Hambisa ngaphandle kwe-VPN isevisi eyodwa yewebhu yasendaweni, ngokwetheku

Isevisi eyodwa yomsingathi kufanele iphendule i-inthanethi ngoxhumo oluphezulu lomzimba ngenkathi konke okunye kumshini kusasebenzisa umhubhe. Izimo ezintathu zinquma ukuthi ukuhamba kwendlela okususelwe kwinqubomgomo kungawuthwala yini lowo mthwalo, futhi ngayinye ishibhile ukuyihlola ngaphambi kokubhala umthetho. Isevisi kufanele iphele kulo msingathi hhayi ngemuva kwe-DNAT noma iphothi elidlulisiwe, imithetho ye-VPN uqobo kufanele ivumele ukuhlukile, futhi kufanele uqondanise impendulo hhayi isicelo. Uma kwehluleka eyodwa kwezintathu, imiyalo engezansi ilayisha ngokuhlanzekile kodwa ayenzi lutho olusizayo.

Hlola izimo ezintathu ngaphambi kokubhala umthetho

Isitsha esishicilela iphothi nge-DNAT, noma isiphakeli esingemuva kokudluliswa kwephothi, sikhiqiza amaphakethe angaveli kulo msingathi. Lawo maphakethe ayadluliswa, ngakho-ke umthetho osuselwe kokokufaka kwasendaweni komsingathi awazange awabone futhi ithrafikhi iyaqhubeka ithatha indlela ezenzakalelayo. Qinisekisa ukuthi isevisi isebenza kuphi ngempela ngaphambi kokuqhubeka, ngoba lesi yisimo abantu abahluleka kuso kaningi.

Isimo sesibili inqubomgomo hhayi ubuchwepheshe. Noma iyiphi indlela edlula umhubhe iyahlukile kunhloso yomhubhe, futhi kumsingathi ophethwe inqubomgomo leso sinqumo singesomnikazi wenqubomgomo, hhayi umuntu olungisa ukuphela kwesikhathi.

Qondanisa impendulo, hhayi iphothi lendawo okuyiwa kuyo yeklayenti

Impendulo evela kusiphakeli esilalela ku-TCP 443 ishiya umsingathi ngephothi lomthombo 443. Isiphequluli esikulowo msingathi esixhumana nesayithi ye-HTTPS ekude sithumela iphothi lomthombo lesikhashana nephothi lendawo okuyiwa kuyo 443. Kokubili kuyithrafikhi yephothi 443 futhi kukodwa kuphela okufanele kuthathe ithebula le-WAN, yingakho ukuqondanisa iphothi lendawo okuyiwa kuyo kungabamba ingxenye engalungile.

Isiqondiso sempendulo yikho ongakwehlukanisa. Qondanisa iphothi lomthombo, khawulela umthetho kumaphakethe akhiqizwe endaweni, futhi umthetho uhlanganisa izimpendulo zale sevisi ngokwayo ngaphandle kokuthinta izicelo zesiphequluli.

Yakha ithebula eliphelele lokubuyisa ngaphambi kokuba umthetho ukhombe kulo

Ithebula elingenalutho lisho ukuthi ayikho indlela, okubonakala njengesevisi ephukile hhayi inqubomgomo ephukile. Gcwalisa kuqala, ngonombolo wethebula nokubaluleka okungekho okunye kumsingathi okufunayo:

ip -4 route add table 100 192.0.2.0/24 dev eth0
ip -4 route add table 100 default via 192.0.2.1 dev eth0
ip -4 rule add priority 1000 iif lo ipproto tcp sport 443 lookup 100

Funda izinombolo kumsingathi osebenzayo esikhundleni sokuzikopisha. ip -4 rule show kutshela ukuthi yikuphi ukubaluleka okuthathiwe, futhi ukwengeza umthetho ekubalulekeni esivele kukhona kushintsha ngokuthula ukulandelana kwemithetho emibili ebukeka ilungile ngayinye iyodwa.

Umsebenzi wangempela uwenza izikhethi ezimbili lapha. iif lo yindlela i-kernel elibika ngayo amaphakethe akhiqizwe umsingathi uqobo, ngakho-ke umthetho awukwazi ukubamba ngengozi ithrafikhi edlulisiwe evela ngaphandle. ipproto tcp sport 443 ilinciphisa liphothi elilodwa nokuthuthwa okukodwa, okucinana ngendlela imfuneko evumela ngayo. Susa isikhethi sephrothokholi futhi umthetho uzobamba ne-UDP 443, okuyisevisi enye enokuziphatha okunye.

Gcina izimpendulo eziyimfihlo ngaphakathi komhubhe

Uma isilaleli esifanayo siphendula neklayenti ohlangothini oluyimfihlo, indlela ezenzakalelayo ye-WAN ebamba konke kuthebula 100 izozama ukubuyisela lezo zimpendulo ngoxhumo oluphezulu. Engeza iziqalo zangasese okungafanele zilande okwezenzakalelayo kwe-WAN, noma zivumele ziwele kumthetho wenqubomgomo olandelayo:

ip -4 route add table 100 throw 10.90.0.0/24

Indlela ye-throw iqeda ukusesha kuleli thebula futhi ibuyisela iphakethe ohlwini lwemithetho, ngakho inqubomgomo ye-VPN elandelayo ithola ithuba layo. Yona uqobo ayihambisi lutho iye emhubheni, futhi uma kungekho mthetho olandelayo onomzila oqondanayo iphakethe lisahluleka; qinisekisa inqubomgomo elandelayo esikhundleni sokucabanga ukuthi i-throw iyisilungiso.

Ukuhlunga kwendlela ehlanekezelwe nemithetho yodonga lomlilo yomsingathi kusasebenza esicelweni esifikayo. Bheka izinqumo zawo zangempela ngaphambi kokukhulula ukuqinisekiswa, ngoba ukuhlukile kokuhamba kwendlela akwenzisi rp_filter yamukele indlela yokubuyisa eyibona ingenakwenzeka.

Ihlola i-TCP, bese kuba i-QUIC, bese kuba ukuqalisa kabusha

Vula uxhumo olulodwa oluvela kuklayenti langaphandle eligunyaziwe nolunye oluvela ohlangothini oluyimfihlo, bese uhlola ukusesha kwempendulo ngamakheli namaphothi angempela. Uma impendulo yangaphandle ithatha ithebula 100 kanti eyangasese ayithathi, inqubomgomo yenza lokho okucelile.

I-HTTP/3 ihlinzekwa nge-UDP futhi ngeke iqondaniswe nomthetho we-TCP, ngakho isilaleli se-QUIC sidinga isikhethi saso, uma kungenjalo sizoqhubeka sisebenzisa umhubhe ngenkathi i-HTTPS isebenza. Gcina imithetho oyinqumayo engxenyeni ephethe i-interface, futhi uyiqinisekise ngemva kokuxhumana kabusha noma ukuvuselelwa kwe-DHCP. Uma umphathi oqhatsanayo esusa indlela yesikhathi sokusebenza ngemva kokuqalisa kabusha, lokho kuyinkinga yobunikazi okufanele ilungiswe emthonjeni, hhayi isizathu sokwengeza imithetho ebanzi ye-NAT phezulu.