Igxathu elilandelayo kumzila we-VPN: kungani isango kufanele lifinyeleleke endaweni

Ikheli le-via lomzila kufanele lifinyeleleke kusixhumanisi osuka kuso. Landela ukudluliswa, qinisekisa ukusesha, futhi uhlole kusuka kusibungu esiphethe ithrafikhi.

Umzila ongena kunethiwekhi ye-VPN uthwala amakheli amabili okulula ukuwadida: isiqalo sendawo lapho iphakethe lizama ukufinyelela khona kanye negxathu elilandelayo elizolisondeza isinyathelo esisodwa. Kusibungu se-LAN, lelo gxathu elilandelayo kufanele kube umhambisi ongafinyelela kuwo ngempela kusixhumanisi esifanayo. Ikheli le-VPN elikude akusilo igxathu elilandelayo, noma lingahambisana kahle kangakanani nendawo oyicabangayo.

Le ncwadi yokuhola ihlanganisa icala elijwayelekile: ikhompyutha ephathwayo ku-192.168.20.0/24, isango le-VPN elinekhleli le-LAN elingu-192.168.20.5, kanye nenethiwekhi ekude 10.70.0.0/24 ngemuva kwalelo sango. Yonke imiyalo engezansi icabanga ukuthi usukhompyutheni ephathwayo ngaphandle uma kushiwo ngenye indlela.

Amakheli amabili, umzila owodwa

Okufakwayo okuhlosiwe ngu-10.70.0.0/24 via 192.168.20.5. Isiqalo sisho ukuthi iphakethe liya kuphi; ikheli le-via lisho ukuthi ubani ulithwala liye lapho. Ikholelo iyenqaba ukufaka umzila lapho ingakwazi ukufinyelela isango laso ngesikhombisi osishoyo, futhi lokho kwenqaba yiyo yonke inhloso: igxathu elilandelayo elidinga umhubhe ukuze lifinyeleleke angeke libe igxathu elilandelayo elakha umhubhe.

Ngakho ukuhlola kokuqala akukona «ingabe isango liyasebenza» kodwa «ingabe isango likulesi sixhumanisi». Isethi engaphansi yekhompyutha ephathwayo uqobo, okufakwayo kwayo kwe-ARP noma kukamakhelwane, kanye nesikhombisi esisemzileni kufanele kuvumelane. Ikheli elikhona kuphela ngaphakathi kwe-10.70.0.0/24 lingaba indawo yomzila wesibili, kodwa angeke neze libe i-via yowokuqala.

Igxathu elilandelayo libopha isango kuphi

Ukufaka umzila kukhompyutha ephathwayo kunquma kuphela ukudluliswa kokuqala. Ngemuva kwalokho isango lidinga indlela yaso: ukudlulisela okuvunyelwe, umzila womhubhe we-10.70.0.0/24, kanye nanoma yimuphi umgomo wokufinyelela olawula ukuthi ubani angawusebenzisa. Ku-Linux lokho yi-net.ipv4.ip_forward=1 kanye nomzila womhubhe; udonga lomlilo olungaphambi kwayo ludinga umthetho ovumela ukugeleza okudluliswayo.

Indlela yokubuya iyingxenye abantu abayikhohlowayo. Uhlangothi olukude kufanele lube nomzila wokubuya oya ku-192.168.20.0/24, noma umklamo kufanele uhumushe umthombo wekhompyutha ephathwayo ube into eyaziwayo uhlangothi olukude. I-ping esebenza isuka esangweni ifakazela ukuthi isango lingafinyelela inethiwekhi ekude; ayisho lutho mayelana nokuthi amaphakethe ekhompyutha ephathwayo ayasinda ohambweni lokubuya.

