Kungani amakhasimende e-Access Server engafinyeleleki kusuka ku-LAN

I-laptop iyaxhuma, ithaneli iyasebenza, futhi izicelo eziya kusevisi yangaphakathi ziyalenga ngesikhathi sokuxhuma. Kusevisi ngokwayo isicelo sifika sisuka ekhelini elifana ne-10.90.0.25, impendulo iphuma ibheke ku-gateway ezenzakalelayo, futhi akukho okubuyayo, ngoba lelo gateway alazi ukuthi i-10.90.0.25 ikuphi. Ngakolunye uhlangothi lelo phutha lifana nomgcini wangaphakathi ongakwazi ukwenza i-ping kukhasimende oxhunyiwe. Kokubili kuyinto eyodwa engekho: umzila wokubuyela emuva ochibini lamakhasimende e-VPN, okuwukuphela kwenethiwekhi yangasese engawengeza.

Funda ikheli lomthombo elibonwa yisevisi

Leyo nkambu eyodwa inquma konke okunye. Uma isevisi yangaphakathi ibona ikheli lechibi, i-Access Server iyahamba ngomzila esikhundleni sokufihla ukuhamba kwamakhasimende, futhi yonke impendulo kufanele ihambiswe ngomzila ibuyele echibini. Uma ibona ikheli langasese lomsebenzi ngokwayo esikhundleni salokho, umsebenzi wenza i-masquerade futhi indlela yokubuyela emuva isivele isebenza, kodwa ngezindleko zokulahlekelwa ubunikazi bakho bonke bakhasimende kumarekhodi nasezimithethweni zokufinyelela zesevisi.

Qhathanisa izinhlangothi zombili ngaphambi kokushintsha noma yini. Kusiseva, bhalisa izixhumanisi zethaneli namakheli azo; kukhasimende, qinisekisa ukuthi yiliphi ikheli elikugcinile ngempela; kumgcini wangaphakathi, bheka uxhumano olusebenzayo.

ip -br addr show
ss -tnp state established '( dport = :443 )'
ip route get 10.90.0.25

Umyalo wokugcina yiwo ohlulekayo esimweni esiphukile: kungaba likhomba isiqalo sethaneli njengokungafinyeleleki noma, okubi kakhulu, libuyisela i-gateway yakho ezenzakalelayo, futhi yileyo ndlela izimpendulo eziphelela kuyo i-inthanethi.

Ungacabangi ukuthi lichibi elilodwa kuphela. Iseva ingaba nebanga eliguquguqukayo kanye nokumepha okungashintshi komsebenzisi ngamunye, futhi ikheli elingashintshi lingaba ngaphandle ngokuphelele kwesiqalo esiguquguqukayo. Uma uhambisa ngomzila ibanga okhumbulayo kuphela, abasebenzisi abanamakheli angashintshi bahlala bephukile futhi wonke umuntu othile ubika ukuthi inkinga isixazululiwe.

Engeza umzila lapho kunqunywa khona impendulo

Umzila ungowesango isevisi yangaphakathi eseliyisebenzisa, hhayi iwevesi, ngaphandle uma isevisi ihambisa ngomzila ukuhamba kwayo ngokwayo. Yiqondise ekhelini langasese elifinyelelekayo le-Access Server, okuyinto ehlukile ekhelini lethaneli elinalo ikhasimende.

ip route add 10.90.0.0/24 via 10.0.1.5
ip route get 10.90.0.25

Kunethiwekhi yamafu isitatimende esifanayo siba umbhalo kuthebula lemizila onomgomo okuyi-instance noma isixhumanisi senethiwekhi esebenza iseva, nokuhlolwa komthombo nendawo okuyiwa kuyo kukhutshaziwe kuleso sixhumanisi. Qaphela ukuthi lowo mbhalo awukwenzi ini: umzila awukona ukunikeza ukufinyelela, ngakho amaqembu ezokuphepha, ama-ACL enethiwekhi kanye ne-firewall yomgcini kusafanele kuvumele ukuhamba.

Wenze uhlale ukhona, futhi gcina usayizi wamachibi unamanga. Amachibi amabili angasondelene adinga imizila emibili, futhi ichibi elikhula lidlule isiqalo salo esilungisiwe lidala ngokuthula amakhasimende angenayo indawo yokuya yezimpendulo zawo. Uma ulawula amabanga amachibi, khetha isifinyezo ongahamba ngaso ngomzila kanye bese ushiya.

