Shigo da fayiloli a NetworkManager yana kasawa da fayilolin OpenVPN da WireGuard

Na zaɓi Shigo da fayil… a Saitunan GNOME, na zaɓi bayanin martaba da ke aiki da abokin ciniki na mai bayarwa, kuma tattaunawar ta rufe ba tare da ƙara komai cikin jerin ba. A kwamfutar tafi-da-gidanka ta biyu shigo da shi ya kammala, haɗin ya bayyana a ƙarƙashin sunan bayanin martaba, sannan ya kasa a buƙatar tabbatarwa ta farko. NetworkManager ba ya taɓa gudanar da fayil ɗinka na .ovpn ko wg-quick yadda yake. Yana ba da fayil ɗin ga mai nazari, mai nazarin yana mai da shi zuwa tsarin haɗin NetworkManager na kansa, kuma daga nan tunnel ɗin ana gina shi daga wannan abin da aka nazarta — asirai, hanyoyi, DNS da komai. Saboda haka tambayar da ta dace ba ita ce me ya sa fayil ɗin ya lalace ba, amma shin nazarin ya faru kuma me ya riƙe.

Abin da shigo da shi yake yi da fayil ɗin a zahiri

Ga OpenVPN, mai nazarin yana zaune a cikin kunshin plugin, kuma haɗin da yake ƙirƙira yana nuni ga sabis ɗin D-Bus kamar org.freedesktop.NetworkManager.openvpn. Babu plugin, babu mai nazari: nau'in ba a san shi ga nmcli ba, kuma lissafin hoto na ƙara VPN na iya ko da ba ya nuna shigarwar shigo da shi kwata-kwata. WireGuard ya bambanta a wani muhimmin batu — NetworkManager yana da nasa saitunan WireGuard tun jerin 1.30, don haka babu wani kunshin plugin na daban, amma mai karanta wg-quick yana nan ne kawai a cikin gine-ginen da suke kawo shi.

Ko ta yaya, ana karanta fayil ɗin sau ɗaya. Ana rubuta sakamakon a matsayin keyfile a ƙarƙashin /etc/NetworkManager/system-connections/, an lasafta shi da sunan haɗin, mallakar root ne kuma sauran masu amfani ba za su iya karanta shi ba domin yana ɗauke da kayan maɓalli. Wannan keyfile yanzu shi ne haɗin; gyara ainihin .ovpn daga baya ba ya canza kome.

Alamu uku suna cikin matakai uku daban-daban. Babu shigarwar shigo da shi ko nau'in da ba a sani ba yana nufin plugin ko sigar ba su nan. Kuskuren shigo da shi da ke ambaton umarni yana nufin mai nazarin ya karanta fayil ɗin kuma ya ƙi wani ɓangare nasa. Haɗin da yake nan amma ba ya taɓa kunnawa yana nufin abin da aka nazarta bai cika ba ko uwar garke tana ƙi shi. Yanke shawara wanne daga cikin al'amuran uku kake da shi kafin ka gyara komai.

Tabbatar da plugin kafin ka gyara bayanin martaba

Plugin da ya ɓace yana kama da lalataccen bayanin martaba daidai, don haka fara duba kunshin. A Debian da Ubuntu ana kawo tallafin OpenVPN a matsayin network-manager-openvpn tare da mataimaki na tebur; a Fedora kunshin sune NetworkManager-openvpn da NetworkManager-openvpn-gnome; a Arch shi ne networkmanager-openvpn.

dpkg -l network-manager-openvpn-gnome | tail -n 2
rpm -q NetworkManager-openvpn
pacman -Q networkmanager-openvpn

Sannan shigo da shi daga cikakkiyar hanya: nmcli connection import type openvpn file /home/you/profile.ovpn. Hanyoyi na dangi yawanci suna aiki, amma shell da ya canza babban fayil yana mai da shigo da shi cikin sauri zuwa zagaye. Ga WireGuard duba nmcli --version kuma tabbatar da gefen kernel yana nan da modprobe wireguard; shigo da shi da ya yi nasara a kan na'ura marar module yana barin ka da haɗin da na'urarsa ba za ta taɓa bayyana ba. bayanin nmcli yana rubuta umarnin ƙasa import da sunayen nau'in da aka karɓa. Idan an ƙi type wireguard kai tsaye, ginin ya tsufa fiye da wannan fasalin, kuma matakin da ya dace shine kunshin rarraba ko backport — ba kwafin tsarin zuwa wani babban fayil da ba a so ba da fatan wani zai karanta shi.

