{"id":53572,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/chto-proishodit-pri-soedineniyah-vnutri-i-vne-vpn-tunnelya"},"modified":"2020-02-18T14:01:29","modified_gmt":"2020-02-18T11:01:29","slug":"chto-proishodit-pri-soedineniyah-vnutri-i-vne-vpn-tunnelya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-proishodit-pri-soedineniyah-vnutri-i-vne-vpn-tunnelya","title":{"rendered":"Co se d\u011bje p\u0159i p\u0159ipojen\u00edch uvnit\u0159 a vn\u011b VPN tunelu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Z email\u016f na technickou podporu Tucha vznikaj\u00ed skute\u010dn\u00e9 \u010dl\u00e1nky. Ned\u00e1vno n\u00e1s kontaktoval klient s \u017e\u00e1dost\u00ed o vyjasn\u011bn\u00ed, co se d\u011bje p\u0159i spojen\u00ed uvnit\u0159 VPN tunelu mezi kancel\u00e1\u0159\u00ed u\u017eivatele a cloudov\u00fdm prost\u0159ed\u00edm, stejn\u011b jako p\u0159i spojen\u00ed mimo VPN tunel. Cel\u00fd n\u00ed\u017ee uveden\u00fd text je proto skute\u010dn\u00fd e-mail, kter\u00fd jsme poslali jednomu z klient\u016f v reakci na jeho dotaz. Samoz\u0159ejm\u011b jsme zm\u011bnili IP adresy, abychom neodhalili klienta. Ale ano, technick\u00e1 podpora Tucha skute\u010dn\u011b vynik\u00e1 sv\u00fdmi podrobn\u00fdmi odpov\u011b\u010fmi a smyslupln\u00fdmi e-maily. \ud83d\ude42<\/p>\n

Samoz\u0159ejm\u011b rozum\u00edme tomu, \u017ee pro mnoh\u00e9 tento \u010dl\u00e1nek nebude objevem. Ale vzhledem k tomu, \u017ee na Habr se ob\u010das objevuj\u00ed \u010dl\u00e1nky pro za\u010d\u00ednaj\u00edc\u00ed administr\u00e1tory, a tak\u00e9 vzhledem k tomu, \u017ee tento \u010dl\u00e1nek vznikl z re\u00e1ln\u00e9ho e-mailu skute\u010dn\u00e9mu klientovi, i tak se s t\u011bmito informacemi pod\u011bl\u00edme. Existuje velk\u00e1 pravd\u011bpodobnost, \u017ee n\u011bkomu budou u\u017eite\u010dn\u00e9.
\nPodrobn\u011b tedy vysv\u011btlujeme, co se d\u011bje mezi serverem v cloudu a kancel\u00e1\u0159\u00ed, pokud jsou propojeny s\u00edt\u00ed site-to-site. Zaznamen\u00e1me, \u017ee p\u0159i tom je \u010d\u00e1st slu\u017eeb dostupn\u00e1 pouze z kancel\u00e1\u0159e a \u010d\u00e1st odkudkoli z internetu.<\/p>\n

Hned vysv\u011btl\u00edme, \u017ee n\u00e1\u0161 klient si p\u0159\u00e1l, aby na serveru 192.168.A.1<\/b> bylo mo\u017en\u00e9 se p\u0159ipojit odkudkoli p\u0159es RDP, p\u0159ipojuj\u00edc\u00ed se k A.A.A.2:13389<\/b>, a k ostatn\u00edm slu\u017eb\u00e1m pouze z kancel\u00e1\u0159e (192.168.B.0\/24)<\/b>, p\u0159ipojen\u00e9 p\u0159es VPN<\/a>. Klient m\u011bl tak\u00e9 p\u016fvodn\u011b nastaveno, \u017ee k za\u0159\u00edzen\u00ed 192.168.B.2 <\/b>v kancel\u00e1\u0159i bylo mo\u017en\u00e9 p\u0159istupovat p\u0159es RDP odkudkoli, p\u0159ipojuj\u00edc\u00ed se k B.B.B.1:11111<\/b>. Pomohli jsme zorganizovat IPSec spojen\u00ed mezi cloudem a kancel\u00e1\u0159\u00ed, a IT specialista z\u00e1kazn\u00edka za\u010dal pokl\u00e1dat ot\u00e1zky o tom, co se stane v r\u016fzn\u00fdch p\u0159\u00edpadech. Abychom odpov\u011bd\u011bli na v\u0161echny tyto ot\u00e1zky, vlastn\u011b jsme mu napsali to, co m\u016f\u017eete \u010d\u00edst n\u00ed\u017ee.
\n<\/a><\/noindex>
\n\"Co<\/p>\n

A nyn\u00ed se na tyto procesy pod\u00edv\u00e1me podrobn\u011bji.<\/p>\n

<\/p>\n

Prvn\u00ed pozice<\/h3>\n

\nKdy\u017e n\u011bco pos\u00edl\u00e1no z 192.168.B.0\/24<\/b> v 192.168.A.0\/24<\/b> nebo z 192.168.A.0\/24<\/b> v 192.168.B.0\/24<\/b>, dost\u00e1v\u00e1 se do VPN. To znamen\u00e1, \u017ee tento paket je nav\u00edc \u0161ifrov\u00e1n a p\u0159ed\u00e1v\u00e1n mezi B.B.B.1<\/b> a A.A.A.1<\/b>, ale 192.168.A.1<\/b> vid\u00ed paket p\u0159\u00edmo od 192.168.B.1<\/b>. Mohou spolu komunikovat pomoc\u00ed jak\u00fdchkoli protokol\u016f. Odpov\u011bdi se samoz\u0159ejm\u011b stejn\u011b tak p\u0159ed\u00e1vaj\u00ed p\u0159es VPN, co\u017e znamen\u00e1, \u017ee paket z 192.168.A.1<\/b> pro 192.168.B.1<\/b> bude odesl\u00e1n jako ESP datagram z A.A.A.1<\/b> na B.B.B.1<\/b>, kter\u00fd na druh\u00e9 stran\u011b router rozbal\u00ed, vyt\u00e1hne z n\u011bj ten paket a p\u0159ed\u00e1 na 192.168.B.1<\/b> jak bal\u00ed\u010dek od 192.168.A.1<\/b>.<\/p>\n

