I-VPN ne-LAN yasekhaya kusetshenziswa i-subnet eyodwa: landela umzila kuqala
Womabili ama-adapter afuna i-192.168.1.0/24 futhi umzila owodwa kuphela owinayo. Landela uhlu lwama-adapter, umzila owinile nomzila wokubuya ngaphambi kokushintsha izinombolo noma ukusola i-DNS.
Uxhuma ku-VPN yasehhovisi, isithonjana ku-tray siba luhlaza, i-intranet iyalayisha, futhi iphrinta engamamitha amabili iyeka ukuphendula. Ukwabelana obekusebenza ekuseni kuphelelwa isikhathi kumshini ofanayo, futhi alukho ugogodlo olukhuluma ngephrinta. Impendulo yokuqala yi-DNS, ngoba igama elingaxazululeki libonakala njengegama elingekho, kodwa inkinga isekhelini: ama-adapter amabili manje afuna i-192.168.1.0/24 futhi umzila owodwa kuphela ongawina leso siqalo. Kulandele ngale ndlela futhi uzobona ukuthi iyiphi i-adapter eyithathile ngaphambi kokushintsha noma yini.
Qala ngophawu, hhayi ngethumbu
Inkomba ubukhulu. Uma i-intranet isebenza futhi zonke izisetshenziswa zasendaweni zehluleka, ithumbu linempilo futhi indlela yasendaweni ayinayo. Uma izisetshenziswa zasendaweni zisebenza futhi i-intranet yehluleka, kuhlanekezelwe. Uma konke kusebenza ngaphandle kwesibungu esisodwa, ubheka ikheli elilodwa elikhona kuzinhlangothi zombili.
Bhala ikheli lasendaweni nelilodwa elikude ngaphambi kokuthinta noma yisiphi isilungiselelo. “Iphrinta” ayihlolakali; i-192.168.1.40 iyahlolakala. Lelo nyathelo elilodwa livimbela ihora elilahleka kakhulu kule nkinga, okuwukubhala kabusha izilungiselelo ze-DNS ngenxa yesinqumo somzila.
Isinyathelo 1: bona womabili ama-adapter efuna isiqalo
Vula Izixhumo Zenethiwekhi (ncpa.cpl) futhi ufunde womabili ama-adapter eceleni komunye. I-adapter ye-Ethernet ikhombisa i-192.168.1.50/24 nesango i-192.168.1.1. I-adapter ye-VPN ikhombisa i-192.168.1.201/24, ethunyelwe yiseva. Zombili zisemthethweni, zombili zikholelwa ukuthi isiqalo siku-on-link, futhi isitaki sizogcina umzila owodwa waso.
I-Get-NetIPAddress -AddressFamily IPv4 ibala amakheli, futhi i-Get-NetIPInterface | Sort-Object InterfaceMetric ikhombisa ukulandelana okuzosetshenziswa yisitaki. Leyo kolamu ye-metric yisinqumo osizofunda, ngakho bhala izinombolo esikhundleni sokuzama ukuzikhumbula.
Phikisa umbono we-DNS ngezindleko eziphansi: i-Resolve-DnsName printer.office.lan ibuyisela ikheli elifanayo nelayizolo. Igama laxazululwa; khona-ke iphakethe laphuma nge-adapter engalungile. Amaminithi amabili lapha asindisa intambama kusilungiselelo somxazululi.
Isinyathelo 2: funda umzila owinile ngempela
I-Find-NetRoute -RemoteIPAddress 192.168.1.40 iphrinta isixhumanisi, ukugxuma okulandelayo nomthombo isitaki esizowusebenzisa kulelo kheli. Thatha lokho kuphuma njengempendulo, hhayi njengomkhondo. I-route print -4 inikeza itafula lonke uma ufuna ukubona ukuthi yiluphi uhlu olwehlulwe nokuthi ngokungakanani.
Ukwenzeka ngqo kunqoba inhloso. I-192.168.0.0/25 ethunyelwe inqoba i-192.168.0.0/24 yasendaweni ngoba isiqalo sidesha, ngakho i-192.168.0.0 kuya ku-192.168.0.127 iphuma ngethumbu kuyilapho ingxenye ephezulu ihlala isendaweni. Ukunyamalala kwengxenye ye-LAN ngaphandle komyalezo wephutha ukuziphatha okulungile kwalelo tafula.
