Ilabhorethri ye-VPN ye-VirtualBox: i-VM yesango noma inethiwekhi yomphathi kuphela

Kufanele unqume ukuthi ilabhorethri yakho ye-VPN ifanele imishini engakanani. I-VM yesango elayishwe phakathi kwezigaba ezimbili ze-VirtualBox iphinda yenza ukuhunyushwa kwamakheli, indlela yokubuya kanye nendawo ye-firewall iklayenti langempela elihlala ngemuva kwayo. Isigaba esisodwa somphathi kuphela sikunikeza umnyango owodwa olawulwayo futhi akukho okunye. Ingxenye yesango idinga izivakashi ezintathu kanye nethebula yomzila oyigcinayo; ingxenye yomphathi kuphela idinga isivakashi esisodwa kanye nomgomo owodwa. Imibuzo emithathu iyahlukanisa, futhi eyesithathu inquma ukuthi ukuhlolwa kwakho kungaphumelela nhlobo yini.

Phendula imibuzo emithathu ngaphambi kokuklona noma yini

Qala ngalokho okuphakelayo kwe-VPN okufanele kukubone. Uma iseva kufanele ibone ikheli lomthombo okungewona lowo wesivakashi sokuhlola, kufanele kube khona okuthile okuhumushayo phakathi kwabo, futhi lokho okuthile kufanele kube umzila owulawulayo. Inethiwekhi yomphathi kuphela inikeza umphathi i-adaptha esigabeni sesivakashi, hhayi isihumushi. Uma isivakashi sidinga ukufinyelela okuthile ngaphandle, uxhuma i-adaptha ye-NAT, futhi injini ye-NAT ye-VirtualBox ngokwayo iyabhalansela umthombo ngaphandle kokukubuza.

Ngemva kwalokho buza ukuthi isivakashi singafinyelela yini enye ngaphandle komhubhe. Leyo mpendulo ikhetha ingaphakathi noma umphathi kuphela, futhi lo umbuzo izindatshana eziningi zelabhorethri ziwushiya. Ekugcineni, buza ukuthi kufanele kwenzeke ini uma umhubhe uwa, ngoba lokho kunquma umgomo hhayi ukuhleleka, futhi ilabhorethri ebonisa kuphela indlela enhle ayizange ihlole ngalutho.

Xhumanisa izindima ezintathu ngamanethiwekhi angaphakathi

Sebenzisa izivakashi ezintathu nezigaba ezimbili ezinamagama, futhi isango kube umshini okuwukuphela kwawo onadaptha kuzo zombili:

VBoxManage modifyvm lab-client --nic1 intnet --intnet1 WAN
VBoxManage modifyvm lab-server --nic1 intnet --intnet1 LAN
VBoxManage modifyvm lab-gw --nic1 intnet --intnet1 WAN --nic2 intnet --intnet2 LAN

Asikho isinyathelo sokwakha esihlukile senethiwekhi yangaphakathi. Intambo ekwi---intnet1 iyisigaba uqobo: imishini emibili iyabelana ngayo kuphela uma igama lihambisana ncamashi, futhi akukho lutho kumphathi oluxhumene nayo. Yilesi sici sokugcina esiyisizathu sokuthi ilabhorethri iphinde ize ngokuhlanzekile, ngoba imizila yomphathi, iklayenti layo le-VPN kanye ne-firewall yayo akukwazi ukufinyelela izivakashi ngengozi. Isigaba sangaphakathi naso asinayo iseva ye-DHCP ngaphandle uma wengeza eyodwa, ngakho amakheli amile ayindlela emfushane.

Nikeza iklayenti ikheli lalo le-WAN kuphela, futhi isango elizenzakalelayo likhombe ekhelini le-WAN lesango. Iseva ithola ikheli le-LAN futhi isebenzisa ikheli le-LAN lesango njengesango layo elizenzakalelayo. Isivakashi esigcina amakheli amabili esigabeni esisodwa, noma esinomzila olahlekile oya kwesinye isigaba, sinendlela ezungeza umzila, futhi ukuhlolwa okungezansi kuzokukhohlisa.

