Ukufinyelela i-/24 ekude ngomhubhe: NETMAP, DNAT noma umzila?
Hlela yonke i-prefix nge-NETMAP, engeza imithetho ye-DNAT kuyo yonke i-host noma uhambise ububanzi bangempela, bese unquma ngokuthi uhlangothi olukude kufanele lubone ini nokuthi ubani angaqala ithrafikhi.
Ungafinyelela isubneti engemuva kwephoyinti lokugcina lomhubhe ngezindlela ezintathu, futhi umzuzu wokuqoqa amaqiniso uvamise ukukhipha ezimbili. Amaqiniso ukuthi ingabe amaseva alapho kufanele ahlukanise abasebenzisi, ingabe ukhona lapho ozoke axhumane nobubanzi bakho, nokuthi ubani angahlela i-router ohlangothini olukude. Phendula lezo zintathu futhi umklamo uzizikhethela wona. Okunye kucabanga ukuthi usebenzisa iphoyinti lokugcina futhi ungahlela i-firewall yalo.
Izinketho ezintathu, nokuthi ngayinye ishintsha ini ngempela
Ukuhlela i-prefix, i-DNAT nge-host ngayinye kanye ne-prefix ehambisiwe konke kuhambisa amaphakethe phakathi kwezinto ezimbili ezifanayo, kodwa kushintsha izinto ezahlukene. Ukuhlela kusungula ububanzi begama elihlukile futhi kubhala kabusha amakheli ngezibalo lapho kuhamba. Imithetho ye-host ngayinye nayo ibhala kabusha, kodwa indawo ngayinye ibizwa ngesandla. I-prefix ehambisiwe ayibhali lutho kabusha: amaphakethe agcina amakheli angempela futhi iziphetho zombili ziyavumelana ngokuthi lawo makheli ahlala kuphi.
| What the far side needs | Prefix mapping | Per-host DNAT | Routed prefix |
|---|---|---|---|
| Users visible to its logs | Only without source NAT | Same condition | Yes, unchanged |
| To start a connection toward you | No, alias is local | No, same reason | Yes, both ends route |
| To absorb a new host | Yes, arithmetic only | No, one rule per address | Yes, it simply routes |
| To require no config change | Yes, with source NAT | Yes, same condition | No, it needs a route back |
Qala ukususa ohlangothini olukude, lapho imikhawulo kunzima kakhulu ukuyishintsha. Uma iseva yalapho ibhala amakheli amaklayenti kuma-log, iwaqhakambisa nohlu lwabavunyelwe noma iwadlulisela kwesinye isistimu, ukuhumusha umthombo kubhubhisa isihlonzi saso esisodwa. Uma uhlangothi olukude kufanele luxhumane nalo lungene, ukuhumusha akunakwenzeka neze, ngoba akekho lapho owaziyo ukuthi igama elihlukile likhona. Kuphela lapho uhlangothi olukude luphendula izicelo kuphela khona izinketho ezishibhile ziphepha.
Amapheya e-prefix, nokuthi kungani osayizi kufanele bafane
I-NETMAP iwumgomo wethebula le-nat elisebenza ngepheya lama-prefix anobude obufanayo. Alinathebula lekheli ngalinye ngaphakathi: lisusa i-prefix, ligcina amabhithi e-host bese liwaxhuma kabusha ku-prefix entsha, yingakho i-/24 ihlanganiswa ne-/24 futhi ingalokothi ihlanganiswe ne-/25. Indawo inquma isiqondiso: ukufana kwendawo ku-PREROUTING kubhala kabusha ukuthi iphakethe liya kuphi, futhi ukufana komthombo ku-POSTROUTING kubhala kabusha ukuthi lavelaphi.
I-host ku-192.168.2.17 ibonakala kumaklayenti akho njenge-10.50.1.17, futhi i-octet yokugcina ayiyona into yokuhlobisa — iyinombolo efanayo kuzo zombili izinhlangothi. Engeza kusasa i-host ku-192.168.2.40 futhi igama layo elihlukile liyi-10.50.1.40, ngaphandle komthetho okufanele uhlelwe.
Amaklayenti asadinga umzila wobubanzi begama elihlukile okhomba ebhokisini lakho, ngaphandle uma igama elihlukile liwela kwisubneti asezifikela kuyo. I-gateway ayidingi umzila wegama elihlukile, ngoba ukuhumusha kwendawo kusebenza ku-PREROUTING, ngaphambi kokufunwa komzila. Ukudlulisela nakho kufanele kuvuliwe, kungena kunjalo i-kernel izolahla iphakethe ngemuva kokubhala kabusha. Imiyalo emithathu engezansi iwukuphelela kokulungiselela kwi-gateway yesitayela se-Debian enamaklayenti ku-br0, igama elihlukile ku-10.50.1.0/24 kanye nomhubhe ku-tun0.
sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -i br0 -d 10.50.1.0/24 -j NETMAP --to 192.168.2.0/24
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADEImpendulo kufanele izitholele yona indlela yokubuya
Ukubhala kabusha indawo kunquma kuphela ukuthi iphakethe lizolethwa kuphi. Iseva ekude kusamele iphendule ikheli eliyafinyelela, futhi lokho kungahlelwa ngezindlela ezimbili. Humusha umthombo ukuze izimpendulo zibuyele ebhokisini lakho, noma shiya umthombo bese unikeza uhlangothi olukude umzila wobubanzi bamaklayenti.