Karanta haɗin OpenVPN, ba .ovpn ba

Da zarar haɗin ya kasance, karanta saitunan da aka nazarta maimakon sake karanta fayil ɗin: nmcli connection show "Work VPN" | grep -E '^vpn\.'. Kana son remote da tashar jiragen ruwa, jigilar kaya, kayan shaida — ca, cert, key, tls-auth ko tls-crypt — da hanyar tabbatarwa. A cikin bayanin martaba mai kalmar sirrin maɓalli na sirri, ƙara sudo nmcli --show-secrets connection show "Work VPN" ka duba secret flags: 0 shine none, don haka sirrin yana cikin keyfile; 1 shine agent-owned; 2 shine not-saved, wato ba a taɓa rubuta shi cikin keyfile ba; 4 shine not-required, wato ba a buƙatar sirri kwata-kwata. Bita ne, ba ma'auni ba, don haka 3 shine kawai agent-owned da not-saved. Sirrin da ake tambaya sau ɗaya a kowace zama shine agent-owned (1), inda wakili yake neman shi; babu wani lambar tuta ta daban don hakan. Rashin daidaiton tutoci shine dalilin da ya saba sa bayanin martaba ya haɗu daga applet ɗin tebur kuma ya kasa daga rubutun ko a lokacin tashi.

Hanyar da ta fi sauri don ganin abin da mai nazarin ya jefa ita ce ka ce plugin ɗin ya sake rubuta fayil ɗin sannan ka kwatanta shi: nmcli connection export "Work VPN" /tmp/roundtrip.ovpn. Umarnin da suka ɓace a wannan diff ba za su kasance ba a lokacin haɗawa. Hook ɗin ne ake zargi akai-akai — script-security, up, down da route-up suna tsammanin rubutun da ake gudanarwa da babban iko kuma da gangan ba a mayar da su ba. Kada ka rage tabbatarwa ko ba da ƙarin izini don shigo da shi ya yi nasara; zaɓin da ba a tallafa ba yawanci yana nuna jerin fasalin plugin ɗin ba uwar garke da ba za a iya isa ba. Matsar da wannan ɗabi'a zuwa rubutun dispatcher na NetworkManager ko zuwa manufar gefen uwar garke.

Har ila yau tabbatar da filayen shaida sun tsira: maganar CA, remote-cert-tls da duk wani binciken suna da bayanin martaba ya dogara da shi. Haɗin da ya tashi ba tare da su ba yana iya yin magana da duk abin da ke amsa a wannan adireshin.

Karanta haɗin WireGuard, ba fayil ɗin wg-quick ba

Fayil ɗin wg-quick tsari ne mai ma'anar shell; haɗin da aka shigo da shi saitin saituna ne. PrivateKey ya zama maɓallin sirri na interface, Address ya zama ɗaya ko fiye da adiresoshin IPv4 da IPv6, DNS an tsara shi zuwa kaddarorin resolver na NetworkManager, MTU an tsara shi zuwa wireguard.mtu (ainihin tsoho na wg-quick shine 1420), kuma kowane block na peer ya zama shigarwar peer tare da maɓallin jama'a, endpoint, IP da aka yarda da su da persistent keepalive. Buga abin da aka ajiye da nmcli --show-secrets connection show wg0; idan jerin peer bai bayyana a wannan fitarwa ba, karanta keyfile:

sudo sed -n '/^\[wireguard\]/,/^\[/p' /etc/NetworkManager/system-connections/wg0.nmconnection

Abin da ba ya tsira shine rabin shell na wg-quick. PreUp, PostUp, PreDown, PostDown da Table ɗabi'ar wannan kayan aiki ne, ba halayen interface na WireGuard ba, don haka babu abin da ke gudanar da su bayan shigo da shi. Idan ainihin ya yi amfani da Table = off don barin hanyar tsoho cikin kwanciyar hankali, sabbin fitarwar NetworkManager suna ba da ip4-auto-default-route da ip6-auto-default-route don wannan manufa; saita su a fili maimakon ɗauka cewa haɗin yana yi kamar rubutun. Hook da ke tura hanyar al'ada yana buƙatar wannan hanyar a cikin saitunan tafiyar haɗin, in ba haka ba za ta ɓace kawai.

