Kungani isubneti eyodwa isadlula umzila ozenzakalelayo we-VPN yakho

Ushintsha i-VPN iye ethubhini eliphelele, iningi lethrafikhi liyahlonipha, bese kuthi ikheli elilodwa liphendule ngqo — iphrinta, i-NAS, umsingathi wokugxuma ku-10.x. Ukufunda okusobala ukuthi ithubhu liyavuza, ngakho wehlisa imethrikhi kumzila ozenzakalelayo futhi akukho okushintshayo. Lowo mzamo ohlulekile uyisikhombi: umzila ozenzakalelayo uyisiphelele, akusona isinqumo. Ukusesha komzila kuthatha iphrephikisi ende kakhulu efanayo ngaphambi kokuthi kuqhathaniswe imethrikhi, ngakho i-/24 iyaqhubeka inqoba i-/0, noma iyiphi inombolo oyifakayo kunoma iyiphi yazo. Uma lokho kuhleleka kucaca, ukuvuza ngokuvamile kuwumzila umuntu awufake ngamabomu, noma iphrephikisi iklayenti elingakaze lihlose ukuyimboza.

Umzila ozenzakalelayo uthembisa ini ngempela

I-0.0.0.0/0 ihambisana nayo yonke indawo ekuyiwa kuyo ye-IPv4 ngamabhithi angu-zero. Ikhona ukuze umsingathi afinyelele noma yini ithebula laso elingayichazi kangcono. Umzila oya ku-192.168.1.0/24 uthwala amabhithi angu-24 ahambisanayo, ngakho ku-192.168.1.40 unwina ngaphambi kokuba noma ubani aqhathanise imethrikhi, ibanga lokuphatha noma noma yini iklayenti eliyibiza ngokuthi inkambu yokubaluleka. Lowo mthetho ufana usebenza ku-Linux FIB, kwithebula lokuhambisa lwe-Windows kanye nesitaki se-BSD ngemuva kwe-macOS.

Ku-LAN evamile lokho kuziphatha kuyisici. Isubneti yasendaweni ixhunyiwe ngqo, iphrinta iyaqhubeka isebenza ngenkathi ithubhu lithwala ukuphequlula kwakho, futhi akukho okulungiswe kabi. Umbuzo ofanele ukubuzwa awukho wokuthi kungani lelo kheli lihamba ngqo, kodwa ukuthi iyiphi iphrephikisi kuyiphi ithebula ehambisana nalo, futhi ngubani oyibeke lapho.

Isigamu-sokuzenzakalela, noma kungani umbhalo ozenzakalelayo ungabonakala ungathintwanga

Isibonelo esihlanzekile kakhulu siku-redirect-gateway def1 ku-OpenVPN. Esikhundleni sokususa nokushintsha okuzenzakalelayo kwakho, yengeza i-0.0.0.0/1 ne-128.0.0.0/1. Ndawonye labo mabili amboza yonke i-IPv4, iphrephikisi ngayinye yinde kune-/0, futhi kokubili kunqoba okuzenzakalelayo kwerutha ngenkathi kuyishiya endaweni yayo. Gijimisa uhlu lwemizila ngemva kwalokho futhi umzila wokuqala ozenzakalelayo uselapho, usakhomba i-gateway yakho; awukakhethwa nje kunoma yiziphi iindawo ze-inthanethi.

I-wg-quick ye-WireGuard ifinyelela umphumela ofanayo ngokuhambisa okusekelwe kunqubomgomo. Uma i-AllowedIPs imboza i-0.0.0.0/0 yakha ithebula layo, ithumela amaphakethe amakiwe lapho, futhi yengeza umthetho ongayinaki iphrephikisi yobude obungu-zero yethebula eliyinhloko. Ithebula eliyinhloko ligcina umbhalo walo ozenzakalelayo, futhi imithetho inquma ukuthi ithebula lethubhu libuzwa kuqala ngethrafikhi ephethwe i-interface.

Womabili amadizayini adinga umzila owodwa nje ngaphandle kwethubhu: umzila womsingathi oya ekhelini leseva ye-VPN uqobo nge-gateway yokuqala. Ngaphandle kwawo iklayenti lizozama ukuthwala amaphakethe akha ithubhu ngaphakathi kwethubhu, futhi ukuxhumana akusoze kwaqedwa. Ngakho umzila ongewona owethubhu ethebuleni lakho uvamile ngisho kuphrofayela eqinile yethubhu eliphelele. Imizila okufanele ibuzwe yileyo emboza iindawo okukhathazeka ngazo ngempela.

Imethrikhi inquma ukulingana, iphrephikisi inquma abanqobi

Imethrikhi iqhathaniswa kuphela phakathi kwabangenele ukhetho abahambisana ngokulinganayo nendawo ekuyiwa kuyo. Ku-Linux ip route get 10.20.5.9 iphrinta umnqobi kanye nethebula lakhe, futhi ip route show table all ibala abangenele ukhetho, kufaka phakathi noma yisiphi isigamu-sokuzenzakalela nanoma yiliphi ithebula umthetho okhomba kulo. Ku-Windows Find-NetRoute -RemoteIPAddress 10.20.5.9 ibuyisela umzila okhethiwe nekheli lomthombo, kuyilapho Get-NetRoute ibonisa ithebula eliluhlaza — kodwa izindleko ezisebenzayo iyimethrikhi yomzila kanye nemethrikhi ye-interface, ngakho i-adaptha enensayo ingalahlekelwa ukulingana okubonakala sengathi iyakunqoba.

