Cikakken tunnel na OpenVPN yana yanke zamanka na SSH: gyara hanyar amsa

Kunna abokin ciniki na OpenVPN mai cikakken tunnel a kan na'urar da kake isa gareta ta SSH na iya yanke zaman cikin daƙiƙa ɗaya, kuma na'urar ba ta yin wani abu ba daidai ba. Tunnel ɗin ba ya canza yadda fakiti ke isa uwar garken; yana canza yadda amsoshi ke fita. Da zarar hanyar da aka saba ta nuna tun0, amsa ga abokin cinikinka na SSH yana shiga cikin hanyar sadarwar mai bayarwa, wadda ba ta da hanyar komawa zuwa adireshinka. Haɗin yana rataye, ƙoƙari na gaba yana ƙarewa, kuma daemon ɗin yana ci gaba da saurara a tashar 22 duk tsawon lokacin.

Karanta teburin routing kafin ka karanta log ɗin VPN. Log ɗin zai ce tunnel ɗin ya tashi, kuma yana da gaskiya. Tambayar ita ce wace interface aka ba kowane amsa, kuma wannan bincike ne na kowane fakiti a cikin tebur da tunnel ɗin ya sake rubutawa yanzu.

Me ya sa amsar ke fita ta ƙofar da ba daidai ba

Fakitin da ke shigowa har yanzu suna zuwa a kan interface na zahiri, domin abokin ciniki na VPN ba zai iya canza yadda intanet ke isa adireshin jama'a na uwar garkenka ba. Amsoshi yanke shawara ne daban: ga kowane fakiti, kernel ɗin yana neman manufa, kuma bayan --redirect-gateway shigarwar da aka saba tana cewa tunnel. Fitowar mai bayarwa tana ganin manufar da ba ya hidimarta kuma yana watsar da fakitin.

Kariyar OpenVPN kanta tana rufe manufa ɗaya daidai. Littafin 2.6 yana bayyana --redirect-gateway a matsayin jerin ayyuka: yana ƙara hanyar host don peer na VPN ta hanyar gateway da aka yi amfani da shi kafin tunnel ɗin, domin zirga-zirgar da aka ɓoye ba za ta iya juyawa cikin kanta ba, sannan ya maye gurbin hanyar da aka saba. Wannan hanyar host na peer ne kawai. Abokin cinikinka na SSH wata adireshin intanet ce kawai kuma ba ya samun wani keɓe.

Ya kamata a ware kuskuren prefix ɗaya da wuri. ip route add -net 0.0.0.0 gw 10.8.0.1 dev tun0 ba tare da tsayi ba yana dacewa da adireshin ɗaya 0.0.0.0, ba da intanet ba; dole ne ya zama 0.0.0.0/0. Kuma idan ɗaukar hanyar da aka saba ya karya jigilar tunnel ɗin kanta, ƙara ƙarshen matsayin hanyar host ta interface ɗin zahiri, ta amfani da ainihin adireshin mai bayarwa.

Ƙulla adireshin abokin cinikinka na SSH don gyara nan take

Mafi saurin gyara shine hanyar host don adireshin abokin cinikinka ta hanyar gateway da uwar garken ta yi amfani da shi kafin tunnel ɗin ya wanzu. Daga wajenka, nemo adireshin da uwar garken za ta gani, sannan ka karanta teburin uwar garken don sanin tsohon gateway:

curl -s https://ifconfig.co
ip route

A kan uwar garken, ƙara keɓewar kafin abokin ciniki ya fara. Adiresoshin nan masu riƙe wuri ne; siffar ita ce ke da muhimmanci:

sudo ip route add 80.128.240.55 via 192.168.178.1

Wannan shine gyaran da aka yi amfani da shi a lamarin da aka ruwaito, kuma yana aiki nan take. Hakanan yana da rauni ta hanyoyi biyu da ake iya tsammani: hanyar tana ɓacewa a lokacin sake farawa, kuma tana zama mara kyau a daidai lokacin da ISP ɗinka ya ba ka wata adireshi. Dauke shi a matsayin matakin gaggawa kuma ka mai da shi dawwama da gangan, ta hanyar sashin cibiyar sadarwa ko ƙugiya ta dispatcher, ko ka yarda cewa na ɗan lokaci ne kuma ka rubuta hanyar dawo da ita.

