Ukushicilela iseva yasekhaya nge-VPS lapho i-CGNAT ivimba amachweba

Ngiqale ngaphandle, njengoba umsebenzisi engenza: ngabhala igama kusiphequluli sefoni kudatha yeselula futhi ngabuka uxhumano lulenga kuze kuphele isikhathi. Igama lalixazululeka, ngakho i-DNS yayilungile. Ikhasi lokudlulisa amachweba erutha yasekhaya nalo laliyindawo evalekile, ngoba ikheli lalo le-WAN lalikhombisa u-100.64.31.42, futhi lokho akulona ikheli umhlinzeki angangithumela kulo livela ku-inthanethi. Leyo nombolo ichaza konke ukwehluleka: ulayini ungaphansi kwe-carrier-grade NAT, ngakho ikheli lomphakathi ohlangothini lwami lwethaneli lingelomhlinzeki. Okulandelayo yindlela engayihamba isuka kulelo thebhu elilengayo kuze kufike kusevisi ephendulayo.

Qala kuklayenti bese ungena ngaphakathi

Ngaphambi kokushintsha noma yimuphi umthetho, fakazela ukuthi uchungechunge luphela kuphi. Kulaptop ngagijimisa i-dig +short files.example.net futhi ngathola ikheli le-VPS, okwakususa i-DNS endala emshinini wami. Khona-ke i-curl -v --connect-timeout 5 files.example.net:5022 yaphelelwa isikhathi esikhundleni sokunqatshwa. Lo mehluko ubalulekile: ukuphela kwesikhathi ngokuvamile kusho ukuthi amaphakethe alahlwa endleleni, kanti ukunqatshwa kusho ukuthi okuthile kuphendule futhi kwathi cha.

Isinyathelo esilandelayo sokungena ngaphakathi kwakuyi-VPS uqobo. I-ss -ltnp ayikhombisanga lutho olalelayo ku-5022, njengoba kwakulindelekile ngaphambi kokuba umthetho we-DNAT ube khona. Emshinini ofanayo i-wg show (noma i-ip -br a show tun0 ye-OpenVPN) yaqinisekisa ukuthi i-peer yasekhaya iyasebenza futhi inokuxhawana okusha. Uma i-peer ingasebenzi, awukho umthetho we-NAT ozosiza, futhi ukukhanya okuluhlaza ekhasini le-VPN lerutha yasekhaya akusho lutho.

Qinisekisa ukuthi ulayini wasekhaya ngempela ungaphansi kwe-CGNAT

Qhathanisa ikheli erutha elilibika kusixhumi sayo se-WAN nalokho okubonwa yisevisi yangaphandle. Noma yini esebangeni u-100.64.0.0/10, okungukuthi kusukela ku-100.64.x.x kuya ku-100.127.x.x, iyibanga lamakheli abiwe livela ku-RFC 6598 futhi ayifinyeleleki isuka ku-inthanethi. Ufinyelela esiphethweni esifanayo lapho irutha ithi inekheli elijwayelekile langasese kanti ukusesha komphakathi kubuyisa okungahlobene. Ulayini we-CGNAT ungaba nekheli lomphakathi elihlala kuze kube yi-lease elandelayo kuphela, ngakho ukudluliswa kwechweba kubonakala kusebenza ihora bese kufa buthule.

Abanye abahlinzeki banikeza ikheli lomphakathi langempela kodwa bavimba amachweba angenayo u-80 no-443 kuma-akhawunti asekhaya. Uma isevisi yakho iyisizindalwazi kuphela futhi ikheli le-WAN lingelomphakathi ngempela, buza abasekeli ngaphambi kokwakha i-relay. Uma kungenjalo, umklamo ongezansi usebenza ngokulinganayo kuchweba ngalunye, futhi kufanelekile ukumisa ukuhlolwa ohlangothini lwerutha: umhumushi osesixukwini somhlinzeki uqeda uxhumano ngaphambi kokuba lufinyelele isixhumi sakho se-WAN.

Qondisa igama ekhelini le-VPS

I-DNS ayidlulisi ithrafikhi, ngakho irekhodi le-A lesevisi kufanele libe nekheli lomphakathi le-VPS. Irekhodi le-A eliya ku-192.168.1.20 lixazululeka ngokuwusizo kuphela kumaklayenti asevele engaphakathi kwe-VPN; kusuka ku-inthanethi lixazululeka libe yikheli okungekho muntu ongalihambisa. Ukufinyelela kokuphatha kwe-VPS uqobo ngigcina igama elihlukile, ukuze ngingalokothi ngixube ukuthi irekhodi likhomba kuphi umhambi.