Izigameko ezintathu zimboza iningi lalokho ozokubona:

• Indawo efanayo, i-/24 ngokumelene ne-/0: i-/24 inqoba ngobude bephrephikisi, noma imethrikhi ithini.
• Indawo efanayo, ama-/24 amabili anamamethrikhi ahlukene: imethrikhi esebenzayo ephansi iyanqoba.
• Indawo efanayo, amathebula amabili, elilodwa likhethwe umthetho wenqubomgomo: umthetho ukhetha ithebula kuqala, futhi ukuqhathaniswa kwephrephikisi kwenzeka ngaphakathi kwalo.

Isigameko sesithathu yilapho iningi lalemi bika liphela khona. ip rule ye-Linux noma isihlungi sethrafikhi se-VPN ye-Windows singathumela ithrafikhi ethebuleni elingakaze libe nokuzenzakalelayo kwethubhu, futhi ithebula eliyinhloko libonakala liphelele ngaso sonke isikhathi.

Ubani ngokuvamile ongumnikazi walokho kudlula

Qala ngephrofayela, hhayi ithebula. Ukulungiselelwa kwe-split-tunnel nezilungiselelo ze-VPN nge-app ngayinye kushiya ngamabomu amaphrephikisi aqanjiwe ngaphandle kwethubhu; iphrofayela yomsebenzi evikela isubneti eyimfihlo eyodwa futhi ivumele ukuphequlula okujwayelekile ukuthi kuhambe ngqo iziphatha njengoba yakhelwe, futhi ukuyishintsha kwephula inqubomgomo eyayakhelwe ukuyiphumeza. Umhlahlandlela wokuhambisa we-VPN we-Microsoft udweba umugqa ofanayo phakathi kwethrafikhi ephoqelelwe ethubhini nokungafakwa okusobala, okukwenza kube ukuhlola okusizayo ngaphambi kokuhlela noma yini.

Ngemva kwalokho funa izinsalela. Umzila okhomba ku-interface engasekho, noma ekhelini elivela kunethiwekhi yangaphambilini, uvela ngemva kokuba iziteshi zokumisa, ama-adaptha e-USB namabhuloho wekhonteyina zifike zahamba. Ukuwususa kanye akusona ukuphela: amaphrofayela okuxhumana e-NetworkManager, amafayela e-netplan nemizila eqhubekayo ye-Windows ziwufaka futhi ekuxhumekeni noma ekuqaliseni okulandelayo, ngakho thola ifayela noma iphrofayela ewumnikazi ngaphambi kokuhlela noma yini.

Ngemva kwalokho hlola i-IPv6 ngokwehlukana. ip -6 route ne-Get-NetRoute -AddressFamily IPv6 zigcina isimo esihlukile, okuzenzakalelayo okuhlukile nokuziphatha kweklayenti okuhlukile. Ukuhlola kwe-IPv4 kuphela akusho lutho ngomsingathi onesitaki esiphindwe kabili othanda ngokuthula umzila wendabuko we-IPv6, futhi lokho kukodwa kungenza iklayenti libonakale lifana ne-split-tunnel.

Qinisekisa ngokugeleza kwe-app uqobo

Bhala indawo ekuyiwa kuyo esetshenziswa ngempela yi-app, bese ubuza uhlelo ngomzila ewungathathayo kusukela ekhelini lomthombo eliboshwe yilelo app. ip route get 10.20.5.9 from 192.168.1.40 liphendula lokho ku-Linux; Find-NetRoute -RemoteIPAddress 10.20.5.9 kanye nekheli lasendaweni kwenza lokho ku-Windows. Qhathanisa umphumela nalokho okuqinisekiswa yiphrofayela. Ikhasi le-IP lomphakathi lesiphequluli lihlola indawo eyodwa kuphrothokholi eyodwa futhi alisho lutho ngekheli eliyimfihlo eliqale isikhalazo.

Lungisa into encane kakhulu echaza umehluko. Uma ukungafakwa kuvunyelwe, bhala iphrephikisi futhi uyishiye; uma kungenjalo, susa umzila noma wengeze umzila ocacile omncane ngethubhu esikhundleni sokwehlisa imethrikhi yokuzenzakalelayo. Ukwehlisa imethrikhi akukwazi ukudlula iphrephikisi ende, futhi ukuhlela okuzenzakalelayo ngenkathi imizila emibili ye-/1 iphethe umzila we-inthanethi nakho akushintshi lutho.

Ngemva kwalokho xhuma ithubhu futhi uphindise lowo mbuzo. Amaklayenti afaka kabusha imizila kukho konke ukuxhumana, ngakho ushintsho oluhlala kuze kufike ukuxhawulana okulandelayo alukahlolwa. Uma umzila usahluka, abasolwa abasele umthetho wenqubomgomo, ithebula lesibili noma isihlungi sohlangothi lweklayenti — hhayi umzila ozenzakalelayo.

• Shono indawo ekuyiwa kuyo nekheli lomthombo elisetshenziswa ngempela yi-app.
• Phrinta umzila onqobile nge-ip route get noma nge-Find-NetRoute.
• Hlola ukuthi ingabe ipheya ye-/1 noma ithebula lenqubomgomo liphethe umzila we-inthanethi.
• Bala yonke iphrephikisi ende kune-/0 ehambisana nendawo ekuyiwa kuyo.
• Phinda ukuhlola kwe-IPv6 ngokwehlukana.
• Landelela umzila osele ubuyela emuva efayeleni, kuphrofayela noma esihlungini esiwufakayo.
• Xhuma futhi ugijimise umbuzo futhi ngaphambi kokuthi uthi kulungisiwe.

Uma konke okuyisikhombisa kuvumelana nephrofayela, ithubhu lenza ngqo lokho elalilungiselelwe ukukwenza, futhi ukulungiswa kungokwephrofayela, hhayi imethrikhi.