I-VPN eqondisiwe noma enebhuloho: khetha ngokwalokho okufanele iklayenti kufinyelele kukho

Amathikithi amabili afika ngosuku olulodwa: umsebenzisi oyedwa udinga uhlelo lwewebhu lwangaphakathi, futhi unjiniyela oyedwa udinga ukuthi ithuluzi ledeski liziphathe njengokungathi lisesigabeni esifanayo se-Ethernet. Kokubili kuphendulwa ngokuthi bazifake ku-VPN, futhi yilapho inkinga iqala khona. Ithuneli eliqondisiwe nethuneli elinebhuloho zandisa ubudlelwano obuhlukene, futhi eyodwa kuphela yazo ehambisana nesicelo ngasinye. Ukukhetha i-topology kuyisinqumo sokufinyelela, hhayi isilungiselelo se-cryptography.

Izicelo ezimbili ezibukeka zifana edeskini lamathikithi

Isidingo somsebenzi iyinsizakalo, efinyeleleka nge-IP, kusuka kudivayisi ongayilawuliyo. Isidingo sonjiniyela sisezingeni lesixhumanisi: ithuluzi lilindele ukubona amafreyimu e-Ethernet nokutholwa ngokusakaza, futhi mhlawumbe i-DHCP evela esigabeni ellicabanga ukuthi sikuso.

Le mibuzo ihlukene, futhi ukuphendula yomibili ngebhuloho kwandisa ukufinyelela komsetshenziswa kuyo yonke i-LAN yehhovisi ngaphandle kwesizathu.

Bhala isidingo njengomusho ngaphambi kokukhetha: yiziphi izindawo, yimiphi imithetho futhi yibaphi osebenza nabo okufanele babonakale njengabasendaweni. Uma impendulo iyihostu nechweba, ukuhlela imizila kuyayihlanganisa. Uma impendulo iwukuxhumana kwezinga lefreyimu namadivayisi akhuluma ngokusakaza kuphela, ibhuloho lingaba ukuphela kwendlela. Noma yini ephakathi kwalokhu ifanele isigaba sokuhlola esikhundleni se-LAN yokukhiqiza.

Umzila mncane kunokuba yilungu le-LAN

Iklayenti eliqondisiwe lithola ikheli kusubneti yethuneli nemizila yamaprefikhi oyikhethayo. Ingafinyelela iseva yohlelo futhi ingafinyeleli okunye, uma inqubomgomo isho kanjalo. Isango liba indawo yokuphoqelela, inqobo nje uma wonke umzila ofanele udlula kulo.

Ungadidanisi umzila nemvume. Ukutshela iklayenti ukuthi lifinyelela kanjani kusubneti akukuvimbeli ukuzama enye indawo.

Sebenzisa ukulawulwa kokufinyelela lapho kungaqinisekisa khona ukugeleza, futhi gcina izimvume zohlelo ngokwalo zisendaweni yazo. Umthetho obanzi wokudlulisa noma isixhumanisi sesibili esikhohliwe kungase kunikeze okungaphezu kwalokho okukhonjiswa umdwebo. Funda imithetho esebenzayo, hhayi leyo ehlosiwe. Bese uhlola indawo okufanele yehluleke, ngoba inqubomgomo okungekho muntu ozame ukuyephula iwukucabanga nje.

Ibhuloho lishintsha umbuzo wokwamukelwa

Ukuxhuma ngebhuloho kuhlanganisa isixhumanisi esibonakalayo nedivayisi ye-TAP kuswishi yesofthiwe, ngakho amadivayisi akude ajoyina isizinda esifanayo sokusakaza. Leli yikhono langempela nengozi yangempela: idivayisi ekude ayiseyona isivakashi esiqondisiwe, isingumhlanganyeli.

Nquma ukuthi imaphi amadivayisi angajoyina, iziphi izinhlobo zamafreyimu okufanele zidlule nokuthi ukuxhumana okungafuneki kuvinjelwa kuphi. Ukwabiwa kwamakheli negunya le-DHCP kuba yingxenye yenethiwekhi eyabiwe, futhi amaseva amabili e-DHCP esigabeni esisodwa akhiqiza khona kanye lesosiphithiphithi osilindele.

Kuleli thuluzi, isigaba sokuhlola esizinikezele ngokuvamile sifaneleka kangcono kune-LAN yehhovisi. Gcina ukufinyelela kokuphatha ngaphandle kokuhlolwa, futhi chaza ukuthi umhlanganyeli wesikhashana ususwa kanjani uma umsebenzi uphela.

Ukuhlunga kukhona kuzo zombili izinhlobo ze-topology

Ibhuloho aliyona into engakwazi ukuhlungwa ngokwemvelo, futhi umzila awuphephile ngokwemvelo. Ukuhlunga kwamabhuloho ku-Linux kunamagwegwe awo kanye nesintaksi yemithetho yawo, futhi umthetho obhalelwe ukudluliswa kwe-IP eqondisiwe awusebenzi ngokuzenzakalela kumafreyimu anebhuloho.

Hlola ukuthi ipulatifomu isekela ngempela ini ngaphambi kokuthembisa umngcele:

bridge link show
nft list ruleset

I-TUN ne-TAP zichaza ukuhamba kwesixhumanisi, hhayi i-cipher. Ukushintsha izixhumanisi akulungisi lutho kulokho: ukuqinisekiswa koqabane, ukhiye owebisiwe kanye nenqubomgomo ye-cryptography ephelelwe yisikhathi konke kudlula ushintsho. Zombili iziphelelo zisadinga izilungiselelo ezihambisanayo nezesekelwayo namanje.

Fakazela umngcele ngemizamo emithathu

Ukwamukelwa yimibono emithathu, hhayi ukubuyekezwa komdwebo. Umsebenzi odingekayo kufanele usebenze, indawo engahlobene kufanele yehluleke, futhi izinsizakalo zokuphatha zesango uqobo kufanele zihlale zingafinyeleleki.

Gijimisa umzila ovunyelwe nongavunyelwe kusuka kuklayenti elilodwa, futhi urekhode kokubili:

curl -sS -o /dev/null -w "%{http_code}" http://10.20.0.10/health
ip route get 10.20.0.10
ip route get 10.30.0.5

Kubhuloho, engeza izihlolo zezinga lesixhumanisi: ukuthi ukuhamba kokutholwa okuvunyelwe kuyadlula yini, ukuthi ukwabiwa kwamakheli kuvela kugunya elihlosiwe yini, nokuthi umhlanganyeli wesikhashana usuhambile yini ngemva kokususwa. Uma i-IP eqondisiwe nje isivele ihlangabezana nesidingo, ukujoyina isigaba se-Ethernet sehhovisi kudinga isizathu esihlukile, futhi kufanele sibhalwe phansi ngaphambi koshintsho.