Kungani i-nftables ingekwazi ukubona ithrafikhi ye-OpenVPN phakathi kwamaklayenti

Amaklayenti amabili asebenzisa iseva eyodwa ashintshana ngamafayela, ukudlulisela kuyaphumelela, futhi wonke umthetho wokudlulisela oqondisa ku-tunnel ubika amaphakethe angu-zero. Imithetho ayiphukile futhi uchungechunge alukho endaweni engalungile. Uma ukudlulisela phakathi kontanga kuvuliwe, iphakethe lilethwa ngaphakathi kwenqubo yeseva futhi isitaki somsizi asisoze sibe isihambisi sendlela, ngakho udonga lomlilo lwe-kernel alunakho okumele likubale. Ukuqonda lokhu kwehlukanisa kunquma ukuthi ugcina indlela emfushane noma wakha kabusha indlela nge-kernel.

Landela iphakethe elilodwa phakathi kweseva

Ku-tunnel enomzila, i-daemon inikeza iphakethe elisusiwe lokho kwakho iklayenti ngalinye kudivayisi ye-tunnel. Kusuka lapho umsizi uhamba indlela, i-hook yokudlulisela iyasebenza, futhi umthetho ohambisana nedivayisi ye-tunnel ungabala noma ulahle ithrafikhi. Yilokho okucatshangwa yizibonelo eziningi zodonga lomlilo.

Indlela emfushane isusa umsizi phakathi. Iphakethe elisusiwe lesikhathi esisodwa linikezwa esinye isikhathi ngaphakathi kwe-daemon, futhi iphakethe langaphakathi alisoze likhishwe kudivayisi ye-tunnel futhi umsizi akahambi indlela yalo. Ithrafikhi ehlanganisiwe isadlula isixhumi esibonakalayo somzimba, ngakho ukuthwebula kwangaphandle kubonakala kumatasa ngesikhathi imithetho yangaphakathi ithule. Ukuthwebula okuthathwe kudivayisi ye-tunnel akubonisi lutho, okumangaza noma ngubani olindele ukubona ukudlulisela lapho. Lokho kungalingani yiyo indlela eshesha kunazo zonke yokubona indlela emfushane ngaphandle kwe-daemon.

Isivivinyo sesibali esinquma ukuthi iyiphi indlela eyasetshenziswa

Namathisela isibali kumthetho okufanele usebenze, qalisa ukudlulisela phakathi kwamaklayenti amabili umthetho okufanele uwavimbe, bese ufunda isibali.

sudo nft list ruleset
sudo nft add rule inet filter forward iifname "tun0" oifname "tun0" counter accept
sudo nft list chain inet filter forward

Uma ukudlulisela kuphumelela futhi isibali sihlala ku-zero, i-kernel ayikaze iwasebenze lawo maphakethe, futhi akukho ukuhlela kwemithetho okuzokushintsha lokho. Phinda isivivinyo esifanayo ngokumelene nensizakalo ekuseva uqobo, ngoba lowo mfudlana udlula esitakini somsizi futhi isibali sawo siyanyakaza. Ukuqhathanisa imiphumela emibili yikho okunikeza impendulo.

Imininingwane emibili ivimbela ukufunda okungalungile. Igama lesixhumi esibonakalayo elibhalwe kulebula yochungechunge alihlungi lutho ngokwalo, ngoba ukufanisa kwenzeka ezinkambini zesixhumi ngaphakathi kwemithetho. Futhi umklamo webhuloho wezinga 2 uziphatha ngenye indlela futhi: lapho amaklayenti abelana isizinda sokusakaza esisodwa, ngakho ukutholakala kontanga kulindelekile, hhayi iphutha lomzila.

