Ukusebenzisa i-VPN kusihlalo noma ngaphakathi kwe-VM? Umhlahlandlela wesinqumo

Ukwakha ishubhu ngaphakathi kwesivakashi nokuyakha kusihlalo kokubili kushintsha ikheli elibikwa isiphequluli, futhi ukufana kuphela lapho. Ishubhu eliphethwe isivakashi ligcina okhiye balo, umzila walo ozenzakalelayo kanye nesixazululi salo ngaphakathi kwengqikithi yesivakashi, kuyilapho isihlalo sidlulisela amaphakethe abethelwe ekhosini elilodwa elikude. Ishubhu eliphethwe isihlalo liyisithombe esibukweni: iklayenti lesihlalo libamba isikhathi futhi lisebenzisa imizila nenqubomgomo, kanti isivakashi siboleka lokho okuphumayo. Uma ukhetha umnikazi ongafanele, yonke inkomba elandelayo izokuhambisa emshinini ongafanele. Imiyalo emibili ixazulula lo mbuzo cishe ngomzuzu owodwa, futhi ingxenye esele yalo mhlahlandlela yilokho okufanele ukwenze ngempendulo.

Nquma umnikazi ngaphambi kokuthinta iklayenti

Umthetho umayelana nokuthi umbhalo obethelwe ukhiqizwa kuphi, hhayi ukuthi iyiphi imshini ekhombisa isithonjana se-VPN. Uma isivakashi siwukhiqiza, isivakashi sidinga umzila osebenzayo oya kuseva ye-VPN futhi asidingi enye into kusihlalo. Uma isihlalo siwukhiqiza, isivakashi sidinga ukuthi indlela yaso edlula kusihlalo yeqe noma iyiphi inqubomgomo isihlalo esiyibeka kuthrafikhi yasendaweni.

Imibuzo emithathu ivamise ukukhethela indawo. Ngabe ukuthrafikhi kwesivakashi kufanele kudlule iklayenti lenkampani elikusihlalo? Khona-ke ishubhu lingaphakathi kwesivakashi. Ngabe izivakashi eziningi zidinga ubufakazi obubodwa nekheli elilodwa lokuphuma? Khona-ke likusihlalo, nokudluliselwa okuhlelwe ngamabomu. Ngabe ukuthrafikhi kwesivakashi kufanele kuhlale ngaphandle kwe-VPN yesihlalo ngokuphelele? Khona-ke ishubhu elingaphakathi kwesivakashi iyona ndlela yodwa eyenza lokho ngokwakheka kwayo.

Bhala impendulo njengomugqa owodwa eceleni kwegama le-VM: guest-owned noma host-owned. Kulabhorethri yemishini eyisithupha lelo nothi ligcina isikhathi esingaphezu kwanoma isiphi isinyathelo esingezansi, ngoba likuvimbela ekuphenyeni ishubhu elingakaze libe kumshini okungena kuwo.

I-WSL1 ne-WSL2 ziyizimo eziphambene

I-WSL1 ayiyona imshini yombono, ngakho umbuzo wendawo uvame ukunyamalala. Amafayela akho e-Linux asebenza ku-stack yenethiwekhi ye-Windows ngokusebenzisa ungqimba lokuhumusha, futhi iklayenti le-VPN le-Linux alinazo izixhumi ezizimele okufanele zilungiswe. Okusebenzayo ukuhlelo kweshubhu ohlangothini lwe-Windows, kanti ukusatshalaliswa kusebenzisa umphumela ngaphandle kokuphatha lutho.

I-WSL2 iphambene nakho. Isebenzisa ingqikithi yangempela ku-VM yokusiza elula ngemuva kwesishintshi sombono se-Hyper-V, futhi indawo yayo yamakheli ihunyushwa nge-NAT ngokusebenzisa i-adaptha ohlangothini lwesihlalo. Ngakho iklayenti le-Linux ngaphakathi kokusatshalaliswa liziphatha njengasemabhokisini angempela e-Linux: lenza tun0 noma wg0, lifaka imizila yalo, futhi liyasebenza. Ukwehluleka kuhlala ohlangothini lwesihlalo. Uma iklayenti le-VPN le-Windows lixhuma ngenqubomgomo evimbela ithrafikhi kumanethiwekhi asendaweni, lithatha i-subnet ye-WSL2 njengenethiwekhi yasendaweni engathembekile futhi linqamula umzila we-NAT. Khona-ke ukusatshalaliswa kulahlekelwa yi-DNS nokufinyelela kwangaphandle kuyilapho ishubhu laso lilonke lisempilweni: wg show libika ukuxhawulana, ip route libukeka likahle, futhi curl liyaxhuga.

