OpenVPN: haɗin gida ya kasa lokacin tashi — jira ko sake gwadawa

Ana ba da mafita biyu ga sabar OpenVPN da ba ta tashi lokacin tashi: jira adireshin, ko barin sabis ɗin ya sake gwadawa har haɗin ya yi nasara. Dukansu suna magance alamar ɗaya da halin kasawa daban. Jira yana ƙulla wani sharadi na musamman kuma yana kasawa da ƙarfi idan babu shi; sake gwadawa yana ɓoye sharadin kuma yana ci gaba da gwadawa. Wanne ya dace da unit ɗinka ya dogara da ko wannan adireshin tsarin dogaro ne ko kuwa haɗarin lokaci.

Dukansu sun fi barci mai tsayawa kyau, wanda ba ya jira komai kuma ba ya faɗin abin da yake jira.

Abin da zaɓin local ke buƙata a zahiri

local yana ambaton adireshin da daemon ɗin ke ɗaure socket ɗinsa da shi, kuma ɗaurewa da adireshin da bai wanzu ba tukuna yana kasawa nan take da kuskure game da adireshin da aka nema. Idan zaɓin ba ya nan, daemon ɗin yana saurare a duk adiresoshin, shi ya sa wannan bayanin ke aiki a na'urar da interface ɗinta ba ta tashi ba: yana saurare a ko'ina maimakon a adireshin ɗaya da ka ambata. Wannan bambanci shi ne duk kasawar, kuma yana zama marar gani har sai an sake tashi.

Buƙatar ba ita ce interface ɗin ya tashi a wata ma'ana ta gama gari ba. Dole ne a sanya adireshin ga interface ɗin da ya dace a lokacin ɗaurewar, kuma dole ne ya zama interface ɗin tushe ba tunnel ɗin da wannan daemon zai ƙirƙira daga baya ba. Binciken da aka yi minti kaɗan bayan shiga ba ya tabbatar da komai game da jerin tashi.

Jira adireshin ko sake gwada ɗaurewar

Jira yana nufin ExecStartPre da ke tambaya har adireshin ya bayyana, da iyakataccen adadin yunƙuri da ficewa marar sifili idan lokaci ya ƙare. Sake gwadawa yana nufin barin babban tsari ya kasa da neman mai sarrafa sabis ya sake ƙaddamar da shi, misali Restart=on-failure tare da RestartSec=5. Na farko yana ba da rahoton sharadin da ya ɓace a matsayin unit ɗin da ya kasa, yayin da na biyu ke ba da rahotonsa a matsayin jerin sake farawa da ke ƙarewa daga ƙarshe, wanda ya fi hayaniya a cikin jarida amma yana jure wa adireshin da ya zo a makare saboda dalilan da ba za ka iya hango ba.

Ka fifita jira idan adireshin tsarin dogaro ne, kuma ka fifita sake gwadawa idan adireshin yawanci yana bayyana amma lokacinsa ya bambanta. Haɗa su yana da ma'ana: jira mai iyaka yana rufe yanayin gama gari kuma manufar sake farawa tana rufe keɓancewar. Abin da babu ɗayansu ya kamata ya yi shi ne gudana har abada, domin unit ɗin da ke sake gwadawa har abada yana ɓoye kuskuren tsari maimakon ba da rahotonsa.

Dalilin da network-online.target bai isa ba

network-online.target yana yin wa'adi da duk abin da aiwatar da hanyar sadarwa mai aiki ke nufi da online, kuma ba wani abu fiye da haka. Tare da systemd-networkd, systemd-networkd-wait-online yana yanke shawara lokacin da aka cim ma wannan manufa, kuma tunaninsa na asali game da online ana iya cika shi kafin takamaiman adireshinka ya wanzu. A ƙarƙashin NetworkManager, sabis ɗin wait-online yana amfani da nasa dokokin. Yin oda bayan manufar tushe ne mai kyau, ba tabbacin cewa adireshi ɗaya, amsar DNS ko abokin hannu mai nisa a shirye suke ba.

Wannan tunani ɗaya yana watsi da hanyoyin da aka saba. Shigarwar fara kai tsaye ta tebur tana jiran zaman mai amfani wanda wataƙila ba zai taɓa buɗewa a sabar ba, kuma umarnin cron da aka jinkirta yana ƙara lokacin da ya wuce ba tare da ambaton albarkatun da yake fata zai bayyana ba. Dukansu na iya zama kamar sun yi nasara tsawon watanni sannan su kasa a tashin ɗaya da ke da muhimmanci.

Duba ɗaurewar bayan tashi mai sanyi

Tabbatar da tashi mai sanyi na gaske maimakon sake farawa da sabis, domin sake farawa yana gado adireshin da jerin tashi ya kamata ya ƙirƙira. Bayan tashi, ss -lntp ko ss -lunp yana nuna adireshin gida da kowane mai saurare ya ɗaure da shi a zahiri, kuma journalctl -b -u openvpn-server@server yana nuna ko yunƙurin farko ya kasa. Kwatanta adireshin da aka ɗaure da wanda ke cikin bayanin, sannan sake maimaita kwatancen bayan sake haɗa hanyar sadarwa.

Idan bayanin bai taɓa buƙatar tabbataccen adireshi ba, cire local gyare-gyare ne na halal, amma ka mai da shi shawarar tsaro maimakon ɗabi'ar magance matsala.

Faɗaɗa mai saurare yana canza wanda zai iya isa gare shi, don haka haɗa wannan canjin da manufar Firewall da ya kamata ta iyakance shi. Sabis ɗin da ke tashi lafiya a kowace interface bai magance ainihin matsalar ba; ya matsar da matsalar zuwa gefen hanyar sadarwa.