Konkr\u00e9tn\u00ed p\u0159\u00edklad:<\/p>\n

1) 192.168.B.1<\/b> se obrac\u00ed na 192.168.A.1<\/b>, chce nav\u00e1zat TCP spojen\u00ed s 192.168.A.1:3389<\/b>;<\/p>\n

2) 192.168.B.1<\/b> odes\u00edl\u00e1 po\u017eadavek na nav\u00e1z\u00e1n\u00ed spojen\u00ed od 192.168.B.1:55555<\/b> (\u010d\u00edslo portu pro zp\u011btnou vazbu si vyb\u00edr\u00e1 s\u00e1m, zde a d\u00e1le budeme pou\u017e\u00edvat \u010d\u00edslo 55555 jako p\u0159\u00edklad takov\u00e9ho \u010d\u00edsla portu, kter\u00e9 syst\u00e9m vyb\u00edr\u00e1 p\u0159i vytv\u00e1\u0159en\u00ed TCP spojen\u00ed) na 192.168.A.1:3389<\/b>;<\/p>\n

3) opera\u010dn\u00ed syst\u00e9m, kter\u00fd pracuje na po\u010d\u00edta\u010di s adresou 192.168.B.1<\/b>, se rozhodne p\u0159edat tento bal\u00ed\u010dek na br\u00e1nov\u00fd adresu routeru (192.168.B.254<\/b> v na\u0161em p\u0159\u00edpad\u011b), proto\u017ee nem\u00e1 jin\u00e9, specifi\u010dt\u011bj\u0161\u00ed trasy pro 192.168.A.1<\/b>, proto p\u0159ed\u00e1v\u00e1 bal\u00ed\u010dek podle v\u00fdchoz\u00ed trasy (0.0.0.0\/0);<\/p>\n

4) za t\u00edmto \u00fa\u010delem se pokou\u0161\u00ed naj\u00edt MAC adresu pro IP adresu 192.168.B.254 <\/b>v ARP protokolov\u00e9 tabulce cache. Pokud nen\u00ed nalezena, ode\u0161le z adresy 192.168.B.1<\/b> \u0161irokospektr\u00fd who-has po\u017eadavek do s\u00edt\u011b 192.168.B.0\/24<\/b>. Kdy\u017e 192.168.B.254<\/b> na opl\u00e1tku ode\u0161le svou MAC adresu, syst\u00e9m p\u0159ed\u00e1 Ethernetov\u00fd bal\u00ed\u010dek pro n\u011bj a ulo\u017e\u00ed tuto informaci do sv\u00e9 cache tabulky;<\/p>\n

5) router p\u0159ijme tento bal\u00ed\u010dek a rozhodne se, kam ho p\u0159edat: m\u00e1 stanovenou politiku, podle kter\u00e9 mus\u00ed v\u0161echny bal\u00ed\u010dky mezi 192.168.B.0\/24<\/b> a 192.168.A.0\/24<\/b> p\u0159ed\u00e1vat prost\u0159ednictv\u00edm VPN spojen\u00ed mezi B.B.B.1<\/b> a A.A.A.1<\/b>;<\/p>\n

6) router vytvo\u0159\u00ed ESP datagram od B.B.B.1<\/b> na A.A.A.1<\/b>;<\/p>\n

7) router rozhoduje, komu tento bal\u00ed\u010dek p\u0159edat, pos\u00edl\u00e1 ho na, \u0159ekn\u011bme, B.B.B.254<\/b> (br\u00e1na internetov\u00e9ho poskytovatele), proto\u017ee nem\u00e1 jin\u00e9 specifi\u010dt\u011bj\u0161\u00ed trasy k A.A.A.1<\/b>, ne\u017e 0.0.0.0\/0;<\/p>\n

8) stejn\u011b jako bylo ji\u017e \u0159e\u010deno, nalezne MAC adresu pro B.B.B.254<\/b> a p\u0159ed\u00e1 bal\u00ed\u010dek br\u00e1n\u011b internetov\u00e9ho poskytovatele;<\/p>\n

9) internetov\u00ed poskytovatel\u00e9 p\u0159ed\u00e1vaj\u00ed ESP datagram prost\u0159ednictv\u00edm sv\u00fdch s\u00edt\u00ed od B.B.B.1<\/b> na A.A.A.1<\/b>;<\/p>\n

10) virtu\u00e1ln\u00ed router na A.A.A.1<\/b> p\u0159ijme tento datagram, de\u0161ifruje ho a z\u00edsk\u00e1 bal\u00ed\u010dek od 192.168.B.1:55555<\/b> pro 192.168.A.1:3389<\/b>;<\/p>\n

11) virtu\u00e1ln\u00ed router kontroluje, komu ho m\u00e1 p\u0159edat, najde v sm\u011brovac\u00ed tabulce s\u00ed\u0165 192.168.A.0\/24<\/b> a ode\u0161le ho p\u0159\u00edmo k 192.168.A.1<\/b>, proto\u017ee m\u00e1 rozhran\u00ed 192.168.A.254\/24<\/b>;<\/p>\n

12) za t\u00edmto \u00fa\u010delem virtu\u00e1ln\u00ed router nalezne MAC adresu pro 192.168.A.1<\/b> a p\u0159ed\u00e1v\u00e1 mu tento bal\u00ed\u010dek p\u0159es virtu\u00e1ln\u00ed Ethernetovou s\u00ed\u0165;<\/p>\n

13) 192.168.A.1<\/b> obdr\u017e\u00ed tento bal\u00ed\u010dek na portu 3389, souhlas\u00ed s nav\u00e1z\u00e1n\u00edm spojen\u00ed a formuluje bal\u00ed\u010dek v odpov\u011b\u010f od 192.168.A.1:3389<\/b> na 192.168.B.1:55555<\/b>;<\/p>\n

14) jeho syst\u00e9m p\u0159ed\u00e1 tento bal\u00ed\u010dek na br\u00e1nov\u00fd adresu virtu\u00e1ln\u00edho routeru (192.168.A.254<\/b> v na\u0161em p\u0159\u00edpad\u011b), proto\u017ee nem\u00e1 jin\u00e9, specifi\u010dt\u011bj\u0161\u00ed trasy pro 192.168.B.1<\/b>, nem\u00e1, proto mus\u00ed p\u0159edat bal\u00ed\u010dek podle v\u00fdchoz\u00ed trasy (0.0.0.0\/0);<\/p>\n