Ukulungisa okungakusebenzisa kuncike kukwakhiwa kwe-Windows. Okudala isicishamlando kuklayenti lesihlalo se-subnet ye-WSL, okungezwa ngaphansi kwezilungiselelo zenethiwekhi yasendaweni noma zeshubhu elihlukanisiwe lek layenti. Okusha, kukwakhiwo kwe-Windows 11 okulusekelayo, inethiwekhi yesibuko: faka i-networkingMode=mirrored esigabeni se-[wsl2] se-%UserProfile%\.wslconfig, sebenzisa i-wsl --shutdown, futhi ukusatshalaliswa kuzokwabelana ngezixhumi zesihlalo esikhundleni se-subnet ye-NAT eyimfihlo. Imodi yesibuko nayo ishintsha ukuziphatha kwe-localhost namachweba angenayo, ngakho yithathe njengokufuduka hhayi njengesishintshi.

I-NAT, ibhuloho kanye nalokho isihlalo esingakubona

Ngaphansi kwe-NAT, amaphakethe eshubhu lesivakashi aqondiswa ekhelini lomphakathi leseva ye-VPN futhi aphuma nge-adaptha yesihlalo njenge-UDP noma i-TCP ebethelwe. Isihlalo sibona ukuhamba okukodwa nenani lamabhayithi akho, lutho ngendawo eziya kuzo ngaphakathi. Ngaphansi kwe-adaptha yebhuloho isivakashi sinezazisi zaso zongqimba 2 ku-LAN yangempela, sithatha isivumelwano saso se-DHCP, futhi sibonakala kunoma iyiphi inqubomgomo esekelwe ku-MAC njengedivayisi yesibili. Ayikho imodi evumela isihlalo ukufunda umthwalo weshubhu; isivakashi esisebhulohweni sivele sibonakala kakhulu kunethiwekhi elisizungezile.

Ukuhlukanisa nakho kunendawo ephansi. Isivakashi asikwazi ukucasha emshinini ophethe imemori yaso, futhi noma ubani olawula isihlalo angafunda okhiye ku-RAM yesivakashi. Lokho ishubhu elingaphakathi kwesivakashi elikunikeza kona ingumngcele wokuhambisa kanye nomngcele we-malware, hhayi isivikelo kumuntu ophethe ikhompyutha ephathwayo. Amamodi e-adaptha abhaliwe kufanele avulwe ngenkathi ukhetha, ngoba imodi ishintsha kokubili okubonwa isihlalo nokubonwa yi-LAN.

Umhlahlandlela: beka, lungisa, fakazela

Sebenzisa lezi zivivinyo ezine ngokulandelana ku-shell entsha yesivakashi, futhi ume kokokuqala okungahambisani nomnikazi oyibhalile.

1. ip route get 1.1.1.1 ebuyisela i-tun0 noma i-wg0 isho ubunikazi besivakashi, kanti i-eth0 enokugxuma okulandelayo okuyimfihlo isho ubunikazi besihlalo.
2. resolvectl query example.com, noma funda i-/etc/resolv.conf lapho isivakashi singasebenzisi khona isevisi yesixazululi. Ishubhu elithwala ithrafikhi kodwa hhayi i-DNS yisimo esivamile esingakalungiswa kahle.
3. Qhathanisa okuphumayo: i-curl -4 -s https://ifconfig.me esivakashini ne-curl.exe -4 -s https://ifconfig.me kusihlalo. Amakheli ahlukene asho ukuthi isivakashi siphethe ishubhu, futhi isihlalo esiku-VPN nesivakashi esikhombisa i-ISP yasekhaya yisimo lapho kungabanga khona lutho olwatholakala njengefa.
4. Phinda kokubili nge--6. Ishubhu le-v4 kuphela livuza i-v6 ngaphandle uma iklayenti livimbela noma lihambisa, futhi amaklayenti amaningi ashiya i-v6 kusixhumi sangempela ngokuzenzakalelayo.

