I-kill switch ku-router ehlanganisa i-FORWARD, i-OUTPUT ne-IPv6

Ungena ku-router, unamathisela isethi yemithetho ye-kill switch evela kokuThunyelwe kwe-forum, futhi i-LAN iyeka ukuphequluka ngaso leso sikhathi lapho i-tunnel iwa khona. Ezinsukwini ezimbili kamuva i-router isabuyekeza irekhodi layo le-DNS eguqukayo nge-WAN evamile, futhi i-laptop yezivakashi isafinyelela amasayithi e-IPv6. Zombili lezi zimo zivamile, ngoba imithetho enamathiselwe yayihlanganisa iketanga elilodwa nomndeni owodwa wamakheli, futhi akukho kulokho okuyi-router yonke. Ukuhamba ngezindlela zamaphakethe ngokulandelana kubonisa ngqo okwashiywa.

Qala ku-router, hhayi ku-laptop

Inqubomgomo esezingeni le-router iyakhanga ehhovisi elincane ngoba idivayisi ngayinye engemuva kwayo izuza indlela yokuziphatha efanayo futhi akekho ongakhohlwa ukushisa iswishi kuklayenti. Ikupha futhi indawo eyodwa yokuhlola ngemuva kokubuyekezwa ngakunye kwefirmware. Engakunikezi ukumboza okuzenzakalelayo kwethrafikhi ye-router uqobo noma umndeni wesibili wamakheli, futhi lezo yizikhala ezimbili ngemuva kokusetshenziswa okuningi okuhlulekile.

Ngaphambi kokuhlela noma yini, bhala amaqiniso amathathu ephepheni: igama lesixhumi se-WAN, igama lebhuloho le-LAN, kanye nekheli nechweba lesiphetho se-VPN. Uzodinga womathathu emithethweni, futhi ukuqagela amagama ezixhumi iyisizathu esivame kakhulu sokuthi isethi yemithetho ebukeka ilungile ingenzi lutho.

Hamba ngezindlela ezintathu iphakethe elingazithatha

Ithrafikhi esuka ku-laptop iya ku-inthanethi idluliselwa, ngakho idlula iketanga le-FORWARD. Ithrafikhi ekhiqizwa yi-router uqobo, njengokudluliswa kwe-DNS, imibuzo ye-NTP, izibuyekezo ze-DDNS kanye nomsele wokulawula we-VPN, idlula ku-OUTPUT. Ithrafikhi yokuphatha eqondiswe ku-router ingenA nge-INPUT.

Ngakho i-kill switch eyakhiwe ku-FORWARD kuphela ivikela amaklayenti futhi ayikho enye into. Ithebula libonisa ukuthi kungani ukuvuza esigcawini sokuqala kulindelekile hhayi kuyimfihlakalo.

Ezakhiweni eziningi awudingi i-kill switch ku-INPUT, kodwa kufanele ugcine ukufinyelela kokuphatha kusebenza ngenkathi i-tunnel iphansi. Uma kungenjalo, ngelikhulu icala lokuqala lapho i-VPN yehluleka khona uzoshayela eya ehhovisi ngentambo ye-console.

Hlela imithetho ukuze i-tunnel isakwazi ukuphakama

I-kill switch esebenzayo iwuhlu lwezimvume olugcina ngokwengaba, futhi ukulandelana kwayo iyikho okukwenza kube yi-kill switch hhayi isitini. Vumela kuqala i-loopback, isiphetho se-VPN, izimpendulo zemifudlana esunguliwe kanye nesixhumi se-tunnel; nqaba okunye ekugcineni.

iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -d 198.51.100.7 -p udp --dport 51820 -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o wg0 -j ACCEPT
iptables -A OUTPUT -o eth0 -j REJECT

Isiphetho kumele kube ikheli kuleli phuzu, hhayi igama lomsingathi. Uma ukwenqaba kokugcina kuvimba i-DNS, umthetho osho igama lomsingathi womhlinzeki awusakwazi ukuxazululwa, futhi i-tunnel ayisoze iphinde iqale ngemuva kokuqalisa kabusha. Uma umhlinzeki eshintsha iziphetho, xazulula igama ngaphambi kokuthi inqubomgomo isetshenziswe futhi uvuselele lowo mthetho kusuka kusikripthi esifanayo.

