Me yasa ba a iya isa ga ƙaramin cibiyar sadarwar da ke bayan abokin ciniki OpenVPN ba?
OpenVPN ba zai iya tsammani wane abokin ciniki ne ya mallaki LAN mai nisa ba. Shigar iroute a fayil ɗin abokin ciniki, hanyar dawowa da turawa suna sa wannan ƙaramin cibiyar sadarwa ta isa.
Ping zuwa adireshin tunnel ɗin uwar garke yana yin nasara, teburin hanya na abokin ciniki da kansa yana kama da daidai, kuma LAN ɗin da ke bayan wannan abokin ciniki har yanzu ba a iya isa ba. Teburin turawa na abokin ciniki yana kama da daidai, uwar garke tana da hanyar da ke nufin tunnel ɗin, kuma fakiti suna ci gaba da ɓacewa. Wannan shi ne alamar gargajiya ta tunnel ɗin layer-3 wanda bai san cewa ɗaya daga cikin abokan cinikinsa shi ma ƙofa ne ba.
tun interface ba shi da matsakaici na gaba ga kowane abokin ciniki. Kernel yana ganin interface ɗaya tare da abokan hulɗa da yawa, don haka shawarar wane abokin ciniki zai karɓi fakiti don LAN mai nisa dole a yanke shi cikin tsarin OpenVPN. Ana daidaita wannan shawarar da iroute, kuma ba tare da ita ba fakiti ba shi da inda zai je.
Uwar garke tana turawa bisa abokin ciniki, ba bisa interface ba
Lokacin da uwar garke take buƙatar aika fakiti zuwa adireshin tunnel ɗin abokin ciniki, amsar ba ta da shakka: adireshin na zaman wannan abokin ciniki ne. Lokacin da manufar ita ce dukan ƙaramin cibiyar sadarwa da ke bayan wannan abokin ciniki, adireshin ba na kowa ne da uwar garke ta sani ba, kuma hanyar kernel zuwa tunnel ɗin tana cewa kawai "ta wannan interface", ba tare da faɗin wane abokin hulɗa ba.
OpenVPN tana warware wannan da teburin turawa na ciki wanda ke haɗa prefix ɗin manufa da wani abokin ciniki. Ana gina wannan tebur daga shigarwar iroute, shi ya sa hanyar talakawa a kan uwar garke ba ta isa ba. Hanyar kernel tana kai fakiti zuwa interface ɗin tunnel; haɗin ciki ne ke yanke shawarar wane zaman zai karɓe shi. Shi ya kuma sa gyaran ba ya taɓa bayyana a fitowar hanyoyin kernel.
Idan haɗin ba ya nan, fakiti yana isa uwar garke, ya yi daidai da hanyar tunnel, sannan a jefar da shi saboda babu abokin ciniki da ke da'awar manufar. Babu abin da ke rubuta cikakken kuskure, shi ya sa gazawar take kama da babban rami mai duhu a shiru maimakon madauki na turawa.
Rubuta shigar iroute da ke ambaton sunan abokin ciniki
iroute yana zaune a fayil ɗin daidaitawa na musamman na abokin ciniki, ba a babban daidaitawar uwar garke ba. Nuna uwar garke zuwa wani babban fayil da zaɓin client-config-dir, sannan ƙirƙiri fayil wanda sunansa shine sunan gama gari na takardar shaidar abokin ciniki kuma saka prefix ɗin a ciki.
Ga reshe wanda LAN ɗinsa 10.20.0.0/24 ne kuma sunan gama gari na takardar shaida branch-router ne, fayil ɗin da ke wannan hanyar yana ɗauke da layi kamar iroute 10.20.0.0 255.255.255.0. Babban daidaitawa yana buƙatar zaɓin babban fayil kawai; prefix ɗin yana zaune tare da abokin ciniki.
