Iklayenti le-VPN kuseva ye-LAN: kungani izimpendulo ziphuma ngendlela engafanele

Izimpawu zilandela isimo esisodwa: umbingeleli uyasebenza, bese exhuma ku-VPN njengeklayenti, futhi manje amakhasimende e-LAN ayamfinyelela kuyilapho izimpendulo zayo zinyamalala. Ukuthwebula kumbingeleli kubonisa ukuthi izimpendulo ziphuma ngomshini womhubhe esikhundleni sesixhumi se-LAN. Akukho okugqekile emhubheni, futhi ukulungisa kuyindlela, hhayi ukuxhuma kabusha. Yenza izivivinyo ezine ngezansi ngokulandelana futhi ume kokokuqala okwehlulekayo.

Impendulo iyiphakethe elisha, hhayi ukubuyela emuva kwendlela

Kuyasiza ukushiya umqondo wokuthi impendulo ibuyela ngendlela isicelo esahamba ngayo. Ukuhlela indlela kunqunywa ngephakethe ngalinye, ngesiqondiso ngasinye, kumbingeleli othumayo. Isicelo esafika sisuka ku-10.64.0.23 ngaphakathi komhubhe asakhi indlela yokubuya; lapho umbingeleli ephendula, leyo mpendulo iqhathaniswa nethebula njengephakethe elisha futhi iphuma ngendlela enqobayo.

Yingakho iklayenti lomhubhe ogcwele kumshini ophinda usebenzise i-LAN lidala ukwehluleka okudidayo kangaka. Iklayenti lifaka indlela ezenzakalelayo, noma izingxenye ezimbili zendlela ezenzakalelayo ezithandwa amakhasimende athile, futhi impendulo kuklayenti le-LAN isihambisana nomhubhe. Ihamba iye kumhlinzeki, ongenasizathu sokuyidlulisa, futhi iklayenti le-LAN libona isikhathi siphelile nakuba umbingeleli uphila futhi uphendula endaweni. Ukuthwebula kukwenza kube sobala, futhi ithebula lendlela liyakuchaza.

Gcina ama-subnet amabili engqondweni njengoba ufunda okunye. Eyokuqala iqoqo lamakheli e-VPN lapho amakhasimende akude evela khona, kulesi sibonelo 10.64.0.0/24. Eyesibili i-LAN okufanele iqhubeke isebenza, 172.16.24.0/24 nomhleli wayo ku-172.16.24.1. Iphutha liwukuthi ukuhamba phakathi kwazo kunqunywa indlela ezenzakalelayo.

Kufakazela ngokuthwebula nangokusesha

Ngaphambi kokushintsha noma yini, qinisekisa ukuthi iyiphi idivayisi impendulo ezoyisebenzisa. Ukusesha kushesha kunokuthwebula futhi kuphendula umbuzo ofanayo umgogodla ozowuphendula lapho kwakhiwa iphakethe.

ip route get 10.64.0.23 from 172.16.24.10
tcpdump -ni any -c 6 icmp

Funda impendulo ngezingxenye ezimbili. Uma ibala u-dev tun0, umbingeleli uzofaka impendulo embozweni futhi ayinikeze umhlinzeki, futhi iklayenti le-LAN ngeke liyibone. Uma ibala u-dev eth0 kodwa iklayenti lisathola isikhathi siphelile, indlela isivele ilungile futhi iphakethe liyalahlwa kamuva, okuyinkinga enye nokulungisa okunye.

Ukuthwebula esinyathelweni esifanayo kuqeda ukungabaza okungeke kuphendulwe i-ping. Impendulo yomsindo efika kuklayenti le-LAN ikufakazela ukuthi indlela ethile iyasebenza, hhayi ukuthi yisiphi isixhumi esayithwala, ngakho yenza ukuthwebula kumbingeleli uqobo futhi ubheke ukuthi amafreyimu aphuma kuphi. Iphrinta kulelo subnet iqhubeka iphendula, ngoba indlela yayo eqondile icacile ukwedlula indlela ezenzakalelayo yomhubhe. Iphothi elidluliswayo lehluleka njenganoma yikuphi okunye ukugeleza, ngoba isixhumi sithethwa yithebula, hhayi uxhumano.

