Kungani insiza yakho yomphakathi ye-Linux iphendula nge-VPN

Akukho lutho ku-socket olukhumbulayo ukuthi iyiphi i-interface ethwele isicelo, ngakho indlela ezenzakalelayo ye-VPN yomhubhe ogcwele ingabamba impendulo eyeya ku-WAN. Insiza ayiyinaki i-interface engenayo; i-Linux ihambisa impendulo eyakhiwe endaweni ngokwendawo ekuyiwa kuyo kanye nenqubomgomo yomthombo. Umthetho osuselwe emthonbeni ungathumela kuphela izimpendulo zensiza ngethebula le-WAN eligcwele, ushiya ukuphuma okuvamile kumhubhe. Umhubhe uhlala uvuliwe ngesikhathi impendulo iphuma ngendlela engalungile, yingakho uphawu lubonakala lulodwa.

Umbono ongalungile: izimpendulo zilandela i-interface ezingene ngayo

Kubonakala kunengqondo ukuthi iphakethe elingena ku-eth0 liphume ngo-eth0. Izihlungi zamaphakethe angenasimo zingabhalwa kanjalo, futhi i-tcpdump ohlangothini lokungena ibonisa isicelo kanye lapho kulindeleke khona. Ukuhamba kwendlela akusebenzi kanjalo kuthrafikhi edalwa i-host ngokwayo.

Lapho insiza yamukela uxhumano, impendulo yayo yiphakethe elisha elakhiwe endaweni. I-kernel ibheka imithetho yokuhamba kwendlela yendawo ekuyiwa kuyo kanye nomthombo wempendulo, futhi indlela ezenzakalelayo ye-VPN iyimpendulo evumelekile ngokuphelele. Akukho lutho ku-socket olukhumbulayo ukuthi iyiphi i-interface ethwele isicelo.

Yingakho uphawu lubonakala lulodwa: izicelo ziyafika, izimpendulo ziyanyamalala. Yingakho futhi ukwengeza umthetho we-firewall wembobo yokungena kungashintshi lutho. Iphakethe alivinjiwe endleleni yokungena; lihambiswa kwenye indawo endleleni yokuphuma. Landelela impendulo ngosesho olucaciswe ngomthombo futhi indlela eyindilinga izobonakala.

Lokho i-kernel ekuhambisayo ngempela: ikheli lomthombo

Isibambo osidingayo yikheli lasendaweni elisetshenziswa yinsiza ezimpendulweni. Ku-host enekheli le-eth0 eliyisibonelo elingu-192.0.2.10/24 kanye nesango elingu-192.0.2.1, lelo kheli likhona ku-interface. Ku-VM yasefu yamafu, ikheli lomphakathi lingase lihunyushwe phezulu futhi lingabikho esivakashini, ngakho sebenzisa ikheli i-host enalo ngempela.

Hlola isimo samanje ngaphambi kokubeka eceleni inombolo yethebula noma ukubaluleka komthetho. Imithetho yenqubomgomo ekhona ingase isithe isikhwama esisha, futhi ithebula elidala elinenombolo efanayo lingase libe semigwaqweni engahlobene:

ip -4 addr show dev eth0
ip -4 rule show
ip -4 route show table all

Bese ukhetha ithebula ngokomthombo. Umthetho uhambisana nezimpendulo ezivele zithwele u-192.0.2.10, okuyiwona kanye umgwaqo ophela endaweni ofuna ukumkhipha. Umgwaqo odluliswayo namaphakethe avela kwamanye amakheli asendaweni awuhambisani.

