I-gateway ye-VLAN kuqala, bese kuba yisinqumo sendlela yokuphuma ye-VPN

Ama-VLAN amabili adinga izindlela zokuphuma ze-VPN ezihlukene, futhi umbuzo wokuqala awuwona wokuthi yimuphi umgomo okufanele ubhalwe kodwa ukuthi iyiphi idivayisi ephendula i-gateway ezenzakalelayo. Uma iswishi ihambisa phakathi kwama-VLAN, umthetho we-firewall ungachaza indlela amaphakethe angayihambi neze. Hamba i-topology ngaphambi kokuthinta umgomo wokuphuma.

Isinyathelo sokuqala: thola i-gateway esetshenziswa yi-VLAN ngayinye

Buza iklayenti ngayinye nge-gateway yayo, futhi buza iswishi ukuthi iyiphi i-interface ephethe i-VLAN. I-gateway ezenzakalelayo inquma isinqumo sokuqala sokuhambisa somkhondo ophuma ku-subnet, ngakho futhi inquma ukuthi iyiphi idivayisi engasebenzisa umgomo.

ip route show default
show ip interface brief

Amalayout amabili ahambisanayo ajwayelekile. Kungaba i-firewall ephethe ama-interface e-VLAN futhi ihambisa phakathi kwawo, noma iswishi yezendlalelo eziningi iwaphethe futhi ihambisa endaweni, ithumela kuphela izindawo zangaphandle ku-firewall. Kokubili kuyasebenza, futhi kubeka umgomo ezindaweni ezihlukene.

Khetha okukodwa ngamabomu, ngoba ilayout exubile iyona ndlela imithetho egcina ngokuphelela kudivayisi engalungile.

Isinyathelo sesibili: nquma ukuthi umgomo wasendaweni uhlala kuphi

Uma iswishi ihambisa phakathi kwabasebenzi nelabhorethri, umthetho we-firewall awukwazi ukuhlola ukushintshana okungafiki neze ku-firewall. Umgomo wasendaweni kufanele uhlale ezilawulweni zokufinyelela zeswishi ngokwayo, noma umkhondo kufanele uqondiswe ngamabomu endaweni yokuhlola.

Ukukhetha okuphambene nakho kunenani. Ukwenza i-firewall ibe i-gateway ye-VLAN ngayinye kubeka umkhondo ohambiswa endaweni ohlelweni lwamandla nokutholakala kwale divayisi, ngakho ukuqalisa kabusha i-firewall kuba ukuphazamiseka phakathi kwama-VLAN. Hlola ihadiwe yangempela esikhundleni sokucabanga ukuthi amaswishi awanazo izimo noma ama-firewall anensayo. Ukuhlela amandla kulula lapho idivayisi oyiqalisa kabusha ingeyona ndlela phakathi kwama-subnet amabili amatasa.

Okubalulekile ukuthi umgomo okhethiwe ukuyo yini indlela amaphakethe ayilandela ngempela.

Isinyathelo sesithathu: nikeza izinto ezimbili i-transit eyodwa

Lapho iswishi ihambisa, i-subnet eyodwa ye-transit igcina i-topology ifundeka, esikhundleni sokulengisa womabili amabhokisi ku-VLAN ngayinye yeklayenti njengamarowutha ayizimbangi. Iswishi iphethe ama-subnet amaklayenti futhi i-firewall iphethe ingaphandle.

# on the switch
ip route 0.0.0.0/0 10.255.0.2
# on the firewall
ip route add 10.20.10.0/24 via 10.255.0.1
ip route add 10.20.20.0/24 via 10.255.0.1

Iswishi ithumela izindawo zangaphandle ekhelini le-transit le-firewall, futhi i-firewall inemizila yokubuya eya kuzo zombili iziqalo zamaklayenti ngeswishi. Gcina ukufinyelela kokuphatha, izilungiselelo ze-gateway ye-DHCP nobulungu be-VLAN kungaphazamiseki phakathi nokufuduka, ngoba lezo zinto ezintathu yizona eziguqula ukushintsha okumsulwa kube ngentambama enekhebula lekhonsoli.

Idizayini ye-transit yenza futhi ukushintshwa kwe-firewall okulandelayo kube ushintsho lokuhambisa esikhundleni sephrojekthi yokufaka izintambo kabusha.

Isinyathelo sesine: khetha indlela yokuphuma ngokomthombo ofikayo

Ngokuhambisa okuvamile nangaphandle kokuhunyushwa komthombo phakathi, i-firewall ithola ikheli lokuqala labasebenzi noma lelabhorethri ku-interface ye-transit. Womabili ama-VLAN afika ngoxhumo olulodwa, futhi ubunikazi bawo be-IP buyasinda kulokho.

Veza ukukhetha kwe-VPN ngalelo kheli lomthombo kanye nezindawo ezihlosiwe endleleni yangempela yokungena. Imibhalo yemithetho ye-OPNsense ihlukanisa isilungiselelo se-gateway ezenzakalelayo, esilandela ukuhambisa kwesistimu, ne-gateway ecacile, evusa ukuhambisa okusekelwe kumgomo. Sebenzisa indlela ecacile lapho ukukhetha kuncike ekutheni iphakethe livela kuphi. Umzila ojwayelekile ozenzakalelayo awunasizathu sokubheka umthombo.

Gcina izindawo zasendaweni ngaphandle komthetho wokuphuma obanzi kakhulu, futhi hlola imodeli ye-gateway esekelwayo yokukhishwa okusebenzayo.

Isinyathelo sesihlanu: fakazela zombili izindlela

Bhala umphumela njengemisho emibili: umkhondo wabasebenzi oya ezindaweni ezigunyaziwe uphuma ngokuphuma A, futhi umkhondo welabhorethri oya ezindaweni ezigunyaziwe uphuma ngokuphuma B. Engeza imizila yokubuya, imithetho yokuhumusha kanye nokuziphatha okuhlosiwe lapho ukuphuma kungasebenzi.

traceroute -n 198.51.100.10

Bese uhlola ngokwehlukile isevisi yasendaweni phakathi kwama-VLAN, ngoba izijwayeza isinqumo esihlukile kulo mklamo ofanayo.

Ukugeleza okusha okuvela ku-VLAN ngayinye, isevisi yasendaweni esebenzayo kanye nendlela yokwehluleka ebhaliwe kuhlangene kufakazela umklamo; i-ping eyodwa ephumelelayo ifakazela kuphela ukuthi indlela eyodwa yayikhona ngaleso sikhathi.