I-prefix yomphakathi nge-OpenVPN: lungisa indlela yokubuya

Buka ukuthi ithumbu liyenyuka futhi iklayenti lenza i-ping ohlangothini olunye, bese kuthi ikheli lomphakathi elingemuva kwe-VPN liphendula livela kwenye indawo, noma lingaphenduli nhlobo. Lesi sifo ngokuvamile asihlobene ne-cipher noma izitifiketi. I-prefix eruthiwe umhlinzeki ilethwa njengendlela ye-IP, futhi ukuyihambisa nge- OpenVPN kusho ukukhiqiza kabusha leyo ndlela emazingeni amabili nokugcina ikheli lomthombo endleleni yokubuya. Akudingeki ukuhlanganisa i-WAN ngebhuloho, futhi ukwengeza ikheli kuyi-interface akudali indlela ephezulu.

I-prefix kufanele iqale iruthwe kuwe

Buza umhlinzeki ukuthi ibhlokhi ilethwa kanjani. I-prefix eruthwe ekhelini eliyinhloko leseva yakho ihlukile kumakheli umhlinzeki alindele ukuwafinyelela ngqo kusegimenti ye-WAN. Kuphela imodeli yokuqala esebenza ngesakhiwo salapha.

Uma umhlinzeki erutha i-198.51.100.64/28 esevani yakho yokungena, amaphakethe alelo banga afika esevani futhi ayeke lapho ngaphandle uma uwadlulisela phambili. Uma umhlinzeki esikhundleni salokho ehlanganisa ibanga ngebhuloho ku-uplink yakho, iseva kufanele iphendule nge-ARP ngalo, okuyinkinga enye.

Hlola imodeli yokuletha ngaphambi kokuthinta i-OpenVPN: ngaphandle, pinga ikheli elikubhlokhi bese ubona ukuthi iyiphi i-interface eliyamukelayo. Uma kungafiki lutho, akukho ukucushwa kwethumbu okuzosiza. Uma ikheli liphendula ngqo ku-WAN, umhlinzeki uhlanganisa ngebhuloho esikhundleni sokurutha, futhi isakhiwo esingezansi asisebenzi.

Amazinga amabili okurutha: indlela ye-kernel ne-iroute

I-OpenVPN idinga i-prefix ezindaweni ezimbili. I-kernel kufanele yazi ukuthi i-prefix ingeyedivayisi yethumbu, ukuze amaphakethe adluliselwa phambili angene ku-OpenVPN esikhundleni sendlela ezenzakalelayo. I-OpenVPN futhi kufanele yazi ukuthi iyiphi iklayenti eqinisekisiwe ephethe i-prefix, futhi lokho kuyisifakelo se-iroute kusikhombisi esiqondile sekklayenti.

Indlela ohlangothini lweseva ibukeka kanje, futhi i-prefix ne-mask kufanele zihambisane nokwabiwa:

ip route add 198.51.100.64/28 dev tun0

Ukucushwa okuqondile kweklayenti kunikeza ubunikazi. Kuyifaka efayelini le-CCD eliqanjwe ngokwegama elijwayelekile lesitifiketi seklayenti, futhi qinisekisa ukuthi leso sikhombisi yiso leso iseva esifunda ngempela:

iroute 198.51.100.64 255.255.255.240

Imibhalo ye- OpenVPN mayelana namanethiwekhi aruthiwe ichaza amazinga womabili nokuthi kungani ehlukene. Indlela ye-kernel ngaphandle kwe-iroute ithumela amaphakethe ethumbini ngaphandle komnikazi, futhi i-OpenVPN iwalahla. I-iroute ngaphandle kwendlela ye-kernel ishiya amaphakethe endleleni ezenzakalelayo yeseva. Womabili amaphutha abukeka njengethumbu eliphukile kusukela ohlangothini lweklayenti.

Ikheli lomsebenzi lihlala kuphi

I-prefix edelegelwe ayifani namakheli ethumbu ngokwalo. Nombela isixhumanisi kusukela esikhaleni esiyimfihlo uma uthanda, futhi beka ikheli lomsebenzi lomphakathi lapho umsebenzi usebenza khona ngempela.

Kukkilayenti ye-Linux eqeda umsebenzi kwasendaweni, ikheli elilodwa le-host lanele:

ip address add 198.51.100.70/32 dev lo

Uma i-prefix iruthwa phambili iye kuseva ye-VM noma kwenye i-LAN, cusha leyo ndlela engezansi kanye nendlela yayo yokubuya esikhundleni salokho. Akudingeki ukwabela wonke amakheli ebhlokhi kukkilayenti ye-VPN, futhi lokho kudala izingxabano kamuva.

Gcina umthombo womphakathi endleleni yokubuya

Impendulo evela ku-prefix edelegelwe kufanele iphume ethumbini futhi ifinyelele indlela yomhlinzeki. Uma i-host ekude iyithumela nge-ISP yayo siqu, ikheli lomthombo libukeka lingelona iqiniso, futhi umhlinzeki noma indawo ekuyiwa kuyo iyalahla. Isixazululo yi- umthetho osuselwe emthonjeni noma ithebula lokurutha elikhethekile, hhayi i-NAT ebanzi. Ngaphandle kwalo, umsebenzi usebenza kusukela kumlingani wethumbu futhi wehluleka kuzo zonke ezinye izindawo.

Esevani yokungena, umthetho we-masquerade obanzi uyisigebengu esivamile. Ubhala kabusha umthombo womphakathi ukuya ekhelini eliyinhloko leseva, futhi ikklayenti aliwuboni neze lowo wangempela:

iptables -t nat -S POSTROUTING

Khulisa i-NAT kumaklayenti e-VPN ayimfihlo ayidingayo futhi ushiye i-prefix edelegelwe ingahunyushiwe. Bese uqinisekisa ukuthi iseva iyidlulisela phambili i-prefix nhlobo, ngoba uchungechunge lokudlulisela olunokwenqaba okuzenzakalelayo luyilahla buthule.

Qinisekisa izinhlangothi zombili ngaphambi kokuyethemba

Ukuqinisekisa yizimo zokubheka ezine, hhayi okukodwa. Qinisekisa ukuthi indlela yomhlinzeki iyafika, i-kernel ithumela i-prefix ethumbini, i-OpenVPN iyihlobanisa neklayenti elifanele, futhi impendulo ibuye nomthombo womphakathi ongashwabekile. Isimo ngasinye sinomyalo waso, ngakho ukuhluleka kukhomba isendlalelo hhayi isakhiwo sonke. Bazisebenzise ngalowo myalelo ngemva kwakho konke ukushintshwa kokucushwa.

Buza i-kernel ukuthi ikheli elidelegelwe lithatha iphi indlela, futhi ubuke ithumbu ngenkathi isicelo sisasebenza:

ip route get 198.51.100.70
sudo tcpdump -ni tun0 host 198.51.100.70

Ukuhlungwa kwendlela ephambene kungase kuqede indlela efanele. Hlola isilungiselelo esisebenzayo ethumbini nakwi-uplink, futhi khumbula ukuthi imodi eqinile inqaba ithrafikhi umthombo wayo ongahambisani ne-interface eyangena kuyo:

sysctl net.ipv4.conf.tun0.rp_filter net.ipv4.conf.eth0.rp_filter

Ekugcineni, hlola isimo sokuhluleka. Misa ithumbu futhi uqinisekise ukuthi i-prefix yomphakathi ayiconsi nge-uplink evamile. Ukubuyisela i-VPN kufanele kubuyise umsebenzi ngaphandle kokwandisa ukuthi iyiphi imigudu i-host eyivezayo.