Hambisa phakathi kwama-LAN angasese ngaphambi kokwengeza enye i-NAT
Isikhala samakheli esihlangene, umzila wokubuya ongekho noma ukudluliswa okungathenjwa kunquma phakathi kokuhambisa, i-NAT kanye nomhubhe. Hlola lezo zintathu ngaphambi kokuhlela i-firewall.
Ama-firewall amabili angaphakathi, ingxenye eyodwa yokudluliswa yangasese, kanye nesicelo sokuvumela ama-host ambalwa ku-LAN ngayinye ukuthi akhulume nalawo akwelinye. Impendulo evamile iwukwakha i-VPN noma ukwengeza ungqimba lwesibili lwe-NAT, futhi zombili lezi zindlela zibiza ngaphezu kwalokho okufanele yile nkinga. Ukuhambisa okuvamile kwanele lapho izimo ezintathu zigcwaliseka: izigaba zamakheli azihlangani, izinhlangothi zombili zingabuyisela ithrafikhi kwenye i-LAN, futhi ingxenye yokudluliswa isithenjwa ngokwanele idatha. Hlola lezo zintathu ngaphambi kokuhlela noma yini, ngoba ngayinye ishintsha impendulo.
Izimo ezintathu ezinquma umklamo
Isimo sokuqala isikhala samakheli. Uma womabili ama-LAN esebenzisa ibhlokhi elilodwa le-RFC 1918, ukuhambisa akukwazi ukuwahlukanisa futhi ukuhumusha kuba yinto engenakugwenywa hhayi into yokuzikhethela. Okwesibili umzila wokubuya: umzila osuka ku-A uya ku-B awunamsebenzi ngaphandle uma u-B nazo ezazi ukuthi kufinyelelwa kanjani ku-LAN ka-A, futhi ulwazi olungalingani yisizathu esivame kakhulu sokuthi umklamo ohambisiwe ulahle izimpendulo ngasese.
Okwesithathu ukuthembela. Ukuhambisa kuhambisa amaphakethe; akukavikeli. Ingxenye yokudluliswa yangasese ngaphakathi kwesakhiwo esisodwa ihlukile ekunikezeleni kumhlinzeki noma kwixhumanisi eliwela umgogodla wekhampasi owabiwe. Uma ingxenye ingathenjwa, impendulo umhubhe phakathi kwama-firewall amabili, futhi uhlelo lokuhambisa olungezansi lusasebenza ngaphakathi kuwo.
Umklamo olula unqoba kuphela lapho zontathu zikhomba ohlangothini olulodwa. Uma enye yazo ihluleka, lungisa leso simo ngokusobala esikhundleni sokusicwilisa ngokuhumusha, ngoba i-NAT ifihla ukwehluleka kunokuba ikuxazulule.
Yakha uhlelo lwemizila kunethiwekhi yokudluliswa
Nikeza i-firewall ngayinye ikheli engxenyeni eyabiwe futhi wengeze umzila othile owodwa ku-LAN ngayinye ekude. Akukho okunye ekucushweni okukhona okumele kunyakaze, ikakhulukazi umzila oyisisekelo we-inthanethi kufanele uhlale khona kanye lapho ukhona. Ukushintsha umzila oyisisekelo nge-firewall engumlingani kungathumela yonke indawo engahlobene ngokusebenzisa ukudluliswa, okuwushintsho olukhulu kakhulu kunalokho okuceliwe. Idokhumenti ye-pfSense mayelana nokuhambisa okumile ichaza imodeli efanayo yomzila-noma-isango kulelo platform, futhi isilawuli esilingana naso sikhona kunoma iyiphi i-firewall oyisebenzisayo ngempela.
| Firewall | Remote LAN | Next hop on the transit |
|---|---|---|
| A | 10.40.0.0/24 | 192.0.2.20 |
| B | 10.30.0.0/24 | 192.0.2.10 |
I-firewall A isebenzela i-10.30.0.0/24 futhi i-firewall B isebenzela i-10.40.0.0/24, kanti amakheli amabili okudluliswa ase-192.0.2.0/24. I-host ngayinye ye-LAN igcina i-firewall yasendaweni njengesango layo, ngakho isimo esisha sodwa umzila owodwa ohlangothini ngalunye. Ku-firewall esekelwe ku-Linux uhlelo olufanayo lubukeka kanje, futhi ukudlulisela phambili kufanele kuvulwe, ngaphandle kwalokho umzila uzoxazululwa kuyilapho iphakethe lilahliwe.