15) stejn\u011b jako v p\u0159edchoz\u00edch p\u0159\u00edpadech, syst\u00e9m, kter\u00fd pracuje na serveru s adresou 192.168.A.1<\/b>, nalezne MAC-adres 192.168.A.254<\/b>, proto\u017ee se nach\u00e1z\u00ed v jedn\u00e9 s\u00edti s jej\u00edm rozhran\u00edm 192.168.A.1\/24<\/b>;<\/p>\n

16) virtu\u00e1ln\u00ed sm\u011brova\u010d p\u0159ij\u00edm\u00e1 tento paket a rozhoduje, kam ho poslat: m\u00e1 nastavenou politiku, podle kter\u00e9 mus\u00ed pos\u00edlat v\u0161echny pakety mezi 192.168.A.0\/24<\/b> a 192.168.B.0\/24<\/b> p\u0159ed\u00e1vat prost\u0159ednictv\u00edm VPN spojen\u00ed mezi A.A.A.1<\/b> a B.B.B.1<\/b>;<\/p>\n

17) virtu\u00e1ln\u00ed sm\u011brova\u010d vytv\u00e1\u0159\u00ed ESP-datagramu od A.A.A.1<\/b> pro B.B.B.1<\/b>;<\/p>\n

18) virtu\u00e1ln\u00ed sm\u011brova\u010d rozhoduje, komu m\u00e1 tento paket poslat, a odes\u00edl\u00e1 ho na A.A.A.254<\/b> (br\u00e1na internetov\u00e9ho poskytovatele, v tomto p\u0159\u00edpad\u011b jsme to tak\u00e9 my), proto\u017ee neexistuj\u00ed konkr\u00e9tn\u011bj\u0161\u00ed trasy k B.B.B.1<\/b>, ne\u017e 0.0.0.0\/0;<\/p>\n

19) internetov\u00ed poskytovatel\u00e9 p\u0159en\u00e1\u0161ej\u00ed ESP-datagramu po sv\u00fdch s\u00edt\u00edch A.A.A.1<\/b> na B.B.B.1<\/b>;<\/p>\n

20) sm\u011brova\u010d na B.B.B.1 <\/b>p\u0159ijme tento datagram, de\u0161ifruje ho a z\u00edsk\u00e1 bal\u00ed\u010dek od 192.168.A.1:3389<\/b> pro 192.168.B.1:55555<\/b>;<\/p>\n

21) ch\u00e1pe, \u017ee by m\u011bl b\u00fdt posl\u00e1n p\u0159\u00edmo na 192.168.B.1<\/b>, proto\u017ee se nach\u00e1z\u00ed se n\u00edm v jedn\u00e9 s\u00edti, a proto m\u00e1 ve sm\u011brovac\u00ed tabulce odpov\u00eddaj\u00edc\u00ed z\u00e1znam, kter\u00fd nut\u00ed pos\u00edlat pakety pro cel\u00e9 192.168.B.0\/24<\/b> p\u0159\u00edmo;<\/p>\n

22) sm\u011brova\u010d najde MAC-adresu pro 192.168.B.1<\/b> a p\u0159ed\u00e1v\u00e1 mu tento paket;<\/p>\n

23) opera\u010dn\u00ed syst\u00e9m na po\u010d\u00edta\u010di s adresou 192.168.B.1<\/b> p\u0159ij\u00edm\u00e1 paket od 192.168.A.1:3389<\/b> pro 192.168.B.1:55555<\/b> a iniciuje dal\u0161\u00ed kroky pro nav\u00e1z\u00e1n\u00ed TCP-p\u0159ipojen\u00ed.<\/p>\n

V tomto p\u0159\u00edkladu je stru\u010dn\u011b a zjednodu\u0161en\u011b (a tady si lze vzpomenout na hromadu detail\u016f) pops\u00e1no, co se d\u011bje na \u00farovn\u00edch 2-4. \u00darovn\u011b 1, 5-7 nebyly probr\u00e1ny.<\/p>\n

Pozice druh\u00e1<\/h3>\n

\nPokud je 192.168.B.0\/24<\/b> n\u011bco odesl\u00e1no pr\u00e1v\u011b na A.A.A.2<\/b>, jde to ne do VPN, ale p\u0159\u00edmo. To znamen\u00e1, \u017ee pokud u\u017eivatel z adresy 192.168.B.1<\/b> se obrac\u00ed na A.A.A.2:13389<\/b>, tento paket vystupuje z adresy B.B.B.1<\/b>, proch\u00e1z\u00ed na A.A.A.2<\/b>, a tam sm\u011brova\u010d jej p\u0159ijme a p\u0159ed\u00e1 na 192.168.A.1<\/b>. 192.168.A.1<\/b> nev\u00ed nic o 192.168.B.1<\/b>, vid\u00ed paket od B.B.B.1<\/b>, proto\u017ee ten ho odeslal. Proto odpov\u011b\u010f na tento dotaz jde obecn\u00ed trasou, jde to tak\u00e9 takto z adresy A.A.A.2 <\/b>a jde na B.B.B.1<\/b>, a ten sm\u011brova\u010d tuto odpov\u011b\u010f odes\u00edl\u00e1 na 192.168.B.1<\/b>, ten vid\u00ed odpov\u011b\u010f od A.A.A.2<\/b>, ke kter\u00e9 se obr\u00e1til.<\/p>\n

Konkr\u00e9tn\u00ed p\u0159\u00edklad:<\/p>\n

1) 192.168.B.1<\/b> se obrac\u00ed na A.A.A.2<\/b>, chce nav\u00e1zat TCP spojen\u00ed s A.A.A.2:13389<\/b>;<\/p>\n

2) 192.168.B.1<\/b> odes\u00edl\u00e1 po\u017eadavek na nav\u00e1z\u00e1n\u00ed spojen\u00ed od 192.168.B.1:55555<\/b> (tohle \u010d\u00edslo, stejn\u011b jako v p\u0159edchoz\u00edm p\u0159\u00edkladu, m\u016f\u017ee b\u00fdt jin\u00e9) na A.A.A.2:13389<\/b>;<\/p>\n

