Ukuhanjiswa komthombo kwamachibi amabili e-VPN: okushiwo umthetho wakho
Umthetho wohlobo lwe-from ufanisa nekheli leklayenti ngaphambi kokuba i-SNAT ilibhale kabusha, futhi ukuhlolwa okuvela esangweni akufanisani nakho kokubili. Gijima ukusesha kwichibi ngalinye bese ufunda amazinga esikhundleni.
Amachibi amabili amaklayenti, isango elilodwa futhi uhlelo lubonakala lulula: umthetho owodwa uthumela ichibi lokuqala ngomgudu ophezulu osheshayo, omunye uthumela ichibi lesibili ngomhubhe womlingani. Bese imithetho isendaweni futhi ichibi lesibili lisaphuma ngomzila ozenzakalelayo. Umthetho awuphukile. Umthombo wephakethe awuyona into umbhali ayilindele ngesikhathi sokusesha, ngoba ukuhumusha nokusesha kwenzeka ezindaweni ezahlukene ohambweni lwephakethe elilodwa, futhi ukulandelana kuphambene nomdwebo wengqondo abantu abaningi abawudwebayo.
Ukusesha kwenzeka ngaphambi kokuba umthombo ubhalwe kabusha
Ephaketheni elidluliswa lisuka kuklayenti ye-VPN, i-kernel yenza ukulandelana okunqunyiwe. Lifika kusixhumi somhubhe, lidlula ku-prerouting lapho kuhlala khona i-conntrack ne-DNAT, bese kuthathwa isinqumo somzila, bese ukudluliswa, bese i-postrouting lapho i-SNAT isetshenziswa khona ekugcineni. Umthetho wohlu lwe-from ubhekwa ngesikhathi saleso sinqumo somzila, okusho ukuthi ubona ikheli lokuqala lekliyenti, hhayi elihunyushiwe.
Ngakho ukwengeza umthetho we-masquerade akushintshi ukuthi iyiphi inqubomgomo ehambisana nokugeleza okuphumayo. Okushintshayo yilokho umkhawulo okude akubonayo, futhi ngenxa yalokho ukuthi iyiphi indlela yokubuya ekhona. Lezi ziyimiphumela emibili ehlukene, futhi ukubuyekezwa kwezinguquko kuhlale kuzixuba. Zihlukanise futhi umklamo uvame ukucaca phakathi nomzuzu.
Kukholu lokuphendula lapho ikheli elihunyushiwe livela khona emthethweni. Iphakethe elibuya esangweni likhonjiswe ekhelini elihunyushiwe, futhi uma unemithetho yenqubomgomo esekelwe endaweni noma kusixhumi elingene kuso, yilokho kukona okuyokufanisa. Uxhumano olulodwa, umthombo weqiniso ohlukile ohlangothini ngalunye.
| Stage | Source the kernel sees | What it means for your rule |
|---|---|---|
| Prerouting | Client address, 172.31.7.42 | Where marks and DNAT are applied |
| Routing decision | Still 172.31.7.42 | This is where from rules match |
| Postrouting | Becomes 198.51.100.9 | What the far end and its return route see |
Ngakho amachibi amabili anemithombo ehlukene adinga ngempela amathebula ahlukene, futhi umklamo ulungile. Okukhishwa ithebula elingenhla yindlela emfishane yokuxazulula ngokubheka lokho okwamukelwa isayithi elikude nokucabanga umthetho kusukela lapho.
Ukuhlolwa okuvela esangweni akulona ukuhlolwa kwechibi
Ithrafikhi eyenziwa isango ngokwalo ayidluli ku-prerouting, ngoba ayifikanga kunoma yisiphi isixhumi. Ihanjiswa emzileni wokuphuma, ngokuthi ikheli lesango ngokwalo libe umthombo, futhi umthetho we-from osekelwe ebangeni lekliyenti awuyofanisa. Yonke ithikithi kulesi sigaba ethi iyasebenza kusukela kubhokisi kodwa hhayi kuklayenti iwukuphindwa kwalelo qiniso.
Lingisa iklayenti esikhundleni sokulinganisa. Ukusesha komzila kungabuzwa ngqo, ngokunikeza umthombo nesixhumi sokungena:
ip route get 198.51.100.9 from 172.31.7.42 iif tun0
ip route get 198.51.100.9 from 172.31.8.42 iif tun0
ip route show table 201Kugijime kanye ngechibi ngalinye. Uma imiyalo emibili ibuyisa isixhumi esifanayo, imithetho ayihlukanisi amachibi, futhi isizathu umthetho ongekho noma umthetho onezinga eliphezulu ohambisana nakho kokubili. Uma ibuyisa izixhumi ezahlukene kodwa iklayenti lisahluleka, iphutha lingemva kokusesha futhi ungayeka ukubheka imithetho.