Hana abokin ciniki ɗaukar hanyar da aka saba

Zaɓin da ya fi tsafta shine hana tunnel ɗin maye gurbin hanyar da aka saba kwata-kwata. route-nopull, idan aka yi amfani da shi tare da --client ko --pull, yana karɓar zaɓuɓɓukan da aka tura sai dai hanyoyi, block-outside-dns da zaɓuɓɓuka irin na DHCP kamar sabar DNS, don haka kana ƙara prefix ɗin da kake buƙata kawai. Ƙaramin kayan aiki shine matatar ja, wanda ke watsar da umarni ɗaya mai matsala kuma ya riƙe sauran:

route-nopull
pull-filter ignore "redirect-gateway"

Yi amfani da ɗaya ko ɗayan, ba duka biyu ba, kuma ka fito fili game da abin da ke canzawa. Ba tare da hanyar da aka saba ta cikin tunnel ba, uwar garken ba ta sake bincika intanet ta hanyar mai bayarwa ba; tana isa ga abin da ka yi routing da shi a fili kawai. Idan cikakken tunnel shine dukan manufar saitin, wannan shine maɓallin da ba daidai ba kuma hanyar host da ke sama ita ce daidai.

Raba hanyar dawowa bisa tushe ko bisa haɗi

Lokacin da adireshin da ke shigowa ya tsaya tsayin daka, ƙa'idar tushe tana riƙe amsoshi a cikin gida ba tare da taɓa hanyoyin tunnel ɗin kanta ba. Ba adireshin interface ɗin zahiri nashi tebur da ke ɗauke da prefix ɗin LAN da na zahiri da aka saba, sannan zaɓi wannan teburin don zirga-zirgar da ke fitowa daga gare shi:

ip rule add from 192.168.1.11 table 128
ip route add table 128 to 192.168.1.0/24 dev eth0
ip route add table 128 default via 192.168.1.1

Wannan yana aiki domin amsoshin haɗin SSH da ke shigowa suna fitowa daga adireshin da abokin ciniki ya haɗa zuwa gare shi. Wani lamari da aka ruwaito inda kowace hidima mai shigowa dole ta ci gaba da aiki ya yi amfani da daidai wannan siffa. Lokacin da adireshin da ke shigowa yana shawagi ko hanyar tana da ƙarfi, yi wa haɗin alama maimakon haka: sanya alamar conntrack a kan fakitin farko da ya zo daga interface ɗin zahiri, kwafa shi a kan fakitin amsa a cikin OUTPUT, kuma yi routing ɗin fakitin da aka yi wa alama ta tebur da ke nuna gateway ɗin zahiri.

iptables -t mangle -A PREROUTING -i eth0 -m conntrack --ctstate NEW -j CONNMARK --set-mark 1234
iptables -t mangle -A OUTPUT -m connmark --mark 1234 -j MARK --set-mark 4321
ip route add default via 192.168.1.1 dev eth0 table 3412
ip rule add fwmark 4321 table 3412

Ka riƙe alamar haɗi, alamar firewall da lambar tebur daban yayin gwaji. Sake amfani da lamba ɗaya don ayyuka biyu yana samar da ƙa'ida da ke kama da daidai kuma tana dacewa da fakiti marasa kyau. Shigarwar da aka saba ta tebur kuma tana buƙatar via tare da gateway ɗin LAN a kan hanyar Ethernet ta yau da kullum; dev eth0 tsirara yana aiki ne kawai lokacin da interface ɗin yana matsayi-zuwa-matsayi ko kuma an warware tsallake na gaba ta wata hanya. An samu uwar garken Jessie da aka ruwaito a kan hanyar da siffar tsirara ta yi aiki, wanda ba ƙa'idar rarrabawa ba ce da za a kwafa.

Tabbatar ba tare da ka kulle kanka a waje ba

Kada ka gwada ta hanyar cire haɗi. Ka riƙe zaman farko a buɗe, ka ɗaga tunnel ɗin, sannan ka tambayi kernel ɗin wace hanya adireshinka zai bi:

ip route get 80.128.240.55

Amsa ya kamata ya ambaci interface ɗin zahiri da tsohon gateway, ba tunnel ɗin ba. Sannan buɗe haɗin SSH na biyu; wannan shine ainihin gwajin, domin tsohon zaman na iya rayuwa a kan yanayin da sabon haɗi ba zai iya sake haifarwa ba. Idan na biyu ya rataye yayin da na farko har yanzu yana amsawa, ƙa'idar ba ta taɓa dacewa da zirga-zirgar da ke da muhimmanci ba, kuma alamomi ko adireshin tushe shine wurin da za a duba.

Ka riƙe na'urar kula da ba ta cikin bandeji a hannu duk tsawon atisayen. Uwar garken da hanya ɗaya tilo ta shiga ita ce tunnel ɗin da ka karya yanzu ba za a iya gyara ta ta wannan tunnel ɗin ba, kuma komawa baya yana da sauƙi idan ka rubuta lambobin tebur da prefix ɗin da ka ƙara.