Shicilela imbobo yeklayenti le-VPN ngemuva kwe-CGNAT: uhlu lokuhlola

Beka isevisi kukhompyutha ephathwayo engemuva kwe-NAT yezinga lomhlinzeki, qondisa leyo khompyutha ku-VPS nge-VPN, futhi akekho ngaphandle ongayifinyelela. Wengeza umthetho we-NAT wendawo ku-VPS futhi uthola into embi kakhulu kunokuthula: ukuxhumana kuyavuleka, bese kuma. Impendulo ayilahlekile, iphuma ngomzila ozenzakalelayo weklayenti uqobo, okusho ukuthi iseva ayiyiboni neze. Yenza lezi zivivinyo ezinhlanu ngokulandelana futhi ume kwesokuqala esingaqhubeki.

Qinisekisa ukuthi iseva izodlulisa noma ngabe yini

Phawula leli bhokisi ngaphambi kokubhala ngisho ukuhumusha okukodwa. Umthetho we-DNAT wephakethe i-kernel enqaba ukulidlulisa wamukelwa umhlaziyi wemithetho bese ulahliwe indlela yokudlulisa, okukhiqiza isikhathi sokulinda esibonakala njengenkinga yefirewall.

sysctl net.ipv4.ip_forward
sysctl -w net.ipv4.ip_forward=1

Ukuyibeka ku-kernel esebenzayo akufani nokuyibeka ngaphesheya kokuqalisa kabusha. Bhala net.ipv4.ip_forward=1 efayeleni elingaphansi kwe-/etc/sysctl.d/, sebenzisa sysctl --system, bese ufunda ibalazwe futhi esikhundleni sokwethemba ukuthi ifayela lathathwa. Ikhonteyina ephethe indawo yayo yamagama enethiwekhi idinga inani elifanayo ngaphakathi kwaleyo ndawo, hhayi kuphela kumphathi.

Uma ukufunda kabusha kuseyiqhuzu, ma lapha. Akukho okungezansi okuzosebenza.

Gxilisa ikheli lethinelu ngaphambi kokuba noma yimuphi umthetho ubhekise kulo

Ichibi linikeza amakheli ngokulandelana kokuxhumana, ngakho umthetho obhalelwe isivumelwano sanamuhla ungakhomba ngokuthula kwelinye iklayenti ngesonto elizayo. Hlanganisa ikheli nobunikazi besitifiketi hhayi nokulandelana kokufika.

client-config-dir /etc/openvpn/ccd
ifconfig-push 10.77.0.14 10.77.0.13

Leyo mbhangqwana iwukuphela kweklayenti nokuphela komlingani wethinelu lephuzu-kuya-phuzu, futhi iseva iboshelwe egameni elivamile lesitifiketi. Ku-topology yesubneti inani lesibili lifundwa njengemaski yenethiwekhi esikhundleni salokho, ngakho bhala isimo esihambisana ne-topology esetshenziswayo. Bese uxhuma kabusha iklayenti futhi ufunde ikheli kuklayenti uqobo, ngoba umbono wesiva mayelana nechibi awuwona ubufakazi balokho okulungiselelwe yiklayenti.

Uma ikheli lishintsha ngemva kokuxhuma kabusha, ma. Umthetho we-NAT olandela umgomo onyakazayo uzohluleka ngezikhathi ezithile futhi awukufundisi lutho.

Humusha nhlangothi zombili

Ukuhumusha kwendawo kuthumela iphakethe elingenayo kuklayenti. Ukuhumusha komthombo yikho okwenza iklayenti liphendule iseva hhayi umthumeli wokuqala, futhi uwona umthetho abantu abawushiyayo.

