Hambisa i-subnet eyodwa ye-LAN nge-OpenVPN futhi ugcine indlela ezenzakalelayo
Gcina indlela ezenzakalelayo ye-LAN ngenkathi i-subnet eyodwa ihamba ngomhubhe. Qhathanisa ithebula lenqubomgomo nezinguquko kuthebula eliyinhloko, bese ukhetha i-NAT noma indlela ohlangothini lweseva.
Amadivayisi ahamba ngendlela ye-LAN futhi ngesikhathi esifanayo ashaya i-VPN agcina esengxabano efanayo nawo: umhubhe ufuna ukuba ngumnikazi wendlela ezenzakalelayo, kanti i-LAN iyidinga ibuyele kuyo. Lapho OpenVPN ixhuma, ingafaka indlela ezenzakalelayo ngomhubhe noma imibhangqwana emibili yengxenye yendlela ezenzakalelayo, okuyikho okulungile kwilaptop kodwa okuyiphutha kusango elilindele izimpendulo ezivela ekhelini lalo le-LAN. Impendulo akukhona ukweqa i-VPN. Impendulo ukunikeza izinqumo ezimbili amathebula ahlukene.
Indlela eyodwa ezenzakalelayo, abanikazi ababili
Ithrafikhi edluliswayo kanye nethrafikhi eyenzeka endaweni akudingeki zihambe ngendlela efanayo. Amaklayenti e-LAN adinga umhubhe kuphela ezindaweni ozikhethayo, kuyilapho amaseshini okuphatha awo umsingathi ngokwakhe kanye nezimpendulo zawo kulabo maklayenti zidinga indlela ezenzakalelayo ye-LAN. Ukuhlanganisa kokubili kuthebula eliyinhloko kuphoqa impendulo eyodwa emibuzweni emibili ehlukene.
I-OpenVPN ineswishi yalokhu ngqo. route-noexec ivimbela iklayenti ekutheni lingathinti ithebula eliyinhloko nhlobo, futhi amanani ebezowasebenzisa akhishwa ayiswe kumbhalo wesikhathi route-up njenge route_vpn_gateway, dev kanye namakheli e-interface. Ngemva kwalokho ucabanga ukuthi yiliphi ithebula elithola yiphi indlela, kukhodi ongayifunda kamuva.
Ithebula lenqubomgomo uma liqhathaniswa nokubhala kabusha ithebula eliyinhloko
| Approach | What it buys | What it costs |
|---|---|---|
| Separate table plus source rule | LAN traffic and host traffic keep independent defaults | Every lookup now depends on rule order |
| Editing the main table only | Fewer moving parts on a single-purpose host | One mistake takes the gateway offline entirely |
| Two half-default routes | Works for a full-tunnel client | Ambiguous on a host that must answer on its LAN address |
Ithebula elihlukile ukuphela kwendlela engakhula idlule i-subnet eyodwa. Yinike igama kanye, bese uyibhekisela ngegama ukuze kungabikho muntu okufanele akhumbule inombolo:
echo "10 vpn" >> /etc/iproute2/rt_tables
ip rule add from 192.168.50.0/24 table vpn
ip route add default via 10.8.0.1 dev tun0 table vpnAmakheli lapha ayizindawo zokubamba. Shintsha isiqalo se-LAN, isango lomhubhe kanye negama ledivayisi kusuka ekusetshenzisweni kwakho ngaphambi kokugijima noma yini.
Umthetho kufanele uhambisane nomsingathi futhi
Umthetho ohambisana nesiqalo se-LAN kuphela uhlanganisa amaphakethe adluliswayo. Akuhlanganisi ithrafikhi eyenziwa isango ngokwalo, futhi akuhlanganisi izimpendulo elizithumela emuva kumaklayenti e-LAN, ezithwala ikheli le-LAN lesango njengomthombo. Lokho kusesha kuwa ku-main futhi kusengaphuma ngomhubhe.
Engeza umthetho wesibili wamakheli e-LAN esango ngokwalo, noma unwebe umthetho wokuqala ube yiqoqo elihlanganisa kokubili. Ukulandelana kubalulekile: beka umthetho ocacile kuqala, bese uqinisekisa umphumela ngosesho olusho umthombo ngokusobala.
ip route get 203.0.113.9 from 192.168.50.1Uma lokho kubika idivayisi yomhubhe endaweni okufanele ihlale isendaweni, iqoqo lemithetho alilungile kungakhathaliseki ukuthi ithebula linani.
I-NAT noma indlela ohlangothini olude
Iseva ye-VPN yazi i-subnet yomhubhe futhi ayazi enye into. Amaphakethe angena nekheli lomthombo le-LAN awanandlela yokubuya ngaphandle uma othile ehlinzeka ngayo, futhi kunezindlela ezimbili ngqo zokuyihlinzeka. Ukwengeza indlela yesiqalo se-LAN kuseva kugcina umthombo wangempela ubonakala kusukela ekugcineni kuya ekugcineni, okuyikho okufunwa umklamo ohloliwe ngokuvamile. Ukufihla kusango kubhala kabusha umthombo ukuya ekhelini lomhubhe futhi akudingi ukusebenzisana kuseva.
iptables -t nat -A POSTROUTING -s 192.168.50.0/24 -o tun0 -j MASQUERADEKhetha i-NAT uma ungayilawuli iseva futhi ungeke wengeze izindlela lapho. Khetha indlela ohlangothini lweseva uma amalogi, ukulawulwa kokufinyelela noma ukulingana kwendlela yokubuya kubalulekile, ngoba ukufihla kususa ikheli langempela kukho konke okurekhodwa uhlangothi olude.
Noma kukuphi, ukudluliswa kufanele kuvuliwe, futhi ukuhlunga okuqinile kwendlela yokubuya kungaphonsa impendulo lapho i-main ibingeke ikhethe umhubhe kulo mthombo. Hlola inani elisebenzayo ngaphambi kokusola umhubhe.
Yenza ukwehlukaniswa kuhlale ngisho ngemva kokuxhuma kabusha
Imithetho nezindlela ezengezwe ngesandla ziyanyamalala lapho i-interface yakhiwa kabusha, futhi ukufakwa kuthebula okudala kungaphila isikhathi eside kuneseshini eyayikufanelekela. Faka umthetho wethebula, indlela yomhubhe kanye nokufakwa kokufihla kumbhalo wesikhathi route-up weklayenti, bese uhlanza ithebula phezulu kombhalo wesikhathi ukuze isango elidala lingaphili lingene kwiseshini entsha.
Qinisekisa kuzo zombili izinhlangothi: usesho kusango ngomthombo we-LAN, kanye nesicelo sangempela esivela kuklayenti le-LAN siya endaweni okufanele idlule ngomhubhe. Indlela ekhona kodwa engakhethwa neze iziphatha ngendlela efana ncamashi nokungabikho kwendlela, kuze kube ufunda izibali.