VPN na Mac ya haɗa amma ip-up bai taɓa kunna ba: ƙaddamar da kallon launchd

Kana saka umarnin route a cikin /etc/ppp/ip-up, ka sake haɗa tunel ɗin ofis, amma fayil ɗin ba ya gudana. Babu abin da ke damun rubutun: wannan haɗin ba ya wucewa ta PPP kwata-kwata. Abokan ciniki na ciki na Cisco IPSec da IKEv2 ba sa taɓa ƙaddamar da pppd, don haka ba a taɓa karanta babban fayil ɗin ƙugiya ba, yayin da PPTP da L2TP bisa IPSec har yanzu suna wucewa ta cikinsa. Gano wane yanayi ne naka, sannan ka kunna wanda ba na PPP ba daga aikin kallon launchd.

Duba interface ɗin kafin ka gyara kowace ƙugiya

Umarni biyu ne ke tabbatar da wace hanya za ta iya aiki. Lissafa ayyukan da aka saita, sannan lissafa interface ɗin da ke akwai yayin da tunel ɗin yake aiki. Sunan interface ɗin shine hujja; alamar da ke cikin Saitunan Tsarin ba ita ce ba.

scutil --nc list
ifconfig -l | tr ' ' '\n' | grep -E '^(utun|ppp)[0-9]+$'

Aikin da ke samar da ppp0 yana gudanar da ƙugiyoyin PPP kuma zai aiwatar da fayil ɗinka. Aikin Cisco IPSec ko IKEv2 yana samar da na’urar utun a maimakon haka, interface ɗin tunel marar Layer PPP, don haka babu abin da ke cikin /etc/ppp da zai isa gare ta. Idan nau’ikan biyu suka bayyana, duba wace aiki ka haɗa. Mutane suna ɓata rana a kan ƙugiya marar kyau saboda karanta sunan abokin ciniki.

A kan hanyar PPP dole fayil ɗin ya kasance mallakar root kuma yana iya gudana, domin pppd yana duba duka biyu kafin ya gudanar da wani abu. install yana saita mai shi da yanayi a mataki ɗaya.

sudo install -o root -g wheel -m 0755 /dev/null /etc/ppp/ip-up
sudo ls -l /etc/ppp/ip-up

Fayil ɗin da aka ƙirƙira ta Finder ko editan hoto sau da yawa yana zama mallakar asusunka, ko ba shi da bit ɗin gudanarwa, sannan ya kasa shiru kamar yadda ƙugiyar da ta ɓace ta yi. Saka ip-down a gefensa yanzu. root da wheel a ginshiƙin mai shi da rwxr-xr-x a ginshiƙin yanayi shine abin da kake so.

Bar launchd ya kunna rubutun idan tunel ya bayyana

Ga abokan cinikin da ba sa taɓa PPP, dole mai kunna ya fito daga wani wuri, kuma ma’ajiyar saitunan tsarin ita ce tushen gaskiya: macOS yana sake rubuta ta a kowace canjin tunel. Aikin launchd da ke kula da wannan babban fayil ana kiransa idan tunel ya bayyana ko ya ɓace.

<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0">
<dict>
  <key>WatchPaths</key>
  <array><string>/Library/Preferences/SystemConfiguration</string></array>
  <key>Label</key><string>net.example.tunnel-watch</string>
  <key>ProgramArguments</key>
  <array><string>/bin/sh</string><string>/usr/local/sbin/tunnel-hook</string></array>
  <key>RunAtLoad</key><true/>
  <key>ThrottleInterval</key><integer>20</integer>
</dict>
</plist>

Shigar da shi a matsayin launch daemon, ba wakili na kowane mai amfani ba, domin gyaran hanyoyi na na’ura ne. bootstrap yana maye gurbin tsohon siffan load -w a bugu na yanzu. RunAtLoad yana sa gudanarwa ta farko a iya gani, kuma ThrottleInterval yana hana ɗimbin canje-canjen haɗin Wi-Fi sake ƙaddamar da rubutun.

sudo install -o root -g wheel -m 0644 tunnel-watch.plist \
  /Library/LaunchDaemons/net.example.tunnel-watch.plist
sudo launchctl bootstrap system \
  /Library/LaunchDaemons/net.example.tunnel-watch.plist

Tarkon shine babban fayil ɗin da ake kulawa yana canzawa saboda al’amuran da ba su da alaƙa da VPN ɗinka: haɗin Wi-Fi, sabunta DHCP, kebul da aka saka. Mai gadi da ke ƙasa yana mai da mai kunna mai hayaniya zuwa ƙugiya mai amfani, kuma layin log yana bayanin hanya a wani sa’i mai ban mamaki.

