Kungani ukulawula i-router kuyeka ukuphendula ngemuva koshintsho lwe-VPN

Ushintshe indlela noma umthetho wesivikelo somlilo ukuze uhlole umhubhe ku-router, futhi manje ikhasi lokulawula aliphenduli kusukela kubhukwana elalisebenza kahle emizuzwini eyishumi edlule. Ukusabela kokuqala ukusola i-VPN. Isikhathi esiningi umhubhe uphilile futhi enye yezinto ezintathu ezinye yephukile: ayikho indlela yokubuyela ekhelini le-router uqobo, inqubomgomo yokungena ilahla isicelo, noma isevisi yewebhu ayilaleli ekhelini olibizayo. Zombili lezi zinto zibonakala zifana kusiphequluli, yingakho abantu beqala kabusha umhubhe ihora lonke futhi bangafundi lutho.

Lena inganekwane okufanele ibulawe kuqala: umhubhe osebenzayo awuyona indlela yokubuyela ngaphakathi. Uwukuxhumana kwenethiwekhi okusha okunemibuzo yalo yokuthembela, futhi kungasusa ngokuthula indlela yakho endala yokuphatha kuyilapho kuvula enye entsha okungekho muntu oyihlolile.

Umhubhe awukaze ube yindlela yokuphatha

Ukudlulisela nokungena kuyimisebenzi ehlukene. "Ingabe iklayenti lingafinyelela i-NAS ngomhubhe?" uwumbuzo wokudlulisela mayelana namaphakethe adlula ku-router. "Ingabe ngingavula imbobo ye-SSH ye-router?" uwumbuzo wokungena mayelana namaphakethe akhelwe i-router uqobo. Umthetho wokuvumela obhalelwe ithrafikhi edlulisiwe awenzi lutho embuzweni wesibili, futhi lesi yisizathu esivame kakhulu sokuthi umhubhe othwala ithrafikhi ngokuphelele kungani unqaba isikhathi sakho sokulawula.

Iphutha eliphambene ukwethemba igama lesixhumi. Umhubhe ufinyezwa ngokugqanyiswa kuya kumlingani, hhayi kuyo yonke isevisi engemuva kwayo, futhi igama elithi VPN kulebula yesixhumi alisho lutho mayelana nokuthi imiphi imithombo okufanele ivunyelwe ukungena.

Izinga lokuqala: ingabe ikhona indlela eya ekhelini le-router uqobo?

Qala kuklayenti bese ubuza umgogodla ukuthi iphakethe lizoya kuphi. Ku-Linux i-ip route get 10.6.0.1 iphrinta indlela ekhethiwe, isixhumi sokuphuma nekheli lomthombo. Uma ibika indlela ezenzakalelayo ebheke kumhlinzeki wakho, iphakethe alilokothi lingene emhubheni, futhi awukho umthetho ku-router ongalisindisa.

Uhlangothi lomhubhe lunenguqulo yalo yombuzo. I-WireGuard ibheka i-AllowedIPs njengethebula lokuhamba kwengcwele yokubhala: emkhawulweni ngamunye imemezela ukuthi imiphi imikheli yomthombo umlingani angayisebenzisa nokuthi yimiphi imigomo ethunyelwa kulo mlingani. Uma ingxenye yeklayenti ingenayo ikheli lomhubhe le-router, iklayenti alinayo indlela eya lapho. Uma ingxenye yeseva yalelo klayenti ingayihlanganisi ikheli lomhubhe leklayenti, iseva ilahla iphakethe ngaphambi kokuba kubhekwe noma yimuphi umthetho wesivikelo somlilo.

Qinisekisa ikheli eliqondile ohlose ukulifinyelela ngaphambi kokuxazulula inqubomgomo. Irekhodi le-DNS elidala noma ingxenye yomakhelwane egcinwe kunqolobane ngaphambi koshintsho kukuholela ekhelini i-router engakaze ibe nalo.

