Ukudlulisela iphothi ku-WireGuard peer engemuva kwe-NAT: DNAT kanye ne-SNAT

Isiphequluli sicela i-https://203.0.113.10:8443, i-proxy iyamukela ukuxhumana, futhi insiza ku-WireGuard peer ayiphenduli neze. Umthetho we-DNAT wenza umsebenzi wawo; ingxenye ehlulekayo yimpendulo. Landela iphakethe kuzo zombili izinguqulo futhi umthetho ongekho uyacaca. Ukulungisa ukusitatimende se-NAT esisodwa esengeziwe ku-hook efanele, hhayi umhubhe omusha.

Landela isicelo esisodwa kusukela ekuqaleni kuze kube sekupheleni

Isicelo sifika ku-interface yomphakathi ye-proxy, umthombo uyikheli lomphakathi lekhasimende kanti umgomo uyikheli le-proxy. Ku-nat PREROUTING umthetho we-DNAT ubhala kabusha umgomo ukuya ekhelini lomhubhe we-peer, 10.90.0.2. Bese isinqumo sokuhamba sithumela iphakethe ngaphandle nge-wg0, futhi indlela yokudlulisa iyaphela.

Ku-peer iphakethe manje lithwele ikheli lomthombo lomphakathi lokuqala, ngoba akukho okulibhalile kabusha. Insiza iyamukela ukuxhumana futhi ithumela impendulo yayo ku-gateway yayo yokuzenzakalela, okuyi-router yasekhaya engaphambi kwe-peer. Leyo router ayinaso isimo somfudumalo engakaze iwubone, ngakho iyalahla iphakethe noma iylihumusha ekhelini layo lomphakathi, okungeke kukwamukele ikhasimende.

Ukungalingani yiyo yonke inkinga: isicelo sidlula ku-proxy, kanti impendulo izama ukuya ngqo. Ukulandelela ukuxhumana kwe-proxy kusiza kuphela uma impendulo ibuya nge-proxy, futhi ayikwazi ukubuya lapho uma ikheli lomthombo lisabhekisa kukhasimende lokuqala.

Engeza inguqulo yokubuya

Bhala kabusha umthombo womfudumalo odluliswayo ekhelini lomhubhe we-proxy ngaphambi kokuba uhambe ukuya ku-peer. Bese insiza iphendula ku-10.90.0.1, i-proxy iyakwamukela, futhi ukulandelela ukuxhumana kuphendula zombili izinguqulo ngaphambi kokuba iphakethe libuyele kukhasimende.

iptables -t nat -A PREROUTING -p tcp -m multiport --dports 8080,8443 -j DNAT --to-destination 10.90.0.2
iptables -t nat -A POSTROUTING -d 10.90.0.2 -o wg0 -p tcp -m multiport --dports 8080,8443 -j SNAT --to-source 10.90.0.1

Umthetho we-POSTROUTING uwufushane ngamabomu: uhambisana nomgomo ohumushiwe kanye ne-interface yomhubhe, ngakho awubhali kabusha ithrafikhi engahlobene eyenzeka ngengozi iphume nge-wg0. Umthetho we-masquerade obanzi nawo uzofihla ikheli lekhasimende, kodwa uzokwenza lokho kumfudumalo ngamunye futhi kwenze ithebula le-NAT libe nzima ukulihlola.

Beka imithetho lapho umhubhe ukhona

Imithetho ebhekisa ekhelini lomhubhe noma ku-interface kufanele igijime ngemuva kokuthi i-wg-quick iwulungisile. I-interface idalwa ngaphambi kwe-PreUp, kodwa amakheli, i-MTU, i-DNS nemizila kusetshenziswa ngemuva kwalokho, futhi i-PostUp igijima lapho konke lokho sekukhona. Beka izengezo ku-PostUp kanye nokususa ku-PreDown.

