I-WAN IP ishintshile futhi umhubhe wehla: ukuhlola ngokulandelana

Umhubhe uyehla, i-router iqopha ukuxhumana kabusha, futhi akukho lutho ku-LAN olunyakazile. Ikheli elisha le-WAN lenza ukuxhumana kwangaphandle kungasebenzi ngaphandle koshintsho lwangaphakathi: ikheli lomthombo wekhasimende lishintshile, isimo se-NAT esidala sikhomba kumthombo ongasasekho, futhi ontanga abakude kungenzeka basathumela ekhelini langaphambilini. Ukululama kuwukuziphatha okuvamile, futhi umbuzo owusizo ukuthi yisiphi isimo esihlulekile ukubuyekezwa.

Qamba umcimbi ngaphambi kokufunda ilogi

Hlola okwenzeka ngempela esigabeni sokufinyelela. Ukuvuselelwa kwesivumelwano sokuqashwa kwe-ISP kuwumcimbi owodwa. Iseshini ye-PPPoE exhumene kabusha ngenye into. Imodemu ye-fiber eqalisiwe kabusha, noma ukudluliselwa kwe-WAN isuka kolunye uxhumo kuya kolunye, kushintsha ikheli langaphandle noma indlela yalo ngendlela yesithathu. Lezi akuzona umcimbi owodwa futhi azishiyi insalela efanayo.

Umgqa wokuxhumana kabusha kwi-logi ye-VPN nawo awubona ubufakazi boshintsho lwe-WAN. Isikhathi sokungenzi lutho, isikhawu sokuqinisekisa kabusha kanye nokutholwa kontanga ofile konke kukhiqiza ukuxhumana kabusha ngaphandle kwanoma yiluphi ushintsho lwekheli. Qhathanisa izigxivizo zesikhathi ezivela kulogi yokufinyelela nelogi ye-VPN ngaphambi kokuphetha noma yini, futhi gcina iwindi lokuqhathanisa libanzi ngokwanele ukubamba ushintsho olwenzeke ebusuku.

I-roaming nokuxhumana kabusha kuyizimiso ezihlukene

I-WireGuard inokuzulazula okuqinisekisiwe okwakhelwe ngaphakathi kwesimiso: lapho ontanga bethola iphakethe eliqinisekiswe ngendlela efanele livela ekhelini elisha lomthombo, libuyekeza iphoyinti lokugcina lalobo ntanga. Ukuqala okusheshayo kwe-WireGuard kuchaza ukulungiselelwa kontanga okwenza lokhu kwenzeke, yingakho ikhasimende elisekhelini elishintshayo livame ukululama ngaphandle kokuqalisa kabusha okubonakalayo.

OpenVPN iziphatha ngendlela ehlukile ngokuzenzakalelayo. Iseshini ye-UDP ingaphela futhi ixhumane kabusha, futhi ukuziphatha kwe-float okuzikhethelayo kuvumela ontanga oqinisekisiwe ukuthi baqhubeke bevela ekhelini elisha lapho ukulungiselelwa kukuvumela khona. Imihubhe esekelwe ku-TCP iqinile kakhulu, ngoba ukuxhumana uqobo kuboshelwe kubhangqa lekheli. Lowo mehluko unquma ukuthi ukululama kubonakala kungabonakali noma kuzimemezela kulogi njalo.

Akukho kukuziphatha kokubili okusho lutho ngamaphrogramu angaphakathi. Umhubhe olulamile awubuyiseli iseshini ye-TCP ontanga ababekade beyibona ifile.

Isimo umhubhe ongaso

Isimo sokuhumusha nokuhlela imizila siyasinda ekuxhumaneni kabusha ngezindlela ezimangaza abantu. Irekhodi le-conntrack elidalelwe umthombo wakudala ligcina indlela yokuphendula iboshelwe ekhelini elingasekho, futhi liphelelwa isikhathi ngokohlelo lalo hilo, hhayi lapho umhubhe ubuyile. Ukuqalisa kabusha isevisi yomhubhe akusifinyeze leso silo, ngakho uxhumo olulungisiwe lungase lubonakale lukhululekile isikhashana.

Imizila nemithetho yenqubomgomo kungase kubhekise ku-gateway noma ku-interface endala. Isethi yemithetho eyayilungile ngaphambi koshintsho lwe-WAN ingase ikhombe kudivayisi engekho emsebenzini manje, okukhiqiza umhubhe obika ukuthi uxhumekile kanye nethrafikhi engayi ndawo. I-DNS eguquguqukayo yesiphakeli osihosayo iyingxaki ehlukile kuleyo yekhasimende elithola umthombo omusha. Irekhodi kumele libuyekezwe ukuze amakhasimende akude akuthole, futhi akukho kulungiselelwa ohlangothini lwekhasimende okunxephezela ikheli okungeke kulithumele ukuhumusha okungaphezulu.

Hlela ukuhlola kusuka ngaphandle kuye ngaphakathi

Ukulandelana okungezansi kuhamba kusuka ekuxhumaneni kwangaphandle kuye ngaphakathi, futhi ukuma esigabeni sokuqala esihlulekayo yikho okukwenza kube usizo: ukuhlola ngakunye kususa isigaba esingaphezulu. Gcina lokho kulandelana ngisho lapho iphutha libonakala licace bha.

wg show
ip -br addr show
ip route get 198.51.100.7
conntrack -L 2>/dev/null | grep -c ESTABLISHED
journalctl -u openvpn-client@home --since '-2 hours' | tail -n 40

Umyalo wokuqala ukhombisa iphoyinti lokugcina lamanje kanye nobudala bokuxhawulana kwesandla kontanga ngamunye. Eyesibili neyesithathu zikhombisa ukuthi i-interface yangaphandle nomzila oya ephoyintini lokugcina kusenengqondo yini. Inombolo ye-conntrack iwukuhlola okukhululekile kwesimo esisele ekhelini langaphambilini, futhi ijenali yindawo lapho kubhalwa khona isizathu sokuxhumana kabusha.

Bese uhlola kusuka kukhasimende le-LAN hhayi kusuka ku-router. I-ping ethunyelwe i-router ngokwayo isebenzisa umzila ohlukile kunethrafikhi edluliswayo, ngakho i-ping ephumelelayo evela ku-router ifakazela ukuthi umhubhe ukhona futhi ayisho lutho ngokufinyeleleka kwekhasimende.

Nquma ukuziphatha okulindelekile bese ukubhala phansi

Ukuxhumana kabusha kuwukuziphatha okulungile ezikhungweni eziningi, ngakho umgomo akukhona ukuvimbela lokho. Esikhundleni salokho nquma ukuthi kufanele kwenzeke ini nethrafikhi phakathi nesikhala: ukuyimisa, ukuyibamba, noma ukudlulela komunye umzila. Leso sinqumo singesomlilo womlilo kanye nenqubomgomo yokuhlela imizila, hhayi iphrofayili ye-VPN.

Qopha imicimbi yokufinyelela kanye nezikhathi zokuxhumana kabusha ndawonye iviki. Izinguquko eziphindaphindayo ngaphandle komcimbi wokufinyelela ohambisanayo zikhomba kusevisi yokufinyelela, futhi ukushintsha iphrofayili ye-VPN ngeke kulungise uxhumo oluqhubeka luxoxa kabusha. Ibhangqa elilodwa lamarekhodi emzuzwini ofanayo liqeda umbuzo waleso sigameko futhi linikeza esilandelayo umugqa wesisekelo.