Ukuphuma okuhlukile: ipuli ye-VPN ku-usb0, ithrafikhi yesango ku-eth0

Amaklayenti ayaxhuma futhi aqinisekise, bese ithrafikhi yawo iphuma ngomugqa ongaphezulu ongafanele, ngoba indlela eyodwa yokuzenzakalelayo emshinini ingeyesango ngokwalo. Ukushintsha leyo ndlela yokuzenzakalelayo kuzophula izibuyekezo zomshini kanye nokufinyelela kokuphatha, ngakho ukukhetha kufanele kube mncane kuno-«yonke ithrafikhi». Isimo esisebenzayo umthetho wenqubomgomo osuselwe kukheli lomthombo langaphakathi lepuli yamaklayenti, okhomba kwithebula lesibili lokuhamba kwemizila eline-WAN ehlukile. Kusukela lapho uhlu lokuhlola lukhuluma ngokuphelela nokuziphatha lapho kwehluleka, hhayi ngomthetho ngokwawo.

Qinisekisa ukuthi ikheli lomthombo lihlala lize lifike esinqumweni sokuhamba kwemizila

Umthetho wenqubomgomo ohambisana nebanga lomthombo uvula kuphela lapho iphakethe lisaphethe lowo mthombo ngesikhathi sokusesha. Ithrafikhi yamaklayenti edlulisiwe yenza lokho, inqobo nje uma kungekho lutho oluphezulu oluyibhalile kabusha ngaphambi kokuhamba kwemizila. Ithrafikhi edalwa isango ngokwalo ayikwenzi lokho, futhi yikho kanye isizathu sokuthi indlela yokuzenzakalelayo yesango ingahlala lapho ikhona.

Yilapho izivivinyo zasendaweni zidukisa khona. I-curl egijinywa esangweni iwukugeleza okwakhiwe endaweni ngekheli lesango, ngakho ithatha ithebula eliyinhloko futhi ayifakazi lutho mayelana nomzila weklayenti. Viva kuklayenti elixhunyiwe, noma wakhe ithrafikhi ngomthombo ongokwakhona ongowepuli.

Qala ngokubhala amanani angempela: isiqalo sepuli, isixhumanisi somhubhe osiphethe, ikheli nesinyathelo esilandelayo se-WAN yesibili, kanye nenombolo yethebula ohlose ukuyisebenzisa. Sula imithetho emidala kunoma yimuphi umzamo wangaphambilini ngaphambi kokwengeza emisha, ngoba imithetho ephindiwe emazingeni ahlukene okubaluleka ikhiqiza ukwehluleka okubonakala kungahleliwe.

Yakha ithebula elikhethiwe eliphelele

Ithebula akuyona indlela yokuzenzakalelayo enomngane. Lidinga imizila eyanele ukuze ukusesha ngakunye kuxazululwe ngaphakathi kwalo, kuhlanganise nomzila oxhunyiwe wengxenye ye-WAN ukuze isinyathelo esilandelayo sifinyeleleke. Ngepuli engu-10.77.0.0/24 ku-tun1, ikheli le-WAN elingu-203.0.113.20/24 elinesinyathelo esilandelayo esingu-203.0.113.1, nethebula elingu-600:

ip -4 route replace 203.0.113.0/24 dev usb0 src 203.0.113.20 table 600
ip -4 route replace 10.77.0.0/24 dev tun1 table 600
ip -4 route replace default via 203.0.113.1 dev usb0 table 600
ip -4 rule add priority 1500 from 10.77.0.0/24 lookup 600

Umthetho uhlezi ezingeni lokubaluleka elingaphansi kwanoma yimuphi umthetho okhona obamba konke, ngakho amaklayenti ahambisanayo ashaya ithebula elingu-600 kuqala futhi konke okunye kuwela kuthebula eliyinhloko. Isithenjwa se-ip-rule sichaza ngokuphelele imodeli yokusesha ehleliwe kanye nesakhiwo sokubhala sesikhethi.

Bese ucabanga ngalokho ithebula elingenakho. Indawo yokuyisa enomzila osethebuleni eliyinhloko kuphela, njengengxenye yokuphatha efinyeleleka ngo-eth0, ayizukutholakala kuthebula elingu-600 futhi ayizukubuyela kweliyinhloko uma sekunendlela yokuzenzakalelayo lapho. Uma leyo mizila ibalulekile, yengeza ngokucacile ethebuleni elikhethiwe, okuvamise ukuba yimpendulo efanele yethebula lokuphuma le-VPN.

Gcina ithrafikhi yesilaleli ngokwaso ingaphandle kwenqubomgomo

Isilaleli se-OpenVPN sinokuxhumana kwaso kwangaphandle, okuthwalwa ngomugqa ongaphezulu iklayenti elafinyelela kuwo. Leyo thrafikhi kufanele igcine indlela yokubuya eyafika ngayo, futhi umthetho obanzi ohlanganisa ikheli lomphakathi leseva noma yonke into yomhubhe ungayidonsela ethebuleni elihlukile. Khawulela umthetho epulini langaphakathi hhayi kokunye.