Izinga, hhayi isikhundla efayeleni
Imithetho ihlolwa ngokulandelana kwezinga elikhulayo, futhi inombolo iyona ebalulekile, hhayi ukulandelana oyithayiphile. Ithebula le-local likuzinga 0, ithebula le-main ku-32766 futhi umthetho ozenzakalelayo ku-32767, yingakho umthetho owengezwe ngezinga elizenzakalelayo uwela eduze nokuphela kohlu futhi uhlulwa cishe yikho konke.
ip rule show
ip rule add from 172.31.8.0/24 lookup 201 priority 1000
ip -4 route show table 201Izinga elicacile lenza ukulandelana okuhlosiwe kubonakale efayeleni nasekubuyekezweni. Futhi livimbela ukwengezwa kwakamuva ukuba kweqe ngokuthula phambi komthetho okhona, okuyisizathu esivame kakhulu sokuthi inqubomgomo esebenzayo iyeke ukusebenza ngemva koshintsho olungahlobene.
Umthetho ofanisayo okhomba ethebuleni elingaphelele ungenye ingibe. Uma ithebula 201 linomzila ozenzakalelayo kodwa lingenawo umzila oya endaweni, iphakethe liyalahlwa noma lithunyelwa endaweni engalungile, futhi umthetho ubonakala ulungile ngokuphelele uma uwubheka wedwa. Funda ithebula, hhayi umthetho kuphela. Umthetho uyisikhombisi, futhi ithebula elingenalutho yisikhombisi esiya lutho.
Indlela yokubuya kusamele ibekhona
Inqubomgomo yomthombo ikhetha indlela yokuphuma. Ayidali indlela yokubuya. Uma ichibi lesibili liphuma ngomhubhe womlingani, umlingani kufanele azi ukuthi ufinyelela kanjani ku-172.31.8.0/24, kungaba ngomzila wokubuya esangweni noma ngokwamukela amakheli ahunyushiwe asewazi.
Ukukhetha phakathi kwalokho kuyisinqumo somklamo esinemiphumela ebonakalayo. Ukuhanjisa ibanga lamaklayenti libuyela emuva kugcina ubunikazi beklayenti ngayinye kumlingani futhi kudinga ukuthi amukele isiqalo sakho. Ukuhumusha kufihla ichibi ngemuva kwekheli elilodwa futhi kudinga ukuthi umlingani amukele lelo kheli kuphela, ngezindleko zokuthi amalogi akho nawakhe awasavumelani ngokuthi ubani oxhumile.
Noma yini oyikhethayo, yibhale eceleni kwencazelo yechibi. Umzila wokubuya okhona kuphela emqondweni womuntu othile yikona kanye into eqhubeka ikhona kuze kube umlingani ushintsha i-firewall, bese kuthatha usuku ukuyibuyisela.
Ungabambeli umhubhe wesango ngokwalo enqubomgomeni
Imithetho oyibhalela amaklayenti isebenza futhi kuthrafikhi eyenziwa isango, ngaphandle uma uyikhipha. Umthetho obanzi osekelwe kuphawu noma kusixhumi sokuphuma ungabamba uxhumano lwesango ngokwalo nomlingani, bese umhubhe othwala inqubomgomo uhanjiswa yinqubomgomo. Lokho kukhiqiza umjikelezo noma ukuphazamiseka okubonakala njengephutha lomhlinzeki.
Nciphisa umthetho ngamunye ngangokuba umklamo uvumele: isiqalo somthombo, isixhumi sokungena futhi, lapho kusekelwa khona, uphawu oluthwelwa amaphakethe eklayenti kuphela. Bese uhlola ukuxhumana kwesango ngokwalo ngemva kwashintsho ngalunye lomthetho, ngoba iphutha lizibhekisela lona futhi alibonakali ekuhlolweni okuvela kuklayenti.
Ikhasi lemanuwali le-ip-rule libhala incazelo yesikhethi neyezinga. Hlanganisa nokuhlolwa kokusesha kwechibi ngalinye futhi umklamo uyahloleka, futhi lowo umahluko phakathi kokuhanjiswa kwenqubomgomo okuhlala unyaka nokuthi wonke umuntu owesaba ukukuthinta.