Amaklayenti e-VPN afinyelela isiphakamiso kodwa hhayi i-LAN: yikuphi ukulungiswa?

Ithuluzi likhona futhi isango liyaphendula, kodwa amahosthi angemuva liyathula. Khetha umzila oqinile ku-LAN ekude, i-NAT kuseva noma ithuluzi lesibili.

Iklayenti lenza i-ping ekhelini lethuluzi lesiphakamiso se-OpenVPN futhi lithola impendulo, bese lizama ihosthi ku-LAN yesiphakamiso futhi alitholi lutho. Lokhu kwahlukanisa kunciphisa kakhulu iphutha: ithuluzi likhona, ukudluliswa kungenzeka kuyasebenza, futhi impendulo iphuma ngomnyango ongabuyi. Kunezixazululo ezintathu, futhi esilungile sincike kulokho okulawulayo nalokho ozimisele ukukushiya. Phendula imibuzo emithathu engezansi ngokulandelana futhi ukukhetha ngeke kusaba indaba yokunambitha.

Okokuqala, qinisekisa ukuthi yiluphi uhlangothi olugobile

Isicelo sifika kusixhumi sethuluzi sikanye nekheli lomthombo elivela echibini le-VPN. Isiphakamiso sisidlulisela kuhosthi ku-LAN, futhi leyo hosthi iphendula isango elishiwo yithebula yayo, ngokuvamile umzila we-LAN. Uma umzila ungenawo umzila oya echibini, impendulo iyafa lapho noma izulazula ibheke kwi-inthanethi.

Hlola kokubili imishini ngaphambi kokushintsha noma eyodwa. Buza ithebula lemizila kuseva ukuthi ingafinyelela kanjani iklayenti; buza ihosthi ku-LAN ukuthi ingafinyelela kanjani kuleyo kheli efanayo. Ukusesha kokuqala ngokuvamile kukhombisa ithuluzi futhi okwesibili kukhombisa umzila we-LAN, futhi lowo mehluko uyiphutha emgqeni owodwa. Ukusesha okubili kushibhe ukuhlola kwe-firewall futhi kunquma isiqondiso senkinga.

ip route get 10.8.0.37
sysctl -n net.ipv4.ip_forward

Uma ihosthi ku-LAN isivele ikhombisa isiphakamiso se-VPN, inkinga yakho ngumthetho we-firewall noma umkhawulo we-MTU, hhayi indlela yokubuya engekho. Ungangezi umzila ukuze ulungise isihlungi.

Umbuzo wokuqala: ungakwazi yini ukuhlela umzila we-LAN ekude?

Lapho umzila we-LAN kungowakho, impendulo ehlanzekile umzila oqinile oya echibini le-VPN okanye nekheli le-LAN lesiphakamiso se-VPN njengokugxuma okulandelayo. Ugcina amakheli omthombo wamaklayenti engagugi, futhi lokho kubalulekile lapho amahosthi e-LAN ebhala, ehlunga noma enciphisa isivinini ngokwekheli. Futhi awudingi ukuhumusha kuseva, ngakho ithuluzi lihlala liyindlela emsulwa yomzila. Isibopho esikudala incwadi, ngoba ichibi, umzila nokuhlelwa kweseva kumele kuvumelane.

Ihluleka buthule ngosuku lapho othile eshintsha ichibi. Bhala inani kanye futhi uthathe ukushintshwa kwakunoma yikuphi kwezindawo ezintathu njengokushintshwa kwezontathu.

I-NAS noma iswishi ye-Layer 3 ephethe isevisi idinga umzila ofanayo, ngaphandle uma ithumela konke ngomzila onayo. Hlola idivayisi eqeda i-subnet, hhayi kuphela leyobheke kwi-inthanethi. Amanethiwekhi amancane avamise ukuba namadivayisi amathathu anombono ngomzila.

Umbuzo wesibili: i-LAN ingayeka ukubona amakheli amaklayenti?

