Isango le-VPN ku-Raspberry Pi: ikhadi elilodwa lenethiwekhi noma imbobo eyodwa yeklayenti
Imbobo eyodwa ye-Pi ingasebenza amaklayenti akhethiwe, noma imbobo yesibili ingavala amadivayisi ngaphakathi. Khetha isakhiwo ngezinga lokuhlukanisa, inqubomgomo yokuwa emuva nokuthi i-DNS ingeyakabani.
Unakho i-Pi eyodwa, iphrofayili ye-VPN ephumayo esebenzayo, namadivayisi amabili okufanele afinyelele i-inthanethi ngayo. Umbuzo onquma ukwakhiwa konke awuwona wokuthi yiluphi uhlu lokuhola okufanele lulandelwe, kodwa ukuthi kudingeka ukuhlukanisa okungakanani. Imbobo eyodwa ivumela i-Pi ukuthi ime eceleni kwalawo madivayisi ku-LAN yomgwaqo futhi isebenze njengesango elengeziwe; imbobo yesibili ikuvumela ukuthi uwabeke engxenyeni lapho i-Pi iwukuphela kwendlela yokuphuma. Konke ngemva kwalokho kukhetha — i-DHCP, ubukhulu besicishamlilo, i-DNS, isimo sokuphazamiseka — kuvela kulokho.
Izakhiwo ezimbili zihluke ngempela kuphi
Zombili izakhiwo zihambisa ngemigwaqo. Umehluko ukuthi ubani omunye emile entanjeni nokuthi kwenzekani lapho inqubomgomo yakho ingalungile.
| Layout A: Pi on the ISP LAN | Layout B: dedicated client port | |
|---|---|---|
| Cabling | One Ethernet port, existing switch port | Two interfaces: uplink plus a separate LAN port |
| Can a client bypass the Pi? | Yes, by using the ISP router as its gateway | No, unless the device has another radio or link |
| Who hands out addresses | The ISP router, with a per-client setting or a DHCP option | The Pi, on its own LAN interface only |
| Blast radius of a mistake | Any LAN host, if a rule is too broad | The attached segment |
| Good fit for | One laptop, a console, a temporary test client | Appliances, always-on boxes, untrusted devices |
Umhobholo wangempela ukuhlukanisa. Isakhiwo A sinikeza iseluleko: idivayisi elinganaki isango elinikezwe yi-DHCP bese likhetha umgwaqo lisasebenza, kodwa ngaphandle kokubethela. Isakhiwo B liphoqelelwa yisakhiwo senethiwekhi, ngoba akukho esinye isinyathelo esilandelayo ongasikhetha.
Isakhiwo A: i-Pi njengesango elengeziwe ku-LAN ekhona
Ake sithi umgwaqo we-ISP ngu-192.168.50.1, i-Pi ngu-192.168.50.2, futhi amaklayenti akhethiwe akhomba ku-Pi. Okubalulekile ukuthi imigudu emibili ehlukene yamaphakethe yabelana ngentambo eyodwa. Iphakethe langaphakathi leklayenti lifika ku-Pi futhi kufanele liphume ngomhubhe; iphakethe lika-Pi uqobo elibethelwe liya kumlingani we-VPN kufanele liphume ngentambo efanayo liye kumgwaqo. Zihamba ngezindlela eziphikisanayo kusixhumi esisodwa futhi zidinga ukuphathwa okuhlukile.
Nika i-Pi ikheli layo ngomphathi wenethiwekhi ofakiwe, hhayi ngeresiphi endala yefayela lesixhumi ehlangana nayo ngomdlalo wedivayisi. Bese uhlela amaklayenti: isango elingaguquki kudivayisi eyodwa, noma ukubekelwa kwe-DHCP okunikeza u-192.168.50.2 njengomgwaqo. Ungashintshi lonke ibanga le-DHCP lomgwaqo ngenxa yamadivayisi amabili, futhi ungacabangi ukuthi iklayenti lihlonipha lokho kukhetha — qinisekisa.
