Ingabe kufanele usebenzise i-SNAT ekudluliseni iphothi ku-VPN subnet?

Ukudlulisela iphothi kumsingathi ongemuva kwekhlayenti ye-VPN ye-router uqobo kuyahluleka ngendlela ebukeka njengenkinga ye-firewall, ngoba isicelo sifika ngokusobala. Isevisi irekhoda ukuxhumana, ikhlayenti ilinda, futhi akukho lutho olubuyayo. Ukuhumusha kwendawo okuyiwa kuyo kwenze umsebenzi wakho; iphakethe lokubuya yilona ngxenye elahlekile. Umthetho owodwa okhethiwe we-NAT yomthombo kwi-router uyalungisa lokhu, futhi ingxenye ethakazelisayo ukunquma ukuthi lowo mthetho ungaba mncane kangakanani.

Kungani impendulo ithatha enye indlela

Ukudlulisa iphothi kubhala kabusha ukuthi iphakethe liya kuphi, akukaze kubhale ukuthi lavelaphi. Ikheli lekhlayenti ye-inthanethi lihlala endaweni yomthombo kuyo yonke indlela phakathi kwethuneli, ngakho isevisi ekude ibona umfokazi futhi iphendula ngendlela eyodwa eyaziyo: nge-gateway yayo emisiwe. Leyo gateway iyisihlanganisi se-VPN ohlangothini olukude, esingenayo indlela yokubuya eya kunoma yiliphi ikheli lomphakathi.

Buka ukuthwebula kusixhumi sethuneli futhi ukungalingani kusobala: amaphakethe esicelo aphuma, akukho okungena. Uchungechunge lokudlulisa luvumele ukugeleza futhi ithuneli layithwala, ngakho ukulahla kwenzeka ngemva kokuba umsingathi okude esekhethe indlela yokubuya.

Umthetho womthombo omncane ngokwanele ukwethenjwa

Yenza i-router ibe umthombo umsingathi okude aphendula kuwo. Kulesi sakhiwo ikheli le-WAN yi-203.0.113.24, i-LAN yi-192.168.88.0/24, ikheli lethuneli le-router yi-172.20.5.1, futhi isevisi iphendula ku-172.20.5.40:8443. Umthetho ongezansi uhambisana nephakethe ngemva kokuhumusha indawo okuyiwa kuyo, yingakho ibiza ikheli elihumushiwe hhayi elomphakathi. Akukho lutho kuwo oluncike ekhelini lekhlayenti, futhi yilokho kanye iphuzu.

iptables -t nat -A POSTROUTING -o tun0 -p tcp -d 172.20.5.40 --dport 8443 -j SNAT --to-source 172.20.5.1

Konke ukufanisa kulowo mugqa kukhona ukuze ukubhala kabusha kuhlale kusendaweni kusevisi eyodwa ethunelini elilodwa. Susa isixhumi noma iphothi futhi uzobe ubhala kabusha ithrafikhi eningi kunalokho okudingwa yinkinga, futhi yileyo ndlela ukulungisa okuqondisiwe okuphenduka kube yindida kumuntu olandelayo.

Nini ukufihla konke kuyisinqumo esithembekile

Uma i-router idlulisela izinsiza eziningi ku-VPN subnet efanayo, umthetho wesevisi ngayinye uba uhlu olungekho muntu olunakekelayo. Ukufihla konke okuphuma kusixhumi sethuneli kulula futhi kuyabikezelwa, ngezindleko zokufihla ikhlayenti lokuqala kusukela kumsingathi ngamunye ohlangothini olukude. Khetha lokho lapho amarekodi alakhaya engasetshenziswa ekwabelweni; gcina umthetho omncane uma esetshenziswa.

Zombili izinketho zehluleka ngendlela ehlukile. Umthetho omncane ongekho uphula isevisi eyodwa; ukufihla okubanzi okufanisa okuningi kakhulu kungabhala kabusha ngokuthula ithrafikhi eyayivele isebenza, kuhlanganise nokuxhumana kwayo okuphumayo kwe-router uqobo.

Hlola izibali ngaphambi kokushicilela

Imithetho engafani neze ibukeka ifana ncamashi nemithetho esebenzayo kuze kube yilapho ubala amaphakethe. Funda ithebula futhi ngezibali zamabhayithi ngaphambi kokuba noma iyiphi ikhlayenti ixhumeke, bese uxhuma kunethiwekhi engeyona i-LAN futhi ulifunde futhi. Ukufunda kabili yikho okuguqula ukuqagela kube yiqiniso. Shicilela ukudlulisa kuphela ngemva kokuba owesibili unyakazile.

iptables -t nat -L POSTROUTING -v -n --line-numbers

Isibali esinguziro kumthetho womthombo ngemva kokuxhumana kwangempela sisho ukuthi ukufanisa akulungile, ngokuvamile ngoba indawo okuyiwa kuyo noma iphothi akuhambisani nephakethe ngemva kokuhumusha. Uma isibali sikhuphuka kodwa ikhlayenti isaphelelwa yisikhathi, indlela yokubuya isilungisiwe futhi kukhona okunye okulahla impendulo, ngakho bheka phambili inqubomgomo yokudlulisa ohlangothini olukude. Ukufinyelela kwe-hairpin kusuka ngaphakathi kwe-LAN kuyinkinga ehlukile futhi kudinga umthetho wayo, hhayi inguqulo ebanzi yalona.