Lapho umzila ungokomunye umuntu, ukuhumusha kuseva ye-VPN akudingi ukubambisana. Ihosthi ku-LAN ibona ikheli le-LAN lesiphakamiso, iyayiphendula, futhi isiphakamiso sihumusha emuva. Yingakho amadivayisi nezindima zokufinyelela kude ezisekelwe ku-NAT zenza kanjalo.

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Izindleko wukwabiwa: amakheli ngeklayenti ngayinye ayanyamalala kumarekhodi e-LAN. Khona-ke noma yiluphi uhlu lwezimvume kuhosthi ku-LAN kumele lusho isiphakamiso esikhundleni sechibi.

Khetha ukuhumusha lapho ukubambisana kungekho, hhayi lapho kumane kungakhululekile. Kufihla iklayenti kulo lonke uphenyo lwesikhathi esizayo, kanye nalolo lapho udinga ukwazi ukuthi iyiphi i-laptop evule ukuxhumana. Kungaphinda kwephule izivumelwano ezifaka amakheli emthwalweni, ngoba ukuhumusha kuhlala ekhanda. Asikho isinqumo esiphambili; zombili ziphendula imibuzo ehlukene mayelana nobunikazi.

Umbuzo wesithathu: ingabe isiphakamiso ngokwaso siyiklayenti lethuluzi elinye?

Cabanga ngolunye uhlelo: isiphakamiso se-VPN siphinde sishayele umhlinzeki wezebhizinisi, ngakho sinezithuluzi ezimbili namasethi amabili amakheli. Ithrafikhi esiyidlulisela amaklayenti ayo iphuma ngomhlinzeki, futhi lowo ngeke aqondise izimpendulo emuva emakhelini echibi. Yingakho izimpendulo zinyamalala nakuba zombili izithuluzi ziphilile.

Isixazululo siwukufihla nethuluzi lokuphuma, ukuze umhlinzeki abone ikheli lethuluzi lesiphakamiso kuphela. Uhlangothi oluphambene ludinga umthetho wabo, ngoba isiphakamiso esiqala ukuxhumana siya kwelinye lamaklayenti aso siwukugeleza okunye. Ngaphandle kwalowo mthetho iklayenti liphendula ikheli elingakwazi ukuliqondisa. Beka umthetho omncane ngaphambi kwanoma yikuphi ukufihla okubanzi ukuze ukuhumusha okuqondile kunqobe.

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o tun1 -j MASQUERADE
iptables -t nat -A POSTROUTING -d 10.8.0.0/24 -o tun0 -j SNAT --to-source 10.8.0.1

Amahosthi anezixhumi eziningi engeza iphutha elihlobene elibonakala lifana lisuka kuklayenti. Impendulo iphuma ngesixhumi esinekhodi ephansi ngoba ikheli lomthombo lakhethwa kwelinye ithebula. Hlola indlela yokubuya ngokusesha esikhundleni sokucabanga ukuthi indlela yokuya iyayihlanganisa.

Bese uqinisekisa izinhlangothi zombili nosayizi bobabili

Ngemva koshintsho, pinga kusuka kuklayenti kuya kuhosthi ku-LAN bese kusuka kuhosthi ku-LAN kuya kuklayenti. Uhlangothi lwesibili yilolo abantu abalweyayo, futhi yilolo olwembula umthetho wokuhumusha ongaphelele. Rekhoda yomibili imiphumela ngesigxivizo sesikhathi ukuze ukuhlehla kwesikhathi esizayo kuqhathaniseke.

Bese uhambisa idatha yangempela, ngoba i-ping encane ephumelelayo ngenkathi ukudluliswa okukhulu kumile kuwuphawu lwe-MTU. Lelo phutha livela ngokushesha ngemva kokuthi uzihalisele ngokulungisa umzila.

Ekugcineni, hlola futhi ngemva kokuqalisa kabusha. Imiyalo yomzila ne-firewall yesikhathi sokusebenza ayidluli lokho, futhi ukulungiswa okunyamalalayo ekuqalisweni okulandelayo kuzobonwa futhi umuntu onolwazi oluncane. Yenza ushintsho luqine ngendlela isistimu yakho esivele yenza ngayo, bese uqalisa kabusha kanye ngamabomu.

Izihloko ezihlobene