Kungani i-LAN yakho ingakwazi ukufinyelela isevisi kuklayenti ye-VPN

Iklayenti ye-VPN ingasingatha isevisi i-LAN engakwazi ukuyivula. Okujwayelekile ukushoda indlela yokubuya: umzila owodwa, ipheya le-DNAT, noma umugqa we-SNAT ongengezwa muntu.

Ithuneli yakho iyasebenza, isevisi iyalalela, kodwa i-LAN yasehhovisi ayikatholi lutho olubuyayo. Akekho owephule i-VPN. Ngasohlangothini lwe-LAN, ikheli lethuneli lomshini ophathekayo alikho kuze kube khona okutshela i-LAN ukuthi ifinyelela kanjani kulo, futhi impendulo kufanele ibuye ngendlela efanayo nesicelo esaphuma ngayo. Ngibonile abantu bakha kabusha ithuneli ephelele empilweni izikhathi ezintathu ngaphambi kokuba othile abheke indlela yokubuya.

Akuyona ithuneli eyephukayo

Womabili amaphethelo ahlala emikhakheni yangasese, lokhu kuyisimo esijwayelekile hhayi ukumiswa okungalungile. Ikheli elifana no-10.8.0.6 lingempela ngaphakathi kwethuneli futhi alikho kwenye indawo, ngakho i-LAN ayinasizathu sokuthumela lutho lapho. Ngaphambi kokuthinta umzila, qinisekisa ukuthi isevisi iyafinyeleleka ngaphakathi kwethuneli nhlobo: kuklayenti, ss -ltn ibonisa ukuthi umlaleli uboshelwe ku-127.0.0.1, ku-interface ye-LAN noma ekhelini lethuneli. I-daemon eboshelwe ku-loopback kuphela ayiphenduli muntu ngaphandle kwayo, futhi akukho mzila, DNAT noma ukudluliswa kwembobo okushintsha lokho.

I-proxy embobeni 80 noma 443 iyithuluzi elinye elinokubonakala okunye. Ihambisa izicelo, hhayi amaphakethe, ngakho isigaba asilungile ekuxhumekeni kwedathabheyi eluhlaza, futhi ukwelula isandla kuyo yiyo indlela le nkinga egcina ngayo ijula ngamathuluzi amathathu ngaphambi kokuba othile akale noma yini.

Isimo somzila: tshela i-LAN ukuthi ichibi likuphi

Umzila ome ngukho kugethiweyi ye-LAN uyimpendulo ehlanzekile kakhulu uma i-LAN nechibi lethuneli kungahlangani. Qondisa ichibi emshinini oqeda ithuneli:

ip route add 10.8.0.0/24 via 192.168.1.12
route add -p 10.8.0.0 mask 255.255.255.0 192.168.1.12   # Windows, persistent

Lokho kulungisa uhlangothi olulodwa kuphela, yingakho izinguqulo eziyingxenye yalolu shintsho zibonakala njengentuthuko. Uhlangothi lwethuneli ludinga ingxenye efanayo, ngaphandle kwalokho impendulo ishiya iklayenti ngomzila walo ojwayelekile bese ifa endleleni:

push "route 192.168.1.0 255.255.255.0"

Kusubnethi engemuva kweklayenti elilodwa hhayi emuva kweseva, iseva idinga kokubili umzila wesistimu kanye nokufakwa kwe-iroute efayeleni laleyo klayenti ngaphansi kwe-client-config-dir. Ngaphandle kwe-iroute, OpenVPN iyazi ukuthi isiqalo sikhona futhi ayazi ukuthi iyiphi iklayenti esiphethe: amaphakethe ayafika futhi i-daemon ayinalutho yokuwahlanganisa nakho.

Nayi inganekwane efanele igama. Umzila wenza ikheli lifinyeleleke; awenzi uhlangothi olubhekene nalo lube nesifiso sokuphendula. Ozakwethu bezingosi-kuya-ezinye banezela esinye isigaba phezulu, ngoba igethiweyi ekude yamukela kuphela imithombo engaphakathi kweziqalo ezisohlwini lwenqubomgomo yayo, futhi ikhompyutha ephathekayo evela echibini lasekhaya ayikho kuzo.

Isimo se-NAT: i-DNAT ingena, nomugqa we-SNAT wonke umuntu awudlulayo

Uma ungakwazi ukuthinta igethiweyi ye-LAN, noma ufuna ukushicilela imbobo eyodwa ncamashi, ukuhumusha kumsingathi we-VPN kusebenza ngaphandle komzila we-LAN nhlobo. Shicilela imbobo, yidlulisele phambili, futhi uhumushe umthombo endleleni engena ethunelini:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 -j DNAT --to-destination 10.8.0.6:3000
iptables -A FORWARD -i eth0 -o tun0 -p tcp -d 10.8.0.6 --dport 3000 -j ACCEPT
iptables -t nat -A POSTROUTING -o tun0 -d 10.8.0.6 -p tcp --dport 3000 -j SNAT --to-source 10.8.0.1

Umugqa wesithathu yiwona olahlekayo. Wudlule, iklayenti lizobona ikheli le-LAN lokuqala njengomthombo, liphendule ngomzila walo ojwayelekile, futhi leyo mpendulo ingena ethunelini esikhundleni sokubuyela e-LAN. Ukuthi uxhumano luzophila yini kuncike ekuhambeni komzila ongakaze ukuhlele. Nge-SNAT iklayenti libona ikheli lethuneli leseva, ngakho impendulo ilandela ithuneli libuyela emuva kumsingathi oyedwa ongakwazi ukuhoxisa ukuhumusha.

