Kungani iklayenti le-VPN ku-LAN yasehhovisi lilahlekelwa yiyo yonke impendulo

I-laptop ihlezi ku-/24 yasehhovisi nge-Ethernet futhi ijoyina ne-OpenVPN server ehlala kuyo leyo /24. Uzakwabo wenza i-ping ekhelini leshumi; isicelo sifika ngokucacile, futhi akukho okubuyayo. Ilogi yeshumi ihlanzekile futhi ukuphequlula kusasebenza, ngakho ishumi umsolwa ongalungile. Ukuqinisekiswa komthombo we-IPv4 kumshini owamukelayo kujikijela iphakethe ngaphambi kokuthi noma yini ilifunde.

Ukujikijela kwenzeka ngaphambi kokuthi noma yini ifunde iphakethe

Ukuqinisekiswa komthombo kubuza umbuzo owodwa mayelana nephakethe ngayinye engenayo: uma le host iphendula lowo mthombo, ingabe impendulo izophuma nge-interface iphakethe elisanda kungena ngayo? Uma impendulo ingu-cha, i-kernel ijikijela iphakethe lapho lifika. Asikho isokhethi noma umzila wokudlulisa oke ulibone, yingakho ukubamba kushumi kusabhala isicelo uhlelo lokusebenza olungasitholi neze.

Iklayenti lapha libamba u-10.66.0.9 kushumi laso, futhi i-OpenVPN server iphendula ku-192.168.80.10 ngaphakathi kwesimiso sehhovisi. Uzakwabo ku-192.168.80.25 wenza i-ping ekhelini leshumi, ngakho isicelo siwela i-LAN, i-server isiqondisa kushumi, futhi sifika ku-interface yeshumi yeklayenti sithwele ikheli lomthombo lasehhovisi. Kuthebula lomzila yalowo mshini, isimiso sehhovisi singesedivayisi ye-Ethernet, hhayi eseshumi. Ukuqinisekiswa kuqhathanisa i-interface yokufika nomzila, kuthola ukungahambisani futhi kujikijele iphakethe, ngakho uzakwabo ubona ukulahlekelwa okuphelele ngenkathi zombili iziphetho zibika ishumi elinempilo.

Uhlangothi lwesibuko lunomumo ofanayo: lapho iklayenti liqala ngasehhovisi, izimpendulo zingajikijelwa ohlangothini lwehhovisi ngesizathu esifanayo. Ukulungiswa okuqinisekiswe ohlangothini olulodwa kuphela kuvame ukubuya njengekhithi yesibili.

Fakazela imodi esebenzayo ngaphambi kokuthinta noma iyiphi i-sysctl

Funda amanani asebenzayo esikhundleni sokwethemba okuzenzakalelayo kwe-distribution, ngoba isilungiselelo se-interface ngayinye siyingxenye yokukhetha kuphela. Imodi esebenzayo yileyo ephakeme phakathi kwenani le-interface nenani lika-all, ngakho uziro ku-interface yeshumi awusho lutho uma u-all enguwedwa. Isinqumo semodi eqinile yisinqumo somzila, ngakho gijimisa uphenyo olugijimiswa i-kernel futhi uqhathanise impendulo yalo ne-interface iphakethe elafika ngayo ngempela.

tcpdump -ni tun0 icmp and host 192.168.80.25
ip route get 192.168.80.25
sysctl net.ipv4.conf.all.rp_filter net.ipv4.conf.tun0.rp_filter

Bese uphinda i-ping ngenkathi ubheka isibali sezinkinga. Isibalo esikhuphukayo eduze kwesicelo okubamba esivele ukukhombisa ukusayinda kokujikijela, hhayi komzila ongekho. Vula ukulogwa kwamaphakethe e-Mars ngenkathi ukhona, ukuze i-kernel ibize umthombo ne-interface eyikwenqabileyo. Kanyekanye zisusa ukubethela, i-firewall kanye ne-iroute engekho njengezincazelo.

Bhala umugqa wesisekelo ngaphambi kokushintsha noma yini: womabili amanani, idivayisi ekhethwe uphenyo, kanye nesibali obusibhekile. Yilo mbhalo ozokutshela kamuva ukuthi ushintsho lwenze lokho ocabanga kukho.

