Finyelela ikhasi lokuphatha le-router nge-VPN, hhayi nge-WAN

Ikhasi lokuphatha le-router livuleka ngemizuzwana emibili kusofa futhi liphelelwa yisikhathi liphuma egumbini lehhotela, kuyilapho iklayenti le-VPN lihlala libika ukuthi lixhunyiwe. Okunawo yindlela yokuphuma, hhayi indlela yokubuyela: ithuneli lithwala ithrafikhi yakho liye kwi-inthanethi bese lima lapho. Ukuze ufinyelele idivayisi engaphakathi kwe-LAN yakho kudingeka isikhathi esiphela entweni enomzila wokuya lapho. Lesi yisinqumo somklamo, hhayi isethingi, futhi sinquma ukuthi umsebenzi osele ungenzeka yini nhlobo.

Kulula ukulahlekelwa yilo mehluko ngoba umkhiqizo owodwa ungenza imisebenzi yomibili. Iklayenti lokuphuma lezentengiselwano kanye neseva yokufinyelela kude kungakhuluma iphrothokholi efanayo embobeni efanayo, futhi umehluko ukuthi yiluphi uhlangothi oluphethe isikhala samakheli ngemuva kwephoyinti lokugcina.

Luluphi uhlangothi lwethuneli oluphethe i-LAN

Ukuphatha, iphoyinti lokugcina kufanele libe ngaphakathi kwenethiwekhi ofuna ukufinyelela kuyo, noma libe nomzila ogunyaziwe wokungena kuyo. I-router eqhuba iseva yayo ye-VPN iyafaneleka; kanjalo ne-host encane ehlala ivuliwe enamakheli aqinile nomzila oya ku-LAN. Isevisi yokuphuma eqhutshwa yiqembu lesithathu ayifaneleki, ngoba iphoyinti layo lokugcina alinayo i-interface ku-LAN yakho futhi alinawo umthetho ongavumela eyodwa ukuba ivele. Lolu ukuhlola okufanele kuqedwe ngaphambi kokuthinta enye into.

I-firmware ayivamisile ukulebula lo mehluko, ngakho funda ukuthi isici senzani, hhayi ukuthi sibiza muphi iphrothokholi. WireGuard, OpenVPN kanye ne-IKEv2 kuzo zonke zivela ezinhlangothini zombili zemakethe: ukwakhiwa okukodwa kuthumela ithrafikhi yasekhaya ngaphandle, okunye kwamukela idivayisi yakho ekude. Ukwakhiwa kweklayenti kuphela akukwazi ukuguqulwa kube iseva ngokulungiselela, noma imenyu ibhalwe kanjani.

Ukwenza indlela yokubuyela ibekhona

Iseva ye-WireGuard ku-router inekheli le-interface elifana ne-10.8.0.1/24 kanye nokufakwa kontanga kwelaptop. Iklayenti linquma ukuthi yiziphi izindawo ezizothunyelwa ethunelini, futhi uhlu oluqukethe kuphela isethi engaphansi yethuneli lushiya i-LAN ingabonakali, noma iseva ilungiselelwe kanjani. Izinhlangothi zombili kufanele zivumelane, futhi ngokuvamile kuhlelwa okukodwa kuphela kuzo.

wg show wg0 allowed-ips
ip route get 192.168.1.1

Umyalo wokuqala ubika ukuthi intanga ngayinye ivunyelwe ukuthumela ini ngokombono weseva; owesibili ubika ukuthi ikheli le-LAN lizoya kuphi ngempela kuklayenti. Indawo ye-LAN exazululwa iye ku-interface yethuneli iwumzila osebenza, futhi lokho okuphuma ngokusebenzisa isango lomzimba ngeke kufike, noma i-firewall ithini. Engeza isiqalo se-LAN ohlwini oluvunyelwe lweklayenti, bese leyo micimbi emibili efanayo iba yisinyathelo sokuqinisekisa esikhundleni sokuxilonga.

Ukugxuma okufanayo kwamagxobo e-IPsec kuchazwa incwadi yokudlulisa ye-strongSwan lapho ukudlulisa kanye nomthetho we-source-NAT kuxhuma iklayenti lethuneli ne-host yangaphakathi. Ukwengamela kwamakheli kuyahluka; imfuneko ayihlukile.

