I-VPN gateway idinga ukudluliswa kwe-IP: yini okufanele uyihlole

I-gateway ingaphendula kukheli wayo ngesikhathi kungekho okudlulayo phakathi kwama-interface. Hlola ukudluliswa ngomndeni ngamunye, bese kuba yindlela yokubuyela.

Iklayenti lakho lingenza i-ping kukheli le-gateway kuyilapho zonke izinsiza ezingemuva kwalo zihlala zingafinyeleleki. Lezi zimo ezimbili zichaza umsingathi okhuluma nawe kanye nomhleli ongeke ahlele, okuyindima ezehlukene emshinini owodwa. Ukudluliswa kuyiswishi phakathi kwazo.

Izindima ezimbili zizimele, futhi nemindeni emibili yamakheli izimele.

Ukuphendula kukheli lawo akufakazi lutho

Lapho iphakethe likhetheliswa ku-gateway uqobo, isitaki sendawo siyalisebenzisa futhi akukho sinqumo sokudluliswa esithathwayo. Yingakho i-ping ephumelelayo ekhelini lethumbu noma ku-interface yokuphatha ikutshela ukuthi i-daemon iyaphila futhi ithumbu liphezulu, kuyilapho ingasho lutho mayelana nethrafikhi eqondiswe kunethiwekhi engemuva kwebhokisi. I-kernel ibheka indlela yayo yokudluliswa kuphela kumaphakethe angakhetheliswanga kuyo.

Funda imfuneko njengendima, hhayi njengesethi: lo msingathi kufanele ahambise amaphakethe phakathi kwama-interface amabili. I-laptop edinga kuphela ukufinyelela inethiwekhi ekude ayilokothi ithathe leyo ndima, futhi indawo yokugcina ye-site-to-site iyithatha njalo. Ukufunda imfuneko ngale ndlela kuchaza ukuthi kungani ukulungiselelwa kweklayenti okusebenzayo kwehluleka lapho kudluliselwa ku-gateway.

Umshwano ofanayo usebenza ku-firewall engaphambi kwesinqumo sokudluliswa, enomgomo wayo mayelana nokuthi yini engadluliswa.

Hlola umndeni wamakheli ngamunye ngokwehlukana

Ukudluliswa kwe-IPv4 kuyiswishi eyodwa, futhi ukudluliswa kwe-IPv6 kungenye enokuziphatha kwayo ku-interface ngayinye. Ukuvula eyokuqala akusho lutho mayelana neyesibili, futhi iklayenti eline-stack ekabili lingafinyelela ingxenye yenethiwekhi kuyilapho okusele kusemnyama. Ngakho-ke amaklayenti amabili emindeni ehlukene angavumelani nge-gateway efanayo. Buza ukuthi umndeni upi owasetshenziswa yiklayenti elihlulekile ngaphambi kokuhlela noma isiphi isethi. Qinisekisa kokubili ngaphambi kokuphetha ngokuthi umklamo wokuhlela awulungile.

sysctl net.ipv4.ip_forward
sysctl -a --pattern 'net.ipv6.conf.(all|default).forwarding'
nft list ruleset | head -n 40

Ezisatshalalweni eziningi inani olifunda ngesikhathi sokusebenza lafakwa lapho isevisi noma ifayela lokulungiselela, ngakho-ke ushintsho olwenziwe ngomyalo wesikhathi esisodwa lungase lunyamalale lapho kuqalwa kabusha. Thola ifayela eliphethe isethi ngaphambi kokuhlela inani lesikhathi sokusebenza.

Ukudluliswa kungenye yezimfuno ezine

Ukugeleza okudlulisiwe okusebenzayo kudinga izinto ezine ngasikhathi sinye: iklayenti kufanele lazi ukuthi indawo okufunekayo ingemuva kwethumbu, i-gateway kufanele ibe nendlela eya phambili, izimpendulo kufanele zibe nendlela yokubuyela emuva, futhi i-firewall kufanele ivumele ithrafikhi. Ukuhumusha komthombo kuyingxenye yalowo mklamo njengokukhetha hhayi njengomthetho, ngoba inethiwekhi eyimfihlo ehleliwe enemizila elinganayo ayikudingi futhi engalingani ivamise ukukudinga. Ngakunye kwezine kwehluleka ngokuzimela, yingakho ukulungisa okukodwa akuvamile ukususa uphawu. Bhala zozine ngaphambi kokushintsha noma yikuphi.

Amapulatifomu asefu engeza ukucabangela kwesihlanu. Amanye aphoqa ukuhlolwa komthombo nendawo eya kuyo kuma-instance, okulahla amaphakethe adlulisiwe kungakhathalekile ukuthi i-kernel yesivakashi ilungiselelwe kanjani. Igunya lapho imibhalo yenethiwekhi yepulatifomu uqobo, hhayi okukhishwa yi-sysctl ngaphakathi kwe-VM.

Hlola kuklayenti, hhayi ku-gateway

Ukuhlola okuqaliswa ku-shell ye-gateway uqobo akudluli kunoma iyiphi ingxenye yendlela yokudluliswa oyivule nje. Khiqiza ithrafikhi kuklayenti elinenkinga, futhi qinisekisa ukuthi ifinyelela kokuthile engemuva kwe-gateway hhayi i-gateway uqobo. Yilokho kuphela ukuhlola okuqeqesha indima oyishintshile.

Gcina imithetho yomlaleli nemithetho yokudluliswa ihlukene ekhanda lakho nasemrekhodini yezinguquko. Ukuvula imbobo ye-VPN kuvumela amaklayenti enkonzweni; akawanikezi lutho kunethiwekhi engemuva kwayo, futhi kokubili kubonakala kufana ohlwini lwe-firewall olukhule iminyaka.

Uma amaphakethe efika futhi isevisi inqaba umsebenzisi, usudlule kunethiwekhi. Qhubeka ngokugunyazwa kohlelo esikhundleni sokwandisa kabusha inqubomgomo yokudluliswa.

Izihloko ezihlobene