Kungani iseva ye-VPN engemuva kwe-CGNAT ingalokothi yamukele ukuxhumana
Ikheli lika-100.64, igama le-DNS eliguquguqukayo elixazululwa kwenye indawo ehlukile kanye nokungabikho kokuxhawana okungena yinkinga eyodwa: i-NAT yomhlinzeki. Qinisekisa, bese udlulisa ithrafikhi ephumayo ngokusebenzisa i-relay.
Umzila uxoxa ngekheli le-WAN eliqala ngo-100.72, igama le-DNS eliguquguqukayo lixazululeka kwelinye ikheli lomphakathi, futhi iseva ye-VPN kulo mzila ayilokothi iqedele ukuxhawana okuvela ngaphandle. Ukudlulisa amachweba kumisiwe, isevisi iyasebenza, futhi ukuhlolwa okuvela ku-LAN kusasebenza. Akukho okubonakala njengephutha kumbhalo womzila. Leyo nhlanganisela yi-NAT yezinga lomhlinzeki, futhi awukho umthetho we-firewall ongavula ichweba ekhelini eliphethwe yi-ISP.
Ukuqinisekisa ikheli elabiwe kuthatha amaminithi amabili futhi kuvimbela ushintsho lokuhlela lweviki elilodwa.
Izimpawu ezikhomba ku-NAT yomhlinzeki
Qhathanisa ikheli le-WAN ekhasini lesimo lomzila nekheli elixoxwa ukusesha kwangaphandle. Ikheli le-WAN elingaphakathi kwe-100.64.0.0/10 liwuphawu olujwayelekile, futhi izigaba zangasese i-10/8, 172.16/12 kanye ne-192.168/16 zisho into efanayo. Uma i-traceroute ikhombisa igxuma elifanayo lomphakathi liphindwa, noma igxuma lokuqala liphendula ngekheli langasese, kukhona omunye umhumushi phakathi komzila ne-inthanethi. Amanye ama-ISP afaka ikheli elabiwe kuphela kuphothali yekhasimende, ngakho hamba lelo nani kanye ne-traceroute.
Ukushintsha ama-protocol noma amachweba akusizi, ngoba inkinga ukufinyeleleka kokungena hhayi ichweba elivaliwe.
Kungani ukudlulisa kanye ne-DNS eguquguqukayo kungakwazi ukukulungisa
Umthetho wokudlulisa ichweba uhlanganisa ichweba kusixhumi se-WAN somzila, kodwa ithrafikhi engenayo ayilokothi ifinyelele kuleso sixhumi: i-ISP iyihumusha kuqala futhi idlulisa kuphela lokho okuvunyelwe yithebula yayo. Ukushicilela ikheli elabiwe ku-DNS eguquguqukayo kuqondisa amakhasimende esangweni le-ISP elisetshenziswa ababhalisi abaningi, yingakho igama lixazululeka kodwa ukuxhawana kusahluleka. Ukuhlolwa kwe-hairpin kuyaphumelela ngoba umzila uphendula umthetho wawo ngaphakathi, futhi i-UPnP inendawo efanayo yokungaboni.
Ukuhlela kabusha ikhasimende ngeke kusize, ngoba ukwehluleka kwenzeka ngaphambi kokuba kufundwe noma yiluphi ukuhlelwa kwekhasimende.
Dlulisa nge-VPS enemizila ecacile
Beka ikheli lomphakathi phambili ngokuthi uqashe i-VPS encane kunazo zonke engathwala ithrafikhi, bese wenza umzila wasekhaya ushayele ngaphandle kuyo. I-UDP ephumayo evela kunethiwekhi yasekhaya idlula ku-NAT yomhlinzeki, ngakho umhubhe usungulwa ngaphakathi futhi i-VPS iba indawo yokugcina efinyelelekayo. Uhlangothi lwasekhaya luba ikhasimende elinekheli lomhubhe elingaguquki, hhayi iseva.
Ku-VPS, engeza ingeno yohlu lwamafayela eqondene nekhasimende ukuze iseva yazi ukuthi iyiphi intangano ephethe inethiwekhi encane yasekhaya, futhi engeza umzila we-kernel ohambisanayo.
# /etc/openvpn/server/ccd/home-site.conf ifconfig-push 10.8.0.10 255.255.255.0 iroute 192.168.50.0 255.255.255.0 # server.conf client-config-dir /etc/openvpn/server/ccd route 192.168.50.0 255.255.255.0 push "route 10.8.0.0 255.255.255.0"
Umugqa iroute utshela OpenVPN ukuthi iyiphi ikhasimende ethola ithrafikhi yenethiwekhi encane yasekhaya; umugqa route ufaka leyo nethiwekhi encane kuthebula ye-kernel ye-VPS ukuze amaphakethe angene emhubheni. Ngesevisi eshicilelwe, engeza umthetho we-NAT wendawo ohlulisa ichweba lomphakathi ku-10.8.0.10 futhi unike amandla i-net.ipv4.ip_forward.
Hlola indlela ngaphandle
Qinisekisa igxuma ngalinye ohlangothini lomphakathi, ngoba umhubhe ophumelelayo awufakazi ukuthi isevisi iyafinyeleleka. Isimo sokulalela nokubanjwa kwamaphakethe ku-VPS kuhlukanisa 'akukho okufikile' nokuthi 'kufikile futhi kwalahlwa'.
ss -lunp | grep 1194 tcpdump -ni any udp port 1194 nft list ruleset | grep -A4 dnat # from a phone on mobile data, not the home Wi-Fi nc -vz -u 203.0.113.10 1194
Uma ukubanjwa kukhombisa amaphakethe avela ocingweni kodwa akukho impendulo, isigaba esilandelayo ukuhlelwa kweseva noma i-firewall. Uma ukubanjwa kungakhombisi lutho, ikhasimende lisaxazulula noma lithumela ekhelini elingalungile.
Ezinye izindlela okufanele zilinganiswe ngaphambili
Ikheli le-IPv4 elikhethekile elivela ku-ISP liyisixazululo esifushane futhi ngokuvamile iyimali encane yanyanga zonke. I-IPv6 yemvelo isusa ukuhumusha ezinhlangothini zombili uma i-VPN, inethiwekhi yekhasimende kanye namarekhodi e-DNS kukusekela konke. Isendlalelo se-mesh esinomzila wenethiwekhi encane ngaphakathi kunethiwekhi yasekhaya sifinyelela ukudlulisa okufanayo ngaphandle kwe-VPS, kodwa ngezindleko zokuncika kusevisi yokuxhumanisa.
Khetha ukudlulisa uma isidingo kuwukufinyelela okungena okuzinzile futhi wonke umthetho kufanele uhlale ngaphansi kokulawula kwakho. Khetha ikheli le-ISP uma isabelomali sivuma futhi inhloso iwukuyeka ukucabanga ngakho.