Ikheli le-VPN uma liqhathaniswa nokurentwa kwe-DHCP ku-LAN: ubani unikeza i-IP yomhubhe?

Xhuma iklayenti bese ubheka i-adaptha esikhundleni sesithonjana se-Wi-Fi. Ikheli elifana ne-10.80.0.14 lingahlala emhubheni noma kungekho seva ye-DHCP ku-LAN yehhovisi eye yalibhala lelo renta. Inqubo ekhethe inombolo iyona enquma ukuthi ukuxazululwa kwenkinga kuqala kuphi.

Kuklayenti konke kubukeka kufana: ikheli elilodwa le-IPv4, imaskhi eyodwa, ngezinye izikhathi isango elizenzakalelayo. Umehluko uvela kuphela uma ubuza ukuthi ubani uphendula lelo kheli nokuthi ubani ugcina irekhodi lalo.

Funda ikheli lomhubhe ohlangothini lweklayenti

I-Windows ibonisa umehluko uma ufunda lonke ibhlokhi hhayi umugqa wokuqala. ipconfig /all iphrinta incazelo ye-adaptha, ikheli lomzimba kanye nomugqa we-DHCP. I-adaptha yokushaya yocingo ye-PPP noma ye-IKEv2 ivamise ukubika ukuthi i-DHCP ivaliwe, ngoba uxhumano lwaxoxisana ngekheli lwalo ngesikhathi sokushaya ucingo esikhundleni sokulirenta kusuka kuseva ye-LAN. I-adaptha yomhubhe ene-DHCP evuliwe ayijwayelekile futhi ifanele ukuphenywa ngokwayo.

I-Linux ihlukanisa ulwazi olufanayo phakathi kwamathuluzi amabili. ip -4 addr show dev tun0 inikeza ikheli nobude besiqalo. nmcli -f IP4 connection show work iveza ukuthi inani lavela kuphrofayela yoxhumano, ekushintshiswaneni kwe-DHCP kusixhumanisi, noma kukho ukucushwa okucindezelwe. I-WireGuard iyisimo esicacile kakhulu, ngoba uma isixhumi sibonakala i-wg-quick isebenzisa umugqa we-Address osuka efayeleni lokucushwa futhi akukho mlingani onikeza lutho ngesikhathi sokuxhuma.

Isiqalo naso sisho okuthile. I-/32, noma imaskhi ye-255.255.255.255, isho ukuthi isango lilindele ukuhambisa ikheli elilodwa lomsingathi, kuyilapho imaskhi ebanzi isikisela isixhumanisi esingaphansi esiseduze kwendlela emuva komhubhe.

Umthwalo wokucushwa we-IKEv2 uthwala ini

I-IKEv2 inomshini okhethekile walo msebenzi. Umthwalo wokucushwa ochazwe ku-RFC 7296, isigaba 3.15.1 uthwala izimiso ezifana ne-INTERNAL_IP4_ADDRESS, INTERNAL_IP4_NETMASK, INTERNAL_IP4_DNS kanye nokulingana kwazo kwe-IPv6. Iklayenti lithumela isimiso esinenani lobude obunguziro uma lingenakho okukhethayo, futhi ophendulayo ubuyisela inani afuna lisetshenziswe. Lokho kushintshiswana kuhamba ngaphakathi kwe-IKE_AUTH, osekuvele kufihliwe, ngakho akukho kusakazwa kwe-DHCP okweqa umhubhe.

Kulandela imiphumela emibili. Okokuqala, ikheli likhethwa ngophendulayo noma yiluphi ugxile wokugunyaza alubonisayo, yingakho ichibi lingahlala esangweni, empendulweni ye-RADIUS noma kumephu yomhlinzeki wobunikazi. Okwesibili, isimiso se-DNS sihlukile kwisimiso sekheli. Ukuthola i-10.80.0.14 akusho lutho mayelana nokuthi yisiphi isixazululi esibuyile, noma ngabe kukhona esibuyile.

Isimiso semaskhi yenethiwekhi siyazikhethela ngokoqobo. Ukusetshenziswa okuningi kubuyisela ikheli kuphela futhi kuvumela iklayenti ukuthi lifake umzila womsingathi, yingakho ichibi elilodwa lingabonakala njenge-/32 kwiklayenti elilodwa futhi njenge-/24 kwelinye.

Lapho kubhekana khona ububanzi be-DHCP yase-LAN nechibi le-VPN

Inkinga iqala lapho kokubili abanikezeli bekhomba ebangeni elilodwa. Iseva ye-DHCP ye-10.20.30.0/24 ayazi lutho ngechibi le-VPN elilungiselelwe i-10.20.30.128/25, ngakho akukho okuvimbela ukuthi irente i-10.20.30.140 kumshini wokubhala ngenkathi isango linikeza ikheli elifanayo kuklayenti elikude. Ukungqubuzana kuhlala kuthule izinsuku bese kuvela njengokuphindwa ngezikhathi ezithile.

Idizayini yomzila yendawo-kuya-endaweni igwema ukungqubuzana ngokwakhiwa kwayo. Umsingathi osegatsheni ugcina ikheli alinikwa yiseva ye-DHCP yasendaweni. Izixhumi zomhubhe kumazango womabili zithwala amakheli azo okuxhumanisa, futhi ithebula lomzila linquma ukuthi amaphakethe ahamba kanjani. Amakheli amaklayenti okufinyelela kude ayisigaba sesithathu futhi akufanele ahlanganiswe namakheli okuxhumanisa esango.

Ukwenza ibhuloho lomhubhe ku-LAN kususa lokho kwehlukana. Uma idizayini idinga ngempela isizinda esisodwa sokusakaza, iphuzu lokugcina le-VPN kufanele libambe iqhaza ezinqumweni zokwaba ezifanayo neseva ye-DHCP, ngokusebenzisa i-relay noma umthombo ogunyaziwe owabiwe, esikhundleni sokukhipha amakheli ngokwalo.

Qinisekisa ukuthi iyiphi inqubo ephethe ikheli

Fakazela ubunikazi ngaphambi kokushintsha ububanzi. Kuklayenti, bhala ikheli nesiqalo. Ku-LAN, sesha kusizindalwazi sokurenta. Esangweni, bhala amachibi elilungiselelwe ukuwaba. Ikheli elitholakala efayeleni lokurenta lingeleseva ye-DHCP, okusho ukuthi umhubhe wenziwe ibhuloho noma udluliswe nge-relay; ikheli elitholakala kuphela echibini lesango lingelophuzu lokugcina lomhubhe.

# client: address and prefix on the tunnel interface
ip -4 addr show dev tun0

# LAN DHCP server: is this address leased to anyone?
grep -c '10.80.0.14' /var/lib/dhcp/dhcpd.leases

# gateway: pools that remote-access clients draw from
sudo swanctl --list-pools

Bhala izinto ezine uma impendulo isicacile: iyiphi ingxenye enikeza ikheli leklayenti, yiluphi ububanzi obugcinelwe lona, ukuthi ithrafikhi ebuyayo ifinyelela kanjani kulobo bubanzi nokuthi yiziphi izinsiza eziyamukelayo. Lezo zinto ezine zishintsha umugqa we-adaptha yobuciko ube yiqiniso lokusebenza.

Phinda ukuhlola kwesimiso se-DNS ngesikhathi usulapho. Ichibi elinikeza amakheli kodwa lingenasisixazululi lishiya iklayenti ku-DNS yalo yasendaweni, okuwukwehluleka okuhlukile kwechibi elinikeza ikheli i-LAN esivele ilisebenzisa.