Faka indlela encane kakhulu edlula umhubhe

Ubude besiqalo sinquma, hhayi imethrikhi, ngakho indlela yeqoqo lamakhasimende ngomhleli we-LAN inqoba noma iyiphi indlela ezenzakalelayo efakwa iklayenti le-VPN. Akudingeki ukuhlinzwa kwemethrikhi, futhi indlela ezenzakalelayo ingahlala khona lapho iklayenti ikubeka khona.

ip route replace 10.64.0.0/24 via 172.16.24.1 dev eth0
ip route get 10.64.0.23 from 172.16.24.10

Sebenzisa u-replace esikhundleni sika-add, ngoba iklayenti elixhuma kabusha lizobe selifake ukufaka kwalo futhi u-add wesibili wehluleka ngephutha lendlela ekhona elifundwa njengenkinga yemvume. Kumbingeleli we-Windows okulingana nako ngu-route add 10.64.0.0 mask 255.255.255.0 172.16.24.1 -p, lapho u--p egcina ukufaka phakathi kokuqalisa kabusha, ngoba iklayenti lingakha kabusha ithebula lapho umhubhe ubuya. Kumbingeleli wesimanje we-Windows okulingana nako okusekelwayo ngu-New-NetRoute -DestinationPrefix 10.64.0.0/24 -NextHop 172.16.24.1 -InterfaceAlias Ethernet -PolicyStore PersistentStore, kanti umyalo wakudala u-route ugcinwa njengendlela yakudala.

Isici esisodwa sinquma ukuthi lokhu kulungile noma kukholakala nje: ukugxuma okulandelayo kufanele kube umhleli ongumnikazi wangempela wendlela ebuyela kumakhasimende. Ukuqondisa indlela ekhelini elifinyelelwa ngalo ngokwalo ngomhubhe kwakha umjikelezo obonakala njengokulahleka kwezikhathi ezithile esikhundleni sokwehluleka okumsulwa. Qinisekisa ukuthi ukugxuma okulandelayo kuse-subnet ye-LAN ngaphambi kokuqinisekisa umugqa.

Gcina impendulo ngemuva kokuxhuma kabusha

Indlela efakwe ngesandla ihlala isikhathi eside uma kuhle kuze kube ukuxhuma kabusha okulandelayo. Uma iqoqo lamakhasimende liguquguquka, libambe kuqinisiwe ekulungiselelweni kweseva ukuze isiqalo osihlelile sihlale siyisiqalo amakhasimende asitholayo; uma kungenjalo ukufaka kukhomba ebangeni elingenalutho futhi uphawu luyabuya ngemuva kwamasonto ngaphandle kwesizathu esicacile. Ukubhala indlela ku-skripthi ye-up yeklayenti uqobo kungenye indlela ethembekile, ngoba kusebenza ngemuva kokuba iklayenti libhale kabusha ithebula.

I-firewall enesimo ingasahlula indlela elungile. Uma ukuthwebula manje kubonisa ukuthi impendulo iphuma ngo-eth0 futhi iklayenti lisathola isikhathi siphelile, hlola ukuthi umbingeleli ulahla iphakethe ngaphambi kokulithumela. Ukuhlunga okuqinile kwendlela ebuyayo kanye ne-net.ipv4.conf.all.rp_filter esethwe ku-1 kulahla amaphakethe omthombo wawo ongayihleli indlela ebuyela emuva ngesixhumi ewangena ngaso, futhi lesi yisimo esingalingani osanda kusakha wase usilungisa, futhi isimo se-conntrack sitshela indaba efanayo ngamaphothi adlulisiwe.

Isivivinyo sokugcina yileso abantu abasitshiyayo: phinda ukusesha ngemuva kokuba umhubhe wehle futhi wenyuka futhi. Amanani amane kufanele ahambisane nalokho okubhalile: indawo ekuyiwa kuyo, ukugxuma okulandelayo, idivayisi kanye nomthombo okhethiwe. Uma noma yikuphi kulokhu kusukile, iklayenti libhale kabusha ithebula futhi ukulungisa kusezingxenyeni zalo ezingemuva, hhayi emlandweni we-shell.