sysctl -w net.ipv4.ip_forward=1 ip route add 10.40.0.0/24 via 192.0.2.20 dev eth1 ip route get 10.40.0.15 traceroute -n 10.40.0.15
Hlukanisa ukuhlunga ekuhumusheni
Ukuhambisa kanye nomgomo yizilawuli ezihlukene, futhi kungokwesibili lapho iningi lamaklomo ahambisiwe lihluleka khona ngempela. Vumela imithombo ethile, izindawo kanye nezinsizakalo emngceleni wokungena amaphakethe awela kuwo ngempela, futhi khumbula ukuthi ilebula ye-interface efana ne-WAN iyigama, hhayi isitatimende mayelana nokuthembela. Iphothi yokudluliswa ethwala ithrafikhi yangasese ingase isavulekile ukuvinjwa kwamakheli angasese ngokuzenzakalela.
Bese ubheka ukuhumusha okuphumayo ngaphambi kokuphetha ngokuthi akukho NAT okwenzekayo. Imithetho yokuphuma ezenzakalelayo ingabhala kabusha ithrafikhi eyayingakaze ihloselwe ukuhumushwa, futhi lokho kucekela phansi amakheli omthombo adingwa uhlangothi olunye kumgomo walo kanye namarekhodi alo. Qinisekisa ukuthi imifudlana ekhethiwe igcina amakheli ayo okuqala, futhi ushiye imithetho yokuhumusha ye-inthanethi ithrafikhi esayidingayo.
iptables -t nat -S POSTROUTING iptables -t nat -L POSTROUTING -n -v tcpdump -ni eth1 -c 5 host 10.40.0.15
Lapho i-NAT iyimpendulo eqotho
Ukuhumusha kuthola indawo yako lapho izigaba zamakheli zihlangana ngempela futhi ukufakwa kwezinombolo kabusha akutholakali, noma lapho umgomo udinga ukuthi uhlangothi olulodwa lubone ikheli elilodwa esikhundleni senethiwekhi encane. Kulezo zimo ukumephu ngamabomu kweyodwa-kuyodwa noma okukhawulelwe emaphothini kuyisinqumo somklamo esinemiphumela eyaziwayo, hhayi indlela yokugwema.
Umphumela okufanele ukhulunywe ngokuzwakalayo ukuthi uhlangothi olunye alusakwazi ukubona noma ukuhlunga imithombo ngayinye. Amarekhodi awela ekhelini elihumushayo, umgomo we-host ngayinye uyeka ukusebenza, futhi ukuxazulula izinkinga kuba ukufuna ukuthi iyiphi i-host yangaphakathi eyayiphethe umfudlana ngesikhathi esithile. Uma kungelutho kulokho okubalulekile kuthrafikhi okukhulunywa ngayo, i-NAT ilungile.
Lapho ukudluliswa uqobo kuwumbono ongafanele
Uma ingxenye eyabiwe iwela kumhlinzeki, indwangu yokushintsha eyabiwe noma noma yimuphi umzila lapho olunye uhlangothi lungafunda khona ithrafikhi, ukuhambisa kuphela akusiyo impendulo ephelele. Umhubhe phakathi kwama-firewall amabili ukunika imfihlo nokuqinisekisa umlingani, futhi ithebula lemizila engaphakathi kuwo yiyo leyo thebula obekuzobhala kuyo ekudlulisweni.
Nquma lokho kusuka embuzweni wokuthembela esigabeni sokuqala, hhayi emkhubeni wokuthi ama-VPN avikeleke kakhulu. Umhubhe phezu kwengxenye esivele iyimfihlo wengeza izindleko zokusebenza kanye nenye indlela yokwehluleka ngaphandle kwenzuzo, kuyilapho ukuhambisa phezu kwengxenye engathenjwa kushintshanisa imfihlo ngobulula ongakwazi ukubukhokhela. Bhala ukuthi yisiphi sezimo ezintathu esiholele ekukhetheni, futhi unjiniyela olandelayo ngeke kudingeke aphikisane nakho futhi.