Ubuthaka buwukwakheka, abulungiseki. Noma iliphi iklayenti kuleyo ngxenye lingakhomba ku-192.168.50.1 bese liphuma ngombhalo osobala, futhi idivayisi enesixhumi sesibili noma umsakazo weselula ishiya ngokuphelele indlela yakho yokuphoqelela. Uma lowo musho ungamukeleki kudivayisi efanele, impendulo isivele inawe: sebenzisa isakhiwo B.
Isakhiwo B: imbobo ehlukile ivala amadivayisi ngaphakathi
Lapha i-Pi igcina u-192.168.50.2 kuxhumaniso oluphezulu nesango u-192.168.50.1, futhi ithatha u-10.20.0.1/24 kusixhumi sesibili samadivayisi axhunyiwe. Manje i-Pi iwumgwaqo onamanethiwekhi amabili, futhi ingxenye exhunyiwe inomnyango owodwa wokuphuma.
Hlola ibanga nayo yonke enye into ngaphambi kokuzibophezela: isethi engaphansi yomhubhe uqobo, ezinye iziqalo phakathi kwezindawo, nakho konke okufinyeleleka nge-VPN. I-10.20.0.0/24 ehlangana ne-LAN ekude iletha umphumela osebenza ngengxenye odonsa ubusuku ukuxilonga. Uma imbobo yesibili iyisixhumi se-USB, qinisekisa ukuthi iyasekelwa futhi unamathisele igama layo kumphathi wenethiwekhi ukuze ukuhlelwa kabusha ngemva kokuqala kabusha kungasusi ikheli lakho le-LAN.
Sebenzisa isilaleli se-DHCP kuleso sixhumi kuphela. Iseva ephendula kuxhumaniso oluphezulu iqhudelana nomgwaqo we-ISP futhi inikeza amakheli engxenye yakho yonke indlu. Yibophelele kusixhumi se-LAN, yikhawulele ebangeni elimenyezelwe, futhi ugcine ikheli le-Pi uqobo lingaphandle kwedamu.
Ukudlulisela, ukuhumusha kanye nomthetho wokuvala lapho kwehluleka
Izinto ezine zivame ukuchazwa njengenye futhi azinjalo. Ukuvula ukudlulisela (net.ipv4.ip_forward=1) sitshela umgogodla kuphela ukuthi ungasusa amaphakethe phakathi kwezixhumi; ngokwaso akugunyazi lutho futhi akuqinisekisi ndlela. Ukukhetha indlela yokuphuma yisinqumo somgwaqo. Ukuvumela iphakethe yisinqumo senqubomgomo ochungechungeni lwe-forward. Ukubhala kabusha umthombo walo yisinqumo se-postrouting. Ukwakhiwa okwenza okokuqala kuphela kuveza i-Pi edlulisela ngokujabula uhambo lwamaklayenti liphuma kuxhumaniso oluphezulu.
Khawulela imvume emithonjeni obuyihlosile nase-sixhumi okufanele uhambo lusisebenzise, futhi ufake indlela yokubuya kanye nezindawo ezidingwa yi-Pi uqobo. Bese uhumusha endleleni yokuphuma yomhubhe uma umhlinzeki engayihambisi emuva kuwe ingxenye ye-LAN yakho. incwadi ye-nftables ibuka ukudlulisela, ukuphuma kwasekhaya nokuhumusha komthombo njengemisebenzi ehlukene, futhi lowo umfanekiso wokucabanga olungile lapha.
Ukwehluleka okuvamile umthetho obanzi we-masquerade kusixhumi somzimba. Lapho-ke uhambo lufinyelela i-inthanethi ngendlela ye-ISP kuyilapho, ohlangothini lweklayenti, kubonakala sengathi i-VPN esebenzayo ngempela. Lokho akuqinisekisi lutho. Gcina ukuhumusha kuboshelwe endleleni yokuphuma emenyezelwe, futhi gcina imithetho yakho kusicishamlilo esivele sisetshenziswa umsingathi, esikhundleni sokwengeza iqoqo lemithertho eliqhudelanayo elikhipha konke ochungechungeni lwe-postrouting olwabiwe.
