Sunayen abokan ciniki na OpenVPN a dnsmasq: script ko shigarwa ta dindindin?

Matsalolin suna biyu suna bayyana a kusan kowace ƙaramar ƙofar OpenVPN. Ba za ka iya isa ga kwamfutar tafi-da-gida da ke haɗe da sunan da ke kan takardar shaidarta ba, kuma ayyukan da ke bayan ramin ba su da suna kwata-kwata. Suna kama da matsala ɗaya kuma suna buƙatar magani dabam-dabam, domin adireshin ɗaya yana motsi da kowane zama ɗaya kuma ɗayan ba ya motsi. Ka yanke shawara irin sunan da kake ƙarawa kafin ka gyara wani abu.

Yanke shawara bisa kowane suna, ba bisa ƙofa ba

Gwajin mai sauƙi ne: shin wannan adireshin yana canzawa sa’ad da abokin ciniki ya sake haɗawa? Idan haka ne, dole ne a ƙirƙiri sunan daga zaman VPN. Idan ba haka ba, yana cikin shigarwa ta dindindin da za ka iya karantawa da bita.

Haɗa su tare shine gazawar da aka saba. Ayyukan da aka ƙulla a cikin fayil ɗin da aka ƙirƙira yana ɓacewa a karon farko da script ɗin ya sake rubuta shi, kuma abokin ciniki da aka rubuta a cikin shigarwa ta dindindin yana nuni ga wanda ya riƙe wannan adireshin a ƙarshe. Duk kuskuren biyu suna zama marasa ganuwa har sai sunan ya warware zuwa na’urar da ba daidai ba. A lokacin mai gyara yana tsammanin DNS ya lalace ba fayil ɗin ba.

Hanyar mai motsi: learn-address da tafki

OpenVPN ya san rabon, don haka bari ya gaya maka. Waɗannan zaɓuɓɓukan uwar garke suna sa rabon ya dawwama kuma a iya rubuta masa script:

client-config-dir /etc/openvpn/ccd
ifconfig-pool-persist /etc/openvpn/ip-pool 60
script-security 2
learn-address /etc/openvpn/learn-address.sh

learn-address yana gudanar da script ɗinka duk lokacin da aka ƙara adireshi, sabunta shi ko share shi, kuma yana aika aiki, adireshin da sunan gama gari. Ƙaramin script yana ƙara layi ɗaya ga kowane abokin ciniki kuma yana cire shi lokacin sharewa:

#!/bin/sh
HOSTS=/etc/openvpn/hosts.lan
case "$1" in
  add|update) echo "$2 $3" >> "$HOSTS" ;;
  delete)     sed -i "/^$2 /d" "$HOSTS" ;;
esac
kill -HUP $(cat /var/run/dnsmasq.pid)

A na’urar tun, hujja ta biyu ita ce adireshin ramin abokin ciniki, don haka layin yana da amfani kai tsaye. A na’urar tap, OpenVPN yana aika adireshin MAC na abokin ciniki maimakon haka, domin sashin tap na iya ɗaukar wasu ka’idoji ban da IPv4, sannan dole ne ka nemo adireshin a cikin fayil ɗin tafki ta sunan gama gari kafin rubuta wani abu.

Ka kasance da tabbaci game da abin da fayil ɗin da aka ƙirƙira yake: hoton wanda ke haɗe a yanzu. Sunaye suna ɓacewa lokacin cire haɗi, wanda shine ainihin abin da kake so ga kwamfutocin tafi-da-gida da ke ƙaura tsakanin cibiyoyin sadarwa, kuma ainihin abin da ba ka so ga uwar garke da ke aiki duk dare.

Hanyar tsaye: address= da faɗaɗa yanki

Nuna dnsmasq zuwa fayil ɗin da aka ƙirƙira maimakon fayil ɗin hosts na tsarin, kuma ba shi yanki domin gajerun sunaye su faɗaɗa zuwa cikakkun sunaye:

domain=corp.example
no-hosts
addn-hosts=/etc/openvpn/hosts.lan
listen-address=127.0.0.1,10.8.0.1
bind-interfaces

Idan an saita domain, layi kamar 10.8.0.6 alice yana amsawa ga alice da alice.corp.example duka. Riƙe listen-address a ƙofar rami da loopback kawai, domin mai warwarewa da aka buga bisa kuskure a kan muƙamin LAN aiki ne da ba ka yi niyyar bayarwa ba.

Ayyukan da ba sa zuwa daga tafki suna samun nasu shigarwar. Saka su a cikin wani fayil ɗin drop-in daban a cikin babban ɗakin tsarin rarraba domin haɓakar fakiti ba zai iya rubuta musu ba:

address=/files.corp.example/10.8.0.20
address=/db.corp.example/10.9.0.5

Mika mai warwarewa ko babu abin da zai faru

Mai warwarewa da babu wanda ke tambayarsa ba ya canza kome. Dole uwar garke ta sanar da shi:

push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DOMAIN corp.example"

Abokan cinikin Windows suna aiwatar da zaɓuɓɓukan biyu da kansu. Yawancin abokan cinikin Linux ba sa: suna buƙatar haɗin kai na mai warwarewa da ake tallafawa kamar ƙugiyar update-resolv-conf ta rarraba ko sarrafa DNS na NetworkManager, ko yankin bincike da uwar garken suna na hannu. Duba ainihin mai warwarewa na abokin ciniki maimakon ɗauka cewa an bi push ɗin, domin push ɗin da aka yi watsi da shi yana kama da uwar garke da ba ta amsawa.

Tabbatar a matakai uku

Tambayi uwar garke kai tsaye da farko, sannan abokin ciniki, sannan aikace-aikacen:

dig +short @10.8.0.1 alice.corp.example
getent hosts files.corp.example

Idan tambayoyin kai tsaye suna amsawa amma aikace-aikacen ba ya amsawa, laifin na miƙawa ga abokin ciniki ne ba na yankin ba. Idan sunan ya warware kuma haɗin ya ci gaba da kasawa, sunan yana da kyau kuma abu na gaba da za a duba shine hanya ko katangar wuta.

Rubuta rukunoni biyu kusa da tsarin: waɗanne sunaye ake ƙirƙira, waɗanne aka ƙulla, da wace takardar shaida kowanne ya dace da ita. Mutum na gaba da zai ƙara uwar garke zai kwafi tsarin da ya fara samu.