Vimbela amaklayenti e-VPN ukuthi afinyelelane kuthumbu

Amaklayenti amabili angavula womabili umsingathi wokugxuma futhi angabi nawo umsebenzi wokuvula omunye nomunye. Ukufinyelela isevisi kuyisinqumo sokudlulisela, kuyilapho ukufinyelela untanga kuyisinqumo senqubomgomo, futhi izitaki eziningi ze-VPN zikugcina lokho ezingxenyeni ezihlukene. Akukho okulungiselela okokuqala okugcizelela okwesibili. Ngakho umsebenzi akukhona ukwengeza umthetho, kodwa ukuthola into enquma ithrafikhi phakathi kontanga kule sevidishi, ukubhala ukwenqaba lapho nokukufakazela kusukela kuklayenti.

Umzila oya kusevisi eyabiwe awusona isivumelwano phakathi kontanga

Ukumemezela isixhumanisi sengxenye samaklayenti sitshela untanga ukuthi ubeka kanjani iphakethe ocingweni ukuya ekhelini lelinye iklayenti. Ukuthi lelo phakethe lizolethwa yini kunqunywa kamuva, yilokho okulidluliselayo. Kugeyithi ye-Linux lokho kuwuchungechunge lwe-FORWARD; ngaphakathi kwedaemon esikhaleni somsebenzisi lokho kuyithebula yemihlangano yethumbu uqobo. Umzila uphendula ngokufinyeleleka futhi ushiya imvume ingathintekile.

Yingakho ukuhlola kokuhlukanisa okufunda imizila kuphela akufakazeli lutho. I-/24 ingaphushwa kuklayenti ngayinye kuyilapho iphakethe ngalinye phakathi kontanga liphonswa endaweni yokudlulisela. Isimo esiyingozi yileso esiphambene: awukho umthetho ocacile, okungukuthi okuvumayo okuzenzakalelayo, kanye nokuhlukanisa okukhona kuphela ngoba akekho oyihlolile.

Bhala imfuneko emugqeni owodwa ngaphambi kokuvula itheminali. Finyelela ibhulokhi yezinsizakalo kanye nomsingathi wokugxuma, ungafinyeleli enye into ngaphakathi kwebhulokhi yamaklayenti.

Thola ukuthi ngubani odlulisela iphakethe lentanga ngempela

Izinqubo ezimbili zeseva zibonakala zifana ohlangothini lweklayenti futhi zidinga imithetho ehlukile. Kungaba umnyombo udlulisela iphakethe liphume ku-interface yethumbu futhi, noma idaemon ilikopisha phakathi kwemihlangano futhi umnyombo awuliboni neze.

I-WireGuard iseqenjini lokuqala: ayinaso isishintshi phakathi kontanga, ngakho iphakethe elisuka ku-10.8.0.4 liya ku-10.8.0.5 lifika ku-wg0, lishaya indawo yokudlulisela futhi liphinde liqondiswe liphume ku-wg0 lapho i-AllowedIPs ihlanganisa womabili amakheli. I-OpenVPN iyiqembu lesibili lapho i-client-to-client isetwa ekulungiseleleni kweseva, ngoba lowo myalelo unikeza iphakethe phakathi kwemihlangano esikhaleni somsebenzisi. Hlola ukulungiselela okulayishiwe ngalowo myalelo ngaphambi kokubhala noma yini. Umthetho womnyombo ongalokothi ubone ithrafikhi awukwazi ukwehlukaniswa nomthetho osebenzayo, futhi yileyo ndlela ukusetshenziswa okuphetha ngaphandle kokuhlukanisa.

Funda ukulungiselela okusebenzayo esikhundleni sefayela ocabanga ukuthi lilayishiwe, ngoba amaphakethe ezisabalalisi aletha okufakiwe kwawo. Uma idaemon idlulisela, ukwenqaba kusekulawuleni kwayo kweklayenti ngalinye, futhi i-firewall yomsingathi ihlunga kuphela ithrafikhi eqondiswe kumsingathi. Uma umnyombo udlulisela, indawo yokudlulisela iyindawo kuphela ebalulekile.

Ukusetshenziswa okuhleliwe nokuhunyushiwe kudinga okunye ukuhlola: umthombo obonwa iklayenti elikude kungenzeka ukuthi awuyona leyo oyilindele. Khona-ke umthetho ohambisana nesixhumanisi sengxenye samaklayenti awuhambisani nalutho. Bhala ikheli elisinda ekuhunyushweni ngaphambi kokubhala ukufanisa, futhi ukhethe ukufanisa ipheya le-interface kunokuqagela amakheli e-NAT.

