile kuphela bokuthi umthetho ufanile. Qhuba uhlu olunemininingwane, qala ukulanda kuklayenti bese uyiphinda. Amakholomu amaphakethe namabhayithi aseceleni komthetho wakho kufanele akhule, futhi umthetho ohlala kuziro awukafani namanje. Uma izibali zinyakaza kodwa amakhasi ehluleka, qhathanisa ububanzi bomthombo neqoqo langempela ngalokhu: grep -n "^server " /etc/openvpn/server.conf. Uma zinyakaza futhi amakhasi elayisha kodwa umfutho wokudlulisa umbi, ukuhumusha kuphelile futhi inkinga esele ikwenye indawo.

Qhathanisa ukudluliswa okubili kusuka kuklayenti elifanayo, okukodwa kuya kumkhandlu kusixhumo sasendaweni kanye nokunye ngethumela kuya kumkhandlu ofanayo. Ukunensa kukho kokubili kukhomba kusixhumo esiphezulu se-Pi noma kuxhumano lwe-Wi-Fi, hhayi ku-VPN. Ukunensa ngethumela kuphela kukhomba ku-MTU nasekudlulisweni kabusha, ongakuhlola ngalokhu: ip -s link show tun0 ngaphambi kokushintsha noma yisiphi isilungiselelo se-crypto.

Ukuze uhoxise ukuhlola, buyisela ikhophi bese uyilayisha kabusha, bese uqinisekisa ukuthi umthetho wokuqala nezibali zawo zibuyile. Bhala idivayisi ephumayo nomyalo wokulayisha kabusha kumanothi eseva, ngoba ushintsho olulandelayo lwesixhumo esiphezulu luzothola futhi ukungafani okufanayo. Umthetho osho idivayisi engalungile uhlala ungabonakali kuze kudingeke kuwo itrafikhi.