Ubani ongavula ikhasi lokuphatha

Ukulawula ukufinyelela kungokwe-router, hhayi okwenhloso yokuqapha. Vumela kuphela ubunikazi bethuneli obuqinisekisiwe noma ibanga lomthombo elidinga ikhasi, futhi funda uchungechunge lokufaka lwe-router uqobo kanye nanoma yimuphi umgomo we-LAN odlulisiwe. Umthetho ovumela i-LAN enezintambo ukuba ifinyelele ikhasi lokuphatha awusho lutho mayelana neklayenti elifika ku-interface yethuneli. Bhala okuhlukile kobunikazi obuthile, bese ugcina ubunikazi besibili okufanele benqatshwe.

Isilaleli siyingxenye yesibili futhi asibonakali emiphumeleni ye-firewall. ss -ltnp ikhombisa ikheli iseva yewebhu eboshelwe kulo, futhi isevisi eboshelwe kuphela ekhelini le-LAN ngeke iphendule ekhelini lethuneli, noma imithetho ivumela kangakanani. Ukuyibopha kabusha noma ukwengeza ikheli ushintsho lokulungiselela ku-router, hhayi ushintsho lwe-firewall.

Gcina ukuqinisekisa kanye nokuqinisekisa ukuthutha kuvuliwe emzameni ofanayo. Ukufinyeleleka akukona ukwethenjwa, futhi idivayisi ngayinye engaphakathi kwethuneli ayibi umphathi ngalokho. Izifakazelo zethuneli kanye ne-akhawunti ye-router yizimvume ezihlukene ezinemijikelezo yokuphila ehlukene, ngakho ukhiye welaptop elahlekile ungasuswa ngaphandle kokusetha kabusha iphasiwedi yomphathi ngamunye.

Ukuhlola ngaphandle, hhayi kusofa

Hlola kunethiwekhi ongayilawuliyo. Xhuma ngethuneli eligunyaziwe, vula isikhathi sokuphatha esisha, futhi ushintshe into engenabungozi oyibona ikhombisa ekhasini. Kusofa ufakaza ukuthi i-LAN iyasebenza, okwakungakaze kube nokungabaza.

Bese uhlola ukwenqatshwa ngokunakekela okufanayo. Zama ikhasi ngaphandle kwethuneli futhi uqinisekise ukuthi liyehluleka, futhi uqinisekise ukuthi isevisi yokuphatha ayilaleli nhlobo ekhelini le-WAN. Ikhasi elingenasixhumanisi kuphela akukona ukulawula ukufinyelela, futhi isilaleli se-WAN esikhombisa ifomu lokungena siseyisilaleli se-WAN. Uma iphasiwedi iyinto kuphela phakathi kwe-inthanethi nekhostholi ye-router, umklamo uyiphasiwedi.

Izinsizakalo zasekhaya zifanele ukubukwa ngenkathi ukhona. Ukuqinisa imithetho yokuphatha kuvame ukwephula inethiwekhi yezivakashi noma isixazululi esisetshenziswa amadivayisi omndeni, futhi lokho kuvela ezinsukwini kamuva njengesikhalo esingahlobene.

Ukugcina indlela yokubuyela ngenkathi ushintsha izinto

Ngaphambi kokushintsha imizila noma izilungiselelo zethuneli kude, lungiselela indlela yokubuyela ezimele. Isikhathi esikhona singase sidlule ekushintsheni okuvele kuvimbela ukuxhumana okusha, futhi yileyo ndlela abantu abazivalela ngayo ngaphandle ngenkathi bebuka isikhathi esisasebenza. Izinketho zicacile: ukuqalisa kabusha okuhleliwe okuya ekulungiseleleni okwaziwayo, ukufinyelela ngekhonsoli noma ngomzimba, ithuneli lesibili elingancikile ekulungiseleleni okuhlelwayo, noma ukuphatha ngaphandle kwebhendi lapho ihadiwe inikela khona. Khetha okukodwa futhi ukufakazele ngaphambi kwewindi lokunakekela, hhayi phakathi kwalo.

Gcina irekhodi lifushane futhi lishesha: iyiphi i-host eqeda ithuneli, yibuphi ubunikazi obungafinyelela ekhasini, isevisi iboshelwa ekhelini eliphi, futhi idivayisi elahlekile isuswa kanjani. Lolo hlu lusebenza futhi njengecebo lokubuyisela, ngoba lusho ukuthi ukuncika ngakunye kuhlala kuphi. Umzila wokubuyela ongekho uyinkinga yomzila okufanele ilungiswe, futhi awusoze waba yisizathu sokushicilela ukuphatha ku-WAN.