Amaklayenti amabili e-VPN kukhompyutha eyodwa: yini ishayisanayo nokuthi yini isebenzayo

Amaklayenti amabili alwela umzila ozenzakalelayo, isixazululi kanye namadrayivu wokuhlunga. Bhala ukuthi ubani ungumnikazi wokuphuma, bese wehlukanisa umhubhe wesibili nge-VM noma i-netns.

Iklayenti lakho lesibili liyaxhuma, izinsiza zelokuqala ziyeka ukuxazululwa, futhi ithikithi lithi i-VPN yomsebenzi yephule eyangasese. Akukho okwephukile ngomqondo wephutha: womabili amaklayenti enza lokho aklanyelwe kona, futhi umshini unethebula eyodwa yomzila. Ukungqubuzana kumayelana nezinsiza ezine iklayenti ngalinye licabanga ukuthi zalo. Zihambe ngokulandelana, futhi ukulungiswa ngokuvamile kuba ukukhetha kokuklama hhayi ukulungisa.

Isinyathelo 1: thola ukuthi iyiphi iklayenti engumnikazi wokuphuma

Funda isinqumo sokuphuma samanje ngaphambi kokushintsha noma yini. Ukusesha komzila kwikheli lomphakathi kukutshela ukuthi iyiphi i-interface kanye nokugxuma okulandelayo iphakethe elizokusebenzisa manje, futhi yilokho impendulo yokuthi ubani unqobile. Kuqhathanise namagama e-interface akhiwa amaklayenti, avamise ukuthwala igama lomkhiqizo noma iphrothokholi. Uma ukusesha kukhombisa umhubhe obawulindele, usuwutholile ukungqubuzana.

ip route get 1.1.1.1
ip route show default
route print

Amanye amaklayenti awawushintshi umzila ozenzakalelayo nhlobo; aengeza izingxenye ezimbili, eyodwa yengxenye engezansi yesikhala samakheli neyodwa yengxenye ephezulu, ezihlangene zihlanganisa konke. Lokhu kushiya umzila wokuqala ozenzakalelayo ubonakala futhi kwenza ukulungisa ngesandla kubonakale kulungile ngenkathi ithrafikhi isaphuma ngomhubhe. Funda imethrikhi nobude be-prefix, hhayi ukuba khona komugqa ozenzakalelayo kuphela.

Yima uma womabili amaklayenti efuna i-prefix efanayo ngemethrikhi efanayo. I-kernel izokhetha eyodwa, kanti enye izobonakala ixhunyiwe ingadlulisi lutho.

Isinyathelo 2: hlola isixazululi kanye nama-prefix agqagqene

I-DNS ingukungqubuzana kwesibili, futhi ikhiqiza uphawu oluyingqayizivele: amagama ahluleka ngenkathi amakheli esebenza. Iklayenti ngalinye liphoqa isixazululi salo, futhi obhala ekugcineni unqoba emibuzweni elandelayo. Buza insizakalo yesixazululi ukuthi isebenzisa ini kuxhumano ngalunye esikhundleni sokufunda ikhasi lezilungiselelo leklayenti.

resolvectl status
Get-DnsClientServerAddress
dig +short intranet.corp.example

Bese uqhathanisa ama-prefix angasese asetshenziswa amanethiwekhi amabili. Uma izinhlangothi zombili zabela kusuka kububanzi obufanayo, akukho kulungiselelwa kohlangothi lweklayenti okuzokulungisa, ngoba umshini awukwazi ukusho ukuthi iyiphi indawo yokuphela engu-10.0.0.0/8 eyomhubhe obuphi. Uhlangothi olulodwa kufanele luphinde lubhalwe izinombolo noma luhunyushwe, futhi lokho kuyingxoxo nabangabanikazi benethiwekhi hhayi ukushintsha kokulungiselelwa. Ukugqagqana ukungqubuzana okuwukuphela kwakho lapho impendulo eqotho iwukuthi ukuklama kufanele kushintshe.