Ngigcina ifayela lombhalo eduze kwamagama e-VM elinamakheli amane namagama ezigaba amabili, futhi ngilinamathisela kuwo wonke ama-shell. Emasontweni ambalwa kamuva, lapho ushintsho lwephrofayela luphula okuthile, lelo fayela liwumehluko phakathi kokulungisa iphrofayela nokulungisa inkumbulo yami uqobo.

Khetha okwangaphakathi noma umphathi kuphela esigabeni okungafanele sivuze

Imodi yomphathi kuphela idala i-adaptha ebonakalayo kumphathi uqobo, ngokuvamile i-vboxnet0, futhi inikeza umphathi ikheli esigabeni sesivakashi. Lokho kulula ekuphathweni kodwa kuyingozi ekuhloleni ukwehlukaniswa, ngoba umphathi manje angafinyelela isivakashi ngqo futhi yonke insizakalo ohlangothini lomphathi iba indlela engaba khona. Imodi yangaphakathi ayinayo neze i-adaptha yomphathi. Lezi zimo ezimbili zidideka kalula kuphaneli yezilungiselelo zenethiwekhi, ngakho hlola umehluko obhaliwe hhayi ilebula (bheka ikhasi le-imininingwane yenethiwekhi ye-VirtualBox).

Esivakashini okufanele sisebenzise umhubhe, okwangaphakathi yikho okuyisisekelo esiphephile, futhi isango liwukuphela kokuphuma. Uma ugcina umphathi kuphela, thatha i-adaptha yomphathi njengendlela yokuphatha futhi ukusho ngokuzwakalayo: umphathi angafinyelela isivakashi, futhi isivakashi akufanele sikwazi ukusebenzisa umphathi njengokuphuma.

VBoxManage modifyvm lab-client --nic1 hostonly --hostonlyadapter1 vboxnet0

Ukwehlukaniswa ongakubonisa yikho okwehlukaniswa okukulungisele. Isivakashi esine-adaptha eyodwa yangaphakathi, umzila ozenzakalelayo esangweni futhi singenayo i-adaptha ye-NAT asinayo indlela ezungeza isango. Isivakashi esine-adaptha yomphathi kuphela ne-adaptha ye-NAT sinezindlela ezimbili, futhi eyodwa kuphela yazo iyileyo obufuna ukuyihlola.

Layisha futhi uhumushe esangweni, bese ukwenza kwehluleke ngokuvaliwe

I-VirtualBox ayidlulisi phakathi kwezigaba; isivakashi siyakwenza lokho. Uma i-VM yeseva ye-VPN ingemuva kwesango, vula ukudlulisa futhi uhumushe ithrafikhi yeklayenti njengoba iphuma iya eseveni:

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

Ngalo mthetho iseva ibona ikheli le-LAN lesango esikhundleni selokho sekhayenti, futhi yileyo indlela iklayenti langempela elingemuva kwe-NAT yomhlinzeki elibonakala ngayo ekhanda lenethiwekhi. Gcina inani le-sysctl ku-/etc/sysctl.d/ kanye nomthetho ensizakalweni ye-firewall esetshenziswa ukusatshalaliswa, ngaphandle kwalokho ukuqalisa kabusha kuzobuyisela ilabhorethri buthule esimweni esilayishiwe kodwa esingahunyushiwe.

Ukudlulisa akusona isigunyazo. Ngaphansi komgomo ozenzakalelayo we-FORWARD onenani le-ACCEPT, isivakashi esinomzila waso ozenzakalelayo okhomba esangweni siphuma nge-adaptha ekhethwe ithebula yomzila, kungaba nomhubhe noma cha. Uma isango futhi line-adaptha ye-NAT yokufaka amaphakethe, leyo adaptha iyindlela yokuphuma engabhalwanga esebenzayo ngomzuzu umhubhe uwayo, futhi ukuhlolwa kwakho kwe-VPN kuphela akuzange kube ukuhlolwa kwe-VPN kuphela.