Bese ubhekana nokungabikho komhubhe. Iphrofayili yeklayenti efaka indlela ebanzi yokuzenzakalela isho futhi ukuthi lapho umhubhe uwile, indlela evamile yokuzenzakalela ingabuya futhi uhambo lweklayenti lubuyele buthule kuxhumaniso oluphezulu. Lapho ukubuyela embhalweni osobala kungamukeleki, lapho inqubomgomo ye-forward kufanele yenqabe ngokusobala uhambo olusuka eklayentini luya kuxhumaniso oluphezulu, esimweni lapho indlela ye-VPN isihambile. Bhala lokho njengomthetho wokwenqaba, hhayi njengokucabanga. Ukuthutha okubethelwe kwe-Pi uqobo okuya kumlingani we-VPN kuwumgudu ohlukile we-local-output futhi kufanele uhlale kuvunyelwe, ngaphandle kwalokho umhubhe awusoze wabuya.
I-DNS ne-IPv6 zidinga impendulo yazo
Uma amaklayenti esebenzisa i-Pi njengesixazululi, afinyelela isilaleli sasekhaya futhi i-Pi iqala umbuzo omusha. Lowo mbuzo ophezulu ulandela indlela ye-Pi uqobo, hhayi umthetho we-forward owawubhalele amaklayenti, ngakho indlela yeklayenti ngomhubhe kuphela kanye nesixazululi esiphuma ngqo iwukuvuza okungenamuphi umlayezo wephutha. Nquma ngamabomu: isixazululi esifinyeleleka ngomhubhe, noma esasekhaya osamukela njengesiqondile, futhi wenze inqubomgomo yokuphuma ye-Pi uqobo ihambisane naleso sinqumo.
I-IPv6 iphinde ibe yisimo esihlukile. Umthetho we-forward we-IPv4 awukhawuleli lutho mayelana ne-IPv6, futhi izimemezelo zomgwaqo kuxhumaniso oluphezulu zinganika i-Pi, futhi ngayo ingxenye exhunyiwe, indlela yesibili yokuzenzakalela edlula inqubomgomo yakho. Noma nikeza i-IPv6 indlela yayo evikelwe ngokwalowo mthetho, noma yikhawulele ngokusobala engxenyeni yamaklayenti bese usho lokho.
Hlola umngcele ngaphambi kokuwethemba
Yamukela isakhiwo kuphela ngemva kokuhlolwa okune okuhlukene, ngoba ukuhlolwa okukodwa okuhehayo — ukuvula isiphequluli kuklayenti elilodwa — kudlula ezimweni ezimbalwa eziphukile.
Qinisekisa ukuthi iklayenti langempela lifinyelela i-inthanethi ngomhubhe, bese uqinisekisa ukuthi lelo klayenti lifinyelela i-inthanethi uma umhubhe uphansi. Qinisekisa ukuthi ukuxazululwa kwe-DNS kuyasebenza nokuthi umbuzo uphuma lapho obukuhlosile. Qinisekisa ukuthi ukuthutha kwe-Pi uqobo kusasebenza ngemva kokuqalisa kabusha umhubhe, nokuthi ukubuyisela akudingi ukuqalisa kabusha umshini. Ekugcineni, hlola idivayisi ongayikhethanga: kusakhiwo A kufanele iqhubeke isebenza ngokujwayelekile, futhi kusakhiwo B akufanele ibe khona ngokuphelele kuleyo ngxenye.
- Imibhobo emibili nomthetho wokwenqaba kunikeza ukuphoqelela; imbobo eyodwa nokukhetha kwe-DHCP kunikeza iseluleko.
- Ukuhumusha kusixhumi esingalungile kubonakala kuyimpumelelo futhi akunjalo.
- Uhambo lwe-Pi uqobo, i-DNS ne-IPv6 ngakunye kudinga isinqumo, hhayi ukuqagela.