Yima lapha uma ama-prefix egqagqene. Konke okulandelayo kulolu hlu kucabanga ukuthi awagqagqani.

Isinyathelo 3: khetha iphethini yokwehlukanisa ehlala njalo

Amaphethini athembekile agwema ukuxhaxha kwamaklayenti amabili ebhodini lomzila elilodwa. Iklayenti elilodwa eline-nqubomgomo yomhubhe ohlukanisiwe efinyelela womabili amanethiwekhi angasese yilona elilula kakhulu, inqobo nje uma izindawo zokuphela zingagqagqani futhi umnikazi wenqubomgomo evuma. Umshini obonakalayo noma isikhala segama senethiwekhi yisinyathelo esilandelayo, ngoba ngasinye sithola ithebula laso nesixazululi saso.

sudo ip netns add vpn2
sudo ip netns exec vpn2 ip link show
sudo ip netns exec vpn2 curl -sI https://intranet.corp.example/

Isikhala segama sinikeza ukwehlukanisa okufanayo nomshini obonakalayo ngaphandle kohlelo lokusebenza lwesibili, kodwa sinemiphetho emahhadlahhadla: idivayisi yomhubhe kufanele ishukunyiselwe kuso, futhi uhlelo lokusebenza kufanele luqalwe ngaphakathi kwaso. Idivayisi ebonakalayo ehlukile ivamise ukuba yikho okukhethwayo okungamangazi kakhulu kwi-VPN yomuntu siqu eceleni kweklayenti lomsebenzi elilawulwayo. Ukufaka umhubhe owodwa ngaphakathi komunye akusiyo iphethini yokwehlukanisa; indawo yokuphela yangaphakathi kufanele ihlale ifinyeleleka ngomhubhe wangaphandle, futhi lokhu kulungiselelwa kunezela izinkinga ze-MTU nokubambezeleka phezulu.

Khetha iphethini eyodwa bese ubhala ukuthi kungani. Ukuhlanganisa isikhala segama sohlelo olulodwa nomhubhe ohlukanisiwe kwezinye kubuyisela ukungqubuzana kwasekuqaleni ngendlela enzima ukuxazulula.

Isinyathelo 4: qinisekisa womabili amanethiwekhi kusuka kuseshini eyodwa

Hlola insiza eyodwa kunethiwekhi ngayinye yangasese kusuka endaweni uhlelo lokusebenza olusebenza ngempela kuyo, hhayi kusuka ku-shell yakho uma uhlelo lusebenza ngaphakathi kwesikhala segama. Hlola i-interface yokuphuma, ikheli elixazululiwe kanye nekhodi yempendulo ndawonye, ngoba impumelelo kwelinye kwemithathu ingafihla ukwehluleka kweminye. Phinda ngemuva kokuqalisa kabusha, ngoba ukulandelana amaklayenti aqala ngakho kunquma ukuthi ubani unqobayo. Yikho kanye lokho ukulandelana abantu abakhohlwa ukukubhala.

curl -sI https://intranet.corp.example/
curl -sI https://files.personal.example/
ip route get 10.20.30.40

Bhala izinguqulo zamaklayenti, ama-interface, isimo sesixazululi kanye nama-prefix enethiwekhi ngayinye. Uma iklayenti libuyekezwa futhi lishintsha ukuziphatha kwalo komzila, lowo mbhalo uwumehluko phakathi kokulungisa kwemizuzu emihlanu nokwakha kabusha. Umuntu olandelayo ngeke abe nokukhumbula kwakho ukuthi wuphi umhubhe ovele kuqala.

Uhlu luphelele uma usukwazi ukusho i-interface engumnikazi womzila ozenzakalelayo, isixazululi esisetshenziswa yigama ngalinye, iphethini ehlukanisa umhubhe wesibili, kanye nomphumela wesicelo esisodwa kunethiwekhi ngayinye ngemuva kokuqalisa kabusha. Noma yini engaphansi kwalokho iwukulungiselelwa okusebenza ngengozi namuhla.

Izihloko ezihlobene