Isishintshi akulona uhlu lokufinyelela

Lena ingxenye edla isigamu sosuku. Ukudlulisela phakathi kontanga kuyisethingi eyodwa evuliwe noma icishiwe, futhi ngesikhathi ivuliwe i-daemon iyona kuphela indawo yokudlulisela. Udonga lomlilo lomsizi alunakuchaza ukuthi ubani angafinyelela kubani, futhi amafayela ngeklayenti ngalinye awakwenzi isishintshi sibe yimatrix yomgomo.

Uma udinga imithetho ngentanga ngayinye, ukukhetha kuphakathi kokuyeka indlela emfushane nokuyeka udonga lomlilo lomsizi njengengilazi yokulawula. Ukulicisha kubuyisela ukudlulisela kwe-kernel, okudinga ukuthi ukudlulisela kwe-IP kuvulwe kuseva kanye nemithetho ecacile yemifudlana oyifunayo. Ukulishiya livuliwe kusho ukuthi umgomo uhlala kukhonfigurashini ye-daemon, okusho ukuthi empeleni zonke izintanga noma akukho ntanga.

Izinqubo zeseva ezihlukene ezinamachibi ekheli nemigubhu yazo ziyindlela ephakathi esebenzayo. Inqubo ngayinye ithwala isinqumo esisodwa sokufinyelela, ngakho amaqembu amabili angaba nemithetho ehlukene ngaphandle kwematrix yomgomo. Umsizi angahamba indlela phakathi kwamachibi uma lokho kuyinhloso, futhi lapho udonga lomlilo lubona leyo mifudlana ngoba idlula umsizi. Izindleko imigubhu eyengeziwe, izitifiketi ezengeziwe kanye nephrofayela yeqembu ngalinye.

Ukukhetha indawo yokudlulisela

Khetha ukudlulisela kwe-kernel uma udonga lomlilo luyinjini yomgomo, uma udinga ukuloga ngomfudlana ngamunye, noma uma ukubala kubalulekile. Izindleko ukudlula esitakini somsizi nemithetho eminingi okufanele inakekelwe. Inzuzo ukuthi wonke amathuluzi akhona, kusukela ezibalini kuya kubakhiphi bemifudlana, achaza ithrafikhi futhi. Kuseva encane lezi zindleko azibonakali; ku-relay ematasa azibonakali.

Khetha ukudlulisela ngaphakathi kwenqubo uma ithrafikhi phakathi kontanga ivunyelwe yonke noma inqatshiwe yonke futhi iseva ilinganiselwe lokho. Izindleko ukuthi izibali, imithetho yomugqa kanye nokulandelela ukuxhumana akusachazi imifudlana yangaphakathi; lokho kwamukeleka kuphela uma kungekho othembele kukho kamuva.

Noma yini oyikhethayo, yibhale eduze kwemithetho yodonga lomlilo. Isethi yemithetho ebonakala ivumela ithrafikhi phakathi kontanga ngesikhathi i-daemon inquma noma ngabe yini idukisa umuntu olandelayo ozolungisa ukudlulisela okwehlulekile. Noma ngubani ofunda imithetho kuphela uzocabanga ukuthi i-kernel iyisango.

Yini okufanele ihlolwe ngaphambi kokushintsha imithetho

Funda ikhonfigurashini iseva eyilayishe ngempela, hhayi ifayela okhumbula ukuthi walihlela, futhi qinisekisa ukuthi inketho yentanga ikhona. Uma uyishintshile, qiniseka ukuthi insizakalo ilayishe kabusha hhayi nje ukuthi ibhale kabusha ifayela kudiski.

Bese uphinda isivivinyo ngomfudlana osuka kuklayenti uya kuseva ukuze ubonise ukuthi umthetho uhambisana nakanjani, futhi uhlole imizila elethwe, ngoba umzila ongekho ubonakala ohlangothini lweklayenti ufana ncamashi nokuvinjelwa kodonga lomlilo. Shintsha ukulandelana kwemithetho kuphela uma usukwazi ukuthi iyiphi indawo yokudlulisela ephethe isinqumo.