Izinga lesibili: inqubomgomo yokungena, hhayi inqubomgomo yokudlulisela

Izivikelo zomlilo zihlola imithetho kusixhumi lapho iphakethe lifika khona. Ku-pfSense ne-OPNsense, ithebhu yesixhumi nokulandelana kwemithetho kunquma ukuthi ithrafikhi eya kumasevisi esivikelo somlilo uqobo ivunyelwe yini; umthetho ovumela amaklayenti e-LAN ukuphuma ku-inthanethi awuwona umthetho ovumela umlingani womhubhe ukuvula i-GUI yewebhu. Ku-OpenWrt ene-firewall4, isifunda ngasinye sithwala inqubomgomo yokungena, i-option input 'ACCEPT' noma i-'REJECT', futhi isixhumi somhubhe esifundeni esine-REJECT yokungena sizonqaba ukuxhumana kokuphatha kuyilapho sisadlulisela ithrafikhi uma ukudlulisela kuvunyelwe.

Ungayicishi inqubomgomo yokulwa nokukhiywa ukuze indlela entsha isebenze. Leyo nqubomgomo ivimbela umthetho omubi ukukhiya ikheli lokuphatha le-LAN; ivikela inethiwekhi encane ye-LAN, hhayi inethiwekhi encane yomhubhe osanda kuyakha. Engeza umthetho owodwa omncane womthombo womlawuli bese ushiya inethi yokuphepha njengoba injalo. Imibhalo ye-pfSense mayelana nokufinyelela komlawuli ichaza ukuthi lezo zilawuli zikuphi.

# on the router: bind addresses and the loaded ruleset
ss -ltnp | grep -E ':(22|80|443)\b'         # Linux / OpenWrt
sockstat -4 -l | grep -E ':(22|80|443)\b'   # FreeBSD / pfSense
nft list ruleset | grep -A6 'chain input'    # firewall4
pfctl -sr | head -40                         # pf / pfSense

Izinga lesithathu: ingabe ikhona into elalela kulelo kheli?

Isevisi ingase isebenze futhi ingafinyeleleki ngoba ibophezele ekhelini elilodwa. I-uhttpd ye-OpenWrt igcina amangxenye acacile okulalela ku-/etc/config/uhttpd, isibonelo i-list listen_http '0.0.0.0:80'; ukwakhiwa okubophezela ekhelini le-LAN kuphela akwamukeli lutho ekhelini lomhubhe, futhi imikhiqizo ekhombisa isilungiselelo sesixhumi sokulalela yenza okufanayo. Imiyalo yokulalela engenhla iphendula lokhu ngqo.

Bese uhlukanisa ukunqatshwa nokuthula. I-nc -vz 10.6.0.1 443 ebuyisela ukuxhumana okunqatshiwe isho ukuthi iphakethe lafika ku-router futhi kwaba nokuthile okwalinqaba, kungaba imbobo evaliwe noma umthetho ocacile wokunqaba. Ukulenga kuze kuphele isikhathi kusho ukuthi iphakethe lalahlwa noma alizange lihanjiswe. Lowo mehluko ukutshela ukuthi yisiphi isigaba okufanele usihlole ngokulandelayo, futhi kuthatha imizuzwana emihlanu.

Isixhumi se-VPN siwumngcele, hhayi indlela yokululama

Ukugqanyiswa kuvikela ucingo; akusho lutho mayelana nokuthi ubani ovunyelwe ukuvula ikhasi lokulawula. Uma umhubhe ususebenza, melana nesifiso sokuxazulula ukufinyeleleka ngokuvumela konke kusixhumi somhubhe. Nika abalawuli umthetho obophezele ekhelini labo lomhubhe noma umhubhe ohlukile wabalawuli kuphela, futhi gcina abasebenzisi abajwayelekile, i-NAS, amakhamera namabhukwana omndeni kude nembobo yokuphatha. Umlingani odinga ukwabelana ngamafayela akufanele abe ngumthetho owodwa ukusuka ekungeneni kwe-router.

