IP ɗaya na uwar garke, hanyoyi biyu: yin alama a kan ƙorafin waje na OpenVPN

Kariyar madauki ta yau da kullum ita ce hanyar uwar garke: aika zirga-zirga zuwa adireshin jama'a na uwar garken VPN ta hanyar uplink don kada zaman da aka ɓoye ya taɓa shiga ramin kansa. Wannan yana aiki har zuwa lokacin da kake son isa ga sabis ɗin yanar gizo a kan wannan uwar garke ta hanyar rami, domin keɓancewar an ɗaure ta ne da manufa kuma manufar ɗaya ce. Hanyar fita ita ce ka daina rarraba bisa manufa ka fara rarraba bisa wace soket ta aika fakitin.

Fara da ƙorafi biyu da kake son raba

Ɗaya daga cikin ƙorafin shi ne jigilar OpenVPN da aka ɓoye ita kanta, wadda dole ta fita ta uplink, in ba haka ba ramin zai ɗauki haɗin waje nasa. Ɗayan kuma buƙatar HTTPS ce ta yau da kullum zuwa wannan adireshin jama'a, wadda kake so ta kasance cikin ramin don ta isa sabis ɗin daga tushen rami. Manufa ɗaya, a yawancin lokuta lambar tashar jiragen ruwa ɗaya, hanyar da ake bukata daban.

A wannan bayanin, ɗauka akwai abokin ciniki a 10.90.0.10 ta tun1, adireshin jama'a na uwar garke 198.51.100.25, da babban tebur marar taɓawa wanda tsohuwar hanyarsa ke nuni ga uplink na yau da kullum. Bangaren uwar garken kuma dole ya karɓi sabis ɗin yanar gizo a hanyar ciki kuma ya mayar da zirga-zirga ga tushen rami; aika fakiti zuwa adireshin jama'a ba ya soke mai sauraro ko manufar firewall na uwar garken.

Kafin ka canza wani abu, rubuta dokokin uwar garke na yanzu ka zaɓi ƙima waɗanda babu wanda ke amfani da su: alama, lambar tebur da fifiko uku na doka. Ka riƙe hanyar dawowa cikin na'urar da ba ta bi ta wannan haɗin ba, domin kuskure a nan yana cire damar shiga nesa naka, ba kawai ya karya shafin burauza ba.

Yi alama a kan soket ɗin da ke ɗauke da ambulan

Tsarin abokin ciniki yana samun alama don fakiti masu fita da aka ɓoye kuma ya daina shigar da hanyoyi da kansa, don manufar maye gurbin ita ce kaɗai ke yanke shawara kan hanyoyi:

mark 42
route-noexec
disable-dco

Goma 42 ita ce hexadecimal 0x2a, kuma sifar hexadecimal ita ce dokokin tuƙi za su dace da ita. Bayanin link-options ya bayyana mark a matsayin abin da ya shafi fakiti masu fita da aka ɓoye a Linux, wato ainihin soket ɗin da kake buƙatar sarrafa hanyarsa. Kashe offload na tashar bayanai yana riƙe wannan misali a kan hanyar sararin mai amfani, inda halin alamar shi ne wanda aka bayyana.

route-noexec yana danne ƙara da cire hanyoyi ta atomatik na OpenVPN. Ba ya shigar da komai a maimakonsu, don haka daga wannan lokacin mai hanyoyin dole ya kula da kowace hanya da ramin ke buƙata. Idan manufa mai zaman kanta ta ɓace bayan canjin, wannan shine manufar maye gurbin da ta ɓace, ba lahani a cikin alamar ba.

Kada ka riƙe hanyar uwar garke a babban tebur don 198.51.100.25 yayin da kake yin wannan. Irin wannan hanyar tana sake gabatar da ainihin keɓancewar da ƙirar ke ƙoƙarin taƙaitawa, kuma za ta yi nasara ga ƙorafin HTTPS kafin a tambayi ɗaya daga cikin manufofin da ke ƙasa.

Aika duk sauran zuwa teburin rami

Da zarar ƙofar ramin ta wanzu kuma tana riƙe da adireshinta, manufar ta kasance kamar haka:

ip -4 route add default dev tun1 src 10.90.0.10 table 47100
ip -4 rule add priority 20000 lookup main suppress_prefixlength 0
ip -4 rule add priority 20001 not fwmark 0x2a lookup 47100
ip -4 rule add priority 20002 not fwmark 0x2a unreachable

Doka ta farko tana riƙe takamaiman hanyoyin uwar garke a bayyane, gami da duk wata hanyar sadarwa ta gida da aka amince da ita, yayin da take sa hanyar da aka saba ta babban tebur ba a gani ga wannan binciken. Wannan bambanci yana da muhimmanci: danne na asali ba ɗaya ba ne da watsi da tebur, kuma keɓancewar gida da kake buƙata har yanzu suna rayuwa saboda wannan. Karanta waɗannan keɓancewar ɗaya bayan ɗaya maimakon ɗauka cewa sakamakon shine juyawa na gaggawa na duniya.

