Shin abokin ciniki na OpenVPN ɗinka ya kamata ya yi amfani da nobind ko port tabbatacce?

Bayanan martaba biyu da suka bambanta da layi ɗaya suna yin daban a lokacin da abokin ciniki na biyu ya fara a kan wannan host ɗin. Ɗayan yana ɗauke da nobind kuma yana karɓar duk wani port na gida da kernel ya bayar; ɗayan yana ajiye 1194, kuma misalin na biyu ya mutu da adireshin da ake amfani da shi tuni. Wannan layin yana yanke shawara wanene zai zaɓi port ɗin tushe, wanda kuma hakan ke yanke shawara ko bayanin martabar zai iya zama tare da wani abu a kan injin. Tambayoyi uku ne ke warware shi, kuma na farko yana amsa yawancin bayanan martaba kafin ka isa sauran biyun.

Abin da nobind a zahiri ke tsallakewa

A bisa tsohuwar dabi'a abokin ciniki yana ɗaure socket na gida kafin ya yi kira, kuma port ɗin gida 1194 ne sai dai idan bayanin martabar ya ce akasin haka. nobind yana cire wannan ajiyar, don haka stack ɗin yana ba da port da ba a yi amfani da shi a lokacin haɗi. Keɓewa ne ba tsohuwar dabi'a ba, kuma abokin ciniki marar layin yana riƙe da 1194, wanda shi ne ainihin dalilin da misali na biyun da ba a ƙulla ba ke yin karo. Yawancin bayanan martabar abokin ciniki da ake rarrabawa suna ɗauke da umarnin saboda wannan dalili, kuma yin wani abu a fayil ɗin misali ba daidai yake da injin ɗin yin haka a tsohuwar dabi'a ba.

Abin da ba ya canzawa shi ne gefen nesa. Sabar ɗin har yanzu yana saurara a inda bayanin martabar ya ce yana saurara, kuma port ɗin manufa a cikin ƙirar har yanzu port ɗin manufa ne. Port ɗin tushe mai motsi yana canza adireshin dawowa na socket ɗinka kuma babu wani abu na sabar ɗin.

Hakanan ba ya ɓoye komai. Adireshinka na jama'a shi ne abin da hanya ke fassara shi zuwa gare shi, fakitin har yanzu yana ratsa cibiyar sadarwar gida, kuma duk wanda ke tafiyar da wannan cibiyar sadarwar har yanzu yana ganin kwarara. nobind ba siffa ce ta sirri ba kuma ba hanyar tsallake katangar wuta ba ce.

Sharuɗɗa uku da ke yanke shawara

Tambaya ɗaya ce ke yanke shawarar sauran biyun, don haka ka amsa ta kafin ka gyara komai. Idan abokin tarayya yana kira zuwa waje, sauran tambayoyin suna ƙara dalla-dalla shawarar da aka riga aka yanke. Idan yana karɓar haɗe-haɗen cikin gida, babu adadin daidaita port ɗin gida da zai sa a iya isa gare shi.

Shin wannan abokin tarayya ne ke fara haɗin? Idan yana kira zuwa waje, port ɗin tushe mai motsi ba shi da lahani kuma yawanci an fi so, domin amsar tana bin wannan kwararar zuwa baya. Idan yana jiran haɗe-haɗen ciki, port mai motsi yana sa ba a iya isa gare shi sai dai idan wani abu a gaba ya bayyana port ɗin. Wannan amsa ɗaya ce ke raba kowane bayanin martabar abokin ciniki daga kowane na sabar.

Shin hanya tana tacewa bisa port ɗin tushe? Ƙa'ida mai tsanani da aka rubuta don wani sanannen port tana tilasta port na gida bayyananne, kuma bayanin martabar ya kamata ya rubuta wace ƙa'ida yake cikawa. Yawancin cibiyoyin sadarwa suna tacewa bisa manufa kawai, don haka wannan sharadi ya fi na farko wuya. Inda ya shafi, yana rinjayar fifikon port mai motsi.