Ukuhlunga komzila wokubuya nakho kufanele kubhekwe ngesizathu esifanayo. Lapho izimpendulo eziya kumaklayenti ziphuma ngo-usb0 ngenkathi isicelo sifika ngesinye isixhumanisi, ukuhlelwa okuqinile kwe-rp_filter kungalahla amaphakethe enqubomgomo yokuhamba kwemizila ewabona evumelekile. Hlola amanani e-sysctl asebenzayo kuzo zombili izixhumanisi ngaphambi kokuphetha ngokuthi umthetho wehlulekile.

Ukwesulela kobalulekile futhi maqondana nakho konke okunye emshinini. Amabhuloho e-Docker, i-VPN yesibili kanye nanoma yimiphi imithetho ekhona kakade evela kusithombe somhlinzeki konke kwengeza amazinga okubaluleka, ngakho funda uhlu oluphelele lwemithetho esikhundleni sokucabanga ukuthi izinga lokubaluleka elingu-100 lilodwa.

Yenza ukudlulisa nokuhumusha kuhambisane nomzila

Ukuhamba kwemizila kukhetha umugqa ongaphezulu; akunikezi imvume yokudlulisa. I-mboni kufanele ibe nokudlulisa kwe-IPv4 okuvuliwe, futhi udonga lomlilo kufanele lwamukele isiqondiso esisuka kuklayenti siya ku-WAN kanye nethrafikhi yokubuya. Ithebula elifanele elineketanga le-FORWARD elilahla ukugeleza linikeza uphawu olufanayo nendlela engekho, ngakho kokubili kuhlolwa ngasikhathi sinye.

Uma i-WAN yesibili ingayihambisi ipuli yangasese ibuyela kuwe, humusha umthombo kuleyo ndawo yokuphuma. Esixhumanisini esinekheli eliguqukayo, ukukhetha okuvamile umthetho wemasquerade omncane obekelwe ipuli nesixhumanisi:

iptables -t nat -A POSTROUTING -s 10.77.0.0/24 -o usb0 -j MASQUERADE

Lapha ububanzi bubaluleke kakhulu kunomgomo. Umthetho wemasquerade ohambisana nanoma yisiphi isixhumanisi esiphumayo uzobhala kabusha nethrafikhi ephuma ngendlela efanele ngo-eth0, futhi lokho kufihla amaphutha okuhamba kwemizila esikhundleni sokuwalungisa. Ukuhumusha kwenzeka ngemva kwesinqumo sokuhamba kwemizila, ngakho akunakulungisa neze iphakethe elithunyelwe kumugqa ongaphezulu ongafanele.

Izindleko zombheke nakho zidinga ukunakwa lapho imizila yehlukile. Uma amaklayenti evumelana nge-TCP MSS enkulu futhi i-WAN ehlukile inokuthi i-MTU ephansi noma umhubhe ngaphakathi kwayo, izingxenye ezinkulu ziyama ngenkathi ezincane zisebenza. Ukucindezela i-MSS emzileni wokudlulisa kukwenza kube ukuziphatha okulindelekile esikhundleni sokuma ngezikhathi ezithile.

Nquma ukuthi kwenzekani lapho i-usb0 inyamalala

Ithebula elingenalutho akusona isimo sokuvaleleka ekwehlulekeni. Uma umzila ohambisanayo unyamalala, ukusesha kuqhubeka kuye kumthetho olandelayo, kufinyelela ithebula eliyinhloko futhi kuthathe indlela yokuzenzakalelayo ye-eth0. Ithrafikhi okwakufanele iphume nge-WAN yesibili iphuma buthule ngeyokuqala, okokuthi ekusetshenzisweni okuhamba kwemizila ngokwenqubomgomo ngokuvamile umphumela ongawufuni kakhulu.

Lapho lokho kubuyela emuva kungamukeleki, engeza umzila wokugcina ocacile kuthebula elingu-600, njengokuzenzakalelayo kwe-blackhole, noma lahla ipuli kudonga lomlilo ngenkathi isixhumanisi sivaliwe. Noma yikuphi kwalokho kuyisinqumo ongakubhala phansi; ukuthula akusona.

Ukuqina kuyinto yokugcina. Noma ubani ophethe zombili izixhumanisi, kungaba umphathi wenethiwekhi, umbhalo wokuthumela noma umjikelezo wokuphila kokuxhumana, kufanele akhe kabusha imizila nomthetho ngakunye ukuxhumana kabusha ngaphandle kokwengeza izimpinda. Qinisekisa ngesicelo esivela kuklayenti langempela kanye nesicelo esihlukile esivela esangweni, qinisekisa ukuphuma okubonwayo kukho kokubili, bese udonsa i-WAN yesibili futhi ubheke ukuthi yikuphi kwimiphumela emibili oyihlelile okwenzeka ngempela. I-IPv6 idinga ithebula layo, umthetho wayo nokuhumusha kwayo; umthetho we-IPv4 ongenhla awusho lutho ngayo.