Ba haɗin mai shi ɗaya daidai

Gazawar da ke biyo baya ta gargajiya ita ce haɗin da ke aiki har zuwa tashin gaba sannan ya shiga madauki. Yawanci [email protected] yana nan har yanzu an kunna shi daga gwaji na baya, ko abokin ciniki na mai bayarwa yana ƙaddamar da daemon ɗinsa, kuma masu shi biyu suna rubuta hanyoyi da DNS don wannan manufa. NetworkManager yana saita resolver ta hanyarsa, wg-quick yana rubuta ta resolvconf, kuma wanda ya rubuta na ƙarshe ya ci — don haka warware suna yana aiki, sannan ya tsaya, sannan ya sake aiki. Duba systemctl status wg-quick@wg0, nmcli connection show --active da ip link show type wireguard, sannan kashe mai shi na biyu maimakon daidaita metric ɗinsa.

Idan da gaske kana buƙatar duka biyun, ba su interfaces daban-daban da IP da aka yarda da su waɗanda ba su haɗu ba, kuma bar ɗaya daidai ya shigar da hanyar tsoho. Hanyoyi biyu na tsoho da metric daban ba split tunnel ba ne; tsere ne da sabis ɗin da ya fara na biyu ke yankewa. Kuma bayan sake haɗawa, sake duba yanayin da aka yi amfani da shi — gyaran resolver na hannu sau ɗaya da ke sa abubuwa su yi aiki ba hujja ba ce cewa shigo da shi ya cika.

Tabbatar da zirga-zirga kuma ka tsira daga sake kunnawa

Tada haɗin da nmcli connection up "Work VPN", sannan karanta yanayi, adireshi da hanyoyi maimakon amincewa da gunki: nmcli device show wg0 | grep -E 'GENERAL.STATE|IP4.ADDRESS|IP4.ROUTE', ip route show default da ainihin binciken sunan da ake warware shi kawai a cikin tunnel. Handshake ko ping mai nasara yana tabbatar da cewa ɓoyewa yana aiki kawai; ba ya faɗin komai game da turawa, prefix ɗin split tunnel ko DNS na sirri, kuma waɗannan sassan ne suka saba karyewa.

Sannan sake kunnawa ka maimaita. Halin autoconnect, interface da aka sake masa suna da plugin da ke lodawa bayan na'urar duk gazawa ne da kake gani kawai a tashin tsafta. journalctl -u NetworkManager -b --no-pager | tail -n 40 yana nuna abin da daemon ya yi da wannan haɗin a wannan tashin. Don kwamfuta ta biyu, kwafi keyfile ɗin kuma ka riƙe shi mallakar root da yanayin 600, ko yi amfani da nmcli connection export don OpenVPN ka sake shigo da .ovpn da ya samu — hanyar fitarwa ba ta da kwatankwacin WireGuard, don haka wannan alkibla kwafin fayil ne ko sabon shigo da shi daga ainihin da aka kare.

Gajeren sigar, bisa tsari: tabbatar da plugin ko sigar NetworkManager, shigo da shi daga cikakkiyar hanya, karanta saitunan da aka nazarta har da secret flags, kwatanta fitarwar OpenVPN da ainihin, duba hooks da hanyoyi a gefen WireGuard, kashe duk wani mai shi na biyu, sannan bayan sake kunnawa tabbatar da warware suna da teburin hanyoyi. Idan haɗi ya wuce duk waɗannan, fayil ɗin bayanin martabar da ya fara shi zai iya komawa cikin ajiyar da aka kare.