Amaklayenti e-VPN ayaxhuma kodwa awanayo i-inthanethi: izingxenye ezintathu ezingekho

Iklayenti lithola ikheli, iseva liphendula i-ping, futhi ikhasi ngalinye lisaphelelwa yisikhathi. Iningi labantu liqala ukuhlela iphrofayela yeklayenti kuleli qophelo, okuvame ukuba umsebenzi oyize: uma ithuneli seliphakeme, iseva kufanele iziphathe njenge-router. Izimo ezintathu kufanele zibe khona ngesikhathi esisodwa ngaphambi kokuba iphakethe liphume futhi impendulo ibuye, futhi uphawu luyafana noma yikuphi okungekho.

Kungani ithuneli elisebenzayo lingenayo indlela yokuphuma

I-kernel kufanele idlulise amaphakethe phakathi kwama-interface, futhi lokhu kucishiwe ngokuzenzakalelayo kwezinye izinhlelo ze-Linux. Ithrafikhi kufanele ihunyushwe iye ekhelini umhlaba wangaphandle ongayiphendula, ngaphandle uma yonke i-router ephezulu isivele iyazi indlela yokubuyela kunethiwekhi encane yethuneli. Indlela yokudlulisa yodonga lomlilo kufanele ivumele ithrafikhi kuzo zombili izinhlangothi, kuhlanganise nezimpendulo.

Ngakunye kwalokhu kungalungiswa ngokwehlukana, futhi yilapho kukhona ugibe. Ukuvula ukudlulisa ngaphandle komthetho wokuhunyusha kwenza amaphakethe aphume ngomthombo oyimfihlo futhi ngaphandle kwendlela yokubuyela. Ukwengeza ukuhunyusha ngaphandle komthetho wokudlulisa kwenza i-kernel ilahle iphakethe ngemuva kwesinyathelo esisodwa.

Ngakho-ke hlola izendlalelo ezintathu hhayi iklayenti, futhi shintsha okukodwa ngesikhathi ukuze umphumela ube nencazelo.

Ukudlulisa kuyiswishi ye-kernel okufanele uyenze ihlale ikhona

Hlola inani lamanje ngaphambi kokulishintsha, bese ulibeka futhi uqinisekise ukuthi ushintsho lusebenzile.

sysctl net.ipv4.ip_forward
sysctl -w net.ipv4.ip_forward=1
sysctl net.ipv4.ip_forward

Umyalo wokuqala ubika inani lamanje, owesibili ulibeka ngesikhathi sokusebenza, futhi owesithathu ubonisa ukuthi ukubhala kusebenzile. Inani lesikhathi sokusebenza linyamalala ekugaleni kabusha okulandelayo, yingakho iseshini esebenzayo ingaphuka ngemva kokunakekelwa ngaphandle kwanoma yiluphi ushintsho lokucwangciswa.

Yenza ihlale ikhona efayeleni ngaphansi kwe-/etc/sysctl.d/, bese usebenzisa lelo fayela esikhundleni sokuqala kabusha ukuze wazi. Ku-FreeBSD okulingana nakho yi-net.inet.ip.forwarding, futhi ukuze ihlale ikhona kusetshenziswa i-gateway_enable=YES ku-rc.conf. Idivayisi ebika ukuthi ukudlulisa kucishiwe ichaza lonke ikilasi lemibiko ethi «amaphakethe ayafika futhi akukho lutho olubuyayo». Hlola isilungiselelo futhi ngemva kwalokho konke ukuthuthukiswa, ngoba i-kernel eyakhiwe kabusha noma isithombe sedivayisi esishintshiwe kungase kusibuyisele emuva ngaphandle kokutshela muntu.