Zirga-zirgar da ba a yi alama ba sai ta faɗi cikin teburin rami, ta karɓi tushen rami kuma ta fita ta VPN. Zirga-zirgar da aka yi alama tana faɗuwa a gwajin fwmark a kan dokoki biyu masu zuwa kuma ta ci gaba zuwa babban binciken da aka saba a ƙasa a cikin jerin, inda tsohuwar hanyar uplink har yanzu take. Doka ta ƙarshe ta unreachable ita ce ke hana ƙorafin da ba a yi alama ba faɗuwa cikin nutsuwa zuwa uplink lokacin da hanyar ramin ta ɓace. Mai zaɓe shine alamar daga farko zuwa ƙarshe, kuma adireshin manufa ba ya taɓa shiga cikin shawarar.

Riƙe wannan mai gadi a wurinsa tsakanin katsewa, kuma shigar da shi tare da sauran manufofin maimakon da hannu. Doka da ke ɓacewa tare da ƙofa ba manufa ba ce, daidaituwa ce. Share manufar lokacin da ramin ya faɗi yana canza yanayin gazawa daga “an toshe” zuwa “ya zube”, kuma tsohuwar hanyar rami da ta ƙare daga baya ita ce matsala mafi sauƙin bayani fiye da zirga-zirgar da ta fita ta ƙofar da ba daidai ba.

Bari hanyar dawowa ta ga alamar ɗaya

Alamomin fita rabin tsarin ne kawai, kuma wannan shine ɓangaren da yawancin sake bugawa ke watsi da shi. Amsoshin zaman da aka ɓoye suna isowa ta uplink kuma suna ƙarƙashin tabbatar da hanyar dawowa, wanda ke tambaya ko tushen zai koma ta hanyar da ya bi. Ba tare da taimako ba, wannan binciken yana amfani da manufar ramin da ba a yi alama ba kuma ya kammala cewa fakitin yana kan ƙofar da ba daidai ba.

Gyaran na mai firewall ne: adana alamar a kan haɗin fita, mayar da ita a kan fakiti masu shiga da suka dace kuma kunna sarrafa alamar da tushe ya tabbatar don hanyar da ta dace. OpenVPN saita alamar soket ba ya yin ɗaya daga cikin waɗannan uku, kuma girke-girken da kawai ya lissafa zaɓuɓɓukan abokin ciniki bai cika ba. Nemi wannan haɗin kai a rubuce, domin shine ɓangaren ƙirar da ba a ganuwa kuma mafi sauƙin ɓacewa yayin sake ginawa.

Duba hanyar dawowa a sassauƙa shima ba madadi ba ne. Yanayin sassauƙa har yanzu yana buƙatar wata hanya ta wanzu ga tushen, kuma mai gadin unreachable da ka ƙara yana cire ɗaya da gangan don binciken da ba a yi alama ba. Kammala kuma duba haɗin alamar haɗin kai kafin ka dogara da wannan ƙira, kuma ɗauki matatun uwar garke a matsayin tambaya daban: alama sigina ce ta tuƙi, ba izini ba. Idan haɗin kan babu, alamar ita ce zaman da ke kafawa sannan ya yi shiru da zaran amsoshi suka fara zuwa.

Tabbatar da shi da binciken hanya biyu

Kwatanta abin da kernel ke yankewa ga yanayi biyu, kuma karanta filayen dev da src maimakon matsayin fita:

ip -4 route get 198.51.100.25
ip -4 route get 198.51.100.25 mark 0x2a

Binciken farko ya kamata ya warware zuwa tun1 tare da tushen rami, na biyu kuma zuwa uplink. Waɗannan bincike ne na wucin gadi, don haka suna tabbatar da manufar ba tsarin da ke gudana ba: tabbatar da ainihin hanyar jigilar abokin ciniki mai gudana daban, sannan ka yi ainihin buƙatar HTTPS tare da tabbatar da takardar shaidar a kunne.

Rubuta abin da ƙirar ba ta rufe kafin ka ayyana ta gama. DNS, IPv6 da tsarin rayuwar dokoki kowanne yana buƙatar shawararsa, kuma wannan misali ne na tuƙin IPv4, ba cikakken tsarin sirri ba. Ƙimarsa ita ce mai zaɓe: ambulan yana samun keɓancewar uplink, kuma sabis na yau da kullum a wannan adireshin ba dole ya gaji ta ba.