route-gateway ba redirect-gateway ba ne: me ke canzawa da gaske
Zaɓin yana ba da matakin gaba ne kawai ga hanyoyin da OpenVPN ke sakawa. Cire shi ba ya kashe cikakken tunnel da aka tura, kuma gyaran yana cikin juyar da hanya.
Tunnel ɗinka yana tashi, ƙananan hanyar sadarwa ta sirri tana amsawa, kuma bincike na yau da kullum har yanzu yana ɓacewa cikin VPN duk da cewa wani ya share layin ƙofar daga bayanin martaba. Wannan haɗin shine sawun yatsa na umarnin da ba daidai ba da aka gyara. Abin da aka cire yana ba abokin ciniki matakin gaba ga hanyoyin da yake sakawa; abin da ya ci gaba da kama zirga-zirga ya zo daga wani wuri kuma uwar garken ta tura shi. Rufewa da matakin gaba ayyuka ne daban-daban, kuma ɗaya ne kawai daga cikinsu ke yanke shawara ko wuraren jama'a suna amfani da tunnel ɗin.
Layin da ka cire matakin gaba ne, ba maɓallin manufa ba
Kowace hanya da abokin ciniki ke sakawa tana buƙatar adireshin ƙofa don nunawa, kuma umarnin ƙofa shine tushen wannan adireshin lokacin da hanya ba ta faɗi ɗaya da kanta ba. Share shi kuma waɗannan hanyoyin ba su da inda za su manne, don haka ko dai ba a saka su ko sun sauka a kan hanyar da ba ta kai ko'ina. Ƙananan hanyar sadarwa ta sirri ita ce ainihin abin da irin wannan hanya ke ɗauka.
A halin yanzu halin da ya tsira yana da wani marubuci: zaɓin juyar da hanya a cikin toshe da aka tura, wanda ke motsa zirga-zirgar fita ta yau da kullum zuwa cikin tunnel bisa tutocinsa. Cire ƙofar ba ya kashe shi kuma ba ya raunana shi. Sakamakon shine mafi munin yanayi biyu, tare da zirga-zirgar jama'a har yanzu ana kamawa kuma wurin sirri da ya tabbatar da tunnel ɗin yanzu ba a iya isa gare shi. Shi ya sa gyaran na biyu, wanda aka yi cikin ruhu ɗaya, shima ba ya canza komai.
Lever huɗu, ayyuka huɗu daban-daban
Ana ambaton umarni huɗu a musanya a cikin wannan tattaunawa, kuma ɗaya ne kawai daga cikinsu ke jagorantar rufewa, wato waɗanne wurare ake turawa ta cikin tunnel kwata-kwata. Na biyu yana saita matakin gaba da hanyoyi ke amfani da shi, na uku yana saka prefix ɗaya, kuma na huɗu yana jefar da duk abin da uwar garken ta tura, ciki har da hanyoyin sirri da turawa ke buƙata. Tebur ɗin yana jera su bisa abin da mai gudanarwa ke ƙoƙarin canzawa ba bisa suna ba, domin sunaye ne ke haifar da rudani. Ka ɗauke su a matsayin shawarwari huɗu daban-daban kuma ka zaɓi wanda kake son juya shi da gaske.
A aikace, duk huɗun suna zuwa a cikin toshe ɗaya da aka tura, layi bayan layi, wanda ke sa su yi kama da sassan saiti ɗaya. Ba haka suke ba, kuma manufar OpenVPN tana rubuta su a matsayin hanyoyin daban saboda wannan dalili. Gano wace shawara kake juyawa shine aikin; gyaran layi ɗaya ne.
| What you are trying to change | Directive that decides it | What it leaves alone |
|---|---|---|
| Which destinations use the tunnel | redirect-gateway | Per-prefix routes and resolver choice |
| The next hop a pushed route points at | route-gateway | Coverage of public destinations |
| One reachable prefix | route | Every other destination, default path included |
| All pushed routing and DNS at once | route-nopull | Nothing, which is the problem |
Tace layin da aka tura, ka riƙe matakin gaba
Idan rufewar da kake adawa da ita ta zo a matsayin zaɓi da aka tura, amsar da ta dace ita ce ka yi watsi da wannan zaɓin da suna kuma ka bar sauran toshewar da aka tura ba tare da an taɓa su ba. Idan an rubuta shi a matsayin tacewa, yana kama da layin da ke ƙasa, kuma yana cikin bayanin martabar abokin cinikin da abin ya shafa, ba cikin tsarin uwar garken ba.
pull-filter ignore "redirect-gateway"Ƙunci shine ainihin maganar. Domin tacewar tana kwatanta prefix na rubutu, gajeriyar tsari kuma tana dacewa da umarnin matakin gaba, wanda ke cire ainihin bayanin da hanyoyin sirri suka dogara da shi kuma yana maimaita ainihin kuskuren cikin sabon sutura. Tacewa kuma tana aiki ne kawai akan zaɓukan da aka tura, don haka ba ta taɓa wani layi daidai da aka rubuta a gida ko aka tilasta ta hanyar manajan cibiyar sadarwa ba. Sake haɗawa bayan haka, domin zaman mai rai ba ya sake kimanta abin da uwar garken ta tura.
Karanta binciken, ba tebur ba
Bayan sake loda bayanin martabar, tambayi kernel inda wurare biyu za su je da gaske: ɗaya cikin prefix ɗin sirri da ɗaya a intanet ɗin jama'a. Cikakken fitar da babban tebur yana da wuya a karanta kuma yana da sauƙi a karanta ba daidai ba, domin hanya na iya kasancewa kuma har yanzu ta sha kaye ga mafi takamaiman daidaituwa. A cikin turawa bisa manufa, ƙa'ida, tebur da adireshin tushe suma suna cikin binciken.
ip route get 10.40.7.25
ip route get 203.0.113.77
ip rule showBambancin def1 ya cancanci saninsa, domin yana barin tsohon shigarwar tsoho a bayyane yayin da biyu na rabin-tsoho ke cin nasarar binciken. Don haka layin 0.0.0.0/0 a cikin fitar ba ya tabbatar da komai da kansa. Binciken yana amsa tambayar da lissafin kawai yake kama da amsawa.
DNS, IPv6 da hanyar sirri dole su ci gaba da aiki
Kin amincewa da juyar da IPv4 ɗaya ba ya faɗi komai game da mai warwarewa, don haka zaɓin DNS da aka tura zai iya ci gaba da aika tambayoyi cikin tunnel yayin da hanyoyi suka yi kama da daidai. Tsohon IPv6 zai iya yin haka ga dangin adireshin da binciken IPv4 bai taɓa ba. Dukansu suna buƙatar shawara bayyananna maimakon zato. Sannan tabbatar da cewa sabis ɗin sirri har yanzu yana amsawa, domin tunnel ɗin da aka raba wanda ya rasa hanyarsa ta sirri ba tunnel ɗin da aka raba ba ne, karyayye ne.
Wani babban kayan aiki ya cancanci gargaɗi: route-nopull yana jefar da kowace hanya da aka tura da kowane zaɓin DNS da aka tura, wanda tabbas yana dakatar da cikakken tunnel kuma haka ma tabbas yana karya hanyoyin sirri da turawa ta dogara da su, don haka babban guduma ne fiye da tacewar suna da aka nufa kan zaɓi ɗaya. Bincika wurin sirri, wurin jama'a da mai warwarewa bayan kowane canji, kuma ka ɗauki musafaha da aka kammala a matsayin hujja ga komai face musafahar.