Indima ye-router ishintsha impendulo. I-router eqeda umhubhe ingamukela ngokusemthethweni abalawuli kuwo, kuyilapho i-router esebenzisa umhubhe njengokuphuma ku-inthanethi kuphela ngokuvamile akufanele. Kuzo zombili izimo imvume yenethiwekhi encane ayikona ukungena, ngakho shiya ukuqinisekiswa kwe-akhawunti nokuphepha kokuthutha kuvuliwe.

Indlela yokunxephezela abantu abayenzayo ngemuva kokukhiywa imbi kakhulu: ukuvula ukuphatha kwe-WAN noma ukudlulisela imbobo ku-GUI yewebhu. Lokho kuguqula ukuphazamiseka okufushane kube ukuchayeka okungapheli, futhi ikhasi lokungena ngaleso sikhathi liyafinyeleleka kunoma yisiphi isihloli ku-inthanethi. Hlola futhi uhlangothi olunqatshiwe, hhayi oluvunyelwe kuphela, ukuze umlingani okungafanele abe nokufinyelela komlawuli athole isikhathi esiphelile noma ukunqatshwa esikhundleni sesicelo sokungena.

Hlola futhi ngokuxhumana okusha. Isivikelo somlilo esinesimo sigcina imifudlana ekhona kuthebula laso lesimo, ngakho isikhathi se-SSH osuvele usivulile singasinda kushintsho oluvimbela konke ukuxhumana okusha. Yileyo ndlela ukukhiywa okuhlala kungabonakali kuze kube ukuqala kabusha okulandelayo noma ubuthongo obulandelayo bebhukwana.

Lungiselela indlela yokubuyela ngaphambi kokuthinta inqubomgomo

Bhala izinto ezine ngaphambi koshintsho lokuqala: ukuthi uzofinyelela kanjani idivayisi uma umhubhe ufa, isibonelo ikhonsoli yochungechunge, ikhonsoli yomhlinzeki noma umshini ose-LAN; ukuthi ukulungiselelwa kwamanje kukhishwa kuphi; ukuthi imuphi umthetho owodwa noma indlela ozoyishintsha; nokuthi uzoyibuyisela kanjani ngqo leyo nto. Ku-OpenWrt i-sysupgrade -b /tmp/backup.tar.gz ibamba ukulungiselelwa, futhi izinguquko zihlala zilindile kuze kube i-uci commit, okukunika ukuhoxiswa okushibhile uma ubona ngesikhathi. I-pfSense igcina umlando wokulungiselelwa, futhi i-AutoConfigBackup isiza kuphela uma ibivele ivuliwe. Uma i-router isebenzisa isethi yemithetho ye-fail-closed, qinisekisa ukuthi indlela yokulungisa oyihlelelayo ayikho ngaphakathi kwethrafikhi evinjwa yilowo mthetho, futhi khumbula ukuthi ukuqala kabusha kusebenzisa futhi imithetho ehlala njalo esikhundleni sokuyisusa.

Shintsha umngcele owodwa ngomzamo ngamunye, bese uhlola kusukela ekuxhumaneni okusha esikhundleni se-shell oyishiya ivuliwe. Uma ukuhlola kwehluleka, buyisela lowo shintsho owodwa ngaphambi kokuthinta isigaba esilandelayo. Umhubhe ungahlala uphezulu ngaso sonke isikhathi, kodwa isithonjana saso sesimo esiluhlaza akubona ubufakazi bokuthi usengangena.

Ukuhlola okusheshayo ngaphambi kokuhamba:

• Ingabe ungafinyelela i-router emthonjeni ongathembeli kumthetho osanda kuwuhlela?
• Ingabe inqubomgomo yokungena kusixhumi somhubhe ivumela umthombo womlawuli kuphela?
• Ingabe isevisi yokuphatha ibophezele ekhelini elikhona kumhubhe?
• Uke wahlola umlingani oyedwa owenqatshiwe nesikhathi esisodwa esisha?
• Ingabe indawo yokuphatha ye-WAN isavaliwe?