Qinisekisa ukusesha kusuka kusibungu esithumayo

Buza ikholelo ukuthi iyiphi igxathu elilandelayo ezoyikhetha, bese ufunda isikhombisi esisempendulweni:

ip route get 10.70.0.10
ip route show 10.70.0.0/24
ip neigh show 192.168.20.5

Uma ukusesha kubika isango nesikhombisi se-LAN, ingxenye yokuqala ihlelwe ngendlela obekuhlosiwe. Uma kubika idivayisi yomhubhe, into ethile engaphambili kuthebula icace kakhulu futhi iyawina. Uma umzila ungafakiwe nhlobo, ikholelo likutshela ukuthi isango alifinyeleleki, futhi lowo mlayezo uwusizo ukudlula noma yikuphi ukubanjwa kwamaphakethe.

Ngemuva kwalokho phinda ukuhlola endaweni efanele. Isicelo esidalwe esangweni sisebenzisa ikheli lomthombo wesango uqobo, okungafihla umzila wokubuya ongekho noma umgomo ovumela imithombo ethile kuphela. Incwadi ye-ip-route yehlukanisa indawo, isango kanye nokushintshwa kwe-onlink, futhi ukushintshwa kufanele kuqondwe ngaphambi kokukusebenzisa.

Ungasebenzisi i-onlink ukukhohlisa ukufinyeleleka

I-onlink itshela ikholelo ukuthi yeqe ukuhlola kokufinyeleleka kwesango bese ithumela kuso noma kunjalo. Ayidali indlela, ayixazululi i-ARP yekheli elingekho, futhi ayenzi umhambisi okude aphendule kusegimenti yakho ye-Ethernet. Isemthethweni emasangweni aphendulayo kodwa angahlali kusethi engaphansi exhunyiwe, futhi iwugibe lapho isetshenziselwa ukuthulisa iphutha ongalichazanga.

Uma umzila ufakwa kuphela nge-onlink, umbuzo olandelayo ukuthi kungani isango lingekho lapho ocabanga khona. I-VLAN engalungile, ikheli lesibili kusikhombisi esingalungile, noma iphutha lokuthayipha ku-oktethi yokugcina konke lokhu kukukhiqiza, futhi ngakunye kwazo kwephula indlela yokubuya lapho ithrafikhi iqala ukugeleza.

Imihubhe yephuzu-kuya-phuzu akuyona i-Ethernet

Idivayisi yomhubhe ayenzi i-ARP futhi ngokuvamile ayinayo isethi engaphansi enengqondo yomakhelwane. Imizila yayo ivamise ukubukeka njenge-10.70.0.0/24 dev tun0, ngaphandle kwanoma yikuphi i-via, ngoba umlingani uyingxenye yokugcina kuphela. Ukukopisha i-via ngesitayela se-LAN kulelo thebula kukhiqiza umzila ikholelo engawenqaba noma, okubi kakhulu, lowo okhomba ekhelini umlingani angaliphenduli neze.

Gcina amamodeli amabili ehlukene encwadini yokuhola: umzila we-LAN unesango elifinyelelekayo, umzila womhubhe unesikhombisi nomlingani. I-WireGuard, OpenVPN ne-IPsec zonke zikhombisa izimo ezihluke kancane, ngakho bhala isimo osisebenzise ngempela esikhundleni sokwenza okujwayelekile kusuka kusibungu esisodwa.

Engeza, qinisekisa, buyisela emuva

Ushintsho lonke luyimiyalo emithathu nokuhlola okukodwa, futhi kufanele kubhalwe ngalolo hlelo:

sudo ip route add 10.70.0.0/24 via 192.168.20.5
ip route get 10.70.0.10
ping -c 3 10.70.0.10
sudo ip route del 10.70.0.0/24 via 192.168.20.5

Qinisekisa indlela, qinisekisa indawo eyodwa, bese ugcina umugqa wokususa ulungile uma ushintsho lungenza isibungu singafinyeleleki ngendlela obungalilindele. Uma umzila kufanele uhlale ngemuva kokuqalisa kabusha, wubeke ekuhlelweni kwenethiwekhi yesibungu hhayi kuphrofayela ye-shell, futhi uhlole ukuqalisa kabusha ngaphambi kokuthembela kuwo. Umzila okhona kuphela ku-shell eyengeze wona uwumzila ozowulungisa kabili.

Izihloko ezihlobene