Ukufinyelela isevisi kuklayenti ye-VPN: ithuneli elihlanekezelwe noma i-DNAT

Ngisho ikhompyutha ephathekayo engemuva kwe-NAT yomhlinzeki ingasebenza uzakwabo, inqobo nje uma iseva ye-VPN iyindawo yokuhlangana. Izindlela ezimbili zifinyelela lapho: iklayenti lishayela ngaphandle futhi licela iseva ukuthi ibambe iphothi elilalelayo, noma iseva ishicilela iphothi futhi iyihumushele ethunelini. Zombili zixazulula inkinga efanayo yokufinyeleleka futhi ziziphatha ngendlela ehlukile uma kukhona ukwehluleka, ukugadwa kanye nokuloga. Imibandela emithathu inquma ukuthi iyiphi efanele ukuhlelwa kwakho.

Izinhlobo ezimbili, indawo yokuhlangana eyodwa

Ohlotsheni lokuqala iklayenti livula isikhathi se-SSH ngaphandle futhi licela iseva ukuthi ilalele iphothi elikhethiwe, futhi libuyisela konke ukuxhumana ngaleso sikhathi. Kuseva akukho okudluliswayo futhi akukho ukuhunyushwa kwamaphakethe, ngakho izidingo kuphela i-akhawunti ye-SSH, ukudluliswa okuvunyelwe kanye nomthetho wodonga lomlilo wale phothi. Isevisi ihlala iboshwe ku-loopback kuklayenti, okuvame ukuba yilokho okukufunayo.

ssh -N -R 8081:127.0.0.1:8080 -o ExitOnForwardFailure=yes -o ServerAliveInterval=30 [email protected]

Ohlotsheni lwesibili iseva ingumnikazi wephothi lomphakathi futhi ibhala kabusha konke ukuxhumana ibheke kukheli wethuneli leklayenti. Lokho kudinga ukudluliswa kwe-IP okuvuliwe, ukuhunyushwa kwendawo lapho kungena kanye nokuhunyushwa komthombo lapho kuphuma, futhi kuyasebenza uma kungekho sikhathi se-SSH. Iphothi ngeleseva hhayi elesikhathi, futhi leso sici yisona esinquma izimo eziningi zangempela.

Alukho uhlobo oluphephile ngaphezu kolunye ngokwakhiwa kwalo. Womabili aveza iphothi elilodwa lesevisi kunoma ubani ongafinyelela ikheli lomphakathi leseva, futhi womabili asancike ekuqinisekisweni kwayo isevisi ngokwayo.

Umbala wokuqala: iphothi kufanele liphile isikhathi eside kunesikhathi

Ukudluliswa okuhlanekezelwe kuphila isikhathi esilingana ncamashi nesikhathi se-SSH esasikwenzile. Uma isixhumanisi siwa, umlaleli unyamalala futhi uzakwabo ubona ukuxhumana okwaliwe esikhundleni sendlela enensayo. Ukugadwa komthetho ngeyunithi ye-systemd nenqubomgomo yokuqala kabusha kuyaxazulula lokho, futhi ExitOnForwardFailure=yes kwenza ukuboshwa okwehlulekile kubonakale ngokushesha esikhundleni sokushiya isikhathi esisebenza ngaphandle kokudluliswa.

Iphothi elihunyushiwe lisisinda ekuqaliseni kabusha uma imithetho igciniwe, kodwa lincike ekutheni iklayenti ligcine ikheli lethuneli elifanayo. Ichibi eliguqukayo elinikeza ikhompyutha ephathekayo ikheli elihlukile ngemva kokuxhuma kabusha libhekisa umthetho ngokuthula endaweni engakho. Qala ugcine ikheli lethuneli, bese ubhala umthetho, futhi ubheke kokubili njengoshintsho olulodwa.

Uma isevisi kufanele iphendule ngehora lesithathu ekuseni kungekho muntu obukayo, uhlobo oluphothi elishicilelwe yiseva lunezingxenye ezinyakazayo ezimbalwa, ngoba inqubo eyodwa okufanele ihlale isebenza iwukuthi ithuneli ngokwalo.

Umbala wesibili: udonga lomlilo namalogi kungokabani

Uhlobo oluhlanekezelwe lugcina yonke inqubomgomo ezindaweni ezimbili. sshd lunquma nge-AllowTcpForwarding ukuthi ukudluliswa kude kuvunyelwe nhlobo yini, futhi GatewayPorts lunquma ukuthi umlaleli uboshelwa ku-loopback noma kuwo wonke amakheli. Ngenani elizenzakalelayo no uzakwabo ongaphandle kweseva akakwazi ukufinyelela iphothi nakuba ukudluliswa kuphumelele, futhi lokho kubonakala njengethuneli eliphukile kuyilapho empeleni kuyikheli lokuboshwa.