Fana ngesimo ku-FORWARD ngethrafikhi yamaklayenti, futhi ubeke umthetho wokuphatha ocacile ngaphezu kokwenqaba. Gcina lowo mthetho wokuphatha uncane kodwa ufinyeleleka, futhi uwuqinisekise ngokuvula iseshini yesibili ye-SSH ngaphambi kokuthi uvale eyokuqala. Ukuzivalela ngaphandle ngesikhathi sokushintsha kwe-kill switch kuvamile ngokwanele ukuthi kuhlelwe. Ku-router egijima i-WireGuard, ama-allowed-ips omlingani anquma okungena ku-tunnel, kuyilapho le mithetho inquma okuvunyelwe ukuphuma ngaphandle kwayo.

I-IPv6 idinga umnyango wayo

Konke okungenhla yi-IPv4. Uma i-LAN yakho ine-IPv6 esebenzayo futhi i-tunnel ithwala i-IPv4 kuphela, idivayisi ngayinye emboziwe isendleleni eqondile eya ku-inthanethi imithetho yakho emisha engayiboni neze. I-laptop eneziteki ezimbili izoyithanda, futhi i-kill switch izobonakala yephukile kuphela kumuntu ohlola nge-IPv4.

ip6tables -A FORWARD -i br-lan -j REJECT
ip6tables -A OUTPUT -o eth0 -j REJECT
ip6tables -A OUTPUT -o lo -j ACCEPT

Nalapha ukulandelana kubalulekile: imvume ye-loopback kumele yeqe ukwenqaba kwe-WAN, uma kungenjalo izinsizakalo zasendaweni ku-router ziqala ukwehluleka ngezindlela eziyinqaba. Uma inethiwekhi ingayisebenzisi neze i-IPv6, ukuyicisha ku-WAN naku-LAN kulula futhi akushiyi lutho okungalibaleka.

Amanye amaklayenti e-VPN afaka umzila ozenzakalelayo we-IPv4 kuphela futhi ashiya umzila ozenzakalelayo we-IPv6 okhona ungathintekile. Hlola ithebula lokuhamba ngemuva kokuthi i-tunnel ixhumeke esikhundleni sokucabanga ukuthi iklayenti ilibhekile.

Fakazela lokho ngenkathi i-tunnel iphansi

Misa i-tunnel kusuka ku-router futhi uhlole kusuka ezindaweni ezintathu ngalolu kulandelana:

# systemctl stop wg-quick@wg0
# ip route get 203.0.113.1
# curl -m 5 -sS http://example.com || echo blocked
# iptables -vnL OUTPUT | head
# ip6tables -vnL OUTPUT | head

Ukusesha komzila kukutshela ukuthi iphakethe lingaya kuphi, futhi izibali zikutshela ukuthi imithetho yakho yake yafanisa yini. Umthetho ongenawo amaphakethe ngemuva kokuhlolwa okwehlulekile awuvikeli lutho, futhi isizathu esivamile igama lesixhumi elihlukile kulelo olibhalile. Hlola ngokusobala ithrafikhi ekhiqizwa yi-router, ngoba ukuhlola okuvela ohlangothini lwe-LAN akukwazi ukusebenzisa i-OUTPUT.

Nquma imodi yokwehluleka ngaphambi kokuyidinga. I-fail-closed igcina amaklayenti engaxhunyiwe kuze kubuya i-tunnel; i-fail-open ibuyisela ukufinyelela kwe-WAN okuvamile futhi ichitha inhloso yethrafikhi obukukhathalele. Umzila we-blackhole oya echibini le-VPN onemetric ephezulu uyisendlalelo sesibili esiwusizo kumiklamo ye-fail-closed, ngoba uyasinda lapho umzila we-tunnel unyamalala esikhundleni sokubuyela kokuzembiwa.

Yamukela ukusethwa kuphela lapho iklayenti le-LAN, isicelo esikhiqizwe yi-router kanye nesicelo se-IPv6 konke kwehluleka ngenkathi i-tunnel iphansi, futhi womathathu asebenza futhi uma isiphakami.