Uma iseva ikude futhi isango ngokwalo liqeda umhubhe, isinqumo esifanayo sikhomba ku-interface yomhubhe, hhayi ku-NIC efinyelela i-inthanethi:

iptables -P FORWARD DROP
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Gcina ukuthuthwa kwangaphandle komhubhe uqobo kanye nomzila wokuphatha ongaphandle kwebhendi kuhlukanisiwe nethrafikhi edlulisiwe. Uma indlela eyodwa yokulungisa isango ingomhubhe owulungisayo, ilabhorethri iba umsebenzi wokuzivalela ngaphandle. Ikhonsoli ye-serial, i-adaptha yokuphatha yomphathi kuphela noma isithombe sesimo esihle esaziwayo kushibhe kakhulu kunokubuyisela umzila ophukile ngesandla.

Qinisekisa indlela usuka esivakashini, hhayi kumphathi

Sebenza uphuma ngaphandle. Qinisekisa ukuthi iklayenti lifinyelela ikheli le-WAN lesango, bese kuba iseva ngokusebenzisa isango, bese kuthi uxhumano lwembobo ye-VPN luphuma futhi lubuye. Ukubamba kuzo zombili izinhlangothi zesango kukhombisa ukuthi impendulo iyafika yini futhi iyalahlwa yini endleleni yokubuya, okungeke kuhlukaniswe ukubamba kuklayenti kuphela:

tcpdump -ni eth0 udp port 1194
tcpdump -ni tun0 udp port 1194

Bese ubonisa ukuphuma. Buza kusuka esivakashini ensizakalweni yokubonisa amakheli ukuthi ibona muphi umthombo bese uqhathanisa nekheli lokuphuma lesango uqobo; uma impendulo ihambisana nekheli lomphathi, kunendlela ezungeza umhubhe. Hlola ukuthi isivakashi sisebenzisa yiphi isixazululi ngempela, futhi uhlole i-IPv6 ngokwahlukile, ngoba isigaba lapho i-IPv6 ivuliwe khona kuyilapho umhubhe uthwala i-IPv4 kuphela sivuze ngokwakhiwa hhayi ngengozi.

Ekugcineni, yephula ngamabomu. Misa umhubhe, noma uvimbe imbobo yawo yangaphandle, bese uvula uxhumano olusha kusuka esivakashini. Kufanele kwehluleke, futhi isizathu kufanele kube esingasibiza ngegama: awekho umzila, kunomthetho wokwenqaba noma isixazululi sifile. Qalisa kabusha umhubhe bese uqinisekisa ukuthi isivakashi siyalulama ngaphandle kokwakha kabusha inethiwekhi. Uma i-mesh VPN efana ne-Hamachi noma i-ZeroTier yabelana ngelabhorethri, khumbula ukuthi i-adaptha eboshwe ngebhuloho ilandela igama le-adaptha, hhayi i-mesh, ngakho ibhuloho kufanele likhonjwe kabusha ngemuva kokuba iklayenti lifake i-adaptha yalo ebonakalayo.

VBoxManage list bridgedifs
VBoxManage modifyvm lab-client --bridgeadapter1 <mesh-adapter-name>

Ukwabelana ngomhubhe wesivakashi nomphathi kukhombisa inkinga. Ukukhomba umzila womphathi ozenzakalelayo esivakashini kuyasebenza, ne-proxy ngaphakathi kwesivakashi iyasebenza; i-NAT ngokusebenzisa umphathi ayithwali umhubhe wesivakashi ethrafikhini eqalwe umphathi. Gcina amagama ezigaba nemithetho ye-firewall endaweni eyodwa, thatha isithombe sesimo esisebenzayo, futhi urekhode ikheli lomthombo iseva elikubonile. Ngemva kwalokho ushintsho lwephrofayela olulandelayo luzobiza ukusetshenziswa kwe-skripti eyodwa esikhundleni selabhorethri eyakhiwe kabusha.