I-SNAT, i-DNAT ne-Masquerade: umthetho ngamunye we-NAT we-VPN wenzani

Beka ukubamba nhlangothi zombili zesango le-VPN futhi umfudlana owodwa ungakhombisa amakheli amane ahlukene. I-NAT yomthombo ibhala kabusha ukuthi iphakethe lithi livela kuphi; i-NAT yomgomo ibhala kabusha ukuthi liya kuphi. I-Masquerade ayiwona umkhombandlela wesithathu, iwumthetho we-NAT yomthombo othatha ikheli kusixhumi esiphumayo esikhundleni senani eliqinile. Shopisha ukuthi iyiphi kulezi zintathu oyidingayo ngempela futhi amathikithi amaningi „i-VPN yephukile“ aphela ekuwumbuzweni ngendlela yokubuya.

Umthetho ngamunye ubhala kabusha ini

I-NAT yomthombo, evame ukubhalwa ngokuthi SNAT, ishintsha ikheli lomthombo lomfudlana lapho uphuma kumzila noma esangweni. Insizakalo eyamukelayo iphendula ekhelini elihunyushiwe, futhi ibhokisi elihumushayo libuyisela ushintsho ngemimo eliyigcinile yalokho kuxhumana. Ku-Linux leyo mimo ihlala ku-conntrack, yingakho i-conntrack -L iphrinta izingqikithi zoqobo neziyimpendulo zihlangene.

I-NAT yomgomo, i-DNAT, ishintsha umgomo esikhundleni salokho. Iphakethe elibhalwe ekhelini lomphakathi ku-UDP 51820 lingabhalwa kabusha liye kuseva ye-WireGuard yangaphakathi ku-10.8.0.2:51820. Yile ndlela umzila wasekhaya noma isilinganisi somthwalo sasefu ejwayele ukushicilela isilaleli se-VPN, futhi lokho akusho lutho ngokuthi umhubhe ungathwala ini ngemuva kwalokho.

I-Masquerade ingeyomndeni we-SNAT. Umthetho awusho likheli; usebenzisa lelo elinaso isixhumi esiphumayo ngesikhathi iphakethe liphuma. I-Linux iyinika umgomo wayo, futhi lokhu kuyisinqumo esivamile kusixhumi se-WAN esithola ikheli nge-DHCP noma nge-PPPoE.

Indawo okuhlala kuyo imephu inquma ukwehluleka

Bhala ingqikithi kumngcele ngamunye: ngaphambi komhubhe, ngaphakathi kuwo nangasosixhumi somphakathi. Ukubamba ngaphakathi komhubhe kwehluka ngokufanele kokungaphandle, futhi onokulinganisa kokubili ngaphandle kokwazi ukuthi ukuhumusha kwenzeka kuphi uzoxosha umsingathi ongafanele.

Ithrafikhi ebuyayo kufanele idlule kudivayisi ephethe imephu. Uma impendulo ithatha enye indlela, enye i-uplink yesibili, umzila wenqubomgomo noma umhlinzeki ongakaze ezwe ngebanga lakho eliyimfihlo, ukuhumusha okuphambene okunesimo akukaze kwenzeke futhi iklayenti libona ithrafikhi yohlangothi olulodwa. Ukwengeza i-NAT yomthombo akuvamisile ukulungisa umzila wokubuya ongekho; kungafihla uphawu kumfudlana owodwa kuyilapho kwephula inqubomgomo esekelwe emakhelini kuyo yonke enye indawo.

Elinye iphutha elivamile ukulindela ukuthi umhubhe udala ukuhamba ngomzila. Iklayenti eliyimfihlo eliphuma nge-inthanethi lininga ukuhlelwa kokuphuma okusebenzayo: umzila ozenzakalelayo, isango elidlulisayo futhi ngokuvamile ukuhumusha komthombo kuyikheli lomphakathi. Ukubethela kukodwa akwenzi ikheli eliyimfihlo lifinyeleleke.

I-Masquerade noma i-SNAT ecacile

Qhathanisa kokubili ngokwabo bakuthembisa. I-Masquerade ikhetha ikheli lokuphuma, i-SNAT ecacile iyalibophela. Esangweni elinekhali lomphakathi elizinzile, ukubophela kunikeza amalogi nezinhlu zamalayisense ezinkampani inani elilodwa elingabikezelwa. Kumgudu we-WAN oguqukayo, ikheli le-SNAT eliboshiwe liba nephele ngaso sikhathi lapho isivumelwano sishintsha, futhi i-Masquerade yakhiwa ngqo yileso simo.

Ububanzi bubaluleke njengokukhetha. Umthetho we-Masquerade ofanayo nayo yonke iphakethe esiphuma esangweni, ngaphandle komkhawulo womthombo noma womgomo, uhumusha nethrafikhi obufuna uyishiye ingathintekile, kuhlanganise nethrafikhi eya kwamanye amanethiwekhi ayimfihlo. Khawulela umthetho kubanga lamaklayenti, umgomo ohlosiwe kanye nesixhumi.

Ku-IPsec esekelwe kunqubomgomo yilapho lokhu kuluma khona kakhulu. Umhlahlandlela wokudlulisa we-strongSwan uhamba ngokuvula ukudlulisa kwe-IP nokwengeza umthetho we-SNAT yomthombo wamaklayenti, futhi imibhalo efanayo ihlanganisa nokukhipha ithrafikhi okufanele igcine ikheli layo loqobo. Humusha umthombo ngaphambi kokuba inqubomgomo yezokuphepha ifane nawo futhi umhubhe ungakhuphuka kuyilapho ithrafikhi isawa, ngoba iphakethe alisabonakali njengesikhethi okwavunyelwana ngaso.