Khetha i-masquerade noma ikheli elilodwa lokuhunyusha elingaguquki

Ngekheli langaphandle eliguqukayo, i-masquerading iyindlela elungile elula kakhulu. Qamba inethiwekhi encane yethuneli njengomthombo kanye ne-interface yangaphandle njengokuphuma.

iptables -t nat -A POSTROUTING -s 10.9.0.0/24 -o eth0 -j MASQUERADE

Ngekheli lomphakathi elingaguquki, ukuhunyusha umthombo kulelo kheli ngqo kuqaguleka kalula futhi kulula ukukuhlola.

iptables -t nat -A POSTROUTING -s 10.9.0.0/24 -j SNAT --to-source 198.51.100.10

Indlela yesibili inogibe lokunakekela: ikheli elibhalwe ngokuqinile elishintsha kamuva ligcina ithuneli lisebenza kuyilapho ukufinyelela kwi-inthanethi kuma buthule. Sebenzisa i-masquerade noma ubuyekeze umthetho njalo uma umhlinzeki ekuhambisa. I-interface nayo ibalulekile, ngoba i-router eyabelana ngethuneli yayo ephezulu kufanele ihunyushe ngale thuneli hhayi nge-WAN yomzimba.

Ithebula lokuhlunga liyisango lesithathu

Ukudlulisa nokuhunyusha kungaba kokubili okulungile kuyilapho iphakethe lisafa ethebuleni lokuhlunga. I-ufw iyisigebengu esivamile: inqubomgomo yayo yokudlulisa iza njenge-DROP, futhi konke okunye ukucwangciswa kungabonakala kulungile ngokuphelele kuyilapho leso silungiselelo esisodwa sibulala ithrafikhi. Ukuyiphakamisa yisinqumo sokuphepha esenziwe ngamabomu hhayi ibhokisi lokumaka.

iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o tun0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Umthetho wokuqala uvumela ithrafikhi entsha ukusuka ethunelini iye ngaphandle, futhi owesibili uvumela izimpendulo kuphela ukuba zibuye. Nciphisa kokubili kunethiwekhi encane yethuneli nakwindawo okuhlosiwe, ngoba imvume ebanzi ku-interface yethuneli yenza i-VPN ibe indawo yokuphuma evulekile kunoma ubani ongazibonisa ukuthi ungubani.

Ithuneli eliboshiwe lidinga enye impendulo. Ikheli lingelebhu, hhayi isikhala somzimba, ngakho-ke ukugqilaza i-interface kususa ikheli elalinalo ngaphambili futhi umethuli ubonakala engafinyeleleki kuze kube ibhu ngokwalo lithola elilodwa, okungenziwa yi-dhclient br0. Leyo hluleka ibonakala iyinkinga ye-VPN kodwa iyinkinga yesendlalelo sesibili. Hlola ikheli lebhu ngokwalo ngaphambi kokuthinta udonga lomlilo, ngoba ushintsho lokuhlunga alunakulungisa umethuli ongenalo ikheli lokuthumela ngalo.

Lapho ubheka khona uma ikhasi lingalokothi lilayishe

Yenza i-ping ekhelini lethuneli leseva ukuze ubonise ukuthi ithuneli likhona. Bese ugijima i-traceroute kusuka kuklayenti ukuya ekhelini lomphakathi futhi ufunde lapho ima khona: kuseva iphakethe liyafika kodwa alidluliswa futhi alihunyushwa; ngale kweseva inkinga iphezulu futhi ingaphandle kwezandla zakho.

ping -c 3 10.9.0.1
traceroute -n 198.51.100.10

Umyalo wokuqala ubonisa ukuthi ithuneli lithwala ithrafikhi iye kuseva ngokwayo, futhi owesibili ubonisa ukuthi iphakethe lifinyelela kude kangakanani ngaphandle. Umkhondo ophela ekhelini lethuneli ukhomba ekudlulisweni noma ekuhunyushweni kuseva, kuyilapho umkhondo oma ngemva kwegxatho elilodwa ukhomba kumhlinzeki noma endleleni yokubuyela ye-router ephezulu.

Kuseva, qaphela i-interface yangaphandle ngenkathi iklayenti lilayisha ikhasi. Ithrafikhi ephuma nekheli lomthombo oyimfihlo isho ukuthi ukuhunyusha akukho, futhi ukungabikho kwempendulo nhlobo kusho ukuthi indlela yokudlulisa noma indlela yokubuyela ephezulu iyalilahla.

Uma amaklayenti akude nawo kufanele afinyelele abasingathi ku-LAN yeseva, khumbula ukuthi i-LAN idinga indlela yokubuyela kunethiwekhi encane yethuneli. Lokho ukuhlela imizila hhayi ukuhunyusha, futhi yisona sinyathelo esikhohlakala kakhulu ngemva kokuba indlela ye-inthanethi isisebenza ekugcineni.