3) opera\u010dn\u00ed syst\u00e9m, kter\u00fd pracuje na po\u010d\u00edta\u010di s adresou 192.168.B.1<\/b>, se rozhodne p\u0159edat tento bal\u00ed\u010dek na br\u00e1nov\u00fd adresu routeru (192.168.B.254<\/b> v na\u0161em p\u0159\u00edpad\u011b), proto\u017ee nem\u00e1 jin\u00e9, specifi\u010dt\u011bj\u0161\u00ed trasy pro A.A.A.2<\/b>, ta ho nem\u00e1, a proto paket pos\u00edl\u00e1 po v\u00fdchoz\u00ed trase (0.0.0.0\/0);<\/p>\n

4) pro to, jak jsme zm\u00ednili v p\u0159edchoz\u00edm p\u0159\u00edkladu, se pokou\u0161\u00ed naj\u00edt MAC-adresu pro IP-adresu 192.168.B.254<\/b> v ARP protokolov\u00e9 tabulce cache. Pokud nen\u00ed nalezena, ode\u0161le z adresy 192.168.B.1<\/b> \u0161irokospektr\u00fd who-has po\u017eadavek do s\u00edt\u011b 192.168.B.0\/24<\/b>. Kdy\u017e 192.168.B.254<\/b> na opl\u00e1tku ode\u0161le svou MAC adresu, syst\u00e9m p\u0159ed\u00e1 Ethernetov\u00fd bal\u00ed\u010dek pro n\u011bj a ulo\u017e\u00ed tuto informaci do sv\u00e9 cache tabulky;<\/p>\n

5) sm\u011brova\u010d p\u0159ij\u00edm\u00e1 tento paket a rozhoduje, kam ho poslat: m\u00e1 nastavenou politiku, podle kter\u00e9 mus\u00ed pos\u00edlat (nahrazuj\u00edc\u00ed zp\u011btnou adresu) v\u0161echny pakety od 192.168.B.0\/24<\/b> na dal\u0161\u00ed uzly s\u00edt\u011b Internet;<\/p>\n

6) proto\u017ee tato politika nazna\u010duje, \u017ee n\u00e1vratov\u00e1 adresa by m\u011bla odpov\u00eddat ni\u017e\u0161\u00ed adrese na rozhran\u00ed, p\u0159es kter\u00e9 bude tento paket odesl\u00e1n, router nejprve rozhodne, komu konkr\u00e9tn\u011b tento paket p\u0159edat, a mus\u00ed ho, jako v p\u0159edchoz\u00edm p\u0159\u00edkladu, odeslat na B.B.B.254<\/b> (br\u00e1na internetov\u00e9ho poskytovatele), proto\u017ee nem\u00e1 jin\u00e9 specifi\u010dt\u011bj\u0161\u00ed trasy k A.A.A.2<\/b>, ne\u017e 0.0.0.0\/0;<\/p>\n

7) tedy router zam\u011bn\u00ed n\u00e1vratovou adresu paketu, od te\u010f paket od B.B.B.1:44444<\/b> \u010d\u00edslo portu m\u016f\u017ee b\u00fdt samoz\u0159ejm\u011b jin\u00e9) na A.A.A.2:13389<\/b>;<\/p>\n

8) router si zapamatuje, co ud\u011blal, tak\u017ee kdy\u017e od A.A.A.2:13389<\/b> k B.B.B.1:44444<\/b> p\u0159ijde odpov\u011b\u010f, bude v\u011bd\u011bt, \u017ee by m\u011bl zm\u011bnit adresu a port p\u0159\u00edjemce na 192.168.B.1:55555<\/b>.<\/p>\n

9) nyn\u00ed mus\u00ed router p\u0159edat paket k s\u00edti internetov\u00e9ho poskytovatele p\u0159es B.B.B.254<\/b>, a proto, stejn\u011b jako jsme ji\u017e zm\u00ednili, najde MAC adresu pro B.B.B.254 <\/b>a p\u0159ed\u00e1 bal\u00ed\u010dek br\u00e1n\u011b internetov\u00e9ho poskytovatele;<\/p>\n

10) internetov\u00ed poskytovatel\u00e9 p\u0159ed\u00e1vaj\u00ed p\u0159es sv\u00e9 s\u00edt\u011b paket od B.B.B.1<\/b> na A.A.A.2<\/b>;<\/p>\n

11) virtu\u00e1ln\u00ed router na A.A.A.2<\/b> p\u0159ij\u00edm\u00e1 tento paket na portu 13389;<\/p>\n

12) na virtu\u00e1ln\u00edm routeru je pravidlo, kter\u00e9 \u0159\u00edk\u00e1, \u017ee pakety, kter\u00e9 p\u0159i\u0161ly od jak\u00e9hokoli odes\u00edlatele na tento port, by m\u011bly b\u00fdt p\u0159ed\u00e1ny na 192.168.A.1:3389<\/b>;<\/p>\n

13) virtu\u00e1ln\u00ed router najde v sm\u011brovac\u00ed tabulce s\u00ed\u0165 192.168.A.0\/24<\/b> a ode\u0161le ho p\u0159\u00edmo 192.168.A.<\/b>1, proto\u017ee m\u00e1 rozhran\u00ed 192.168.A.254\/24<\/b>;<\/p>\n

14) pro to virtu\u00e1ln\u00ed router najde MAC adresu pro 192.168.A.1<\/b> a p\u0159ed\u00e1v\u00e1 mu tento bal\u00ed\u010dek p\u0159es virtu\u00e1ln\u00ed Ethernetovou s\u00ed\u0165;<\/p>\n

15) 192.168.A.1<\/b> obdr\u017e\u00ed tento bal\u00ed\u010dek na portu 3389, souhlas\u00ed s nav\u00e1z\u00e1n\u00edm spojen\u00ed a formuluje bal\u00ed\u010dek v odpov\u011b\u010f od 192.168.A.1:3389<\/b> na B.B.B.1:44444<\/b>;<\/p>\n

16) jeho syst\u00e9m p\u0159ed\u00e1v\u00e1 tento paket na br\u00e1nov\u00fd adresu virtu\u00e1ln\u00edho routeru (192.168.A.254<\/b> v na\u0161em p\u0159\u00edpad\u011b), proto\u017ee nem\u00e1 jin\u00e9, specifi\u010dt\u011bj\u0161\u00ed trasy pro B.B.B.1<\/b>, nem\u00e1, proto mus\u00ed p\u0159edat bal\u00ed\u010dek podle v\u00fdchoz\u00ed trasy (0.0.0.0\/0);<\/p>\n