Shin misalai da yawa suna raba host ɗin? Port tabbatacce ɗaya ba zai iya hidimar biyu daga cikinsu ba, kuma misalin da aka sake farawa zai iya samun 1194 har yanzu yana cikin yanayin rufewa. Port ɗin masu motsi suna cire wannan rikici ba tare da canza wani abu ba. Idan ba za ka iya amsa wannan da tabbaci ba, ɗauka eh kuma bari kernel ya zaɓa.

Inda port ɗin da aka ƙulla shi ne amsar da ta dace

Wasu cibiyoyin sadarwa suna tacewa bisa port ɗin tushe da kuma manufa, don haka mai gudanarwa zai iya rubuta ƙa'idar da ke ba da izinin zirga-zirga daga wani sanannen port kawai. Ƙulla port ɗin gida a lokacin daidai ne, kuma bayanin martabar ya kamata ya ɗauki sharhi da ke ambaton ƙa'idar da yake cikawa. Ƙulla don daidaituwa da port ɗin sabar ba dalili ba ne, domin lambobin biyu ba su da wata alaƙa da juna. Idan ƙullin yana wanzu ne kawai saboda samfuri yana da shi, share shi.

In ba haka ba port ɗin da aka ƙulla yana sayen matsala: abokan ciniki biyu a kan inji ɗaya ba za su iya riƙe 1194 duka ba, kuma na biyu ya kasa da kuskure wanda ke nuna port ɗin maimakon bayanin martabar. Kwandon da ke sake farawa da sauri ya buge wannan bango. Gyaran shi ne umarnin da bayanan martabar da aka rarraba suka riga sun ƙunsa.

Sabar da abokin ciniki ba su da daidaito

littafin jagora na OpenVPN 2.6 yana ajiye nobind kusa da lport, wanda shi ne hujja a cikin layi ɗaya: zaɓi ɗaya yana cewa kernel ne ke zaɓa, ɗayan yana cewa kai ne ke yi. Port ɗin gida mai motsi yana aiki ne kawai ga abokin tarayyar da ke yin kira, domin gefen da ke amsawa ba zai iya sanin port ɗin tukuna ba. Shi ya sa kwafin bayanin martabar abokin ciniki a kan sabar yana haifar da mai sauraro wanda babu wanda zai iya isa gare shi.

A kan host mai mu'amala da yawa, adireshin yanke shawara ce dabam da port ɗin. Ɗaure takamaiman adireshin gida da ɗaure takamaiman port saituna biyu ne daban-daban, kuma sabar da ke da hanyoyin sama biyu yawanci tana ƙulla duka biyun. Abokin ciniki da ya ƙulla duka biyun ya ɗauki wannan taurin ba tare da wani amfani ba.

Taƙaitawar tana magana ne kan matsayi ba kan tsaro ba: wanda ke yin kira zai iya zama mai sassauci game da tushensa, kuma wanda ke amsawa ba zai iya ba. Babu wani zaɓi da ke canza abin da ɗayan gefen ya koya game da ainihinka. Shi ya sa umarnin yake bayyana a cikin misalan abokin ciniki kuma kusan ba ya bayyana a cikin na sabar.

Tabbatar da port ɗin da kernel ya zaɓa

Bayan haɗi, karanta socket ɗin maimakon ƙirar, domin ƙirar tana bayyana niyya kuma socket ɗin yana bayyana abin da ya faru. Abubuwan da suka cancanci rubutawa su ne port ɗin gida, ƙarshen nesa, da ko wani abu har yanzu yana saurara. A kan host ɗin Linux duka ukun suna nisan umarni ɗaya.

ss -unp | grep openvpn
ss -lunp | grep openvpn
sudo lsof -nP -i | grep openvpn

Abokin ciniki tare da nobind yana nuna babban port na gida da port ɗin nesa da aka tsara, wanda shi ne siffar da ake tsammani. Sabar tana nuna socket mai saurara a kan port ɗinta da aka tsara, kuma idan wannan socket ɗin ba ya nan, bayanin martabar ko dai ba mai sauraro ba ne ko ya kasa ɗaurewa. Lokacin da kwarara ta kasance amma babu fakiti da ke dawowa, kwatanta port ɗin tushe da aka zaɓa da duk wani matattarar port a kan hanya kafin ka gyara bayanin martabar. Canza abu ɗaya, sake haɗawa, sannan ka sake karanta socket ɗin.