Aiwatar da asusun Linux ɗaya ta OpenVPN da ƙa'idar UID

Aiwatarwar tushen asusu ta dace sa'ad da kowane soket ɗin IPv4 da wani mai amfani da Linux ya mallaka ya kamata ya fita ta tuntuɓin da ke akwai, kuma ba ta dace ba sa'ad da kake buƙatar keɓewa a matakin shirye-shirye. Tana zaɓar bisa UID, don haka duk abin da ke gudana a ƙarƙashin wannan asusun yana cikin iyaka, har da aikin batch ɗin da ka manta. Warware wannan tambayar kafin ka taɓa ip rule ɗaya.

Misalin da ke ƙasa yana ɗauka cewa akwai keɓaɓɓen asusun burauza a UID 1500, na'urar tuntuɓi tun-office da ke ɗauke da adireshin gida 10.80.0.11, da VPN da ke ba da izinin wuraren da ake magana a kai. Daemon ɗin kansa yana gudana a wajen wannan UID.

Sharuɗɗa uku da ke zaɓar hanyar

Zaɓi ƙa'idar UID sa'ad da asusun ne ainihi da ke yin aikin, sa'ad da matsar da duk zirga-zirgar sa abu ne da aka yarda da shi, kuma sa'ad da namespace zai yi nauyi fiye da yadda aikin ya cancanta. Zaɓi namespace na cibiyar sadarwa sa'ad da aikin yana buƙatar nasa mu'amaloli, mai warwarewa da teburin tafarkin. Zaɓi wakili ko ɗaure kowane tsari sa'ad da aikace-aikace ɗaya kawai ya kamata ya motsa yayin da sauran zaman ya kasance a kan hanyar gida. Rubuta waɗannan uku yana hana ƙa'idar da ke rufe fiye da abin da aka yi niyya a hankali.

Kuskuren da ya kamata a guje wa shi ne ɗauka cewa mai ƙaddamarwa ne ke bayyana mai shi. Burauzan da zaman wani mai amfani ya ba shi URL bai ƙirƙiri soket a ƙarƙashin UID 1500 ba, kuma babu ƙa'idar da za ta motsa zirga-zirgar da yake samarwa.

Tebur ɗin, ƙa'idar da mai gadi

Bayan duba ƙa'idodin da ke akwai da zaɓar lambobin tebur da fifiko da ba a yi amfani da su ba, shirin gajere ne: tafarki na asali a cikin keɓaɓɓen tebur da ke ɗauke da adireshin tushen tuntuɓin, ƙa'idar da ke tura binciken asusun zuwa wannan tebur, da ƙa'idar ƙarshe da ke toshe hanyar ajiya. Idan an rubuta shi, wannan maye gurbin tafarki ne na idempotent, ip -4 route replace default dev tun-office src 10.80.0.11 table 51820, sannan ip -4 rule add priority 12100 uidrange 1500-1500 lookup 51820.

Mai gadin shine ip -4 rule add priority 12101 uidrange 1500-1500 unreachable, kuma yana da muhimmanci fiye da yadda tsawonsa ke nunawa. Ba tare da shi ba, tafarkin da ya ɓace a tebur 51820 yana faɗuwa zuwa hanyar sama ta yau da kullum kuma asusun yana zubar da zirga-zirgar da manufar ta kamata ta kama a hankali. Da shi, irin wannan gazawar tana zama lokacin ƙarewa, wato toshewa maimakon hanyar ajiya.

Riƙe ƙa'idar adireshin gida ta yau da kullum a gaban waɗannan, kuma yanke shawara da sani ko keɓancewar LAN ko gudanarwa ya kamata su kasance kafin zaɓaɓɓen tebur. Tafarkin asali da aka samu a can ba ya tuntuɓar main daga baya don ƙarin takamaiman tafarkin LAN, wanda ke ba da mamaki ga waɗanda suke tsammanin daidaiton mafi tsayin prefix ya shafi tsakanin teburori. Rubuta jerin keɓancewar da aka yi niyya a cikin bayanin canji yayin da dalilin yake sabo.

Abin da tafarkin UID ya bar waje: DNS

Daemon mai warwarewa yana buɗe soket ɗinsa na sama a ƙarƙashin UID ɗinsa, don haka zaɓar 1500 ba ya motsa waɗannan tambayoyin zuwa tebur 51820. Haɗin DNS shawara ce dabam: nuna asusun zuwa mai warwarewa da ake iya isa ta tuntuɓin, ko ka yarda cewa warware suna yana bin hanyar na'urar yayin da zirga-zirga ba ya.

Tambayar loopback zuwa stub na gida ba hujja ba ce cewa tambayar sama ta yi amfani da hanyar burauzan, haka ma lodin shafi mai nasara daga ajiya ba hujja ba ne.

IPv6 yana buƙatar jumlarsa a cikin ƙira

Ƙa'idodin da ke sama suna rufe IPv4 ne kawai. Idan buƙatar ita ce tuntuɓin IPv4 ba tare da IPv6 kai tsaye daga wannan asusun ba, ƙara ƙa'idar ƙarshe da aka duba kamar ip -6 rule add priority 12101 uidrange 1500-1500 unreachable, sannan duba ƙa'idodin IPv6 na baya da keɓancewar loopback da kake son riƙewa.

Toshe IPv6 kai tsaye ba tunnel na dual-stack ba ne; iyaka ne. Kiran sa tunnel zai rikita na gaba da zai karanta manufar, kuma rikicewar za ta bayyana a matsayin tikitin tallafi game da rugujen shafin IPv6.

Tabbatar da ainihin asusun, sannan ka mallaki zagayen rayuwa

Kwatanta bincike: ip -4 route get 198.51.100.25 uid 1500 da wannan wuri tare da UID na yau da kullum. Sannan yi buƙatar da aka yarda a ƙarƙashin keɓaɓɓen asusun kuma duba adireshin tushen da nisa ke gani. Adireshin tushen da aka fi so ba source NAT ba ne, kuma ba zai rinjayi aikace-aikacen da ke ɗaure wani abu dabam ba. Idan duka binciken sun dawo da tafarki ɗaya, ƙa'idar ba ta yin abin da kake tsammani.

Riƙe tebur ɗin, ƙa'idodin da tsawon rayuwar tafarkin tuntuɓin a ƙarƙashin mai shi ɗaya, gwada sake haɗawa da asarar tuntuɓi, kuma lokacin janye manufar cire mata takamaiman shigarwar ta kawai. Namespace na nan har yanzu idan mu'amaloli dabam da yanayi dabam ne ainihin abin da kake buƙata.