I-VPN kurutha noma ukudluliswa kwembobo: yikuphi okunqobayo?

I-rutha iqeda i-VPN ngokwayo, futhi umthetho wakudala wokudlulisa usathumela imbobo efanayo ye-UDP kumshini oku-LAN. Inye kuphela yazo engaba yindawo yokugcina yangempela, futhi i-kernel ayilamuli phakathi kwazo. Ukuhunyushwa kwendawo kubhala kabusha iphakethe ngaphambi kokuba kubuzwe isevisi yasendaweni, ngakho inqubo ye-VPN ilinda ithrafikhi eseyathunyelwa kwenye indawo. Umsebenzi uwukuthi kunqunywe ukuthi imbobo ingeyakabani, bese kwenziwa imithetho ivumelane.

Imbobo eyodwa, abanikazi ababili abamangalayo

Iseva ye-VPN esebenza ngaphakathi kurutha idinga imvume yokungena eholela kusokhethi yayo. Umugqa we-NAT wendawo wale mbobo efanayo uholela kwenye indawo ngokuphelele: ikheli le-LAN nesinqumo sokudlulisa. Lezi zindawo zokugcina ezihlukene ezinamarekhodi ahlukene nezindlela zokwehluleka ezihlukene. Inkomba evamile ukuthi umndeni wamakheli owodwa uyasebenza kanti omunye awusebenzi, ngoba umugqa osele wawubhalelwe umndeni owodwa futhi awuzange ubuyekezwe.

Bhala isimangalo ngaphambi kokuhlela: umndeni, ikheli langaphandle, ukuthutha, imbobo kanye nendawo ehunyushiwe.

Ukuhunyushwa kwenzeka ngaphambi kokuhlolwa kwasendaweni

I-NAT yendawo ishintsha indawo yephakethe esigabeni sangaphambi kokuhamba, ngaphambi kokuba i-kernel ikhethe phakathi kokulethwa kwasendaweni nokudlulisa. Lapho indawo isiba umsingathi we-LAN, iphakethe lithatha indlela yokudlulisa. Imithetho yokungena yesokhethi yarutha uqobo ayikaze ibhekwe, yingakho irekhodi le-VPN lihlala lingenalutho ngenkathi iklayenti ilinda.

Intended local entry:
WAN UDP 1194 -> router local socket -> input path

Conflicting old entry:
WAN UDP 1194 -> DNAT 192.168.50.10:1194 -> forward path

Lokho kuhleleka kuyiyo yonke indlela yokusebenza, futhi izixhumanisi zedivayisi ziyifihla ngemuva kwamabhokisi wokukhetha ngaphandle kokuyishintsha. Indlela iphakethe elizoyithatha isanqunywa umnikazi wendawo.

Uma umsingathi we-LAN kuyiyo ndawo yokugcina ehlosiwe, ukudlulisa kulungile futhi irutha akufanele futhi ilalele kuleyombobo.

Gcina imephu eyodwa bese ususa enye

Bhala uhlu lwemigqa ye-NAT yaleyombobo nomndeni bese ukhetha osindayo:

sudo iptables -t nat -S | grep 1194
sudo ss -lunp | grep :1194

Umugqa we-TCP onenombolo efanayo awuhlangene nokwehluleka kwe-UDP, futhi ukuwabheka njengento eyodwa kuholela ekususweni komthetho ongafanele. Lapho isokhethi yasendaweni kufanele inqobe, umnikazi wemephu engqubuzanayo ususa noma ubhala kabusha lowomugqa, futhi imvume yokungena yembobo yarutha uqobo ihlala endaweni yayo. Ukudluliswa okungahlobene, indlela yokuphatha kanye nekhophi yesethi yemithetho konke kufanele kudlule kulezi zinguquko.

Uma i-VPN ihlala kumsingathi ohlukile, ukudlulisa kuyinto efanele. Isevisi kusiqukathi noma kumshini ongabonakali ingase idinge imbobo eshicilelwe ngisho noma ibhokisi libizwa ngokuthi irutha, ngakho landela isokhethi nendawo yayo yamagama, hhayi ilebula elisebhokisini.

Qinisekisa umnikazi ngaphandle

Hlola umndeni ngamunye ngokwehlukana, ngoba uxhumano lwe-IPv6 oluphela kurutha alusho lutho ngoxhumano lwe-IPv4 oludluliswa umthetho wakudala. Funda irekhodi lesevisi eyamukelayo ukuze ubone ukuthi iyiphi indawo yokugcina ephendulile, futhi uthatha umyalezo wempumelelo weklayenti njengobufakazi obubuthakathaka. Kudingeka ukuhamba okusha ukuze kube nokuhlola okunengqondo. Thumela uphenyo kusuka kumsingathi wangaphandle nge-nc -zvu 203.0.113.7 1194 futhi ufunde irekhodi lomnqobi nge-journalctl -u openvpn@server -n 20. Isilaleli serutha sibhala ngokwaso uxhumano, kuyilapho umsingathi we-LAN ewubhala kwisevisi yakhe.

Ukulandelela ukuxhumana kugcina ukuhamba okukhona kumephu yako yasekuqaleni, ngakho isikhathi esisunguliwe singaphila isikhathi eside kunomthetho osanda kuwulungisa.

Lapho indawo yokugcina ehlosiwe iphendula ngokuhlolwa kwayo kokuzazi okuvamile, hlola umthombo wangasese ongemuva komhubhe. Ukufinyelela isilaleli sangaphandle kuyisinyathelo sokuqala kuphela; ukuhamba kwangaphakathi nokugunyazwa kohlelo lokusebenza kuyimiphumela ehlukene.