Ingabe i-router ephezulu iletha ngempela izimbobo ze-VPN ezingenayo?

Izimo ezintathu zinquma ukuthi ukudluliswa kombobo ku-router yalebhu kuzoshicilela okuthile yini: lokho umphetho ophezulu okuletha kona, inqubomgomo ayisebenzisayo, nokuthi izimpendulo zibuya ngayo leyo ndlela yini. Ikheli elibonakala lingelomphakathi aliphenduli neyodwa yazo. Kanjalo ne-prefix engu-/30 noma uxhumano lwangaphandle olusebenzayo. Hlela lezo zimo ngaphambi kokushintsha i-NAT, ngaphandle kwalokho umthetho wasendaweni uzobonakala uphukile kuyilapho ukuvinjelwa kukude ngamagxathu amabili.

Izimpendulo ezintathu zinquma ukuthi ukhuphukela kuphi

Umnikazi womphetho ophezulu angachaza ukudluliswa ngenye yezindlela ezintathu. Indawo okuyiwa kuyo ilethwa ngqo ku-interface yakho, i-prefix ehlukile ihlelwa ibheke egxathwini lakho elilandelayo, noma okuthile phambi kwakho kuhumusha ikheli ngaphambi kokuba kufike kuwe. Impendulo ngayinye isho idivayisi ehlukile okufanele ivume uxhumano olungenayo, kanye neqembu elihlukile okufanele lishayelwe uma lokho kungenzeki.

Ukuhlunga i-variable yesine futhi kuzimele kuzo zontathu. Inethiwekhi ingahluza ithrafikhi egcina ikheli layo lomphakathi, futhi umhumushi akusona ngokuzenzakalelayo umngcele wenqubomgomo. Buza ngamakheli omthombo avunyelwe, ukuthutha nezimbobo kanyekanye nokulethwa, ngoba umgodi odlulisiwe ophonswa umphetho awufinyeleli emthethweni wakho.

Funda ukudluliswa njengesivumelwano sesevisi

Bhala amanani amahlanu ngaphambi kokuthinta i-router yalebhu: ikheli le-interface elinikeziwe, ubude be-prefix, igxathu elilandelayo, ikheli lendawo okuyiwa kuyo elizosetshenziswa amaklayenti angaphandle, kanye ne-protocol nembobo okuyiyo ngqo. Okuthakazelisayo yindawo okuyiwa kuyo, ngoba kungenzeka ukuthi akulona neze ikheli elilungiselelwe kudivayisi yakho. Uma umphetho ophezulu ulindele ukuthi amaklayenti afinyelele ikheli elihumushiwe, i-DNAT yasendaweni kufanele ihambisane naleso sivumelwano, hhayi ikheli le-interface olibona.

Ingxoxo ye-IETF mayelana nokuziphatha kwe-firewall iyisikhumbuzo esiwusizo sokuthi ukuhlunga nokuhumusha kuyimisebenzi ehlukene. Ichaza ukuthi kungani i-router ingaphoqa inqubomgomo yokungena ngaphandle kokufihla amakheli, nokuthi kungani i-NAT kwenye indawo phezulu ingakufakazeli ukuthi ukuhlunga kwenzeka lapho. Thatha ukudluliswa njengencazelo yesevisi enomnikazi nenqubo yoshintsho.

Bheka umzamo owodwa emingceleni yomibili

Umzamo owodwa omncane, ogunyaziwe, ohlanganiswe ezindaweni ezimbili uthatha indawo yenqwaba yokuqagela. Gijimisa ukubanjwa ku-interface ye-WAN yalebhu nge-tuple eqondile, futhi ucele umnikazi womphetho ophezulu ukuthi abuke i-tuple efanayo emaphethelweni. Gcina indawo okuyiwa kuyo, i-protocol, umgodi, umthombo nesigxivizo sesikhathi kufana phakathi kokubuka okubili.

tcpdump -ni wan0 'tcp port 1194 and host 203.0.113.10'

Funda izimpendulo ezimbili njengesinqumo. Kubonakale emaphethelweni futhi kubonakale ku-WAN yalebhu kusho ukuthi ukulethwa nenqubomgomo yomphetho kudlula kokubili, ngakho qhubeka nomsikamelayo noma i-DNAT. Kubonakale emaphethelweni kodwa hhayi ku-WAN yalebhu kukhombisa ukulethwa noma inqubomgomo ephakathi, futhi ucingo olulandelayo lungolomnikazi womphetho ophezulu. Akubonakalanga ndawo kusho ukuthi i-tuple yokuhlola, umthombo noma indlela akulungile ngaphambi kwanoma yimuphi umbuzo we-firewall.

Ukungabikho kobufakazi ekubanjweni okukodwa akusona ubufakazi be-firewall. Kungumphumela womngcele okutshela ukuthi iyiphi idivayisi okufanele ihlolwe ngokulandelayo.

Ungavumeli i-NAT yasendaweni ifihle impendulo

Umthetho wasendaweni uba othakazelisayo kuphela ngemva kokuqinisekiswa kokungena. Qinisekisa ukuthi umgomo we-DNAT uyikheli langempela nombobo womsikamelayo we-VPN, ukuthi ukudluliswa kuvunyelwe emndenini ofanele, nokuthi impendulo iphuma nge-interface okwafika ngayo isicelo. Umthetho obhala kabusha indawo okuyiwa kuyo kodwa hhayi indlela yokubuya ukhiqiza isikhathi sokuphelelwa esifanayo nepackethe elahliwe.

Gcina ukuphepha kombobo nokudluliswa kokukhiqiza ngenkathi uphenya. Ukushintsha i-router noma ukukhohlisa ikheli layo le-MAC ukuze udlule izilawuli zokuxhunywa kushintsha ukuxilongwa ngokuphazamiseka. Umbobo wesibuko noma ukubanjwa okuvunyelwe kunikeza ukubonakala okufanayo ngaphandle kokunqamula izinsizakalo ezabelana ngoxhumo.

Qedela ngemephu yobunikazi: indawo okuyiwa kuyo, idivayisi elethayo, idivayisi ehluzayo, ukungena kwalebhu nomsikamelayo. Leyo mephu yenza ukubuyekezwa kokudluliswa kombobo okulandelayo kube kuncane, futhi akuqinisekisi lutho mayelana ne-VPN uqobo.