Indlela yokuthumela kuphela isixhumi esisodwa sangasese nge-VPN

Isixhumi esisodwa sangasese emhubheni nakho konke okunye ngomzila wakho ojwayelekile isicelo esincane esinezindlela eziningi zokwenza iphutha. Umphumela awunqunywa yibhokisi lokumaka elibizwa split tunneling, kodwa yilapho isinqumo sikhutshwa khona: kuthebula lemizila yeklayenti uqobo, emzileni ophushwa iseva, noma kunqubo-mgomo okuxoxisana ngayo iziphelo ezimbili. Uma ukhetha isendlalelo esingalungile uzothola umhubhe ogcwele obungeke uwufune, noma umzila okhombisa emhubheni ohlangothi olunye lwenqaba ukuwamukela. Ngisebenzisa isivivinyo esinemibandela emithathu ngaphambi kokuvula noma yikuphi ukuhlelwa, bese ngikhetha enye yezindlela ezingezansi.

Imibandela emithathu enquma umklamo

Okokuqala, udinga isiqalo-sozigaba nesifihlo esinembile kumnikazi wenethiwekhi. Inethiwekhi engu-10.x ayisona isiqalo-sozigaba; 10.20.0.0/16 yisona. Qinisekisa ukuthi ayihlangani ne-LAN yasekhaya, ibhuloho le-Docker noma enye i-VPN oyisebenzisayo, ngoba ukuhlangana kwenza umzila ungacaci futhi i-kernel ikhetha umugqa obukhangele.

Okwesibili, ubani ophendula ithrafikhi ebuyayo. Ukuhambisa iphakethe emhubheni kukuyisa kuphela kuseva ye-VPN. Uma isixhumi silele ngemuva komunye umhleli ongenawo umzila obuyela echibini lakho lamaklayenti, iseva kufanele ifihle ithrafikhi, noma lowo mhleli kufanele afunde ichibi lakho. Awukho umzila ohlangothini lweklayenti olungilungisa umzila wokubuyela ongekho.

Okwesithathu, indawo yokuphoqelela. Amanye amaklayenti afaka umzila bese uhlelo lokusebenza lwenza okunye. Amanye axoxisana ngomgomo, futhi umgomo isango elingawamukeli awukhiqizi mhubhe nhlobo: amaphakethe alahlwa ngaphandle kwephutha elicacile. Thola ukuthi yikuphi kwalokhu okubili okuyikhasi lakho ngaphambi kokubhala noma yini.

WireGuard: AllowedIPs iyithebula lemizila

Kuklayenti, AllowedIPs ibala izindawo ezingangena emhubheni, futhi wg-quick iguqula umugqa ngamunye ube umzila ojwayelekile. Ngakho ingxenye yeklayenti yalo msebenzi iwumugqa owodwa.

[Peer]
PublicKey = ...
Endpoint = vpn.example.net:51820
AllowedIPs = 10.20.0.0/16

Manje qhathanisa umugqa weseva wale kliyenti efanayo. Uchaza lokho iseva ezokuthumela kuklayenti, okuvame ukuba ikheli lomhubhe weklayenti, hhayi isixhumi sangasese.

[Peer]
PublicKey = ...
AllowedIPs = 10.99.0.2/32

Ukushintsha lokhu kokubili iwephutha engilibona kaningi. Ukubeka 10.20.0.0/16 ngaphansi kwesigaba se-peer seseva kusho ukuthi sonke isixhumi silele ngemuva kwaleyo kliyenti, futhi lokho kuyisimangalo sokusuka endaweni kuye endaweni, hhayi imvume. Amaphakethe angahambisani ne-AllowedIPs yanoma iyiphi i-peer alahlwa buthule, ngakho umugqa ongalungile ubonakala ufana ncamashi nenkinga yodonga lomlilo.

Uma ngabe wena uqobo uphatha imizila, setha Table = off ngaphansi kwe-[Interface] futhi wengeze umzila owufunayo. Ngaleso sikhathi akukho okungezwa ngokuzenzakalela, ngakho umzila kufanele ube kulokho okuphakamisa isixhumanisi.

OpenVPN: phusha umzila, bese uqinisekisa ukuthi uyafika

Kuseva ejwayelekile ushintsho luwumyalo owodwa ekuhlelweni kweseva, eceleni kwechibi lamaklayenti.

push "route 10.20.0.0 255.255.0.0"

Iklayenti iwengeza lapho ixhuma. Ikhasi lokwehluleka livela lapho iphrofayili efanayo iphusha futhi i-redirect-gateway, noma lapho othile esewengeze i-route-nopull: eyokuqala iguqula isikhathi sibe umhubhe ogcwele, eyesibili ilahla yonke imizila ephushiwe, kuhlanganise neyakho.

Iklayenti edinga ukuziphatha okuncane mayelana neseva yomhubhe ogcwele kufanele izibe kuphela izingxenye engazifuni. Ku-OpenVPN 2.4 nangemuva kwayo, i-pull-filter ikhona ngenjongo yalokhu.

pull-filter ignore "redirect-gateway"
route 10.20.0.0 255.255.0.0

Gcina imindeni yamakheli ihlukene: umzila we-IPv4 ophushiwe awenzi lutho kusevisi yangaphakathi ehlukaniswa nge-IPv6, futhi leyonsevisi yehluleka emhubheni kuyilapho konke okunye kubonakala kukuhle.

