I-NAT ye-VPN ihamba kuphi ku-before.rules ye-UFW nokuthi uyihlola kanjani

Umthetho we-NAT osebenza uma uwubhala ku-shell uyehluleka uma unamathiselwa ku-before.rules, ngoba leyo fayela akuyona i-script. Idokhumenti yesimo sokubuyisela enezigaba zethebula, izimemezelo zamaketanga kanye nophawu lwe-COMMIT lwethebula ngalinye. Umugqa osendaweni engalungile kungenzeka ukuthi ukhansela konke ukubuyisela noma ulahle ngokuthula imithetho obucabanga ukuthi ikhona. Inqubo engezansi ibeka ucezu endaweni elindelwe uhlaka futhi ifakazela umphumela ngaphambi kokulayisha kabusha okulandelayo.

Umyalo we-shell akuwona ifayela lokubuyisela

Umugqa oqala nge-iptables -t nat uyisiyalelo sebhayinari ye-iptables, kuyilapho ifayela elilayishwa yi-UFW liyincazelo yesethi ephelele yemithetho. Umehluko awuwona wobukhazikhazi: isimo sokubuyisela kufanele sazi ukuthi sikuliphi ithebula, imiphi imiketanga ekhona nokuthi ithebula liphela kuphi. Umyalo onamathiselwe kuleyo dokhumenti kungenzeka ukuthi uyiphutha lesintaksi noma, okubi kakhulu, umthetho oxhunywe ethebuleni elingalungile. Uhlaka lulayisha lawa mafayela ngamathuluzi okubuyisela ngoba ayichazi ngokulandelana kodwa achaza ngokugcizelela.

Idokhumenti ilayishwa futhi njengesamba, ngakho isigaba esisodwa esonakele singavimba ukusetshenziswa kwengxenye esele yefayela. Ngakho iphutha elincane ocezwini lwe-NAT lihudula imithetho yokuhlunga phansi kanye nayo, futhi yileyo ndlela ukushintshwa kwe-firewall okuba ukuphazamiseka.

Beka ucezu ngaphakathi kwesigaba sethebula esikhona

Ucezu lwe-NAT lunomumo, futhi umumo ubaluleke kakhulu kunombhalo womthetho ongaphakathi kuwo. Isihloko sethebula sivula isigaba, izimemezelo zamaketanga zisungula izibali, imithetho iyalandela, futhi i-COMMIT ivala isigaba.

*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.55.0.0/24 -o ens3 -j MASQUERADE
COMMIT

Iqembu nesixhumi esingaphezulu kuyizindawo zokubamba amanani akho; isakhiwo siyingxenye efanele ukukopishwa. Uma ifayela selivele linesigaba se-*nat, engeza umthetho ngaphakathi kwaleso sigaba esikhundleni sokuvula esesibili, ngoba isimo silindele i-COMMIT eyodwa ngethebula ngalinye futhi izigaba ezimbili zethebula elifanayo kuwukulungiswa okulindele ukwenzeka. Gcina izincazelo zamaketanga okusabalalisa zingathintekile, kuhlanganise lezo umhlinzeki azifakile ukuze ahlanganise ezakhe. Incwadi yohlaka lwe-UFW ibhala amafayela e-before, user ne-after kanye nemfuneko ye-COMMIT ehambisanayo.

Uma ifayela litholakala lingenalutho, ungawugcwalisi ngokufundisa. Qinisekisa ukuthi yiliphi iphakethe eliwuphethe nokuthi inqubomgomo esebenzayo ngempela iyiphi, ngoba ifayela elingenalutho elihlala njalo alifakazeli ukuthi i-kernel ayinamithetho, futhi isethi yemithetho elayishiwe ayifakazeli ukuthi ukulayisha kabusha okulandelayo kuzoba nefayela eliphelele lokufunda. Buyisela kuqala isisekelo esisekelwayo, bese uphinda usebenzise izinguquko zesayithi phezu kwakho.

