Shicilela isevisi ye-LAN ekhelini le-VPN gateway ngokwayo

Ukubonisa idivayisi ye-LAN kwelinye lamakheli ethaneli e-VPN gateway ngokwayo kudinga umugqa owodwa we-NAT. Ukuxhumana kusahluleka, ngoba idivayisi ephendulayo ayazi ukuthi ikheli leklayenti liyafinyeleleka ngale gateway. Landela iphakethe lisuka kuklayenti liya ngaphakathi, bese ulandela impendulo ibuyela ngaphandle, futhi ingxenye engekho izobonakala.

Qala ngombono weklayenti

Iklayenti kulesi sibonelo likuchashazi se-VPN 10.62.0.0/24 futhi lixhuma ku-10.62.0.1 kuphothi 8080. Lelo kheli lingele-gateway uqobo, ngakho iphakethe lifika enkambini ye-gateway hhayi kwelinye iqembu. Ngemuva kwe-gateway, i-LAN yi-172.21.4.0/24. I-gateway inokuthi 172.21.4.10, futhi idivayisi esebenza ngempela i-HTTP yi-172.21.4.40.

Ikheli elingelelinye iqembu le-VPN alikwazi ukushintshwa nekheli lesevisi ye-gateway. Uma iklayenti lixhuma ekhelini leqembu, awukho umthetho we-gateway ohilelekile nhlobo, futhi lolu hambo lonke luyicala elingalungile.

Khawulela ububanzi bokuhumusha kwendawo okuyiwa kuyo ngamabomu

Inguqulo encane ibonisa iphothi elilodwa futhi ibhala kabusha indawo okuyiwa kuyo kuphela. Iphakethe ligcina iphrothokholi yalo nomthombo walo, futhi yikho okwenza uhambo olusele lube mnandi.

iptables -t nat -A PREROUTING -i tun0 -s 10.62.0.0/24 -d 10.62.0.1 -p tcp --dport 8080 -j DNAT --to-destination 172.21.4.40:80

Umthetho ongenazo izindlela zokukhetha zephrothokholi nephothi inguqulo ebanzi: ugcina noma yiliphi iphothi elikhethwe yiklayenti futhi ushintsha ikheli kuphela. Lokho kuvumelekile uma kuhloswe ukubonisa isiphathi sonke, futhi akulungile uma kwakuhloswe isevisi eyodwa. Funda umthetho kabusha futhi uqinisekise igama lesikhombisi. Umthetho we-DNAT kusikhombisi esingalungile awuhambisani nalutho, okukhiqiza isikhathi sokuphela esifanayo nomthetho ongekho futhi kuchithe ihora ngokubheka idivayisi.

Vumela umngcele wokudlulisa uvumelane

Ukuhumusha kushintsha inhloko, akunikezi imvume. Ngomgomo wokulahla ozenzakalelayo, ukugeleza okudlulisiwe kudinga imvume yako, futhi indlela yokubuya idinga umthetho wokuxhumana osunguliwe i-gateway yakho okungenzeka isinawo kakade.

iptables -A FORWARD -i tun0 -o lan0 -d 172.21.4.40 -p tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Ukwamukela ngaphandle kwemibandela kukho konke ukugeleza kwe-DNAT kubanzi kunalesi sakhiwo futhi kuzovumela namamephu angezwa kamuva ngomunye umuntu. Shono indawo okuyiwa kuyo nephothi, futhi ushiye okunye kuvaliwe. Uma izibali kumthetho wokudlulisa zihlala zinguziro ngenkathi izibali ze-NAT zikhuphuka, iphakethe liyalahlwa ngaphambi komthetho wakho. Funda ukulandelana kwamaketanga esikhundleni sokwengeza ikhophi yesibili.

Idivayisi kufanele iphendule ngandlela thile

Ngemuva kokuhumusha idivayisi ibona umthombo ngaphakathi kwe-10.62.0.0/24. Impendulo yayo iya ku-gateway yayo ozenzakalelayo, okuyi-router ye-LAN, hhayi i-gateway ye-VPN, ngaphandle uma okuthile kuyitshela okunye. Izinhlelo ezimbili zilungisa lokho futhi azilingani. Umzila kudivayisi noma ku-router ye-LAN uthumela i-10.62.0.0/24 ku-172.21.4.10 ngenkathi ugcina umthombo weklayenti. Ukuhumusha komthombo okulinganiselwe kucasha iklayenti ngemuva kwekheli le-LAN le-gateway.

ip route add 10.62.0.0/24 via 172.21.4.10 dev eth1
iptables -t nat -A POSTROUTING -s 10.62.0.0/24 -d 172.21.4.40 -o lan0 -p tcp --dport 80 -j SNAT --to-source 172.21.4.10

Khetha ngokusho kwalokho okudingwa yisevisi. Umngomo weklayenti ngalinye namarekhodi anencazelo afuna indlela yomzila; idivayisi engeke inikezwe umzila, noma isevisi okumele ibone ikheli le-LAN, ikhomba endleleni ehumushiwe. Ungafinyeleli kumthetho we-masquerade womhlaba wonke ukuze impendulo eyodwa isebenze. Kucasha iklayenti ngalinye kuyo yonke indawo okuyiwa kuyo futhi kwephula buthule imingomo encike emakhelini omthombo.

Ungahloli kusuka ku-gateway uqobo

Isicelo esenziwe ku-gateway siya ku-10.62.0.1 siphuma ngokwetanga i-OUTPUT, hhayi nge-PREROUTING engenayo. Ukuhluleka noma ukuphumelela kwaso akusho lutho ngomthetho obheke kuklayenti, futhi yileyo ndlela abantu abaphetha ngayo ukuthi umthetho osebenzayo uphukile.

conntrack -L | grep 172.21.4.40
tcpdump -ni any 'port 8080 or port 80'

Gijimisa isicelo sangempela seklayenti futhi ufunde kokubili. Umgenyo we-conntrack ubonisa ukuhumusha okusetshenzisiwe, futhi izithwebuli zibonisa ukuthi isicelo sawela saya kwi-LAN nokuthi impendulo yabuya yaya ngasethaneleni. Sebenzisa uxhumano olusha ngemuva kokushintsha imithetho, ngoba isimo esikhona sigcina imephu yaso yangaphambilini futhi sizoqhubeka nokuhluleka ngendlela yakudala. Bese uqinisekisa ingxoxo yonke: ikheli ledivayisi, imvume yokudlulisa nomzila wempendulo konke kuchaza ukugeleza okufanayo.