I-VPN ehanjisiwe noma i-LAN eboshiwe yoxhumano lwegatsha nelebhu

Kunezindlela ezimbili zokwenza igatsha lifinyelele ilebhu yasekhaya, futhi umehluko awukho ekulungiselelweni. Ungahanjisa phakathi kweziqalo ezihlukene, ukuze isiza ngasinye sigcine isizinda saso sokusakaza, noma ubophe i-LAN ezimbili ibe yinye, ukuze ukusakaza nokuhamba kokutholakala kuziphathe sengathi wonke umuntu usendaweni eyodwa. Ukuhanjisa kuwumklamo okhuthazelayo lapho kuhlangana nenethiwekhi yangempela. Ukubopha kuwumklamo owenza iviki lokuqala libe lula futhi ukuphazamiseka kokuqala kube mnandi. Ukuqhathanisa okungezansi kumayelana nokuthi yikuphi okunikezayo nokuthi kushibhe malini, bese kuba ukuthi ungayenza kanjani inguqulo ehanjisiwe ihlolwe.

Izindlela ezimbili zokuxhumanisa, ukushintshana okucacile

Uxhumano oluhanjisiwe lubheka ilebhu yasekhaya njengenethiwekhi ekude enamakheli ayo. Igatsha licela isiqalo selebhu, umhubhe uthwala lawo maphakethe, futhi isango lelebhu liphendula lisuka kusubneti yalo. Akukho okushintshayo kuthebula le-ARP legatsha, futhi akukho okusuka kububanzi be-DHCP belebhu okufinyelela egatsheni.

Uxhumano oluboshiwe lwandisa isizinda esisodwa sezinga 2 kuzo zombili iziza. Amaphrothokholi okutholakala ayasebenza, amadivayisi avela ngokwawo, futhi konke ukusakaza, zonke izicelo ze-ARP namaphakethe e-multicast manje ayizicelo zokuwela umhubhe, okuyisilinganiso esikhulu sokuhamba okuthwalwa amaphrothokholi enzelwe ingxenye yendawo hhayi i-WAN ene-MTU ehlukile nesikhathi sokuhamba nokubuya esishintshayo.

Ukuhanjisa kukunikeza ini

Inzuzo yokuqala indawo yomonakalo. I-loop, iseva ye-DHCP engafuneki noma uzamazama lokusakaza kuhlala endaweni ekukhiqizile, ngoba i-router ayidlulisi ukusakaza. Okwesibili ukucaca kokukheliwa: isiqalo segatsha nesiqalo selebhu kuhlukile, ngakho indawo yephakethe ikutshela ukuthi yisiphi isiza okufanele siphendule, futhi umthetho we-firewall ungathi «igatsha liya kusubneti yelebhu» esikhundleni sokuthi «noma kuphi kuya noma kuphi».

Okwesithathu ukuthi kuhambisana nalokho umhubhe okuyikho ngempela akuthwalayo. Inqubomgomo ye-IPsec iyipheya lamaqalo, futhi indlela yokudlulisa ohlangothini ngalunye iwukuhanjiswa kwe-IP okujwayelekile nokudluliswa okuvuliwe esangweni:

sysctl -w net.ipv4.ip_forward=1
ip route add 10.20.0.0/24 via 192.168.50.1
ip route get 10.20.0.40

Lokho okulahla ukutholakala ngokusakaza. Lokho ukulahlekelwa kwangempela, futhi kufanele kushintshwe ngamabomu esikhundleni sokugwenywa ngokubopha konke.

Izindleko zokubopha

Ukubopha kufanele kuthware amafreyimu ezinga 2 ngomhubhe, okusho ukufaka ngaphakathi okufana ne-GRE noma i-VXLAN phezu kwe-IPsec esikhundleni somhubhe olula osekelwe kwinqubomgomo. Uma lokho sekukhona, iziza ezimbili zabelana isizinda esisodwa sokwehluleka. I-Spanning tree ibona umhubhe njengoxhumano, ukuhamba kokusakaza kudla umthamo womhubhe, futhi noma yiliphi idivayisi elicabanga ingxenye enokulibaziseka okuphansi liziphatha kabi ngezindlela okunzima ukuzichaza kusuka kunoma yiluphi uhlangothi.