17) stejn\u011b jako v p\u0159edchoz\u00edch p\u0159\u00edpadech, syst\u00e9m, kter\u00fd pracuje na serveru s adresou 192.168.A.1<\/b>, nalezne MAC-adres 192.168.A.254<\/b>, proto\u017ee se nach\u00e1z\u00ed v jedn\u00e9 s\u00edti s jej\u00edm rozhran\u00edm 192.168.A.1\/24<\/b>;<\/p>\n

18) virtu\u00e1ln\u00ed router p\u0159ij\u00edm\u00e1 tento paket. Je t\u0159eba poznamenat, \u017ee si pamatuje, \u017ee obdr\u017eel na A.A.A.2:13389<\/b> paket od B.B.B.1:44444<\/b> a zm\u011bnil mu adresu a port p\u0159\u00edjemce na 192.168.A.1:3389<\/b>, tak\u017ee paketu od 192.168.A.1:3389 <\/b>pro B.B.B.1:44444<\/b> zm\u011b\u0148uje adresu odes\u00edlatele na A.A.A.2:13389<\/b>;<\/p>\n

19) virtu\u00e1ln\u00ed router rozhoduje, komu p\u0159edat tento paket, odes\u00edl\u00e1 ho na A.A.A.254<\/b> (br\u00e1na internetov\u00e9ho poskytovatele, v tomto p\u0159\u00edpad\u011b jsme to tak\u00e9 my), proto\u017ee neexistuj\u00ed konkr\u00e9tn\u011bj\u0161\u00ed trasy k B.B.B.1<\/b>, ne\u017e 0.0.0.0\/0;<\/p>\n

20) internetov\u00ed poskytovatel\u00e9 p\u0159ed\u00e1vaj\u00ed p\u0159es sv\u00e9 s\u00edt\u011b paket s A.A.A.2<\/b> na B.B.B.1<\/b>;<\/p>\n

21) router na B.B.B.1<\/b> p\u0159ij\u00edm\u00e1 tento paket a vzpom\u00edn\u00e1, \u017ee kdy\u017e p\u0159ed\u00e1val paket od 192.168.B.1:55555<\/b> pro A.A.A.2:13389<\/b>, zm\u011bnil jeho adresu a port odes\u00edlatele na B.B.B.1:44444<\/b>, tak\u017ee je to odpov\u011b\u010f, kterou je t\u0159eba p\u0159edat na 192.168.B.1:55555<\/b> (ve skute\u010dnosti existuje je\u0161t\u011b n\u011bkolik dal\u0161\u00edch kontrol, ale nezab\u00edh\u00e1me do toho);<\/p>\n

22) ch\u00e1pe, \u017ee by m\u011bl b\u00fdt p\u0159ed\u00e1n p\u0159\u00edmo na 192.168.B.1<\/b>, proto\u017ee se nach\u00e1z\u00ed ve stejn\u00e9 s\u00edti, proto m\u00e1 ve sm\u011brovac\u00ed tabulce odpov\u00eddaj\u00edc\u00ed z\u00e1znam, kter\u00fd p\u0159ikazuje odes\u00edlat pakety pro celou 192.168.B.0\/24 <\/b>p\u0159\u00edmo;<\/p>\n

23) sm\u011brova\u010d nalezne MAC adresu pro 192.168.B.1<\/b> a p\u0159ed\u00e1v\u00e1 mu tento paket;<\/p>\n

24) opera\u010dn\u00ed syst\u00e9m na po\u010d\u00edta\u010di s adresou 192.168.B.1<\/b> p\u0159ij\u00edm\u00e1 paket od A.A.A.2:13389<\/b> pro 192.168.B.1:55555<\/b> a iniciuje dal\u0161\u00ed kroky pro nav\u00e1z\u00e1n\u00ed TCP-p\u0159ipojen\u00ed.<\/p>\n

Je t\u0159eba poznamenat, \u017ee v tomto p\u0159\u00edpad\u011b po\u010d\u00edta\u010d s adresou 192.168.B.1<\/b> nic nev\u00ed o serveru s adresou 192.168.A.1<\/b>, komunikuje pouze s A.A.A.2<\/b>. Stejn\u011b tak server s adresou 192.168.A.1<\/b> nic nev\u00ed o po\u010d\u00edta\u010di s adresou 192.168.B.1<\/b>. Mysl\u00ed si, \u017ee se k n\u011bmu p\u0159ipojili z adresy B.B.B.1<\/b>, a v\u00edc ne\u017e to, tak \u0159\u00edkaj\u00edc, nev\u00ed.<\/p>\n

Tak\u00e9 stoj\u00ed za zm\u00ednku, \u017ee v p\u0159\u00edpad\u011b, \u017ee tento po\u010d\u00edta\u010d se obrac\u00ed na A.A.A.2:1540<\/b>, spojen\u00ed nebude nav\u00e1z\u00e1no, proto\u017ee p\u0159esm\u011brov\u00e1n\u00ed spojen\u00ed na port 1540 nen\u00ed nakonfigurov\u00e1no na virtu\u00e1ln\u00edm sm\u011brova\u010di, i kdy\u017e na n\u011bjak\u00fdch serverech ve virtu\u00e1ln\u00ed s\u00edti 192.168.A.0\/24<\/b> (nap\u0159\u00edklad na serveru s adresou 192.168.A.1<\/b>) a existuj\u00ed n\u011bjak\u00e9 slu\u017eby, kter\u00e9 \u010dekaj\u00ed na spojen\u00ed na tomto portu. Pokud u\u017eivateli po\u010d\u00edta\u010de s adresou 192.168.B.1<\/b> extr\u00e9mn\u011b z\u00e1le\u017e\u00ed na tom, aby nav\u00e1zal spojen\u00ed s touto slu\u017ebou, mus\u00ed pou\u017e\u00edt VPN, tedy se obr\u00e1tit p\u0159\u00edmo na 192.168.A.1:1540<\/b>.<\/p>\n