I-tracert -d 192.168.1.40 iqinisekisa lokhu ngaphandle kwetafula: uma ukugxuma kokuqala kuyikheli lethumbu esikhundleni somzila wakho, umzila uyindaba yonke. Ku-Linux umbuzo ofanayo yi-ip route get 192.168.1.40, ephrinta ikheli lomthombo nedivayisi emgqeni owodwa. Uma impendulo isho i-tun0, yeka ukubheka isiphequluli.
Isinyathelo 3: hlola umzila wokubuya ngaphambi kokusola iklayenti
Umzila wokuya phambili olungile usahluleka uma uhlangothi olukude lungakwazi ukuphendula. Uma i-LAN yeklayenti ifinyelelwa ngethumbu, isango laleyo LAN kufanele lazi ukuthi ichibi lethumbu likuphi: i-ip route add 10.8.0.0/24 via 192.168.1.12 kulowo mzila, futhi push “route 192.168.1.0 255.255.255.0” kusuka kuseva ukuze amaklayenti azi umzila wokubuya.
Ngaphandle kohlu lokuqala impendulo ishiya umgomo iye esangweni layo elizenzakalelayo, elidlulisela ikheli langasese kumnikezeli bese liyilahla. Uphawu lungohlangothi olulodwa futhi kulula ukulufunda kabi: izicelo zivela ku-tun0, izimpendulo aziveli neze.
Umthetho we-masquerade kusibungu se-VPN ususa isidingo salowo mzila ongaguquki: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE. Futhi ufihla amakheli omthombo wangempela, okwenza umbuzo ngamunye wogogodlo kamuva ube nzima. Isibungu esingumgomo esinesango elizenzakalelayo elingalungile siveza ukuthula okufanayo, ngokuqondisa kabusha kwe-ICMP esimweni esihle kakhulu nomgodi omnyama esimweni esivamile, ngakho ukuthwebula kufanele kube kuzinhlangothi zombili.
Isinyathelo 4: khetha isilungiso ongaphila naso
Kusetshenziswa izilungiso ezinhlanu kulokhu, futhi azikwazi ukushintshana. Khetha ngokwalokho okufanele kuhlale kufinyeleleka ngasikhathi sinye, hhayi ngokokuthi yimuphi umyalo omfushane kakhulu.
| Repair | What it fixes | What it costs |
|---|---|---|
| Flip interface metrics | Alternating access: office now, home later, never both | Get-NetAdapter -Name "Ethernet 2" | Set-NetIPInterface -InterfaceMetric 21; set the VPN adapter back to 5000. A client that rewrites metrics on connect defeats it |
| Renumber one side | Every host reachable in both directions | DHCP reservations, printer queues, firewall rules and hard-coded addresses all move |
| Narrow the advertised prefix | Remote hosts really live in the upper half | Breaks the day someone adds a host below the cut |
| Translate with client-nat | Both address plans stay untouched | Stateless per-client mapping, unreadable logs, anything embedding addresses breaks |
| Publish one service with DNAT | One service on the VPN host reachable from the LAN | Both address plans stay; source addresses and reverse lookups stop being meaningful |
Ama-metric ayindlela eshibhile futhi yileyo abantu abayifinyelela kuqala. Ushintsho lusebenza kusixhumanisi, ngakho lusebenza uma ithumbu liphezulu, futhi indawo yalo iseskripthini eceleni kweklayenti hhayi ku-shell ozokhohlwa. Alikwazi ukunikeza ukufinyelela ngasikhathi sinye ekhelini elifanayo kumanethiwekhi amabili, futhi lowo mkhawulo uhambisa wonke amanye phansi kwetafula.
