Kungani i-NAT yasekhaya ingayivikeli i-interface yakho ye-VPN
I-router yasekhaya idlulisa umhubhe, kodwa i-host ihlulela iphakethe elisusiwe ukubethela. Funda isilaleli, indlela yangaphakathi nenqubomgomo yokungena ngokwehlukana.
Amakhompyutha aphathekayo angemuva kwe-router yasekhaya ngaphandle kokudluliswa kwezimbobo asawamukela ukuxhumana kwe-SSH okufika nge-VPN. Lokho akukona ukuphikisana, ngoba amadivaysi amabili ahlukene ahlulela amaphakethe amabili ahlukene. I-router idlulisa ukuthuthwa okubethelwe, futhi i-host inquma ukuthi kwenziwe ini ngephakethe elisusiwe ukubethela elifika ku-interface yayo yomhubhe. Ukuhlukanisa lezi zinqumo ezimbili yiwo wonke umsebenzi.
I-router idlulisa umhubhe, i-host ihlulela iphakethe
Dweba indlela esuka emthonjeni okude iya enkonzweni ngaphambi kokuba ubheke ngisho umthetho owodwa. Ingxenye yangaphandle ukuthuthwa kwe-VPN, okusingathwa yi-router negethiweyini. Ingxenye yangaphakathi iqala lapho i-endpoint isusa ungqimba lomhubhe futhi i-host yamukela iphakethe elibhekiswe ekhelini layo le-VPN.
Hlanganisa lezo zingxenye ezimbili futhi i-router ithola udumo ngesinqumo esithathwa yi-host. Ikhasi lokudluliswa kwezimbobo noma ilogi ye-router ichaza izingxoxo zangaphandle kuphela, futhi akukho nelilodwa elisho ukuthi ithrafikhi ehlukanisiwe yiphi i-host eyoyamukela. I-host isebenzisa inqubomgomo yayo yokungena kuphela kuyo iphakethe langaphakathi, ngendlela efanayo nakunoma iliphi iphakethe elifika ku-interface. Kuyo leyo nqubomgomo lapho umbuzo wokuchayeka uxazululwa khona ngempela.
Isilaleli se-wildcard akusona isevisi yomphakathi
Ku-Linux, ukubopha ku-INADDR_ANY kusho ikheli ngalinye lendawo, ngakho isevisi ingaphendula ku-interface yomhubhe engakaze iyibize ngegama. Isihluthulelo se-socket ye-IP sichaza lokho kubopha, futhi kufanelekile ukusifunda ngaphambi kokuthatha iziphetho ohlwini lwezilaleli. Ukungena kwe-wildcard kuyiqiniso mayelana ne-socket, hhayi isitatimende mayelana nokufinyeleleka.
Imigqa emibili engezansi iyisevisi efanayo ekubopheni okubili okuhlukene, futhi umehluko uyimpendulo yonke yokuthi i-interface ibalulekile yini. Funda ukuthi i-socket ihlezi kukheli lini ngaphambi kwanoma yini enye.
ss -lntp "sport = :22"
LISTEN 0 4096 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=812,fd=3))
LISTEN 0 4096 10.8.0.6:22 0.0.0.0:* users:(("sshd",pid=812,fd=4))Shono isakhiwo esingafinyelela embotsheni
Izinto ezintathu zokuhlela zibeka iphakethe kuleyo interface, futhi zinabanikazi abahlukene. Ukusho lokho okufanele kunquma ukuthi ngubani okufanele ashintshe inqubomgomo.
| Arrangement | What reaches the port | Where the decision lives |
|---|---|---|
| Another permitted VPN peer | A packet from the same tunnel subnet | Gateway forwarding policy and host input rules |
| A deliberate public forward | Traffic the gateway publishes on purpose | Gateway service definition |
| A subnet routed behind the gateway | Client traffic from the far side | Gateway route and host input rules |
Umiphumela wesiphequluli obonisa ikheli lokuphuma lomphakathi awusho lutho nganoma iyiphi yezintathu, ngoba ichaza ukuthi ithrafikhi ephumayo iphuma kanjani hhayi ukuthi yini evunyelwe kuthrafikhi engenayo. Sebenza uye emuva usuka kusilaleli nekheli lomthombo elisilogini yesevisi. Uma umthombo kungenye i-peer yomhubhe, inqubomgomo yegetshiweyini iyidokhumenti ethakazelisayo. Uma kuyikheli elihunyushiwe, thola ukuhunyushwa ngaphambi kokushintsha umthetho.
Khawulela isevisi endleleni obuhlosile
Uma i-SSH idingeka kuphela endleleni yokuphatha, bhala leyo ndlela njengobubanzi bomthombo kanye ne-interface. Bese ukhawulela imithetho yokungena ye-host ngokwe-interface, indawo ekuyiwa kuyo nomthombo esikhundleni segama lenethiwekhi, ngoba igama elibukeka liyimfihlo lingamela noma iliphi ikheli. Shiya umzila kulowo ozoxazulula inkinga elandelayo.
nft add rule inet filter input iifname "tun0" ip saddr 10.8.0.0/24 tcp dport 22 accept
nft list chain inet filter inputUmthetho osho i-interface yomhubhe nobubanzi bokuphatha uveza inhloso endaweni eyodwa. Qhathanisa nomthetho obhalelwe inethiwekhi ye-Wi-Fi, ongasho lutho ngethrafikhi yomhubhe ehlukanisiwe. Uma izingqimba ezimbili zingavumelani, inqubomgomo ye-host iyona ehlangana nayo iphakethe.
Shiya ukungena nezimpoqo zokulungisa kanye lapho zikhona; ukufinyelela embotsheni akukaze kufane nokuvunyelwa ukuyisebenzisa. Rekhoda umndeni wekheli nesikhathi sanoma yimuphi umthombo ongajwayelekile, futhi uphenye ngaphambi kokusola isici noma ubungozi. Umthetho owamukela wonke ama-peer omhubhe uwumklamo ohlukile kunalowo owamukela i-subnet yokuphatha, futhi awukho umugqa welogi ozothi iyiphi eyayihloselwe.
Yamukela ukulungiswa ngempumelelo eyodwa nokwenqatshwa okukodwa
Fakazela zombili izingxenye: ukuxhumana okuvunyelwe kuyaphumelela futhi indlela ekhishiwe iyenqatshwa. Ukwenqatshwa yingxenye abantu abayeqayo, futhi yiyona ekhombisa ukuthi umthetho uyasebenza esikhundleni sokuma eceleni kwesimo esivumayo esizenzakalelayo. Hlola usuka ohlangothini olukishiwe esikhundleni sokuphikisana ngakho.
Phinda ipheya ngemuva kokuxhuma kabusha, ngoba umhubhe obuya ngegama le-interface elihlukile ungadlula buthule umthetho obekelwe owakudala. Umngcele obalulekile yilowo i-host ewusebenzisa kumaphakethe ewamukelayo ngempela.