Je t\u0159eba zd\u016fraznit, \u017ee ve\u0161ker\u00e9 pokusy nav\u00e1zat spojen\u00ed s A.A.A.1<\/b> krom\u011b IPSec spojen\u00ed ze strany B.B.B.1<\/b> nebudou \u00fasp\u011b\u0161n\u00e9. Jak\u00e9koliv pokusy nav\u00e1zat spojen\u00ed s A.A.A.2<\/b>, krom\u011b spojen\u00ed na port 13389, tak\u00e9 nebudou \u00fasp\u011b\u0161n\u00e9.
\nTak\u00e9 si pov\u0161imneme, \u017ee v p\u0159\u00edpad\u011b, \u017ee se na A.A.A.2 <\/b>obr\u00e1t\u00ed n\u011bkdo jin\u00fd (nap\u0159\u00edklad C.C.C.C), budou se ve\u0161ker\u00e9 body 10-20 vztahovat i na n\u011bj. Co se d\u011bje p\u0159ed t\u00edm a po tom z\u00e1vis\u00ed na tom, co p\u0159esn\u011b se nach\u00e1z\u00ed za t\u00edmto C.C.C.C. Tuto informaci nevlastn\u00edme, proto doporu\u010dujeme obr\u00e1tit se na administr\u00e1tory uzlu s adresou C.C.C.C.<\/p>\n

Poloha t\u0159et\u00ed<\/h3>\n

\nA naopak, pokud se z 192.168.A.1 <\/b>odes\u00edl\u00e1 n\u011bco na n\u011bjak\u00fd port, kter\u00fd je nakonfigurov\u00e1n pro p\u0159esm\u011brov\u00e1n\u00ed dovnit\u0159 na B.B.B.1 (nap\u0159\u00edklad 11111), tak\u00e9 to nedos\u00e1hne VPN, ale prost\u011b se p\u0159esune od A.A.A.1<\/b> a dopadne na B.B.B.1<\/b>, a ten u\u017e to p\u0159ed\u00e1v\u00e1 n\u011bkam, \u0159ekn\u011bme, 192.168.B.2:3389<\/b>. Ten vid\u00ed tento paket ne od 192.168.A.1<\/b>, ale od A.A.A.1<\/b>. A kdy\u017e 192.168.B.2<\/b> odpov\u00edd\u00e1, paket p\u0159ich\u00e1z\u00ed od B.B.B.1<\/b> na A.A.A.1,<\/b> a pozd\u011bji se dost\u00e1v\u00e1 k inici\u00e1torovi spojen\u00ed \u2014 192.168.A.1<\/b>.<\/p>\n

Konkr\u00e9tn\u00ed p\u0159\u00edklad:<\/p>\n

1) 192.168.A.1<\/b> se obrac\u00ed na B.B.B.1<\/b>, chce nav\u00e1zat TCP spojen\u00ed s B.B.B.1:11111<\/b>;<\/p>\n

2) 192.168.A.1<\/b> odes\u00edl\u00e1 po\u017eadavek na nav\u00e1z\u00e1n\u00ed spojen\u00ed od 192.168.A.1:55555<\/b> (tohle \u010d\u00edslo, stejn\u011b jako v p\u0159edchoz\u00edm p\u0159\u00edkladu, m\u016f\u017ee b\u00fdt jin\u00e9) na B.B.B.1:11111<\/b>;<\/p>\n

3) opera\u010dn\u00ed syst\u00e9m, kter\u00fd b\u011b\u017e\u00ed na serveru s adresou 192.168.A.1<\/b>, se rozhodne p\u0159edat tento bal\u00ed\u010dek na br\u00e1nov\u00fd adresu routeru (192.168.A.254<\/b> v na\u0161em p\u0159\u00edpad\u011b), proto\u017ee nem\u00e1 jin\u00e9, specifi\u010dt\u011bj\u0161\u00ed trasy pro B.B.B.1<\/b>, proto p\u0159ed\u00e1v\u00e1 bal\u00ed\u010dek podle v\u00fdchoz\u00ed trasy (0.0.0.0\/0);<\/p>\n

4) za t\u00edmto \u00fa\u010delem se, jak ji\u017e bylo zm\u00edn\u011bno v p\u0159edchoz\u00edch p\u0159\u00edkladech, sna\u017e\u00ed naj\u00edt MAC adresu pro IP adresu 192.168.A.254<\/b> v ARP protokolov\u00e9 tabulce cache. Pokud nen\u00ed nalezena, ode\u0161le z adresy 192.168.A.1<\/b> \u0161irokospektr\u00fd who-has po\u017eadavek do s\u00edt\u011b 192.168.A.0\/24<\/b>. Kdy\u017e 192.168.A.254<\/b> v odpov\u011b\u010f pos\u00edl\u00e1 sv\u016fj MAC adresu, syst\u00e9m p\u0159ed\u00e1v\u00e1 Ethernetov\u00fd paket pro n\u011bj a ukl\u00e1d\u00e1 tuto informaci do sv\u00e9 cache tabulky;<\/p>\n

5) virtu\u00e1ln\u00ed sm\u011brova\u010d p\u0159ij\u00edm\u00e1 tento paket a rozhoduje, kam ho p\u0159edat: m\u00e1 definov\u00e1nu politiku, podle kter\u00e9 mus\u00ed (s nahrazen\u00edm zp\u011btn\u00e9 adresy) v\u0161echny pakety od 192.168.A.0\/24<\/b> na dal\u0161\u00ed uzly s\u00edt\u011b Internet;<\/p>\n

6) proto\u017ee tato politika p\u0159edpokl\u00e1d\u00e1, \u017ee zp\u011btn\u00e1 adresa by m\u011bla odpov\u00eddat ni\u017e\u0161\u00ed adrese na rozhran\u00ed, p\u0159es kter\u00e9 bude paket odesl\u00e1n, virtu\u00e1ln\u00ed sm\u011brova\u010d nejprve rozhoduje, komu tento paket p\u0159esn\u011b p\u0159edat, a on, jak jsme ji\u017e zm\u00ednili v p\u0159edchoz\u00edm p\u0159\u00edkladu, mus\u00ed poslat na A.A.A.254<\/b> (br\u00e1na internetov\u00e9ho poskytovatele, v tomto p\u0159\u00edpad\u011b jsme to tak\u00e9 my), proto\u017ee neexistuj\u00ed konkr\u00e9tn\u011bj\u0161\u00ed trasy k B.B.B.1<\/b>, ne\u017e 0.0.0.0\/0;<\/p>\n