Ukushintsha izinombolo ze-LAN yasekhaya kuya ku-10.10.0.0/24 iyisixazululo esihlanzekile: ukuvuselelwa kwesivumelwano se-DHCP okukodwa kanye nokugcinelwa, imigqa yokuphrinta namakheli abhalwe ngqo akhuluma ngobubanzi obudala. Ukushintsha izinombolo ohlangothini lwehhovisi ngokuvamile akusona isinqumo sakho. I-IPv6 isusa ukungqubuzana ngokuphelele uma zombili izixhumanisi ziyisekela, isebenzisa isiqalo sasendaweni esiyingqayizivele esivela ku-fd00::/8 esikhundleni sento ekhumbulekayo, kodwa hlola uhlelo ngokusebenzisa i-TCP, hhayi i-ping, ngoba i-ICMP ingasebenza kuyilapho insizakalo ingasebenzi.
Ukukhetha kokuhumusha kwe-OpenVPN ngokwako kuyindlela yokugcina, kuthunyelwa kusuka kuseva kuya kufakwa kuhlu lwemikhombandlela olukhethekile kuklayenti. Kuthatha amapharamitha amane ngemva kwegama lokukhetha — isiqondiso, inethiwekhi, imaskhi negama elihlukile — futhi igama elihlukile aliyona inketho: push "route 192.168.2.0 255.255.255.0" ne-push "client-nat dnat 192.168.2.0 255.255.255.0 192.168.1.0". Inethiwekhi nemaskhi ububanzi obubona iklayenti (192.168.2.0/24), igama elihlukile ububanzi bangempela bekhovisi ohlangothini lweseva (192.168.1.0/24), futhi umzila othunyelwe owenza lowo bubanzi obubonakalayo bufinyeleleke. Ihhovisi ke libonakala kuleyo klayenti ngaphansi kwe-192.168.2.x. Bhala phansi ukuhlangana kuphrofayela, uma kungenjalo umuntu olandelayo uzokulungisa njengokwehluleka komzila.
Ukushicilela insizakalo eyodwa kuphela inguqulo encane yokuhumusha, futhi ayidingi ukukhetha kwe-OpenVPN nhlobo. Umthetho we-DNAT kusibungu se-VPN ushicilela kabusha imbobo eyodwa, ngakho i-LAN igcina amakheli ayo futhi ifinyelela insizakalo ekhelini lesibungu eliyazi kakade. Izindleko ziyilezo ezijwayelekile: insizakalo ibona isibungu se-VPN njengomthombo, ngakho amagama wogogodlo eklayenti ngayinye nokusesha okuhlanekezelwe akusaba nencazelo. Lokhu kuhlanganisa umugqa owodwa wokuphrinta noma ikhasi elilodwa lokulawula, hhayi izibungu kuzinhlangothi zombili ezifinyelelana.
Yini engayikwenza futhi, nokuthi yini okufanele ibhalwe
Ukusakaza akunqamuli ithumbu elinomzila. I-DLNA, i-UPnP, ukuphequlula kwe-NetBIOS ne-Wake-on-LAN zincike ekusakazeni noma ku-multicast idivayisi ye-tun engayithwali, ngakho awukho umzila olungisa ukutholakala. Ukubhulidisha nge-dev tap kwandisa isigaba, futhi kanye nako ukusakaza kwe-DHCP, i-ARP nawo wonke amanye amaphakethe okutholakala; khetha umzila wesibungu we-unicast njenge-route 192.168.2.1 255.255.255.255 wekheli ohlangothini lwe-LAN lomzila okude.
Ama-router amabili womabili asebenzisa i-192.168.1.1 emzileni ofanayo ayingxenye yomkhaya ofanayo wezinkinga: ikheli lasendaweni lihlala linqoba, ngakho ikhasi lomzila okude lihlala lingafinyeleleki kuze kube yilapho i-LAN eyodwa isuka. Ukwengeza i-adapter yesibili akushintshi lutho kuzo zombili izimo.
Bhala ubufakazi ngaphambi kokuhlela noma yini: ip route get noma Find-NetRoute, ping -c 3 kukheli okukhulunywa ngalo, i-traceroute, ne-tcpdump -ni tun0 icmp kuklayenti, bese kuba yitafula lomzila nezibali ze-NAT kuseva. I-ping esebenza ohlangothini olulodwa futhi ife kwelinye ikhomba umzila wokubuya, hhayi ithumbu, futhi umehluko owodwa lowo unquma ukuthi yisiphi isilungiso esingenhla osidinga ngempela.