sudo ss -ltn '( sport = :8081 )'
sudo grep -E '^(GatewayPorts|AllowTcpForwarding)' /etc/ssh/sshd_config

Uhlobo oluhunyushiwe ludinga ukudluliswa okuvuliwe nemithetho emibili, futhi umthetho wesibili yiwona lapho izindlela eziningi ziphambuka khona. Ukukhawulela ukuhunyushwa komthombo esimweni se-conntrack DNAT kusho ukuthi kubhalwa kabusha kuphela ukuxhumana okwenziwe umthetho wendawo, hhayi yonke iphakethe iseva eyithumela ethunelini.

sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8081 -j DNAT --to-destination 10.88.0.6:8080
sudo iptables -t nat -A POSTROUTING -o tun0 -m conntrack --ctstate DNAT -j SNAT --to-source 10.88.0.1

Lokho kubhala kabusha kubhubhisa nokwabelwa komuntu. Ngemva kwalokho iklayenti libona wonke umshayeli njengekheli lethuneli leseva, okuhlanganisa noma yimuphi umkhawulo wesivinini ngakheli libe yibhakede elilodwa futhi kufihle ukuthi ubani uthumele ini. Uma ukwabelwa kubalulekile, qeda ukuxhumana kuseva noma gcina isinqumo semvume lapho futhi udlulise ubunikazi kunhlokweni isevisi eyethembayo. Ukukhetha phakathi kwalokhu kulungiswa okubili kuncike ekutheni isevisi iyayifunda nhlobo yini inhloko yommeleli.

Umbala wesithathu: iphothi elilodwa noma amaningi, futhi igama ngelikabani

Isevisi eyodwa kuphothi elilodwa yisimo lapho ukudluliswa okuhlanekezelwe kunqoba ngomzamo. Udunga umyalo owodwa, i-akhawunti eyodwa kanye nomthetho owodwa wodonga lomlilo, futhi ukuhlanza ukuqeda isikhathi. Izinsizakalo eziningi ekhelini lomphakathi elifanayo zikusunduzela ohlotsheni olushicilelwe yiseva, ngoba ukudluliswa ngakunye okuhlanekezelwe kudinga iphothi lalo leseva futhi iqoqo likhula ngayo yonke isevisi.

Amagama akwenza kube nzima nakakhulu. Ukudluliswa okuhlanekezelwe kungaba ngemuva kommeleli we-TCP ohamba nge-SNI, kuyilapho iphothi elihunyushiwe ngokuvamile liyiphothi elilodwa ngesevisi ngayinye. Uma isevisi iqeda i-TLS ngokwayo futhi idinga igama lomhambi langempela, indlela yommeleli iyaligcina, kanti indlela ye-DNAT iligcina kuphela uma isevisi yamukela lelo gama kuleyo phothi.

Bhala phansi ukuthi imuphi kule mibandela emithathu onqume uhlobo. Uma kungenjalo umuntu olandelayo ozofaka isevisi yesibili uzovula futhi lokho kuqhathaniswa ngomongo omncane.

Nquma, bese uhlola ngaphandle

Hlola indlela isuka kunethiwekhi engenayo indlela eya ekhompyutheni ephathekayo, futhi ubheke izibali kuseva ngesikhathi isicelo sisasebenza. Ukuhlola kusuka kuseva kuye ekhelini layo lomphakathi akufakazi lutho lapha, ngoba iphakethe lenziwa endaweni futhi alikaze lifinyelele kwihhuku lokuhunyushwa okungenayo, ngakho ukuhlola kungaphumelela kuyilapho indlela yangempela iphukile.

sudo iptables -t nat -L PREROUTING -n -v
sudo tcpdump -ni any 'tcp port 8081' -c 20

Izibali ezihlala zilingana zisho ukuthi iphakethe alikaze lifinyelele emthethweni, lokho okukhomba kumhlinzeki noma kudonga lomlilo lomsingathi. Izibali ezinyakazayo ngesikhathi isevisi inqaba zikhomba kudonga lomlilo leklayenti ngokwalo noma ekhelini isevisi elalela kulo. Ithuneli elithwala iphakethe kodwa lingabuyiseli lutho inkinga yendlela noma yendlela ebuyayo, futhi akukho kulezi ziphumo ezintathu okufanele kususwe ngesihloko ngokuhlela isibopho seklayenti. Bhala phansi ukuthi yisiphi isibali esinyakazile ngaphambi kokushintsha noma yini, ngoba ukuhlola okulandelayo kudinga leso sisekelo.

Uma uhlobo lususebenza, rekhoda iphothi, umnikazi kanye nendlela yokugadwa eduze kokuhlelwa kwethuneli. Ukulungiswa kokufinyeleleka okukhona kuphela emlandweni we-shell womuntu kusebanga ukuqalisa kabusha okukodwa ukusuka emcimbini ophindayo.