7) tud\u00ed\u017e virtu\u00e1ln\u00ed sm\u011brova\u010d m\u011bn\u00ed zp\u011btnou adresu paketu, od t\u00e9to chv\u00edle to je paket od A.A.A.1:44444<\/b> \u010d\u00edslo portu m\u016f\u017ee b\u00fdt samoz\u0159ejm\u011b jin\u00e9) na B.B.B.1:11111<\/b>;<\/p>\n

8) virtu\u00e1ln\u00ed sm\u011brova\u010d si zapamatuje, co ud\u011blal, a tud\u00ed\u017e, kdy\u017e od B.B.B.1:11111<\/b> pro A.A.A.1:44444<\/b> p\u0159ijde odpov\u011b\u010f, bude v\u011bd\u011bt, \u017ee by m\u011bl zm\u011bnit adresu a port p\u0159\u00edjemce na 192.168.A.1:55555<\/b>.<\/p>\n

9) nyn\u00ed virtu\u00e1ln\u00ed sm\u011brova\u010d mus\u00ed p\u0159edat do s\u00edt\u011b internetov\u00e9ho poskytovatele p\u0159es A.A.A.254<\/b>, tedy p\u0159esn\u011b tak, jak jsme ji\u017e zm\u00ednili, najde MAC adresu pro A.A.A.254 <\/b>a p\u0159ed\u00e1 bal\u00ed\u010dek br\u00e1n\u011b internetov\u00e9ho poskytovatele;<\/p>\n

10) internetov\u00ed poskytovatel\u00e9 p\u0159ed\u00e1vaj\u00ed p\u0159es sv\u00e9 s\u00edt\u011b paket od A.A.A.1 na B.B.B.1<\/b>;<\/p>\n

11) sm\u011brova\u010d na B.B.B.1<\/b> p\u0159ij\u00edm\u00e1 tento paket na portu 11111;<\/p>\n

12) na virtu\u00e1ln\u00edm sm\u011brova\u010di existuje pravidlo, kter\u00e9 p\u0159edpokl\u00e1d\u00e1, \u017ee pakety, kter\u00e9 p\u0159ich\u00e1z\u00ed od jak\u00e9hokoliv odes\u00edlatele na tento port, by m\u011bly b\u00fdt odesl\u00e1ny na 192.168.B.2:3389<\/b>;<\/p>\n

13) sm\u011brova\u010d najde v sm\u011brovac\u00ed tabulce s\u00ed\u0165 192.168.B.0\/24<\/b> a ode\u0161le ho p\u0159\u00edmo k 192.168.B.2<\/b>, proto\u017ee m\u00e1 rozhran\u00ed 192.168.B.254\/24<\/b>;<\/p>\n

14) pro to virtu\u00e1ln\u00ed router najde MAC adresu pro 192.168.B.2<\/b> a p\u0159ed\u00e1v\u00e1 mu tento bal\u00ed\u010dek p\u0159es virtu\u00e1ln\u00ed Ethernetovou s\u00ed\u0165;<\/p>\n

15) 192.168.B.2<\/b> obdr\u017e\u00ed tento bal\u00ed\u010dek na portu 3389, souhlas\u00ed s nav\u00e1z\u00e1n\u00edm spojen\u00ed a formuluje bal\u00ed\u010dek v odpov\u011b\u010f od 192.168.B.2:3389<\/b> na A.A.A.1:44444<\/b>;<\/p>\n

16) jeho syst\u00e9m p\u0159en\u00e1\u0161\u00ed tento paket na br\u00e1novou adresu sm\u011brova\u010de (192.168.B.254<\/b> v na\u0161em p\u0159\u00edpad\u011b), proto\u017ee nem\u00e1 jin\u00e9, specifi\u010dt\u011bj\u0161\u00ed trasy pro A.A.A.1<\/b>, nem\u00e1, proto mus\u00ed p\u0159edat bal\u00ed\u010dek podle v\u00fdchoz\u00ed trasy (0.0.0.0\/0);<\/p>\n

17) p\u0159esn\u011b tak, jak tomu bylo v p\u0159edchoz\u00edch p\u0159\u00edpadech, syst\u00e9m, kter\u00fd b\u011b\u017e\u00ed na po\u010d\u00edta\u010di s adresou 192.168.B.2<\/b>, nalezne MAC-adres 192.168.B.254<\/b>, proto\u017ee se nach\u00e1z\u00ed v jedn\u00e9 s\u00edti s jej\u00edm rozhran\u00edm 192.168.B.2\/24<\/b>;<\/p>\n

18) sm\u011brova\u010d tento paket p\u0159ij\u00edm\u00e1. Je t\u0159eba poznamenat, \u017ee si pamatuje, \u017ee dostal na B.B.B.1:11111<\/b> paket od A.A.A.1 <\/b>a zm\u011bnil mu adresu a port p\u0159\u00edjemce na 192.168.B.2:3389<\/b>, tak\u017ee paketu od 192.168.B.2:3389<\/b> pro A.A.A.1:44444<\/b> zm\u011b\u0148uje adresu odes\u00edlatele na B.B.B.1:11111<\/b>;<\/p>\n

19) sm\u011brova\u010d rozhoduje, komu tento paket p\u0159edat. Odes\u00edl\u00e1 ho na, dejme tomu, B.B.B.254 <\/b>(br\u00e1na internetov\u00e9ho poskytovatele, jej\u00ed\u017e p\u0159esnou adresu nezn\u00e1me), proto\u017ee neexistuj\u00ed \u017e\u00e1dn\u00e9 specifi\u010dt\u011bj\u0161\u00ed trasy k A.A.A.1<\/b>, ne\u017e 0.0.0.0\/0;<\/p>\n

20) internetov\u00ed poskytovatel\u00e9 p\u0159ed\u00e1vaj\u00ed p\u0159es sv\u00e9 s\u00edt\u011b paket s B.B.B.1<\/b> na A.A.A.1<\/b>;<\/p>\n