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 29443 -j DNAT --to-destination 10.77.0.14:29443
iptables -t nat -A POSTROUTING -d 10.77.0.14 -p tcp --dport 29443 -j SNAT --to-source 10.77.0.13

Ngaphandle komthetho wesibili iklayenti liphendula ngomzila walo waphezulu we-ISP, ngakho umlingani okude ubona ikheli lomthombo angakaze akhulume nalo, kuyilapho iseva ingenaso isiqophi sokulandelela sempendulo. Umbukeli wangaphandle ubona ukuxhawula okuphela ngesigamu, futhi yiwona uphawu oluthumela abantu ukuba bayofuna iphutha lefirewall elingekho.

Funda kabusha imithetho yomibili nge-iptables -t nat -S futhi uqinisekise ukuthi igama lesixhumanisi yilona elithwala ikheli lomphakathi. Kusiseva esivele sihlunga nge-nftables, bhala ukuhumusha kuchungechunge lwe-NAT le-nftables lomndeni wekheli ofanayo esikhundleni sokuhlanganisa amathuluzi.

Vumela ithebula lokuhlunga ukuba lidlule

Amathebula e-NAT abhala kabusha izihloko; awanikezi imvume. Ngomgomo we-DROP ozenzakalelayo ukugeleza okudluliswayo kudinga ukwamukelwa kwako siqu, kanye nendlela yokubuya evame ukumbozwa imithetho eminingi ngomthetho we-established,related.

iptables -A FORWARD -i eth0 -o tun0 -p tcp --dport 29443 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Hlola umgomo wochungechunge lwe-FORWARD ngaphambi kokwengeza noma yini, ngoba ukulandelana kwe-DROP yasekuqaleni kunquma ukuthi umthetho wakho uzoke ubanjwe yini. Kusiseva okuhlunga kwakho kuhlala ku-nftables, engeza umthetho olinganayo kuhuku lwe-forward lwethebula le-inet futhi uqinisekise ukuthi uchungechunge oluyisisekelo lubona ngempela ithrafikhi edluliswayo hhayi kuphela okokufaka kwendawo. Uma isibali samaphakethe kumthetho omusha sihlala sikuqhuzu ngenkathi izibali ze-NAT zikhuphuka, iphakethe liyalahlwa ngaphambi komthetho wakho. Lokho kuwuphawu lokufunda ukulandelana kochungechunge, hhayi ukwengeza ikhophi yesibili yomthetho ofanayo.

Kufakazele kusuka kunethiwekhi yangaphandle

Hlola kusuka kunethiwekhi engahlobene. Uphenyo olusuka komunye umshini okuleso LAN lungeqa kusixhaso se-hairpin NAT futhi lungakaze lusebenzise umzila osetshenziswa yiklayenti elikude, ngakho umphumela oluhlaza lapho ufakazela into engalungile.

tcpdump -ni any port 29443
conntrack -L | grep 29443

Gijimisa ukubamba kusiseva nakuklayenti ngesikhathi esisodwa. Ukubamba kusiseva kukhombisa ukuthi iphakethe elihunyushwe liyaphuma yini liya ethinelwini; ukubamba kuklayenti kukhombisa ukuthi isicelo siyafika yini nokuthi impendulo iqondiswe kuphi. Umugqa wokuhumusha ku-conntrack -L ufakazela ukuthi umthetho uhambelana, futhi ukungabikho kwawo kufakazela ukuthi iphakethe alikaze lifinyelele uchungechunge lwe-NAT.

Izihloli zembobo ziwubufakazi obubuthakathaka. Zibika imbobo njengevaliwe kuze kube yilapho uhlelo luxhunyiwe futhi lulalela, ngakho sebenzisa ukuxhumana kwangempela kunomsebenzi wangempela. Lapho kwephuma ngempumelelo ekugcineni, gcina ukuchayeka kuleyo mbobo eyodwa: ukudlulisa i-SSH noma iphaneli yokuphatha ngenxa yokuthi umthetho wokuqala wabonakala ungakhululekile kuyisinqumo esikhulu kakhulu kunokushicilela isevisi.