Mataimakin sabar OpenVPN: cibiyar sadarwa da netmask, ba CIDR ba

Layin sabar da ke haɗa ƙarin CIDR da netmask mai ɗigo yana tsayar da daemon kafin ya buɗe ko wata tashar. Mataimakin IPv4 server yana son hujjoji biyu daban: adireshin cibiyar sadarwa madaidaici, sannan netmask a siffar ɗigo. Duk wani abu a wannan layin hasashe ne, kuma a cikin hasashe ne girman tafki da netmask ɗin abokan ciniki ke kuskure.

Hujjoji biyun da mataimakin yake karɓa

Rubuta cibiyar sadarwa da farko sannan netmask ɗin, ba tare da haɗa kome da adireshin ba:

server 10.72.16.0 255.255.240.0

Wannan shine sifar /20. Layin da ke ƙasa shine kuskuren, kuma yana faɗuwa ne a wajen nazarin zaɓuɓɓuka, ba a lokacin aiki ba:

server 10.72.16.0/20 255.255.240.0

Ka raba ra’ayoyin biyu lokacin da kake gyara wannan. Tsayin prefix da netmask mai ɗigo suna bayyana tazara ɗaya, amma mataimakin ba ya karɓar dukansu a lokaci ɗaya, kuma layin da aka ƙi yana haifar da kuskuren zaɓi wanda ke ambaton umarnin, ba lissafin ba.

Daidaita cibiyar sadarwa kafin ka rubuta netmask ɗin

Adireshin farko shine adireshin cibiyar sadarwar tazarar, ba adireshin abokin ciniki mai daɗi a cikinta ba. Don /20 tazarar ta tashi daga 10.72.16.0 zuwa 10.72.31.255, kuma na farko ne kawai daga cikinsu adireshin cibiyar sadarwa mai inganci. /21 yana amfani da 255.255.248.0 kuma ya ƙunshi 10.72.16.0 har zuwa 10.72.23.255, don haka layinsa shine server 10.72.16.0 255.255.248.0.

Canza prefix yana canza tazarar kuma ba wani abu ba. Ba ya canza adadin adiresoshin da abokin ciniki ɗaya ke samu, domin wannan sifa ce ta topolojin, ba netmask ɗin da ke wannan layin ba.

Tabbatar da tafki daga bangaren sabar

Fara misalin a gaba tare da cikakken log, ka karanta layukan da mataimakin ke fitarwa. Tafkin da ya gina ana buga shi a lokacin farawa, wanda ya fi dogaro fiye da lissafin hannu:

openvpn --config /etc/openvpn/server.conf --verb 4 --dev tun9 --port 1195

Nemo taƙaitawar tafki kusa da saman fitarwa. Yana lissafin tazarar da mataimakin ya ajiye, kuma idan wannan tazarar ba ta dace da nufinka ba, hujjojin da ke kan layin ba daidai ba suke ko da me lissafin netmask ɗin ya ce.

Sannan haɗa abokin ciniki ɗaya ka nemo layin da ke rubuta adireshin da aka ba shi. Wannan adireshin guda ɗaya, kusa da tazarar tafki, yana gaya maka ko abokin ciniki ya sauka cikin toshe da aka ajiye ko kuma wani wuri da ba ka tsammani. Idan biyun ba su dace ba, gyara hujjojin ba abokin ciniki ba. Idan sun dace kuma har yanzu abokin ciniki ba ya iya isa kome, tafkin bai taba zama matsalar ba.

Karanta netmask ɗin abokin ciniki tare da la’akari da topolojin

Abokin ciniki da ke nuna /30 a kan hanyar sadarwar bututunsa ba hujja ba ce ta lalacewar tafki. A cikin adireshin batu-zuwa-batu kowane abokin ciniki yana samun ƙaramin toshe kuma netmask ɗin hanyarsa yana bayyana wannan toshe, yayin da tafkin sabar ke rufe duka. A cikin topolojin cibiyar sadarwar ƙasa, netmask ɗin abokin ciniki yana dacewa da netmask ɗin tafki maimakon haka. Don haka netmask ɗin shi kaɗai yana gaya maka wace topoloji ce ke aiki, ba wai an rubuta tafkin daidai ba.

Duba topolojin da aka saita da adireshin da aka ware tare kafin ka yanke shawara:

ip -4 addr show tun0

Idan adireshin yana cikin tafkin kuma netmask ɗin ya fi tafkin siriri, topolojin yana yin aikinsa. Idan adireshin yana wajen tafkin, tafkin ba daidai ba ne, kuma babu wani bincike daga bangaren abokin ciniki da zai gyara shi.

Canza tafki mai aiki

Zaɓi tazara wadda ba ta haɗu da tafkin yanzu, LAN, ko duk wata hanyar da aka riga aka tura wa abokan ciniki. Haɗuwa ita ce gazawar da ke tsira daga sake farawa sannan ta bayyana kwanaki bayan haka a matsayin wurin da ba a iya isa gare shi daga wata hanya.

Canza layin, sake farawa, ka sake karanta tafkin farawa kafin ka bar masu amfani su dawo. Idan sabuwar tazarar ta yi karo da wani abu, wannan fitarwar farawa ɗaya ke nuna shi nan take, kuma komawa baya gyaran layi ɗaya ne da wata sake farawa.

Ka ajiye tsohuwar tazarar har wani lokaci bayan canjin. Abokan ciniki da suka haɗa a makare na iya riƙe adireshi daga tafkin da ya gabata, kuma sabuwar tazarar da ke sake amfani da waɗannan adiresoshin tana haifar da rarrabawa biyu da ke kama da kuskuren hanyar sadarwa. Littafin jagora na OpenVPN 2.6 yana rubuta hujjojin mataimakin da faɗaɗarsa, wanda ya cancanci karantawa kafin ka ɗauka cewa umarni yana ɗaukar wannan rubutun da maƙwabcinsa ke ɗauka.