Yakha ithebula eliphelele lokubuya, hhayi uhhafu wendlela ezenzakalelayo

Ithebula elinendlela ezenzakalelayo kuphela alanele. I-kernel kusamele ixazulule isango, futhi lokho kuxazulula kudinga isiqalo esixhunyiwe etafuleni elilodwa. Ithebula elingenawo leso siqalo lehluleka ekuxazululeni isango ngisho noma indlela yalo ezenzakalelayo ibonakala ilungile. Faka kokubili, bese uqondisa umthetho womthombo etafuleni:

ip -4 route add table 100 192.0.2.0/24 dev eth0 src 192.0.2.10
ip -4 route add table 100 default via 192.0.2.1 dev eth0
ip -4 rule add priority 1000 from 192.0.2.10/32 lookup 100

Sebenzisa isiqalo nesango langempela esikhundleni sokukopisha isibonelo. I-interface yasefu yamafu elungiselelwe njenge-/32 enesango le-on-link idinga enye indlela exhunyiwe, futhi ithebula elakhiwe ngesiqalo esingalungile lehluleka ekweqeni kokuqala. Isici se-src sisho umthombo okhethwayo waleyo ndlela; asithathi indawo yomthetho womthombo.

Ukulandelana nakho kubalulekile. Umthetho obanzi onenombolo yokubaluleka ephansi uhlolwa kuqala, ngakho umthetho womthombo kufanele ufinyelelwe ngaphambi kwanoma yimuphi umthetho ongabuyisela lokhu kuhamba etafuleni eliyinhloko. Hlola ukubaluleka nge-ip rule show ngemva kokuwengeza, hhayi ngesikhathi sokuqalisa kuphela.

Qinisekisa ngosesho olucaciswe ngomthombo

Cela i-kernel ukuthi ihambise indawo yokuhlola isuka ekhelini lensiza. Impendulo kufanele ibale i-eth0 nesango le-WAN, hhayi umhubhe:

ip -4 route get 198.51.100.25 from 192.0.2.10

Bese wenza uxhumano olusha olugunyaziwe futhi ubheke izinhlangothi zombili. Usesho olukhetha ithebula elifanele ngesikhathi uxhumano lwangempela lusahluleka lukhomba ekuhlungweni kwendlela ebuyayo noma emthethweni we-firewall, hhayi etafuleni. Hlola lezo zilawuli ngaphambi kokukhubaza noma yini emhlabeni wonke.

Beka imigwaqo yokugcina kanye nomthetho ngaphansi komphathi wenethiwekhi ongumnikazi we-interface. Izinguquko zekheli, ukuvuselelwa kwe-DHCP kanye nokuxhuma kabusha kwe-VPN konke kubhala kabusha isimo se-kernel, futhi umthetho owengezwe ngesandla uyanyamalala noma ukhomba esangweni elidala ngemva komcimbi olandelayo.

Lapho lesi sikhathi siphela khona

Umthetho ukhulula umgwaqo ophela endaweni ovela ekhelini elilodwa lomthombo. Awukhombi amachweba ashicilelwe yi-Docker, i-DNAT noma izinsiza ezidluliswa nge-host, ngoba lawo maphakethe ahambiswa njengomgwaqo odluliswayo futhi awakaze athwale umthombo wasendaweni we-host ngendlela efanayo. Imiklamo enjalo ngokuvamile idinga uphawu olubekwe ekungeneni kanye nomthetho ohambisana nophawu.

Futhi akwenzi ikheli lomphakathi le-host livele ku-interface. Lapho i-NAT ephezulu ingumnikazi walelo kheli, impendulo kusamele iphume ngendlela i-NAT elindele ngayo, yingakho ithebula le-WAN kufanele likhombise isango nesiqalo sokuqala hhayi ububanzi bomphakathi obuqashiwe.

Gcina lesi sikhathi sibhaliwe ngonombolo wethebula, ukubaluleka komthetho kanye nekheli lomthombo eliqondile. Ushintsho olulandelayo ku-VPN noma ku-interface lungase luphele ngokuthula, futhi inothi elisho amanani amathathu lihlolwa ngokushesha kunokuthola kabusha uphawu embikweni weklayenti.

Uma insiza isaphendula ngendlela engalungile ngemva kokuphumelela kosesho olucaciswe ngomthombo, qhathanisa ikheli lomthombo le-socket ephilayo nalelo elisemthethweni. Insiza eboshelwe ekhelini le-wildcard ingase ikhethe umthombo ohlukile kunekheli olulihlolile, futhi lokho kungafani yigebe elisele.