Ngemva kokushintsha kwe-IP yeseva, umthetho we-SNAT usabiza owakudala

Iseva yathuthela ekhelini elisha, amaklayenti asaxhuma, futhi akukho lokho akuthumayo okufinyelela ku-inthanethi. Lokho kwehlukana kuwuphawu: isokhethi elalelayo nokudluliswa kwephothi kwasinda ekuthutheni, ngakho ithuneli liyaphakama, kuyilapho ukuhumusha komthombo okusetshenziswa kumaphakethe adlulisiwe kusabiza ikheli isingathi esingasaliphethe. Izimpendulo kulawo maphakethe abhalwe kabusha ziya emshinini ongasekho.

Ukuxhuma nokudlulisa kwehluleka ezindaweni ezahlukene

Ukusungulwa kuncike endaweni yokugcina amaklayenti aseyazi: ikheli lomphakathi, ukudluliswa kwephothi okungaphambili kwayo kanye nesilaleli esingaphakathi. Ithrafikhi edlulisiwe incike esinqumweni sesibili esithathwa ngemva kokuba iphakethe lingene ethunelini, lapho isingathi sibhala kabusha umthombo waso ukuze izimpendulo zithole indlela yokubuya.

Ukushintsha kwekheli kuphula isinqumo sesibili kuphela, yingakho uphawu lufundwa ngokuthi "kuxhunyiwe kodwa akukho inthanethi". Lokhu futhi kuchaza ukuthi kungani ukuhlola okuvamile ohlangothini lweklayenti kubonakala kuphilile: ukuxhawana kuqedwa, iklayenti lithola ikheli, futhi ngisho ne-ping eya ekhelini lethuneli leseva ingaphendula. Amahora achithwa eklayentini ngenxa yephutha elihlala kolunye uhlangothi, ngakho ithebula lemithertho iyindawo yokuqala okufanele ibhekwe.

Funda umthetho nezibali zawo ngaphambi kokuhlela

Bhala uhlu lwemithetho yokuhumusha nezibali bese uqhathanisa umthombo ohleliwe namakheli isingathi esinawo ngempela. Umthetho obhalwe kabusha waya ekhelini elifile uvamise ukukhombisa ithrafikhi endleleni yokungena, ngoba amaphakethe ayafinyelela kuwo futhi ahunyushwe, futhi akukho lutho endleleni yokubuya.

sudo iptables -t nat -L POSTROUTING -n -v --line-numbers
ip -4 addr show

Hlola izinkambu ezintathu ngesikhathi ukhona: iphuli ekufanisweni komthombo, i-interface yokuphuma uma umthetho ubiza eyodwa, kanye nokukhishwa okugcina ithrafikhi phakathi kwamathuneli ingabhalwa kabusha. Lokho kukhishwa kulula ukukulahlekelwa ngesikhathi kuhlelwa, futhi ukukulahlekelwa kwakho kwenza ithrafikhi phakathi kontanga ibonakale isebenza kuyilapho izimpendulo zayo zithatha indlela exakile.

Uma izibali zimile kuziro, amaphakethe awafinyeleli kulo mthetho futhi ikheli akusiyo inkinga yamanje. Sesha umthetho olwela phambili ochainini, okwenzeka lapho othile engeza okunye esikhundleni sokuhlela okwangempela. Qhathanisa izinombolo zomthetho nokuphuma owakubhala phansi emzuzwini owedlule. Ukulandelana kuyingxenye yokuhlelelwa, akuyona imininingwane yokuhlobisa.

Shintsha umthombo, noma yeka ukuwubiza

Uma isingathi sinekheli elizinzile, shintsha umthetho endaweni yawo esikhundleni sokwengeza omunye. Ukushintsha ngenombolo yomthetho kugcina ukulandelana okuncike kukho okusele kwechaini.

sudo iptables -t nat -R POSTROUTING 1 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to-source 10.151.0.40

Uma ikheli linikezwa ngendlela eguquguqukayo, ungabizi noma yimuphi umthombo futhi uvumele ikherneli ukuthi ikhethe elamanje kwi-interface yokuphuma. Lolo hlobo lweqa ukuthutha okulandelayo ngaphandle kokuhlelwa, ngezindleko zokufihla ukuthi yiliphi ikheli elasetshenziswa.

sudo iptables -t nat -R POSTROUTING 1 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -o eth0 -j MASQUERADE

Qinisekisa ukuthi ukudluliswa kwe-IPv4 kusakhutheka ngokuhlelelwa okulawulwayo, bese wenza umthetho uhlale unjalo ngomshini wokusabalalisa ngokwawo. Ushintsho olwenziwe kuphela kukherneli esebenzayo luyabuya ekuqaleni okulandelayo, ngokuvamile ngesikhathi sokunakekela okungekho muntu okuxhumanisa nokushintsha.

Izindlela ezimbili zokwenza ukushintsha kungalungi

Ukuhumusha iphuli waya ekhelini lethuneli leseva esikhundleni sekheli lalo le-LAN kuthumela izimpendulo ziqonde emuva ethunelini, lapho ziqondiswa khona kuklayenti elingakaze likucela. Ukuxhumana kuma ngendlela ebukeka njengomjikelezo womzila, ngoba unjalo ngempela.

Ukufaka ukuhumusha kwesibili phezu kokudala kungenye iphutha. Umthetho wokuqala ofanayo uyawina, ngakho okufakiwe okudala kuqhubeka kuphatha amaphakethe kuze kususwe, futhi izibali zomthetho omusha zihlala kuziro kuyilapho wonke umuntu esola ukushintsha. Susa okuphindwe kabili ngaphambi kokwengeza noma yini entsha. Bese ufunda uhlu futhi uqinisekise ukuthi ukuhumusha okukodwa nje kufana nephuli.

Uma ithuneli lithwala ne-IPv6, phinda konke ukubuyekezwa esitekhini esinye. Umzila ozenzakalelayo we-IPv6 ongenakho ukuhumusha nengenakho isiqalo esimiswe umzila wehluleka ngokuthula okufanayo, futhi kulula ukukhohlwa ngoba konke okungaphezulu kubukeka kufana.

Amasevisi angenayo adinga ukuhumusha okuphambene

Isevisi kuklayenti le-VPN okufanele ifinyeleleke kusuka ngaphandle idinga ukuhumusha kwendawo, hhayi ukuhumusha komthombo: iphothi lomphakathi libhalwa kabusha laya ekhelini lethuneli leklayenti ngaphambi kokungena. Indlela yokudlulisa bese idinga umthetho ocacile ovumela leyo thrafikhi.

sudo iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 10.9.8.2:8080

Ungalokothi uhumushe iphothi elithwala ithuneli ngokwalo, ngoba lokho kubhala kabusha kuphula ukuxhumana okugcina isevisi ifinyeleleka. Gcina iphothi lethuneli lingaphandle kwemithetho yendawo ngokuphelele. Ekugcineni qinisekisa kuzo zombili izinhlangothi: izibali kumthetho omusha, ukubanjwa okufushane kudivayisi yethuneli, kanye nesicelo esisodwa ekhelini elingaphakathi ethunelini ngaphambi kokuzama elomphakathi.