Sunan gama gari shine ɓangaren da ke da rauni. Takardar shaida da aka bayar da wani subject daban, ko tsarin da ke tabbatar da masu amfani da sunan mai amfani yayin da fayil ɗin aka masa suna bisa takardar shaidar, yana samar da fayil da ba a taɓa karantawa ba. Duba sunan da uwar garke take bayarwa a zahiri ga zaman, kuma yi la'akari da zaɓin da ke sa abokin ciniki mara daidaito ya kasa maimakon ya haɗa a shiru ba tare da hanyoyinsa ba. Sake sunan fayil ɗin don ya dace da takardar shaidar gyara ne na minti biyar da ke hana wani maraice mai tsawo sosai.
Abokin ciniki ɗaya na iya mallakar prefix da yawa. Ƙara layin iroute ɗaya ga kowace cibiyar sadarwa, kuma ajiye jerin kusa da sauran saitunan wannan abokin ciniki domin haɗin ya kasance mai iya dubawa.
Gina hanyar dawowa a ɓangarorin biyu
Isar da fakiti zuwa LAN mai nisa rabin aikin ne. Dole abokin ciniki ya kuma aika zirga-zirgar wannan LAN cikin tunnel ɗin, wanda yawanci ana yi ta hanyar tura hanya zuwa ga abokin ciniki: layi kamar push "route 10.8.0.0 255.255.255.0" yana gaya wa kowane abokin ciniki yadda zai isa cibiyar sadarwar ɓangaren uwar garke. Ga reshen, hanyar da ta dace tana nufin tunnel ɗin ga duk abin da ya kamata ya isa a ɓangaren uwar garke.
Hanyar dawowa tana buƙatar mai shi a ɓangaren nesa. A wannan ɓangaren, dole wani ya san hanyar dawowa: hanyar tsaye a kan na'urar turawa ta LAN da ke nuna tafkin VPN zuwa uwar garke, ko fassarar adireshi a kan uwar garke kafin zirga-zirga ta shiga LAN. Hanyar tsaye tana kiyaye adireshin asali a bayyane a cikin rajista da ka'idojin shiga amma tana buƙatar haɗin gwiwar mai LAN; fassarar tana da kanta amma tana ɓoye wanda ya haɗa da gaske.
Dole a kunna turawa a kan uwar garke. Ba tare da shi ba kernel yana karɓar fakiti daga tunnel ɗin kuma ya ƙi wuce shi zuwa interface ɗin LAN, wanda daga ganin abokin ciniki ya yi kama da iroute da ya ɓace.
Tabbatar da isa da bincike masu dacewa
Gwada a matakai maimakon ping ɗin ƙarshen nesa da yin hasashe. Daga uwar garke, duba cewa haɗin ciki na prefix ɗin yana nan kuma hanyar kernel tana nufin tunnel ɗin. Daga abokin ciniki, tabbatar cewa an shigar da hanyar da aka tura kuma hanyarsa ta asali ga adireshin LAN ita ce tunnel.
Sannan kalli fakiti. Ɗaukar hoto a interface ɗin tunnel yana nuna ko uwar garke tana aikawa zuwa ga abokin ciniki, kuma ɗaukar hoto a interface ɗin LAN yana nuna ko tana turawa. Idan na farko ya nuna fakiti na biyu bai nuna komai ba, turawa ko tacewa ce matsalar; idan duka ba su nuna komai ba, binciken ya kasa tun da farko.
Uwargida biyu da tunnel ya haɗa suna maimaita wannan dokar a ɓangarorin biyu: kowace tana buƙatar iroute don tafkin ɗayan, kuma kowace tana buƙatar hanyar da turawar da ke sa hanya ta zama daidaitacciya. Turawa da manufa abubuwa ne daban a nan. Turawa tana yanke shawarar inda fakiti zai iya zuwa, yayin da dokar FORWARD ke yanke shawarar ko an yarda, don haka abokin ciniki mai layukan iroute biyu zai iya isa ga prefix ɗin biyu sai dai idan tacewa ta ce akasin haka.