Iklayenti le-VPN elisetshenziswa ngomzila lifinyelela iseva kodwa hhayi amahost we-LAN

Ithuneli liyaphakama, iklayenti lishaya i-ping kuseva ye-VPN, futhi ifolda eyabiwe kumshini okude ngesinyathelo esisodwa ayiphenduli neze. Akukho lutho ekulungiselelweni kweklayenti okuchaza lokhu, ngoba isicelo sasuka ngempela eklayentini futhi safika ngempela. Okwehlulekile wuhambo lokubuya, futhi idivayisi ehlulekile ngokuvamile igeyithi ye-LAN hhayi ihost ye-VPN. Ukulandelela iphakethe lempendulo kuchaza lonke leli qembu lezimpawu.

Landela Impendulo, Hhayi Isicelo

Iseva ye-VPN ixazulula iphakethe leklayenti bese ilidlulisela ku-LAN ngelixa ikheli leklayenti lisekukhona enkambeni yomthombo. Ihost yendawo ekuyiwa kuyo iphendula lelo kheli, futhi manje ithebula lomzila yayo uqobo linquma konke. Igeyithi yayo ezenzakalelayo ayazi lutho ngeqoqo lethuneli, ngakho impendulo iphuma ibheke kumhlinzeki we-inthanethi futhi ilahlwa endaweni ethile kuleyo ndlela.

Kuklayenti uphawu isikhathi sokuphela esithule: akukho ukwenqaba, akukho ukusetha kabusha, akukho lutho nje. Ukuphequlula ifolda eyabiwe kuyama, i-ping ibika ukuthi akukho mpendulo, futhi amalogi eseva abonakala ephilile ngoba iseva yenze umsebenzi wayo.

Beka Umzila Wokubuya Lapho Amahost Ebuka Khona

Ihost ngayinye ye-LAN ibuza igeyithi yayo ezenzakalelayo, ngakho igeyithi iyona kuphela idivayisi okufanele yazi ukuthi iqoqo lethuneli likuphi. Engeza umzila ongaguquki lapho futhi ihost ngayinye izuza indlela efanele ngaphandle kokuthintwa.

Uma igeyithi isabalalisa ikheli layo njengokukhetha kwe-DHCP, sabalalisa umzila ngale ndlela ukuze imishini emisha iwuthatha ngokuzenzakalela. Uma kungenjalo umzila uhlala kufayela elilodwa lokulungiselela futhi unyamalala ekwakhiweni kabusha okulandelayo.

# on the LAN gateway; tunnel pool 172.20.5.0/24, VPN server 10.60.4.10
ip route add 172.20.5.0/24 via 10.60.4.10
ip route get 172.20.5.14

Kungani i-Source NAT Ibonakala Ilungisa

Ukufihla iqoqo lamaklayenti ngemuva kwekheli leseva ye-VPN kususa inkinga ngokususa ikheli leklayenti ephethetini. Izimpendulo zibuyela esevani, esivele sazi ukuthi kufinyelelwa kanjani ethunelini, futhi konke kuyasebenza. Inani ukuthi amahost angaphakathi awasakwazi ukubona ukuthi ubani iklayenti, futhi ukuxhumana ngakunye kubonakala sengathi kuvela kumshini owodwa.

Lokho kushintshana kwesinye isikhathi kulungile, isibonelo lapho idivayisi yomthengisi ingenakunikwa umzila ongaguquki. Ungawenzi umthetho ube banzi kungeqoqo lamanje, ngoba umthetho obhalelwe i-/24 uyeka ukuhlangana ngosuku iqoqo elikhishwa kabusha ngezinombolo libe i-/16, futhi uphawu lokuqala iqembu lamaklayenti amasha axhumayo futhi angafinyeleli lutho.

iptables -t nat -A POSTROUTING -s 172.20.5.0/24 -o ens18 -j MASQUERADE
iptables -t nat -L POSTROUTING -n -v

Indlela Yefu Yedinga Izilungiselelo Ezintathu

Ku-VPC isikhala esifanayo sibuya ngesinye isimo, ngoba isubnet ayinawo umzila womkhakha wamaklayenti nhlobo. Ithebula lomzila lidinga ukufakwa kweqoqo lethuneli okuqondisa kusixhumi senethiwekhi se-instance, futhi isixhumi kudingeka ukuhlolwa komthombo nendawo ekuyiwa kuyo kucishiwe ukuze ipulatifomu yamukele amaphakethe umthombo wawo okungewona ikheli layo. Amaqembu okuphepha nama-ACL enethiwekhi nawo kufanele avumele iqoqo nhlangothi zombili.

Ukweqiwa ngakunye kukhiqiza ukwehluleka okuyingxenye okuhlukile. Yeqa ukufakwa kwethebula lomzila futhi ama-instance ayimfihlo aphendula ku-subnet engakwazi ukubuyisela impendulo eqoqweni. Uma ukuhlolwa kusavuliwe, ipulatifomu ilahla impendulo ngemuva kokuba i-instance isiyithumele. Ngaphandle komthetho weqembu lokuphepha isicelo ngokwaso asifiki neze, futhi iklayenti libona isikhathi sokuphela kusendlalelo esisodwa ngaphambili.

Gijima Izahlolo Ngale Ndlela

Qinisekisa ukudluliswa nenqubomgomo yokuhlunga ngaphambi kokusola umzila, ngoba ihost engadlulisi iyahluleka ngendlela efanayo ethule. Bese ufunda isilungiselelo esisebenzayo somzila obuyayo kusixhumi esithwala ithuneli, ngoba isihlungi esiqinile singalahla izimpendulo ezivela endaweni engalindelekile.

Qeda ngokubamba okuthathwe kuhost ye-LAN ngenkathi iklayenti liyishaya i-ping. Isicelo esifika ngaphandle kwempendulo ehambisanayo sibonisa umzila wokubuya, futhi isicelo esingafiki neze sibuyisela iphutha esevani noma ethunelini.

sysctl net.ipv4.ip_forward net.ipv4.conf.all.rp_filter
tcpdump -ni any host 172.20.5.14 and icmp

Ukuhlolwa komthombo nendawo ekuyiwa kuyo kubhaliwe kumhlahlandlela wesixhumi senethiwekhi esinwebekayo. Kusetha kusixhumi esithwala ngempela ithrafikhi yethuneli, hhayi ku-adaptha engahlobene exhunywe ku-instance efanayo.