21) virtu\u00e1ln\u00ed sm\u011brova\u010d na A.A.A.1 <\/b>p\u0159ij\u00edm\u00e1 tento paket a vzpom\u00edn\u00e1, \u017ee kdy\u017e p\u0159ed\u00e1val paket od 192.168.A.1:55555<\/b> pro B.B.B.1:11111<\/b>, zm\u011bnil jeho adresu a port odes\u00edlatele na A.A.A.1:44444<\/b>. Tak\u017ee, to je odpov\u011b\u010f, kterou je nutn\u00e9 p\u0159edat na 192.168.A.1:55555<\/b> (ve skute\u010dnosti, jak jsme zm\u00ednili v p\u0159edchoz\u00edm p\u0159\u00edkladu, existuje tam je\u0161t\u011b n\u011bkolik kontrol, ale tentokr\u00e1t se do nich nezapoj\u00edme);<\/p>\n

22) ch\u00e1pe, \u017ee by m\u011bl b\u00fdt p\u0159ed\u00e1n p\u0159\u00edmo na 192.168.A.1<\/b>, proto\u017ee se nach\u00e1z\u00ed ve stejn\u00e9 s\u00edti, tedy m\u00e1 v sm\u011brovac\u00ed tabulce p\u0159\u00edslu\u0161n\u00fd z\u00e1znam, kter\u00fd jej nut\u00ed odes\u00edlat pakety pro cel\u00fd 192.168.A.0\/24<\/b> p\u0159\u00edmo;<\/p>\n

23) sm\u011brova\u010d nalezne MAC adresu pro 192.168.A.1<\/b> a p\u0159ed\u00e1v\u00e1 mu tento paket;<\/p>\n

24) opera\u010dn\u00ed syst\u00e9m na serveru s adresou 192.168.A.1<\/b> p\u0159ij\u00edm\u00e1 paket od B.B.B.1:1111<\/b>1 pro 192.168.A.1:55555 <\/b>a iniciuje dal\u0161\u00ed kroky pro nav\u00e1z\u00e1n\u00ed TCP-p\u0159ipojen\u00ed.<\/p>\n

Stejn\u011b jako v p\u0159edchoz\u00edm p\u0159\u00edpad\u011b, v tomto p\u0159\u00edpad\u011b server s adresou 192.168.A.1<\/b> nic nev\u00ed o po\u010d\u00edta\u010di s adresou 192.168.B.1<\/b>, komunikuje pouze s B.B.B.1<\/b>. Po\u010d\u00edta\u010d s adresou 192.168.B.1<\/b> tak\u00e9 nic nev\u00ed o serveru s adresou 192.168.A.1<\/b>. Mysl\u00ed si, \u017ee se k n\u011bmu p\u0159ipojili z adresy A.A.A.1<\/b>, a zbytek je skryt.<\/p>\n

V\u00fdstup<\/h3>\n

\nTakto to prob\u00edh\u00e1 p\u0159i p\u0159ipojen\u00edch uvnit\u0159 VPN tunelu mezi kancel\u00e1\u0159\u00ed klienta a cloudov\u00fdm prost\u0159ed\u00edm, stejn\u011b jako p\u0159i p\u0159ipojen\u00edch mimo VPN tunel. Pokud m\u00e1te dal\u0161\u00ed ot\u00e1zky nebo pot\u0159ebujete na\u0161i pomoc s cloudov\u00fdmi \u00fakoly, obra\u0165te se na n\u00e1s 24\/7.<\/a><\/noindex>
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0437 \u043f\u0438\u0441\u0435\u043c \u0432 \u0441\u043b\u0443\u0436\u0431\u0443 \u0442\u0435\u0445\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Tucha \u0440\u043e\u0436\u0434\u0430\u044e\u0442\u0441\u044f \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0438\u0435 \u0441\u0442\u0430\u0442\u044c\u0438. \u0422\u0430\u043a, \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043a \u043d\u0430\u043c \u043e\u0431\u0440\u0430\u0442\u0438\u043b\u0441\u044f \u043a\u043b\u0438\u0435\u043d\u0442 \u0441 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u043c \u0440\u0430\u0437\u044a\u044f\u0441\u043d\u0438\u0442\u044c, \u0447\u0442\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u0438 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u0445 \u0432\u043d\u0443\u0442\u0440\u0438 VPN-\u0442\u0443\u043d\u043d\u0435\u043b\u044f \u043c\u0435\u0436\u0434\u0443 \u043e\u0444\u0438\u0441\u043e\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438 \u0441\u0440\u0435\u0434\u043e\u0439 \u0432 \u043e\u0431\u043b\u0430\u043a\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u0445 \u0432\u043d\u0435 VPN-\u0442\u0443\u043d\u043d\u0435\u043b\u044f. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432\u0435\u0441\u044c \u0442\u0435\u043a\u0441\u0442, \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u0439 \u043d\u0438\u0436\u0435, \u2014 \u044d\u0442\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u0438\u0441\u044c\u043c\u043e, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043c\u044b \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u043e\u0442\u0432\u0435\u0442 \u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":53573,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53572","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Co se d\u011bje p\u0159i p\u0159ipojen\u00edch uvnit\u0159 a vn\u011b VPN tunelu | ProHoster","description":"Z e-mail\u016f do technick\u00e9 podpory Tucha vznikaj\u00ed skute\u010dn\u00e9 \u010dl\u00e1nky.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-proishodit-pri-soedineniyah-vnutri-i-vne-vpn-tunnelya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u0438 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u0445 \u0432\u043d\u0443\u0442\u0440\u0438 \u0438 \u0432\u043d\u0435 VPN-\u0442\u0443\u043d\u043d\u0435\u043b\u044f | ProHoster","og:description":"\u0418\u0437 \u043f\u0438\u0441\u0435\u043c \u0432 \u0441\u043b\u0443\u0436\u0431\u0443 \u0442\u0435\u0445\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Tucha \u0440\u043e\u0436\u0434\u0430\u044e\u0442\u0441\u044f \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0438\u0435 \u0441\u0442\u0430\u0442\u044c\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-proishodit-pri-soedineniyah-vnutri-i-vne-vpn-tunnelya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53572","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 15:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:50","updated":"2026-02-04 15:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53572","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=53572"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53572\/revisions"}],"predecessor-version":[{"id":156714,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53572\/revisions\/156714"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/53573"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=53572"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=53572"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=53572"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}