Ukudlulisa nokuhlunga kufanele kuvumelane nomzila

Ukuhamba ngomzila ingxenye eyodwa kuphela yendlela. Iseva kufanele ivunyelwe ukudlulisa phakathi kwethaneli nesixhumanisi sangasese, okusho ku-Linux i-net.ipv4.ip_forward kanye neketanga yokudlulisa evumela isibhangqwana sezixhumanisi, futhi kumgcini oqinisiwe ngokuvamile umthetho ocacile wohlangothi ngalunye.

sysctl net.ipv4.ip_forward
nft list ruleset | grep -A5 forward

Ukuhlunga okunesimo kuchaza uphawu oluholela abantu endleleni engalungile. Impendulo engaphakathi kokugeleza okusunguliwe ayidingi umthetho omusha wokungena, ngakho uxhumano olulenga ngemuva kwe-SYN-ACK aluvinjwa umthetho wokwamukela ongekho; luyalahlwa noma luhambiswa ngomzila ongalungile. Gcina lo mehluko, ngoba uhlukanisa ushintsho lomzila kushintsho lwe-firewall.

Imizila yokubuyela emuva engalingani ingenye yezinhlobo ezithulile zale nkinga. Uma imizila emibili ifinyelela echibini futhi impendulo ithatha leyo ephuma kwesinye isixhumanisi kunaleso isicelo esingene kuso, ukuhlunga okuqinile komzila wokubuyela emuva kuyalahla futhi ukugeleza kwehluleka kumakhasimende athile kuphela.

Enomzila noma efihliwe: khetha ngamabomu

Imodi enomzila igcina ikheli lechibi lekhasimende kusevisi, okwenza kube nokwenzeka ukurekhoda nokwenziwa komgomo kukhasimende ngamunye, futhi njengokushintshana yonke inethiwekhi yangaphakathi okufanele iphendule ikhasimende idinga umzila wechibi. Imodi ye-masquerade isusa leso sidingo ngoba izimpendulo zibuyela kuseva, kodwa isevisi ayisakwazi ukwehlukanisa ikhasimende elilodwa kwelinye futhi ayikwazi ukuqala noma yini ibheke kukhasimende ethile.

Ukushintsha lokho kuziphatha kuseva esebenzayo kuphula amaseshini akhona, ngakho hlola kuqala ngekhasimende elilodwa nokugeleza okukodwa. Uma ushintsho luyimpendulo efanele, kuyisinqumo sokuqamba kuseva, hhayi into egwenywayo ngokwengeza imizila ezophenduka ingadingeki.

Isubneti engemuva kwekhasimende iwumsebenzi ohlukile

Ukufinyelela idivayisi ekwi-LAN yakho ye-laptop akufani nokufinyelela ikheli lethaneli le-laptop. Kudinga ukuthi ikhasimende lisebenze njengesango lesubneti: inethiwekhi emenyezelwe ohlangothini lwekhasimende, ukudlulisa okuvuliwe kusistimu yokusebenza yekhasimende, kanye nomzila kuleyo LAN ubuyela kukhasimende. Ukwengeza umzila wenethiwekhi yangasese webanga lasekhaya le-laptop akukwenzi lokhu, futhi kudala izingxabano uma abasebenzisi ababili benebanga lasekhaya elifanayo.

Uhlangothi nalo luyindaba yomgomo. Imvume yokuthi ikhasimende livule uxhumano oluya kusevisi yangaphakathi ayiniki ngokuzenzakalela umgcini wangaphakathi imvume yokuvula uxhumano oluya kulowo khasimende. Hlola umgomo wokufinyelela weserva kanye ne-firewall yomgcini wekhasimende ngaphambi kokuphetha ukuthi indlela iphukile.

Qinisekisa ngokugeleza okukodwa nokubamba okukodwa

Fakazela indlela ngoxhumano olulodwa esikhundleni sokuhlola ukufinyeleleka okujwayelekile. Buka ukugeleza okufanayo ezinhlangothini zombili: isicelo esifika kusevisi nempendulo eshiya yona.

tcpdump -ni any host 10.90.0.25 and port 443

Ngaphambi kokulungiswa ukubamba kubonisa impendulo iphuma ibheke esangweni elingeke liyihambise ngomzila. Ngemuva kokulungiswa impendulo iphuma ibheke kuseva futhi ukugeleza kuyaqedwa. Bese uqinisekisa umzila isango elizowusebenzisa ekhelini lesibili lekhasimende, ukuze ichibi ongalifakanga libonakale manje hhayi emuva kwesonto.

Qeda ngezihlolo ezine ezivala lokhu: ikheli lomthombo kusevisi lihambisana nemodi obuyihlosile, isango linomzila oya kulo lonke ichibi elisetshenziswayo, ukudlulisa nokuhlunga kuvumela izinhlangothi zombili, futhi ukugeleza kwangempela kukodwa kuqedwa kusukela ekuqaleni kuze kube sekugcineni. Imibuzo evamile mayelana nokuhamba ngomzila kwe-Access Server isho umgomo ofanayo wenguqulo efakiwe, okuyinto isixhumanisi sayo sokuqamba esisekelwayo singase sihluke kumihlahlandlela emidala.