Lapho isixhumi sangasese singekho kuseva ye-VPN kodwa silele ngemuva kwenye iklayenti, iseva kufanele yaziswe. Engeza ifayela lekliyenti ngayinye nge-client-config-dir eliqukethe i-iroute 10.20.0.0 255.255.0.0, kanye ne-route ehambisanayo ukuze amanye amaklayenti afunde umzila. Ngaphandle kwe-iroute iseva ayinasizathu sokuthumela leso siqalo-sozigaba ngalowo mhubhe othile.

IPsec: izinto ezikhethiwe zethrafikhi kufanele zivumelane

Ku-IPsec awukho umzila ongaphushwa. Iziphelo ezimbili zixoxisana ngokuthi yimaphi amakheli angaphakathi komhubhe, futhi ithrafikhi engaphandle kwezinto ezikhethiwe ezivunyelwene ngazo ayibethelwa futhi ayidluliswa kuwo. Kuklayenti ye-strongSwan izinto ezikhethiwe zicacile.

leftsubnet=192.168.1.0/24
rightsubnet=10.20.0.0/16

Uma isango lihlelwe nge-0.0.0.0/0 ezinhlangothini zombili, ukuncipha kwe-IKEv2 ngokuvamile kunciphisa i-SA yengane iye ekuhlanganyeleni kweziphakamiso ezimbili, okuwumphumela ofunayo. Amanye amasango enqaba isiphakamiso esingahambisani nezinto zawo ezikhethiwe ezihleliwe, futhi ilogi lapho ikhombisa i-SA yengane ehlulekile hhayi isikhalo somzila. Lapho lokho kwenzeka ushintsho lungolwesango, ngoba umzila weklayenti awukwazi ukwakha umhubhe wento ekhethiwe olunye uhlangothi olungeke luyamukele.

Ku-Windows iklayenti elakhelwe ngaphakathi ifihla isinqumo esifanayo ngemuva kwezilungiselelo ezimbili. Ukuhlukaniswa komhubhe kufanele kuvuliwe, futhi isiqalo-sozigaba kufanele sibhaliswe kuphrofayili.

Set-VpnConnection -Name Office -SplitTunneling $true
Add-VpnConnectionRoute -ConnectionName Office -DestinationPrefix 10.20.0.0/16

Ukubhaliswa kwesiqalo-sozigaba yikho okusenza siphile ngemuva kokuxhuma kabusha, into umzila owengezwe ngesandla ongayenzi.

Gcina indawo yokugcina ne-DNS ngaphandle kwesinqumo

Indawo yokugcina ye-VPN kufanele ihlale ifinyeleleka ngaphandle komhubhe, ngaphandle kwalokho umhubhe uwela kuwo uqobo. Lapho kuhlelwa kuphela i-10.20.0.0/16 lokho kuyazenzakalela, ngoba indawo yokugcina iyikheli lomphakathi. Kuphrofayili yomhubhe ogcwele akunjalo, futhi iklayenti idinga umzila womsingathi ocacile oya endaweni yokugcina ngaphambi kokuba umhubhe ukhuphuke.

I-DNS isinqumo sesibili isiphusho somzila esingasithathi egameni lakho. Amagama angaphakathi ngokuvamile axazululwa ngesixazululi okungafinyelelwa kuso kuphela inethiwekhi yangasese. Uma iseva iphusha iseva ye-DNS, lonke igama lidlula kuyo; uma ingayiphushi, amagama angaphakathi ayehluleka noma axazululwe esidlangalaleni aye kokuthile obekungakukhangele. I-DNS ehlukanisiwe igcina isizinda esisodwa sokusesha kusixazululi sangaphakathi, kodwa lokho kuncike ekusekelweni kweklayenti, ngakho kuthatha njengomsebenzi wawo hhayi umphumela oseceleni wokuhambisa imizila.

Qinisekisa, bese uqala kabusha futhi uqinisekise futhi

Izivivinyo ezintathu zimboza umbuzo womzila. Buza i-kernel ukuthi ikheli elikude lizoya kuphi, thatha okuthile ngaphakathi kwesixhumi, bese uqinisekisa ukuthi isicelo esijwayelekile somphakathi sisaphuma ngoxhumano lwakho olujwayelekile.

ip route get 10.20.5.7
curl -sS http://10.20.5.7/health
curl -sS https://ifconfig.me

Umugqa wokuqala ubiza isixhumanisi. Uma ubiza isixhumanisi sakho somzimba, umzila awuzange ungene. Ku-Windows i-Find-NetRoute -RemoteIPAddress 10.20.5.7 iphendula umbuzo ofanayo, futhi isivivinyo sokugcina kufanele sisakhombisa ikheli lakho elijwayelekile hhayi eleseva ye-VPN.

Bese uqala kabusha. Imizila eyengezwe ngesandla iyanyamalala, kuyilapho imizila evela kuphrofayili, ekuhlelweni okushushiwe noma ku-AllowedIPs ibuyela emuva. Uma ukufinyelela okuncane kusebenza ngaphambi kokusetha kabusha futhi kwehluleka ngemuva, iphutha lisendleleni umhubhe oqala ngayo, hhayi kumzila uqobo.

Ngaphambi kokusho ukuthi kuphelile, qinisekisa izinto ezine: isiqalo-sozigaba sivela kumnikazi wenethiwekhi futhi asihlangani nanoma yini yasendaweni, umzila wokubuyela ukhona noma umthetho wokufihla uyawuthatha isikhala, indlela oyihlelile iyona ephoqelela ukuhambisa imizila endaweni yakho, futhi izivivinyo ezifanayo ziyaphasa ngemuva kokuqala kabusha okuhlanzekile. Amanothi e-strongSwan mayelana nokudlulisa afanele ukufundwa uma umzila wokubuyela uyingxenye ehluleka njalo.