Futhi nquma ukuthi uhlangothi olukude kufanele lubone ini. Ngemuva kokuhumusha insizakalo ibona isango, hhayi iklayenti ngalinye. Lokho kwenza ukuhamba ngomzila wokubuya kube lula futhi ngesikhathi esifanayo kushephisa amalogi futhi kwephula izinhlu zamalayisense zeklayenti ngalinye. Uma ukugcina amakheli amaklayenti kubalulekile, hlela indlela yokubuya enomzila esikhundleni sokuwafihla ukuze isivivinyo sidlule.

Ukufunda imithetho esangweni le-Linux

Isango lokufinyelela kude elinamaklayenti ku-10.8.0.0/24 nesixhumi se-WAN esibizwa nge-eth0 lidinga ukudlulisa okuvuliwe nenqubomgomo yokuhlunga evumela umfudlana, ngaphambi kokuba noma yimuphi umthetho we-NAT usize. Inguqulo ye-iptables igcina zombili izinhlangothi kuthebula le-nat:

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 51820 \
  -j DNAT --to-destination 10.8.0.2:51820

Isimo se-nftables sisebenzisa amahhuku amabili afanayo ngesixhumi esiqanjwe ngegama kanye nochunge lwangempela:

nft add rule ip nat postrouting ip saddr 10.8.0.0/24 oifname "eth0" masquerade
nft add rule ip nat prerouting iifname "eth0" udp dport 51820 dnat to 10.8.0.2:51820

Zombili izingcezu zicabanga ukuthi uchunge lokuhlunga selukwamukela umfudlana odlulisiwe. I-NAT akuwona umthetho wemvume, futhi iphakethe elihunyushwe ngendlela efanele lingasaphonswa kuthebula elilodwa ngemuva. Qinisekisa imephu ekhona nge-conntrack -L, qinisekisa okulayishiwe nge-nft list ruleset noma nge-iptables-save -t nat, bese ubamba kuzo zombili izixhumi ukuze ubone ukuthi ikheli lishintsha ngempela.

Izimo zokwehluleka ezibukeka njengomthetho omubi

Ithrafikhi yokhanda lwezinwele iyisikole sakudala. Iklayenti langaphakathi elifinyelela iseva yangaphakathi ngekheli lomphakathi leseva lidinga i-DNAT endleleni yokungena kanye nokuhumusha komthombo endleleni yokuphuma, ngaphandle kwalokho iseva liphendula ngqo kuklayenti futhi impendulo iyenqatshwa. Isixazululo umthetho wesibili, omncane kakhulu waleso simo sangaphakathi-kuya-komphakathi, hhayi umthetho we-Masquerade obanzi wakho konke.

Ukuhumusha kabili yikho okuthulile. Iklayenti eselivele lingemuva kwe-NAT yezinga lomhlinzeki lifika esangweni lakho ngekheli ongakwazi ukulihambisa ngomzila libuyela emuva, ngakho uhumusha futhi. Kuyasebenza, kodwa amalogi manje athwala ukugxuma okubili kwamakheli ayimfihlo futhi noma yimuphi uphenyo udinga zombili izimephu. I-IPsec esekelwe kunqubomgomo yengeza ukusonteka kwesithathu: humusha ngaphambi kokuba inqubomgomo ifane futhi uthola i-SA emile ngaphandle kwethrafikhi edlulayo, okufundwa njengephutha lokuvimbela umlilo hhayi le-NAT.

Bese kuba nesivivinyo esidlulayo nokusatshalaliswa okwehlulayo. Ukugijima umyalo we-NAT ngesandla kufakazela indlela yokusebenza, hhayi ukumiswa. Umthetho owengezwe ngesikhathi sokusebenza unyamalala ekubuyiselweni noma emcimbini olandelayo wesixhumi, futhi umthetho we-Masquerade oboshelwe esixhumini esishintsha inombolo ungashintsha buthule ikheli elibonwa uhlangothi olukude. Faka umthetho ekumisweni kovimbeli umlilo ongumnikazi wawo bese uphinda uvivinye ngemva kokuxhuma kabusha.

Uhlu lokuhlola ngaphambi kokugcina umthetho

Qala ngokusho uhlangothi: umthombo, umgomo noma kokubili. Bese unquma ukuthi ubani okufanele agcine isimo — isango, umzila ongenhla noma umlingani we-IPsec — futhi uqinisekise ukuthi indlela yempendulo ibuya ngayo. Khawulela umthetho kubanga lamaklayenti, umgomo nesixhumi osiqondile ngempela, futhi unqume kusengaphambili ukuthi uhlangothi olukude kufanele lubone isango noma ikheli loqobo leklayenti.

Vivinya kusuka kuklayenti, hhayi esangweni. Isiphequluli esisangweni uqobo singadlula ngokuphelele umthetho wokuhumusha wamaklayenti, ngakho ikhasi elisebenza lapho alifakazeli lutho ngomhubhe. Thumela isicelo esisodwa esiqala kuklayenti, bukela izibali nethebula le-conntrack, bese uphinda ngemva kokuxhuma kabusha komhubhe nokushintsha kwekheli le-WAN uma okukodwa kwalokho kungenzeka lapho usebenza khona.