Hlola umgadli ngaphandle kokuwusebenzisa

Ithuluzi lokubuyisela lingahlaziya futhi lakhe isethi yemithetho ngaphandle kokuyisebenzisa, futhi lokhu kuwukuhlolwa okushibhile kunakho konke okutholakalayo. Kuyiqhubele ekopisini evikelwe hhayi efayeleni elisebenzayo, futhi ufunde umbhalo wephutha hhayi isimo sokuphuma kuphela. Ukwehluleka kokuhlaziya kusho umugqa futhi ngokuvamile ithebula, okungaphezu kwalokho ukulayisha kabusha okwehlulekile kuzokutshela khona.

sudo cp /etc/ufw/before.rules /root/before.rules.bak
sudo iptables-restore --test < /root/before.rules.bak
echo "exit: 0"

Ukuphumelela kwalolo hlolo kufakazela ukuthi idokhumenti iyahlaziywa futhi akukho okunye. Akufakazeli ukuthi umgadli usanamaketanga wonke i-UFW encike kuwo, ukuthi uvumela imithombo oyihlosile kuphela, noma ukuthi ukuphatha kude kusafinyeleleka. Lokhu kuwukubuyekezwa okwehlukile, futhi okokugcina kufanele ukuthola isikhathi sesibili esivulwa ngaphambi kokuba uqale.

Khetha ithuluzi elihambisana ne-backend efakiwe nomndeni wamakheli. Umsingathi oqhuba i-backend ye-nft ngokusebenzisa isendlalelo sokuhambisana udinga umyalo ohambisanayo, futhi imithetho ye-IPv6 ihlala kwifayela elihluke ngokuphelele.

Hlukanisa ukudlulisela, i-NAT nenqubomgomo yokufinyelela

Ukuhumusha komthombo kuxazulula inkinga yamakheli futhi akunikezi lutho. Ukudlulisela kuyimvume ehlukile elawulwa yi-sysctl nethebula lokuhlunga, futhi yiyo abantu abayikhohlwayo lapho ithumbu lihambisa umzila kodwa lingadlulisi ithrafikhi. Inqubomgomo yokufinyelela iyisinqumo sesithathu sokuthi imiphi imithombo ingafinyelela imiphi imisebenzi, futhi awukho umthetho we-NAT oyivezayo. Ukuhlukanisa lezi zintathu yikho okwenza ukwehluleka kuxilongeke esikhundleni sophawu olulodwa olungacacile.

sysctl net.ipv4.ip_forward
sudo iptables -t nat -S POSTROUTING
sudo iptables -S FORWARD

Funda le miphumela emithathu ndawonye hhayi ngayinye ngayinye. Umthetho we-masquerade onokudlulisela kucishiwe ukhiqiza iklayenti elixhumayo kodwa elingafinyeleli ndawo, okubonakala ohlangothini lweklayenti njengephutha lomzila futhi kuthumele abantu efayeleni elingalungile. Ithebula lokuhlunga futhi liyindawo lapho i-accept ebanzi kakhulu icasha khona, ngakho hlola inqubomgomo yalo yokuzenzakalela ngenkathi ulapho.

Qinisekisa ukulayisha kabusha, ukunqatshwa nokulahlekelwa i-VPN

Ukubona okuthathu kwakha ukuhlolwa kokwamukela okuphelele: ukulayisha kabusha kuyaphumelela, umsebenzi weklayenti ovunyelwe uyasebenza, futhi isicelo okufanele senqatshwe senqatshwa ngempela. Okwesithathu yikho okweqiwa, futhi kuwubufakazi kuphela bokuthi inqubomgomo yenza okuthile.

sudo ufw reload
sudo ufw status verbose
sudo iptables -t nat -L POSTROUTING -n -v

Bese uhlola ukwehluleka obukuklanyele. Wisa ithumbu futhi ubheke okwenziwa umsingathi, ngoba inqubomgomo esebenza kuphela lapho i-VPN ivuliwe iyinqubomgomo enokuncika okungashiwo. Ngemva kwalokho layisha kabusha futhi ukuze ufakazele ukuthi ifayela, hhayi isimo sokusebenza esisele, siyona esikhiqiza umphumela osebenzayo.

I-NAT ye-IPv4 ayisho lutho nge-IPv6, ngakho shono ukumbozwa okuhlosiwe kwemindeni yomibili kumbhalo ofanayo nomthetho. Umgomo inqubomgomo ephethwe ngokuhambisana, futhi ucezu olwenzeke lwahlaziywa aluwona ubufakazi bayo.