Uma i-VPS kanye nomshini wasekhaya kokubili kuhlinzeka nge-HTTP, nikeza ngamunye igama lakhe bese uvumela i-VPS inqume ukuthi ubani uphendulayo. Ukubahlanganisa egunjini elilodwa nokuthemba ukuthi i-proxy izokhetha i-backend efanele yiyo kanye indlela okuchitha ngayo intambama yonke ulungisa umhambi ongafanele.

Ichweba elilodwa nge-DNAT, shiya i-SSH ku-22

Inketho eqondile i-NAT yendawo ekuyiwa kuyo ku-VPS. Nikeza amandla i-forwarding kukernel egijimayo futhi gcina ikheli lethanele leseva yasekhaya emthethweni, hhayi ikheli layo le-LAN:

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -p tcp -d 198.51.100.10 --dport 5022 -j DNAT --to-destination 10.8.0.2

Shiya i-SSH eya kuyi-VPS uqobo ku-22 bese udlulisela elinye ichweba, isibonelo u-5022, emshinini wasekhaya. Uma udlulisela u-22 emshinini ocishiwe, ulahlekelwa indlela eyodwa eyayingayilungisa. Ukuqonda okufanayo kusebenza ku-proxy: gcina ichweba lokuphatha le-VPS ngaphandle kwemithetho ye-relay.

Yenza imithetho ihlale njalo uma isisebenza. Ku-Debian noma i-Ubuntu, i-apt install iptables-persistent bese kuthi i-netfilter-persistent save ziyibhala ku-/etc/iptables/rules.v4. Kumhambi one-firewalld okulinganayo ukudluliswa kwechweba okuhlala njalo endaweni, okudinga i-firewall-cmd --reload ngaphambi kokusebenza. Imithetho ehlala emkhunjini kuphela iyanyamalala ekuqaliseni kabusha kokuqala kokunakekelwa komhlinzeki, ngokuvamile ngesikhathi esibi.

Lungisa indlela yokubuya, noma ugweme isidingo sayo

I-DNAT ibhala kabusha indawo ekuyiwa kuyo kuphela. Iseva yasekhaya ibona uxhumano olusuka ekhelini lokuqala lekliyenti, futhi uma indlela yayo ezenzakalelayo ikhomba erutha yasekhaya, impendulo iphuma nge-WAN yasekhaya lapho umhumushi womhlinzeki eyilahla khona. Lokho kungalingani kwakuwukwehluleka kwesibili engakuthola, ngemva kokuba umthetho we-DNAT wabonakala ulungile ngokuphelele.

Izilungiso ezimbili ziyasebenza. Nikeza umshini wasekhaya indlela yenqubomgomo ukuze ithrafikhi evela ethaneleni ibuye ngethaneli:

ip rule add from 10.8.0.2 table 100
ip route add default dev wg0 table 100

Noma vumela i-VPS ibhale kabusha umthombo ukuze impendulo ibe nekheli engalifinyelela, futhi uvumele i-conntrack iyiphendule ngakolunye uhlangothi uma iphuma:

iptables -t nat -A POSTROUTING -d 10.8.0.2 -p tcp --dport 5022 -j SNAT --to-source 10.8.0.1

Inguqulo ye-SNAT ifihla ikheli langempela lekliyenti kuseva yasekhaya, ngakho amalogi ohlelo abonisa u-10.8.0.1 njenge-peer. Dlulisela ikheli lokuqala esigabeni sohlelo, noma wamukele ukulahleka kokuloga kuklayenti ngayinye, kodwa ncama ngamabomu esikhundleni sokukuthola ngesikhathi sehlakalo.

Hlola yonke indlela ngaphandle

Qinisekisa kusuka kunethiwekhi engeyona i-VPS futhi engeyona ikhaya: ifoni kudatha yeselula, noma i-shell eshibhile kwenye indawo. I-nc -vz files.example.net 5022 kufanele ibike uxhumano oluyimpumelelo, futhi i-openssl s_client -connect files.example.net:443 -servername files.example.net kufanele ikhombise isitifiketi segama lomphakathi. Bese uhlola iqembu lokuphepha noma i-firewall yamafu yomhlinzeki. Umthetho we-DNAT ongalokothi ubone iphakethe ngokuvamile uvimbwa isigaba esisodwa ngaphezu komhambi.

Ekugcineni, ncama ukuthi kwenzekani uma ithaneli liwa. Umthetho we-DNAT uqhubeka wamukela ukuxhumana futhi uyihambisa buthule ethaneleni elifile, okubonakala kufana ncamashi nesevisi eyephukile. Ukuhlolwa kwempilo ku-VPS okwenqaba ichweba ngesikhathi i-peer ingasebenzi kubiza imigqa embalwa futhi kusindisa ihora lokulinganisa. Ngemva kwalokho yeka ukuhlela imithetho futhi uyibuke usuku ngaphambi kokuyethemba.