I-masquerade ekuphumeni iyindlela emfushane: umthetho owodwa ku-POSTROUTING futhi uhlangothi olukude lubona ikheli lakho lomhubhe, ngakho aludingi umzila walo. Intengo ukuthi wonke umsebenzisi ufa emakhelini elilodwa, futhi ama-log omsebenzisi ngamunye awasasho lutho. Ukushiya umthombo ungangathinteki kugcina lolo lwazi, kodwa ngaleso sikhathi isayithi elikude kufanele libuyisele izimpendulo zobubanzi bamaklayenti ngomhubhe.OpenVPN sevha lokho kuyi-push "route 10.50.9.0 255.255.255.0", kanye route 192.168.2.0 255.255.255.0 umugqa.
Ukwehluleka okubizayo ukwenza uhhafu wakho konke. Uma wenza i-masquerade yengxenye yethrafikhi ngesikhathi uhlangothi olukude luthwala nomzila wokubuya wethrafikhi enye, izimpendulo zifika kuyi-interface lapho ingxenye yokulandelela uxhumano ayikaze ibonwe khona. Iklayenti libika isikhathi sokuphela sesicelo iseva eyasibhala njengesisekelwe. Izinhlangothi zombili zokugeleza kufanele zidlule ku-netfilter instance efanayo: i-gateway eyodwa ehumushayo, hhayi ama-firewall amabili ngokulandelana.
conntrack -L -d 10.50.1.17
iptables -t nat -L PREROUTING -v -nFunda ingxenye kuzo zombili izinhlangothi: i-tuple yasekuqaleni igcina igama lakho elihlukile endaweni, kuyilapho i-tuple yempendulo ithwala ikheli langempela. Uma i-tuple yempendulo ingekho, inkinga iwumzila wokubuya, hhayi umthetho. Uma izibali ze-PREROUTING zingakaze zinyakaze, iphakethe alikaze lifinyelele kuleyo hook.
Ukuphikisana nokufunwa okusebenza kuqala
Izinto ezimbili ezihlukene zingaphikisana, futhi kokubili ukwehluleka kubonakala njengomhubhe ophukile hhayi njengomthetho omubi. Igama elihlukile olisungulayo kufanele lingasetshenziswa kuyo yonke indlela, futhi ububanzi bangempela obukude akufanele bube bukhona kakade kunethiwekhi yakho. Ukuphindaphinda kuletha ithrafikhi yezikhathi ezithile kwi-host engalungile, okunzima ukuyixilonga kunokuxhumana okunqatshiwe. Buza ithebula lomzila ngaphambi kokwengeza umthetho.
Ku-gateway, ip route get 192.168.2.17 kufanele ibize idivayisi yomhubhe; ibhuloho lendawo lisho ukuthi ububanzi obukude busithiwe futhi awukho umthetho we-nat ozolungisa. Uma inethiwekhi yakho isivele isebenzisa i-192.168.2.0/24, phinda unombolise isayithi elikude esikhundleni sokunqwabelanisa ukuhlela phezu kokungqubuzana.
Ukuhlola kusuka kuklayenti langempela, bese ukugcina
Hlola kumshini ozosebenzisa ngempela igama elihlukile, hhayi kwi-gateway, ngoba ithrafikhi ekhiqizwe endaweni ayikaze idlule ku-PREROUTING ngendlela efanayo. Vula uxhumano kuyi-host eyodwa enegama elihlukile futhi ubuke izibali kanye nengxenye ye-conntrack zivela ndawonye, bese uyivala futhi uqinisekise ukuthi ingxenye iyahamba. Ingxenye endala ikhomba ekuxhumaneni okuvuleke uhhafu, okusho ngokuvamile ukuthi impendulo ayizange ibuye.
curl -sv http://10.50.1.17/ -o /dev/null
ss -tn dst 10.50.1.17
conntrack -L -d 10.50.1.17Ukuxhumana okubili noma okuthathu okuphumelelayo kubonisa i-arithmetic, kodwa akusho lutho ngokuqina noma ngonjiniyela olandelayo. Gcina imithetho lapho inqubo yokuqalisa iyifunda khona, okuthi ku-Debian naku-Ubuntu kusho iptables-save > /etc/iptables/rules.v4 nge-netfilter-persistent evuliwe. Ukuhlela okunyamalala ekuqaliseni kabusha kubi kakhulu kunokungabi khona, ngoba ukuphazamiseka kufika ngaphandle koshintsho lwakamuva ongalubeka icala.
Shiya inothi eduze kwemithetho: ububanzi begama elihlukile, ububanzi bangempela, isizathu sepheya nokuthi uhlangothi oluthile lungaqala. Leyo nothi ihlukanisa umklamo nenqwaba yemithetho okungekho ozama ukuyisusa. Ixazulula nombuzo wakamuva, lapho isayithi elikude lengeza i-host futhi ikheli okungekho okwalilungiselela seliphendula kakade. Uma inothi ithi uhlangothi olukude ludinga umzila wokubuya, umuntu olandelayo uyazi ukuthi ukususa umthetho we-masquerade kuphula ukuxhumana. Imibhalo ishibhile lapha; ukuthola kabusha ukuncika kwe-NAT ngehora lesithathu ekuseni akushibhile.