Imodi ngayinye ye-rp_filter yamukela ini ngempela

I-kernel iveza amanani amathathu nge-interface ngayinye, futhi awasona izithunzi ezintathu zomthetho owodwa. Uziro uvimba ukuhlola. Okuqala kuqinile futhi kudinga ukuthi umthombo uhanjiswe emuva nge-interface yokufika. Okwesibili kuxekethile futhi kudinga kuphela ukuthi kukhona umzila othile oya emthonjeni kuthebula, noma ngabe ukhomba kuphi.

Umugqa obalulekile lapha ngowoxekethile, kanye nalokho okusakwala. Umthombo wamanga ongahanjiswa noma kuphi kuthebula lakho uyadlula, kuyilapho umthombo ongenawo nomzila wonke usanqatshwa. Ku-laptop lokhu kuwukuvuma okuncane; ku-router edlulisa ithrafikhi yabanye abantu kukhulu. Imodi ingeyase-host, ngakho inombolo efanayo ithwala isisindo esihlukile ezindaweni ezimbili.

Ukuthi imuphi umugqa odingwa yilesi sakhiwo uvela kuthebula hhayi emkhubeni. Iphakethe lisebenza ngokomthetho futhi umthombo walo uyahanjiswa, ngakho oxekethile uyalemukela kanti oqinile akanamukeli. Akukho lutho kuleli cala oludinga uziro, futhi ukukhetha uziro kuzosusa ukuhlola okungabizi lutho lapha.

Khetha ushintsho oluncane olususa ukungacaci

Imodi exekethile ushintsho oluncane olufanele, futhi ingukwehliswa kwangempela kokuqina, hhayi iswishi engenabungozi. Ikhona indlela engcono uma isakhiwo sivuma: susa ukwehlampithana, futhi ukungacaci kuyanyamalala.

Lapho isimiso sehhovisi sidingeka kuphela nge-Ethernet, sisa emizileni edonswa yiphrofayili, futhi ikheli liyafinyeleleka ngomzila owodwa. Uma imizila emibili kufanele ngempela ibe khona kanyekanye, hlanganisa umthombo nedivayisi ngomthetho wenqubomgomo esikhundleni sokuxegisa ukuqinisekiswa ku-interface ngayinye. Lokho kugcina ukuhlunga okuqinile kukho konke okunye kumshini, futhi kubhala ukungafani lapho unjiniyela olandelayo ezokukhangela khona.

Noma umuphi umzila owukhethayo, wubhale ku-sysctl drop-in hhayi kumyalo osebenzayo. Setha okhiye abangu-all naba-default ndawonye, ukuze ukuxhuma kabusha kungakwazi ukubuyisela imodi eqinile ngokuthula.

# /etc/sysctl.d/99-rp-filter.conf
net.ipv4.conf.default.rp_filter = 2
net.ipv4.conf.all.rp_filter = 2
sysctl --system

Imodi exekethile ishiya ini, futhi kuphi

Imodi exekethile isanqatsha umthombo ongasoze ufinyelelwe yinoma imuphi umzila, futhi iyeka ukunqatsha umthombo wamanga ovela uhanjiswa. Ku-laptop lokhu kuwukuvuma okuncane. Kudivayisi edlulisa ithrafikhi engeyona yayo, ukukhetha okufanayo kukhulu kakhulu. Ngakho isilungiselelo esifanayo sithwala izincazelo ezimbili ezihluke kakhulu kuye ngokuthi sisebenza kuphi.

Ukuvimba ukuhlola ngokuphelele ku-host edlulisa ithrafikhi yabanye abantu ukuphela kokulungiswa okufanele kugwenywe. Uziro ulahla ukuqinisekiswa imodi exekethile eyigcina ngokucophelela. Uma i-host idlulisela abanye, thethelela isikhundla somthetho wenqubomgomo esigabeni esedlule esikhundleni salokho.

Shiya inothi elisho ama-interface amabili, isimiso esihlangene kanye nokuhlolwa okuqondile okusephumelelayo manje. Lokho kuwusizo kunjiniyela olandelayo kunomugqa othi ukuhlunga kwalungiswa.