I-firmware yabathengi isebenzisa amagama ayo emigqa futhi ayikukhiqizi lokho kuhumusha kuwe. Ku-Tomato, umthetho ongenayo uwela ku-WANPREROUTING bese uwela kumugqa wokuhlunga ofana no-wanin, futhi isethi yemithetho ebukeka iphelele isadinga umugqa we-POSTROUTING obhalwe ngesandla. Lokho akulona iphutha le-firmware; iyisethi yemithetho ebhalelwe ukuhamba okungena kuphela.

Kungani umthetho obukeka ulungile usalahla iphakethe

Iningi lalokhu kwehluleka akukho emthethweni ogqolozele wona. Hlola izinto ezine ngalokhu kulandelana, futhi ume kokokuqala okungagcwaliseki:

  • Ukulandelana kwemigqa. I-iptables -I ifaka phezulu futhi i--A ingeza ekugcineni, ngakho umthetho wangaphambilini ovumayo noma ovimbayo unquma kuqala.
  • Umugqa ongafanele. Ukuhamba okuqondiswe kurutha yona ngokwayo kudlula ku-INPUT, futhi ukuhamba okudluliselwa phambili akukuthinti neze. Ukushicilela isevisi eyodwa kungadinga imithetho kukho kokubili.
  • Amafulegi ohlangothi. I--i tun0 ihambisana nokuhamba okuvela kumaklayenti futhi i--o tun0 ihambisana nokuhamba okuya kuwo. I-REJECT enefulegi elingalungile ivimbela into obungayihlosile.
  • Umkhawulo womthombo. Ukudlulisela phambili okwamukela ikheli elilodwa leklayenti kusebenza kuleyo klayenti futhi kulahla wonke omunye umthombo ngaphandle kwezwi.

Umthetho onesibali samaphakethe esingu-zero awukho emzileni nhlobo, futhi ukufunda izibali kuyindlela esheshayo yokuhlukanisa inkinga yomugqa ongafanele nenkinga yomthetho ongafanele.

Ukudlulisela phambili kwasendaweni, uma kungekho okungashintshwa ku-LAN

Ukudlulisela phambili kwe-SSH kwasendaweni kudlula umbuzo wonke. Akudingi mzila ku-LAN, akudingi ukubambisana kwe-firewall yeklayenti, futhi akudingi imbobo eshicilelwe ndawo:

ssh -N -f -L 3000:10.8.0.6:3000 user@vpn-host

Isevisi ibese ivela ku-localhost:3000 yomshini ophethe ithuneli, hhayi kwenye indawo. Lowo umkhawulo: isiteshi somsebenzi esisodwa, imbobo eyodwa, futhi ukudlulisela kuyafa nesikhathi ngaphandle uma okuthile kukuqala kabusha. Kumphathi ohlola idathabheyi yokulinga iyithuluzi elifanele. Kukhamera noma isikena abanye abantu okufanele bakufinyelele, akusilo, ngoba umsebenzisi ngamunye uzodinga ukudlulisela kwakhe.

Qinisekisa izinhlangothi zombili ngaphambi kokwengeza omunye umthetho

Ukuhumusha kushiya imikhondo, futhi ukuyifunda kungcono kunokuqagela. Kumsingathi we-VPN, conntrack -L ikhombisa ukuthi ukuhumusha kwenzeka yini, iptables -t nat -L -n -v ikhombisa ukuthi izibali zanyakaza yini, futhi tcpdump -ni any port 3000 ikhombisa ukuthi iyiphi ikheli lomthombo elafika ngempela. Kuklayenti, ss -ltn iqinisekisa ukuthi umlaleli usekhelini umzila ongakufinyelela.

Bese ukhetha isimo osigcinayo. Imbobo eyodwa eshicilelwe, umzila wachibi lonke, nokudlulisela phambili kumphathi oyedwa kuyizibopho ezintathu ezihlukene, futhi ukuzihlanganisa yindlela okusethwa okusebenzayo okuba yikho okungekho muntu ongakuchaza emva kwezinyanga eziyisithupha. Bhala ukuthi iyiphi ikheli efinyeleleka kusuka kuphi, futhi umuntu olandelayo ozolungisa lokhu uzoqala ngempendulo hhayi ngethuneli.

Izihloko ezihlobene