Abasebenzisi abakude abakwazi ukufinyelela isayithi yesibili ngehhabhu le-VPN

Umsebenzisi okude uxhuma kuhhabhu, ufinyelela iseva yamafayela ku-LAN yakhona yehhabhu, futhi konke kubonakala kukuhle. Bese evula ukwabelana ku-10.20.0.50 ekomkhulu, lapho ihhabhu lifinyelela khona ngethuneli elihlukile lesayithi-kuya-kwesinye isayithi, futhi isikhathi siphela. Zombili izithungo ziyasebenza futhi zombili izibali ziyakhula, ngakho akukho thuneli eliphukile. Ukweqa ihhabhu yizinqumo ezintathu zomzila kumadivayisi amathathu, futhi ithuneli lithwala kuphela iziqalo ezakhelwe lona. Nalu uhlelo engahlola ngalo, kanye nomthetho obonisa ukuthi isinyathelo ngasinye siyiqiniso yini.

Ukudlula kudinga ukusesha okuthathu, hhayi ithuneli elilodwa

Idivayisi ngayinye yenza ukufana kwayo kweziqalo ezinde kakhulu bese iyakhohlwa. Ikhompyutha ephathekayo kufanele ithumele u-10.20.0.50 ethunelini hhayi kumzila wayo wasekhaya. Ihhabhu kufanele lithethe iphakethe elafika kumgwaqo wokufinyelela kude bese liyinikela kumgwaqo wesayithi-kuya-kwesinye isayithi. Ikomkhulu kufanele lithumele impendulo yekheli lomsebenzisi emuva ngethuneli. Noma yikuphi kwalokhu okuthathu okuhlulekayo kubonakala ngokufanayo kusiphequluli: ukuthula.

Yingakho ukuhlola ithuneli ngalinye lodwa kufakazela okuncane kangaka. Ukupinga ikheli le-LAN lehhabhu kusebenzisa isinqumo sokuqala, futhi ukupinga ihhabhu kusuka ekomkhulu kusebenzisa esesithathu. Iphakethe elihlulekayo linomthombo oyiqoqo labasebenzisi kanye nomgomo oyisayithi yesibili, ngakho qala ngokubhala lezo ziqalo. Lapha iqoqo yi-10.80.0.0/24, i-LAN yehhabhu yi-10.10.0.0/24 futhi ikomkhulu yi-10.20.0.0/24.

Phusha isiqalo esikude kuklayenti elikude

Kuseva yokufinyelela kude OpenVPN iklayenti lifunda imizila ngesikhathi sokuxhuma. Ngaphandle kwe-push, iklayenti elinethuneli elihlukanisiwe lithumela u-10.20.0.50 kumgedi walo siqu futhi iphakethe alilokothi lingene ethunelini.

push "route 10.20.0.0 255.255.255.0"

Umzila ophushisiwe uqala ukusebenza lapho iklayenti lixhuma, ngakho umsebenzisi ohlala ku-inthanethi akaboni lutho aze axhumeke kabusha. Qinisekisa kuklayenti: ip route get 10.20.0.50 ku-Linux, route print ku-Windows. Umphumela kufanele usho umgwaqo wethuneli.

push ayilisizi ihhabhu. Kuwumlayezo oya kuklayenti, hhayi umzila kuseva futhi hhayi imvume yokudlulisela, ngakho ihhabhu elinomugqa we-push ophelele lisaphonsa ukugeleza kanye emuva. Lesi yisizathu esivamile abantu abaphetha ngaso ukuthi push yehlulekile.

Nika ihhabhu umzila wokuphuma wangempela

Ihhabhu lidinga ukweqa kwalo okulandelayo kwesiqalo sekhomkhulu. Ethunelini elinomzila lokhu kuwumzila ojwayelekile odlula kumgwaqo wesayithi-kuya-kwesinye isayithi, futhi umthetho owodwa ubonisa kokubili umzila okhethiwe kanye nomthombo okhethiwe:

ip route get 10.20.0.50 from 10.80.0.25
sudo ip route add 10.20.0.0/24 via 172.30.0.2 dev s2s0

Lapho umlenze wesayithi-kuya-kwesinye isayithi ngokwawo uyi-OpenVPN, umzila ungahlala kuleso simiso uphethe ikheli lethuneli lomlingani njengomgedi: route 10.20.0.0 255.255.255.0 172.30.0.2. Umgedi awukona ukuzikhethela. Uma uwushiya, ukweqa okulandelayo kuwela kwizinga lokuzenzakalela lokuqalisa, ahluka phakathi kweklayenti elilodwa elikude nehhabhu elinabambisani abaningi.

IPsec esekelwe kumthetho wepolitiki wehlukile: umongo wehhabhu uthumela iphakethe kumgedi walo ojwayelekile we-LAN futhi umthetho wepolitiki uyalibamba lapho liphuma, ngakho umzila wethuneli kungenzeka awenzi lutho noma uhole ukugcwala ngaphesheya komthetho wepolitiki. Qaphela umthombo emthethweni ongenhla, ngoba u-10.10.0.1 esikhundleni sekheli leqoqo kusho ukuthi umongo wakhetha ikheli ohlangothi olukude oluzolichitha. iroute futhi akuyona impendulo; itshela iseva ukuthi iyiphi iklayenti ephethe isub-nethi engemuva kwethuneli layo siqu, hhayi ukuthi ukugcwala kwesayithi sesithathu kufanele kuthunyelwe kuphi.