PostUp = iptables -t nat -A PREROUTING -p tcp -m multiport --dports 8080,8443 -j DNAT --to-destination 10.90.0.2
PostUp = iptables -t nat -A POSTROUTING -d 10.90.0.2 -o wg0 -p tcp -m multiport --dports 8080,8443 -j SNAT --to-source 10.90.0.1
PreDown = iptables -t nat -D PREROUTING -p tcp -m multiport --dports 8080,8443 -j DNAT --to-destination 10.90.0.2
PreDown = iptables -t nat -D POSTROUTING -d 10.90.0.2 -o wg0 -p tcp -m multiport --dports 8080,8443 -j SNAT --to-source 10.90.0.1

Ukususa kufanele kuhambisane nezengezo nge-token ngayinye, kuhlanganise nokufana kwe-multiport ne-interface. Ukususa okuhluka ekufaneni okukodwa akususi lutho, futhi ukuxhumana okulandelayo kwengeza ikhophi yesibili yomthetho. Ngemuva kokuxhumana okumbalwa ithebula liqukethe izimpinda okunzima ukuzihlobanisa nomugqa wokulungisa.

Hlola umphumela usebenzisa iptables -t nat -S ngemuva kokuxhumana kabusha. Uma umthetho ofanayo uvela kabili, umugqa we-PreDown awuhambisani futhi ukuhlanza kwehluleka ngokuthula.

Ukudlulisa, ukuhlunga kanye ne-NAT enye

Nika amandla ukudluliswa kwe-IPv4 unomphela, bese uvumela umfudumalo odluliswayo kuthebula lokuhlunga. I-DNAT yenzeka ngaphambi kochunge lwe-FORWARD, ngakho umthetho wokuhlunga uhambisana nomgomo ohumushiwe hhayi ikheli lomphakathi. Uma i-UFW ilawula i-firewall, veza imvume njengomthetho womzila; umthetho we-host ojwayelekile awuhlanganisi ithrafikhi edluliswayo.

Ezinye izingqimba ezimbili ze-NAT zisengaphula indlela ngisho lapho imithetho ye-proxy ilungile. Kuxhumano lwasekhaya ikheli lomphakathi ngelase-router, futhi ukuvula iphothi ku-firewall yayo akufani nokwakha umbhalo wokudlulisela iphothi othumela lelo phothi ku-proxy. Iphothi elibonakala livulekile ngaphandle kuyilapho kungekho okuphendulayo ngokuvamile alinakho lokho kubonisa.

Ku-NAT VPS umhlinzeki uxhumanisa iphothi lomphakathi nekheli eliyimfihlo. Ukuxhumanisa kufanele kuhambisane nephothi oyimemezelayo, futhi ukungahambisani kubonakala kufana nomhubhe ophukile. Qinisekisa ukuxhumanisa komhlinzeki ngaphambi kokushintsha ukulungiswa kwe-WireGuard.

Qinisekisa indlela yokubuya futhi wamukele izindleko

Xhumana kunethiwekhi engeyona i-LAN ye-proxy, bese uhlola izinguqulo zombili ngesikhathi ukuxhumana kuvulekile:

conntrack -L -p tcp --dport 8080
tcpdump -ni any tcp port 8080

Umbhalo we-conntrack kufanele ubonise i-tuple yokuqala, i-tuple ehumushiwe kanye nendlela yempendulo. Uma impendulo ingekho, i-peer ayithumeli ngomhubhe, okusho ngokuvamile ukuthi umthetho we-SNAT awuzange usetshenziswe noma i-firewall ye-peer ngokwayo yalahla umfudumalo.

Qala kabusha kanye ukuze ubonise ukuthi i-PostUp isebenzisa imithetho futhi, bese umisa umhubhe futhi uqinisekise ukuthi i-PreDown iyisusile. Imithetho efile esala ngemuva kokunqamuka iyisizathu sokuthi ushintsho lwakamuva luziphathe ngendlela engalindelekile.

Ekugcineni, yamukela ukuthi i-SNAT ibiza malini. Insiza ibona zonke izicelo njengezivela ku-proxy, ngakho amalogi okufinyelela, imikhawulo yesivinini ngekhasimende kanye nohlu lwamakheli avunyelwe akusabahlukanisi abasebenzisi. Icala le-hairpin lidinga inguqulo yalo yomthombo yamakhashemende aku-LAN ye-proxy. Uma i-peer idinga amakheli eqiniso ekhasimende, enye indlela umzila wokubuya oya kunethiwekhi yekhasimende, okungumsebenzi omningi kodwa kugcina ulwazi.