Amaklayenti amabili e-VPN, amakheli amabili omphakathi: vumelanisa i-SNAT

Amaklayenti amabili e-VPN angaphuma ngamakheli amabili ahlukene omphakathi e-IPv4, futhi umthetho okwenza lokho mfushane kunalokho abaningi abakulindele. Okukwenza kusebenze akusona isintaksi ye-iptables kodwa isimo sephakethe lapho sifika ochungechungeni lokuphuma: ikheli lomthombo lapho kusafanele lihlukanise amaklayenti. Uma i-masquerade yangaphambili isivele ihlanganise kokubili ekhelini elilodwa, awukho umthetho weklayenti ngalinye ongabuyisela umehluko. Xazulula lowo mbuzo kuqala, bese ubhala ukuhunyushwa.

Yikuphi ukuzazi okusala kuze kufike esangweni

Umthetho uhambisana nekheli lomthombo lephakethe, hhayi igama lomsebenzisi le-VPN futhi hhayi igama eliboniswa uhlelo lokusebenza leklayenti. Konke okuhumusha iphakethe ngaphambilini endleleni kunquma ukuthi umthetho wakho usabona ini. Gxuma ithebula le-nat ngokulandelana futhi uthole iphuzu lapho umthombo usahlukene khona kuklayenti ngayinye.

iptables -t nat -S POSTROUTING

Funda lolo hlu olusuka phezulu. Umthetho we-masquerade oseduze phezulu ubhala kabusha umthombo wakho konke ukugeleza okuhambisanayo, futhi okufakiwe kweklayenti ngalinye okubekwe ngemuva kwawo kuhambisana nekheli elingasekho. Lapho amadivayisi amabili e-LAN abelana ngumhubhe owodwa futhi efika njengekheli elilodwa langaphakathi, umklamo kufanele ushintshe ngaphambi kwe-firewall: gcina izigaba zawo zomthombo zihlukene noma unike ngayinye ikheli layo langaphakathi.

Xhumanisa ukwabiwa kwekheli langaphakathi neklayenti eligunyaziwe. Ukunikeza lelo kheli kwelinye idivayisi kudlulisela nomgomo wokuphuma, futhi ukuhunyushwa komthombo ngokwako akubona ubufakazi bokuzazi.

Ukuhunyushwa akukwazi ukusungula ikheli

Ikhali ngalinye lomphakathi kufanele labiwe noma likhishwe ngomzila liye kuleli phuzu lokuphuma, futhi izimpendulo kufanele zithole indlela yokubuyela lapho. Umthetho odlulisa ithrafikhi isuka ekhelini okungekho muntu okhishayo ngomzila abuyele kulo uyalahlwa emaphethelweni akude noma uphendulwe kumsingathi ongakaze akucela. Isibonelo somhlinzeki wamafu ngokuvamile siba nekheli laso lomphakathi elihunyushwe laba ikheli lesixhumi sangasese ngaphambi kokuthi iphakethe liphume, ngakho umthombo we-SNAT kufanele ube ikheli umhlinzeki azolamukela, hhayi inani eliboniswa i-console. Funda imodeli yamakheli yomhlinzeki futhi uyilandele esikhundleni sokukopisha inani lomphakathi kuphakethe ngalinye.

Ngokwenza, lokhu kusho ukuhlola isiqalo esikhishwe ngomzila ku-console yomhlinzeki ngaphambi kokuthinta i-firewall, nokusebenzisa ikheli lesixhumi sangasese njengomthombo wokuhunyushwa lapho ukubonisa kuyinto eyodwa kuya kweyodwa. Amakheli asetshenziswe ezibonelweni ngezansi avela ezigabeni zemibhalo, ngakho into yokuqala okufanele ishintshwe umbhalo wekheli uqobo.

Faka ngaphambi kwe-masquerade evamile

Qinisekisa isixhumi sokuphuma nochungechunge lwamanje ngaphambi kokwengeza noma yini. Okokuqala kunquma ukuthi yimaphi amaphakethe umthetho ongahambisana nawo, futhi okwesibili kukhombisa ukuthi yini esivele imi phambi kwawo.

ip -4 route show default
iptables -t nat -L POSTROUTING -n -v --line-numbers

Umyalo wokuqala ubiza isixhumi iphakethe eliya kwi-inthanethi eliphuma ngaso ngempela. Owesibili uprinta uchungechunge olunezinombolo zemigqa. Okufakiwe kwe-masquerade evamile umugqa okufanele uhlale ngaphezu kwawo.

iptables -t nat -I POSTROUTING 1 -s 10.88.4.20/32 -o ens3 -j SNAT --to-source 198.51.100.77
iptables -t nat -I POSTROUTING 1 -s 10.88.4.21/32 -o ens3 -j SNAT --to-source 198.51.100.78

Imithertho emibili engenhla ihambisana nekheli langaphakathi elilodwa ngayinye, ikhawulela ukuhambisana esixhumini sokuphuma futhi isetha umthombo ngokusobala. Faka esikhundleni sokwengeza: endaweni 1 ihlolwa ngaphambi komugqa we-masquerade. Ukulandelana phakathi kwemibili akubalulekile ngoba imithombo yayo iyahlukene. Shintsha i-ens3 ngalokho okubikwe umyalo we-route, futhi gcina abanye abaphathi be-firewall kude nezingwegwe ezifanayo, ngoba amathuluzi amabili abhala ithebula elilodwa yisizathu esivamile sokuthi umthetho olungile ungenamphumela.

Fakazela umthombo ngokugeleza okusha

I-Stateful NAT ibopha ukuhunyushwa lapho ukugeleza kuqala futhi ikusebenzisa futhi emaphaketheni alandelayo, ngakho iseshini evulwe ngaphambi koshintsho igcina umthombo wayo omdala ngemva koshintsho. Ukuxhumana okusanda kuqalwa kuphela okuqinisekisa umthetho.

conntrack -L -s 10.88.4.20 -p tcp --dport 443

Funda indlela yempendulo yalokho okufakiwe: indawo yayo iwukuyo ikheli umphetho okude alibona njengomthombo. Qhathanisa nekheli lomphakathi obulihlosile, futhi thatha okufakiwe okuphethe ikheli elidala njengobufakazi bokugeleza okuqale ngaphambi kwesikhathi, hhayi umthetho ophukile. Cela iklayenti livule ukuxhumana okusha, bese uphinda umbuzo. Ukusula lonke ithebula lokulandelela ukuphoqa ukuhlolwa kuphazamisa zonke ezinye izikhathi esangweni.

Ukuhunyushwa akukakhethi umzila, akuvumeli ukugeleza kudlule esihlungwini futhi akukhiphi isevisi engenayo. Umzila ongafanele nomthetho wemvume ongekho kuqhubeka ukwehluleka ngemva komthetho we-SNAT ophelele. Hlola ne-IPv6 nanoma iyiphi indlela yokuphuma yesibili, bese ubhala amapheya angaphakathi-kuya-komphakathi embhalweni we-firewall ukuze ushintsho olulandelayo luqale ekuboniseni hhayi embhalweni womthetho.