Khulisa uhlangothi olukude lufinyelele eqoqweni labasebenzisi

Ikomkhulu selivele limboza i-LAN yehhabhu, i-10.10.0.0/24. Iqoqo labasebenzisi liyisiqalo sesibili futhi kufanele libe khona nakumakhethi, ngaphandle kwalokho akukho mthetho wepolitiki omboza impendulo eqondiswe ku-10.80.0.25. Umbambisani ngamunye usho lelo pheshana elifanayo lamasethi eziqalo avela ohlangothini lwakhe:

# strongSwan swanctl.conf, on the hub
local_ts  = 10.10.0.0/24, 10.80.0.0/24
remote_ts = 10.20.0.0/24

# on the headquarters peer
local_ts  = 10.20.0.0/24
remote_ts = 10.10.0.0/24, 10.80.0.0/24

I-local_ts yedivayisi eyodwa yi-remote_ts yomunye. Kopisha ibhlokhi yehhabhu iye ekomkhulu futhi ipheshana lihlanekezela, ngakho i-SA yengane ayilokothi ikhuphuke.

Isintaksi endala ye-ipsec.conf isebenzisa i-leftsubnet ehlukaniswe ngokhefana. Inhlangano yezokuphepha esebenzayo igcina amakhethi eyaxoxisana ngawo, ngakho setha kabusha ithuneli ngemuva kokuhlela. Ikhethi elashintshwa ngo-10:00 futhi lahlolwa ne-SA eyakhuphuka ngo-09:40 lisahluleka, kuyilapho ifayela lesimo libonakala lilungile ngaso sonke isikhathi.

Bese uhlola ukweqa kokugcina. I-ip route get 10.80.0.25 ekugcineni okukude kufanele ikhombe ethunelini. Uma isevisi isebenzisa umzila we-LAN njengomgedi wayo ozenzakalelayo, lowo mzila nawo udinga umzila wokubuya, ngaphandle kwalokho impendulo iyafa lapho. Ukugijima kwe-tcpdump -ni eth1 host 10.80.0.25 kuleso sigaba kubonisa ukuthi impendulo yaphuma ngempela ekugcineni.

Vumela ukugeleza kuhhabhu

Ukudlulisela kufanele kube kuvuliwe futhi indlela ivunyelwe. Khawulela imithetho kuziqalo ezimbili esikhundleni sokwamukela konke phakathi kwemigwaqo.

sysctl -w net.ipv4.ip_forward=1
iptables -I FORWARD -i tun0 -o s2s0 -s 10.80.0.0/24 -d 10.20.0.0/24 -j ACCEPT
iptables -I FORWARD -i s2s0 -o tun0 -s 10.20.0.0/24 -d 10.80.0.0/24 -j ACCEPT

Ukuhlunga komzila obuyayo kuwukwehluleka okuthule eduze kwakho: lapho imilenze emibili ikumigwaqo ehlukene, i-rp_filter=1 ingaphonsa impendulo kuyilapho isibali somthetho wokwamukela singanyakazi nhlobo. Qhathanisa i-iptables -vnL FORWARD ngaphambi nangemuva komzamo. Umthetho ongakhuli neze awufinyelelwa, ngakho bheka isendlalelo esisodwa ngezansi esikhundleni sokuwubhala kabusha.

Uma iqembu elilodwa kuphela lidinga ukudlula, beka umzila efayeleni leklayenti ngalinye ngaphansi kwe-client-config-dir esikhundleni sokwandisa i-push yomhlaba. I-Source NAT kuhhabhu nayo isusa isidingo somzila wokubuya ohlangothini olukude, kodwa ifihla ikheli lomsebenzisi, ngakho amalogi esayithi elikude kanye nemithetho esekelwe kumakheli ayekile ukwehlukanisa abasebenzisi.

Qinisekisa kusukela kuklayenti, bese uhlehla ngokulandelana okuphambene

Hlola umgwaqo we-TCP, hhayi i-ICMP kuphela, ngoba i-ping ingadlula kuyilapho isevisi isavalekile. I-nc -vz 10.20.0.50 445 ne-traceroute -n 10.20.0.50 kusukela kuklayenti zibonisa ukuthi ukweqa kwesibili ikheli lethuneli lehhabhu yini. Kuhhabhu, i-tcpdump -ni tun0 host 10.20.0.50 nesihlungi esifanayo kumgwaqo wesayithi-kuya-kwesinye isayithi: isicelo kukho kokubili ngaphandle kwempendulo kunoma yikuphi kwedlulisela inkinga ohlangothini olukude.

Bese uhlola into okufanele ihlale ivalekile. Uma isihambeli okufanele iqoqo lingalokothi lifinyelele kuso naso siphendula, uvule okungaphezu kokudlula futhi kufanele unciphise imithetho. Ihhabhu elidlulisela konke kuwo wonke amagatsha lidlula ukuhlolwa kokuqala futhi lehluleka kwesibili.

Gcina uhlu lokuhlehla, ngoba izinto ezine zishintshile futhi ezintathu kulula ukuzikhohlwa: umzila ophushisiwe, umzila wehhabhu, amakhethi kanye nemithetho yodonga lomlilo. Zihoxise ngokulandelana okuphambene, setha kabusha i-SA, futhi vumela umsebenzisi oyedwa ukuthi axhumeke kabusha. Ukuhlehla okuyingxenye kushiya umzila okhomba ethunelini elingasafanini, futhi lokho kunzima ukukufunda kunokuthula kwasekuqaleni. Incwadi ye-OpenVPN 2.6 ibhala i-push, i-route ne-iroute kunguqulo yakho.