Nikeza ikheli ngalinye ubunikazi obungahoxiswa bodwa

Ukuhlukanisa kuyawa lapho amadivayisi amabili abelana isiqinisekiso esisodwa. Umthetho oboshelwe kulobo bunikazi awukwazi ukubahlukanisa, futhi ukuhoxiswa kwe-laptop elahlekile kuhoxisa iqembu lonke. Izitifiketi ngedivayisi ngayinye noma okhiye ngontanga ngamunye kugcina ukuhoxiswa kusendaweni futhi inqubomgomo ifundeka, ngoba ikheli ngalinye lihambisana nomuntu oyedwa noma umshini owodwa. Lapho umklamo ungakwazi khona, shono lokho encwadini yokusebenza esikhundleni sokuchaza umthetho njengocolekile.

Ukwabiwa kwamakheli kufanele kuvumelane nenqubomgomo. Bika ibhulokhi yezinsizakalo, ibhulokhi yamaklayenti, futhi wabela amakheli amaklayenti kusuka echibini olilawulayo hhayi ebangeni lika-okuqala ukufika. Uma iseva ihumusha noma yenza ibhuloho, gcina ithebula lokuxhumanisa eceleni kokulungiselela, ngoba lelo thebula yilokho umfundi olandelayo akudingayo ukuze aphinde akhiphe umthetho.

Beka ukwenqaba lapho iphakethe liwela khona ithumbu

Kugeyithi edlulisela ithrafikhi ye-WireGuard, imithetho emibili ihlanganisa lesi simo: vumela ibhulokhi yezinsizakalo, bese ulahla insalela yebhulokhi yamaklayenti. Ipheya le-interface libalulekile njengamakheli, ngoba ukufanisa indawo yokugcina kuphela kubamba futhi ithrafikhi evela ku-LAN. Layisha ngalolo hlelo ukuze imvume ihlolwe kuqala.

Nge-nftables ipheya lingena kuthebula le-inet filter elikhona, imvume kuqala bese ukulahla. Zombili izifaniso zibopha ipheya le-interface kanye namakheli.

nft add rule inet filter forward iifname "wg0" oifname "wg0" ip saddr 10.8.0.0/24 ip daddr 10.8.2.0/24 accept
nft add rule inet filter forward iifname "wg0" oifname "wg0" ip saddr 10.8.0.0/24 ip daddr 10.8.0.0/24 drop

Funda uchungechunge emuva ngemva kokulayisha esikhundleni sokuthemba isimo sokuphuma, futhi qinisekisa ukuthi imithetho yomibili isekuhlelweni obukuhlosile. Engeza imithetho ye-ip6 efanayo yechibi le-IPv6, kungenjalo ipheya le-v4 liwumhlobiso kuphela ethumbini elinezingqimba ezimbili. Uma iseva isivele inenqubomgomo yokudlulisela evumayo, engeza ukulahla esikhundleni sokushintsha lonke uchungechunge.

Uma i-client-to-client ivuliwe ku-OpenVPN, le mithetho yokudlulisela ayilokothi ihambisane nethrafikhi phakathi kontanga futhi ukwenqaba kufanele kuhlale ekulawuleni kwedaemon uqobo. Gcina imithetho yomnyombo yethrafikhi eqondiswe kumsingathi, kodwa ungayibali njengokulawula kokuhlukanisa.

Fakazela ukwenqaba kusukela kuklayenti, hhayi kuseva

Ukuhlola kusukela kugeyithi akufakazeli lutho, ngoba ithrafikhi ekhiqizwe endaweni ithatha indlela yokuphuma futhi ayiweli neze indawo yokudlulisela. Sebenzisa amaklayenti amabili angempela: elilodwa okufanele lifinyelele isevisi, elinye okufanele lenqatshwe. Qala ngokugijima isimo sokuvuma, ukuze ithumbu eliphukile lingathathwa njengenqubomgomo esebenzayo.

Kusukela kuklayenti elivunyelwe, qinisekisa ukuthi isevisi iyaphendula embobeni yayo. Kusukela kulo kuklayenti, zama ikheli lentanga futhi ulindele ukulahlwa buthule esikhundleni sokwenqatshwa:

ping -c 3 -W 2 10.8.0.5
nc -z -w 2 10.8.0.5 22
nft list chain inet filter forward
iptables -vnL FORWARD
ping -6 -c 3 -W 2 fd00:8::5

Iphakethe elilahlwe kanye nontanga ongaxhunyiwe kokubili kubukeka njengokuphelelwa yisikhathi, ngakho hlola izibali ngaphambi kokuphetha noma yini. Qinisekisa ukuthi isibali somthetho wokulahla siyakhula ngenkathi untanga ebonakala esebenza. Phinda nge-IPv6, lapho umthetho we-ip6 ongekho ushiya ukwenqaba kwe-v4 kubonakala kusebenza. Bhala imiphumela eyamukelwe neyenqatshiwe encwadini yokusebenza nosuku, ngoba ukufuduka okulandelayo kuzophinda kukhiphe umthetho.