Futhi kususa ukuhlolwa kokukheliwa okukugcina uthembekile. Ngesiqalo esisodwa esicaba, ikheli eliphindwe kabili akulona iphutha lokuhanjisa kodwa amahost amabili antshontsha ukuhamba komunye ngokuthula, futhi iziqalo ezigqagqene phakathi kwegatsha nelebhu zivamile ekuhlelweni kwelebhu yasekhaya, ngakho ukubopha akuxazululi lokho kungqubuzana; kuyakusabalalisa.

Impikiswano yezokuphepha yiyo evame ukunquma. Ibhuloho landisa ingxenye lapho amaphrothokholi okuxhumana endawo asebenza khona, ngakho idivayisi elisegatsheni lingakhuluma namadivayisi elebhu okwakungafanele neze afinyeleleke ngaphandle. Uma ilebhu inama-hypervisor, ikhonsoli yokugcina kanye ne-interface yokuphatha kunethiwekhi eyisicaba efanayo, lokho manje kuyingxenye eyodwa kanye negatsha.

Amagama ngaphandle kokusakaza

Isizathu sokuthi abantu babophe ngokuvamile ukutholakala: iphrinta, idivayisi yemidiya noma ihost yelebhu engaveli ohlwini nhlobo. Impendulo ehanjisiwe iwusizo lwamagama. Shicilela amahost elebhu endaweni okungafinyeleleka kuyo isixazululi segatsha, bese uvumela abasebenzisi ukuthi baxhumane ngegama esikhundleni sokuskena inethiwekhi. Lokho kuwumsebenzi omningi ekuqaleni futhi kuncane kakhulu kuzo zonke izinguquko zesikhathi esizayo.

Ukutholakala kwe-multicast yisimo esinzima kakhulu, futhi sifanele ukunemba. Amaphrothokholi afana ne-mDNS asebenzisa i-multicast yokuxhumana endawo, ama-router angayidlulisi ngokuzenzakalelayo, ngakho ihost yelebhu engekho ohlwini lokutholakala ingase isafinyeleleka ekhelini layo elibhaliwe. Uma isevisi ethile idinga i-multicast ngempela, hlela lolo phrothokholi olulodwa, nge-reflector noma umthetho wokudlulisa oqondiwe, esikhundleni sokubopha yonke i-LAN njengokulungisa okujwayelekile.

I-reflector nayo ayiyona impumelelo yamahhala. Ingenisa ukuhamba okukhulumayo okufanayo obuzama ukukugwema, isevisi eyodwa ngesikhathi, futhi idinga umnikazi ozoqaphela lapho idivayisi iqala ukumemezela okuningi kunangaphambili. Yikhethe ngesevisi ngayinye, futhi ubhale ukuthi kungani. Bhala ukuthi iyiphi isevisi eyayiyidinga nokuthi imemezela ini, ngoba ukubuyekezwa kwefirmware kungashintsha lolo hlu ngaphandle kokutshela muntu.

Yenza umklamo ohanjisiwe uhloleke

Khetha umgomo owodwa, isibonelo i-interface yewebhu yelebhu kusubneti yayo yeseva, futhi kufakazele ngezinhlangothi zombili. Kusuka kuhost esegatsheni, qinisekisa ikheli kanye nesevisi elalelayo endaweni, bese uxhumana ngomhubhe futhi uphindise. Umhubhe omile ufakazela ukuthi amasango ayavumelana; mayelana ne-firewall yehost noma indlela yokubuya awufakazeli lutho.

Igateway ejwayelekile yelebhu idinga indlela yokubuya eya esiqalweni segatsha ngaphandle uma umklamo uhumusha umthombo ngamabomu, futhi i-firewall yeserver ngokwayo kufanele yamukele ibanga elikude elivunyelwe. Akukho kokubili okulungiselelwa umhubhe ophumelelayo. Amanothi okudlulisa e-strongSwan achaza indlela yephakethe okufanele isebenze ohlangothini ngalunye.

Bese uhlola nendawo enqatshiwe. Umsebenzisi wegatsha odinga uhlelo lokusebenza olulodwa akadingi ikhonsoli ye-hypervisor, futhi indlela eyodwa yokwazi ukuthi inqubomgomo ingeyangempela ukuzama khona lokho okufanele ikwenqabe. Bhala iziqalo, ukuncika kwesixazululi kanye nemiphumela yokuhlola, futhi ushintsho lwesikhathi esizayo kunoma yisiphi isiza lungabuyekezwa ngemizuzu embalwa esikhundleni sokwakhiwa kabusha kusuka enkumbulweni.