Mallaka tana rufe plist da rubutun. Daemon da ke aiwatar da fayil a cikin babban fayil da asusunka zai iya rubutu a ciki yana ba da root ga wannan asusu.

Kare rubutun domin gudanarwa ta biyu kada ta canza komai

Rubutun da farko yana yanke shawara ko tunel ɗin akwai, kuma yana fita shiru idan babu. Duk abin da ke bayan haka dole ya kasance lafiya a maimaita, domin mai kunna yana aiki fiye da haɗi ɗaya. Gano interface ɗin a lokacin gudanarwa maimakon hardcode index wanda zai canza a haɗi na gaba.

#!/bin/sh
set -u
TUN=$(ifconfig -l | tr ' ' '\n' | grep -m1 '^utun[0-9]' || true)
[ -n "$TUN" ] || exit 0
netstat -rn -f inet | grep -q '^10\.42' && exit 0
route -n add -net 10.42.0.0/16 -interface "$TUN"

route add yana fita da matsayi marar sifili idan hanyar ta riga ta kasance, don haka rubutun da ke ɗaukar kowane matsayi marar sifili a matsayin kuskure yana ba da rahoton ƙugiya da ta karye duk lokacin da yake yin abin da ya dace. Gwajin netstat da ke sama yana mai da wannan yanayin zuwa no-op bayyananne.

Kasancewar interface ɗin hujja ce mafi rauni fiye da yadda take gani, domin sauran abokan cinikin VPN da wasu mahallin kwantena ma suna ƙirƙirar na’urorin utun. Tambayi aikin da kansa da scutil --nc status "Office VPN" kuma ka nemi yanayin haɗi kafin ka taɓa hanyoyin sadarwa. Ajiye amsar a cikin layin log, domin mako ɗaya daga baya wannan rikodin shine kawai bayanin da za ka samu.

Mayar da ƙofar cibiyar ba tare da karya DNS ba

Idan tunel ɗin ya karɓi hanyar da aka saba, bincike na yau da kullum yana fita ta ofis kuma hanyar intanet ta gida ta daina aiki. Fara kama na’urar router ɗin interface ɗin jiki, sannan ka juya na asali zuwa gare ta. DHCP ya fi yin nazarin tebur wanda ya riga ya ƙunshi na asalin tunel ɗin.

PHYS=en0
GW=$(ipconfig getoption "$PHYS" router)
[ -n "$GW" ] && sudo route -n change default "$GW"

Masu warwarewa wani Layer ne daban da kayan aiki daban, kuma gyara hanyar ba ya gyara su. Duba abin da ke aiki da scutil --dns, sannan ka gyara abin da ke samar da shi: tsarin ayyuka da shigarwar DNS a aikin jiki. Share cache yana gano binciken da ya tsaya bayan canjin cibiyar sadarwa; ba abin da za a tsara ba ne.

Tunel ɗin da ya tsira daga canjin Wi-Fi yayin da DNS ya tsaya shine aibu na uku: sudo killall -HUP mDNSResponder yana sa mai warwarewa ya sake karanta saitinsa. Yi amfani da shi sau ɗaya, da hannu.

Tabbatar da cewa aikin yana kunna da kansa

Tilasta gudanarwa ɗaya da kickstart -k kafin ka amince da hanyar kallo, sannan ka karanta matsayin fita da aikin ya rubuta. Fita mai tsabta yana tabbatar da rubutun yana aiki; ba ya tabbatar da mai kunna yana aiki. Sannan ka cire haɗi ka sake haɗawa da aikin a ɗauke, kuma ka lura da gudanarwar da ba ka nema ba.

sudo launchctl kickstart -k system/net.example.tunnel-watch
sudo launchctl print system/net.example.tunnel-watch | grep -E 'last exit code|state ='

Duba scutil --nc status kafin da bayan kowane ƙoƙari. Rubutun da ya gudana yayin da tunel ɗin ke ƙasa ba ya tabbatar da komai game da hanyar haɗi.

Bangaren rushewa ya cancanci kulawa ɗaya da bangaren haɗi: cire hanyar da hannu, bar aikin ya gudana, kuma ka tabbatar ya dawo. Ƙugiyar da ke ƙara hanya kuma ba ta taɓa cire ta tana barin na’urar da za ta yi rashin kyau mako ɗaya daga baya, ba tare da abin da zai haɗa al’amuran biyu ba. Idan duka halayen sun tabbata, sudo launchctl bootout system/net.example.tunnel-watch yana mai da aikin hutu cikin tsabta. Daemon ɗin kallo da aka bar a ɗauke shine hanyar da gyaran lokaci ɗaya ya zama hanyar da ba a bayyana ba watanni bayan haka.