Kumklamo wegesi yesihlalo, lapho izivakashi eziningi zabelana ngeshubhu esisodwa, isihlalo kufanele sidlulise futhi sihumushe. Kusihlalo se-Linux lezo izingxenye ezintathu, futhi isivakashi sibuyela emuva ngokuthula emzileni waso ojwayelekile uma kukhona engasekho:

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
iptables -A FORWARD -i virbr0 -o wg0 -j ACCEPT
iptables -A FORWARD -i wg0 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT

Ohlangothini lwe-WireGuard, i-AllowedIPs yomlingani wesihlalo kufanele ihlanganise i-subnet yezivakashi, isibonelo i-192.168.122.0/24, ngaphandle kwalokho amaphakethe abuyayo awasoze afike futhi ukuhlela kubonakala njengenkinga yodonga lomlilo. Isihlalo se-Windows sithola umphumela ofanayo nge-Internet Connection Sharing noma umthetho we-NAT kusishintshi se-Hyper-V, futhi sidinga ukuhlolwa komzila wokubuyela okufanayo.

Uma ukuhlelwa kusavulekile, le thebula ihlanganisa izinhlelo ezivame kakhulu:

Amashubhu amabili, izivakashi ezimbili, nezingxabano phakathi kwazo

Uma udinga ukuphuma okubili ngesikhathi esisodwa, iphethini eqinile ukuthi kube neshubhu elilodwa ngesivakashi. I-VM ngayinye igcina umzila wayo ozenzakalelayo nesixazululi sayo, isihlalo sihlala kunethiwekhi evamile, futhi amashubhu amabili awasoze axabane ngethebula elifanayo lokuhambisa. Ukuxhumanisa izivakashi ezimbili ngebhuloho nakho akuhlanganisi imizila yazo: inethiwekhi yombono inikeza umzila, futhi iklayenti ngalinye kusafanele litshelwe ukuthi le thrafikhi yasendaweni ingadlula ishubhu.

Ukuqhubeka kweshubhu lesihlalo neshubhu lesivakashi ndawonye kusemthethweni, futhi ukufaka ngamabomu ngaphakathi kwesinye ngesinye ngezinye izikhathi kuyilokho okukufunayo, isivakashi siphuma ngeshubhu saso bese leso shubhu siphuma ngeseshubhu sesihlalo. Okukwenza kube ukuphazamiseka ukuthi akekho obhalile ukuthi iyiphi indawo yokugcina okufanele ifinyelelwe ngakuphi ungqimba. Gcina uhlu lwamakholomu amabili endawo nomnikazi, futhi ukungqubuzana komzila kuba ukusesha esikhundleni sendlu yonke yokuthola.

Qinisekisa, bese ushiya ukubuyisela kumnikazi

Hlola ngaphakathi kwesivakashi ngenqubo entsha yohlelo lokusebenza: ithrafikhi, ukuxazululwa kwamagama, zombili imindeni yamakheli, kanye nokwenzeka uma ishubhu liwa. Isithonjana se-VPN sesihlalo asisho lutho mayelana nokufakwa kwesivakashi, futhi lokho ukuqinisekiswa kwamanga okuvame kakhulu kuyo yonke le nkambu.

Ukubuyisela nakho kungokomnikazi. Ishubhu eliphethwe isivakashi libuyiselwa yiklayenti lesivakashi uqobo kanye nemizila eliyibhalile. Umklamo ophethwe isihlalo ubuyiselwa ukulandelana kokuvulwa kwesihlalo, futhi imithetho yokudlulisela ayidluli ekuqaleni kabusha ngaphandle uma i-unit noma umsebenzi wokuqalisa iyisebenzisa futhi. Isithombe esibuyisiwe ukuthunyelwa, hhayi ukuhoxiswa, ngoba sibuyisela ubufakazi obudala nemizila emidala kanye nediski. Ngaphambi kokumemezela ukuthi umsebenzi uphelile, qinisekisa ukuthi umnikazi usahambisana nomugqa oyibhalile, ukuthi i-DNS kanye nemindeni yamakheli yomibili kuxazululwa ngaphakathi kwesivakashi, ukuthi ishubhu elifile lishiya inethiwekhi esebenzisekayo esikhundleni somgodi omnyama, nokuthi ukuqala kabusha noma ukubuyisela isithombe kukhiqiza isimo esifanayo.