OpenVPN ee Android ma daro waddo la aanta cinwaanka tunnel

Barnaamijkaaga OpenVPN ee Android ma daro waddo sababtoo ah telefoonku cinwaan kama haysto interface-ka mala-awaalka ah, sidaas darteed ma jiro wax waddadu tilmaami karto. Waddooyinku waxay kaliya ka jawaabaan halka baakaduhu ay tagaan. Cinwaanka tunnel-ku wuxuu ka jawaabaa qofka telefoonku yahay gudaha tunnel-ka, macmiilkuna waa inuu bixiyaa mid ka hor inta interface-ku uusan dhalan karin. Mara afarta hubin ee hoose si taxane ah oo jooji guuldarada ugu horeysa, sababtoo ah waddooyinka wax ka beddelka ka hor inta cinwaanku jirin wuxuu qariyaa dhibaatada dhabta ah.

Akhri guuldarada sida uu macmiilku u fuliyo

VpnService.Builder ee Android wuxuu labada fikradood kala saaraa: addAddress() wuxuu cinwaan dhigaa interface-ka ay app-ku dhisayso, addRoute() wuxuu ku daraa prefix-ka goobta, establish() wuu diidaa inuu abuuro interface-ka ilaa ugu yaraan hal cinwaan lagu daro. Macmiilka OpenVPN wuxuu barnaamijka iyo xulashooyinka server-ku soo diro si sax ah ugu xiraa isla wicitaannadaas, sidaas darteed xiriir aan waligiis falanqayn cinwaan ma dhisi karo interface-ka gabi ahaanba.

Taas ayaa sabab u ah in xariiqda log-ga aad akhrinayso ay sheegto waddo iyadoo sababtu hal tallaabo ka horreyso. Macmiilku wuxuu gaaraa marxaladda waddada kaliya ka dib marka interface-ku jiro; cinwaan la aan, wicitaanka waddadu isla markiiba guuldarraystaa ama waligiis ma socdo. Marka log-ku yiraahdo ma dari karo waddo, ka bilow cinwaanka ee ha ka bilownin qaabka waddada.

Hubin 1: miyuu server-ku jawaabta ku darayaa cinwaan?

Adeeg OpenVPN oo waddo leh, cinwaanku wuxuu ka yimaadaa barkada server-ka ama qoondaynta macmiil kasta, qaabkiisana topology ayaa go'aamiya. Server OpenVPN 2.4 ama ka cusub, adeeg leh topology subnet wuxuu u eg yahay sidan:

topology subnet
server 10.8.0.0 255.255.255.0
client-config-dir ccd

Qaabkaas server-ku wuxuu soo dirayaa wax lamid ah ifconfig 10.8.0.6 255.255.255.0. Rakibaad hore oo topology net30 ah wuxuu soo dirayaa cinwaanka lammaanaha, tusaale ahaan ifconfig 10.8.0.6 10.8.0.5, sidaas darteed barnaamij la guuriyay inta u dhaxaysa labada qaab wuxuu u ekaan karaa mid sax ah isagoo qaadanaya maaskaro shabakadeed khaldan.

Ka raadi log-ga xiriirka macmiilka kooxda xulashooyinka la soo diray. Haddii aanu lahayn xitaa hal xariiq oo ifconfig, server-ku waligiis ma dirin cinwaan ama macmiilku wuu diiday xulashada. Server-ka isticmaala client-config-dir, faylka lagu magacaabay common name-ka shahaadada waa inuu jiraa oo uu qaataa qoondaynta:

# ccd/phone-anna
ifconfig-push 10.8.0.6 255.255.255.0

Hubin 2: miyuu macmiilku hayaa cinwaanka la siiyay?

Filteer aad u ballaaran ayaa ah sababta labaad ee caadiga ah. pull-filter wuxuu ku jiraa OpenVPN 2.4 iyo ka cusub, marka dhowr filteer ay la mid noqdaan hal xulasho kan ugu dambeeya ee iswaafaqa ayaa guuleysta, sidaas darteed catch-all ku yaal dhammaadka wuxuu cinwaanka u ridaa isagoon khalad lahayn:

# removes every pushed option, including the address
pull-filter ignore "ifconfig"
pull-filter ignore "route"

Cidhiidhi filteerka ilaa xulashada aad runtii rabto inaad ka takhalusto oo cinwaanka iska daa:

# keeps the pushed address, drops one unwanted LAN route
pull-filter ignore "route 10.60.0.0"

Talo ah in la damiyo dhammaan pull-yada badanaa waxay ka timaaddaa qof rabo inuu ka takhalusto hal waddo oo keliya. route-nopull waa dhagsiga cidhiidhsan: wuxuu hayaa ifconfig iyo xulashooyinka kale ee la soo diray isagoo diidaya waddooyinka la soo diray iyo xulashooyinka nooca DHCP. Isticmaal marka taasi runtii tahay waxa aad rabto, oo su'aasha cinwaanka si gooni ah uga jawaab.

Hubin 3: cinwaanku ma adigaa qoraa?

Cinwaan-gacmeedka gacanta waa xaq marka hawlgalku uu adiga kuu dhiibo qiimaha. Haddii aad adigu qorto mid, waa inuu ka yimaadaa subnet-ka macmiilka VPN, uu gaar ku yahay fadhiyada firfircoon oo uu la jaanqaado topology-ga server-ku socodsiiyo. Koobiga cinwaanka buundada desktop ama martigeliyaha LAN-ka fog wuu ku guuldarraystaa labada dhinac: telefoonku wuxuu sheeganayaa cinwaan horey ugu jira meel kale, iyo albaabka ma lahaan doono waddo ku noqota.

Prefix-ka LAN-ka fog ee waddada waa goob, waligiis ma aha aqoonsiga telefoonka. Waddada 10.60.0.0/24 waxay tidhaahdaa gaar shabakadaas iyada oo loo marayo tunnel-ka; wax kama sheegayso cinwaanka 10.60.0.x ee telefoonku yeelan lahaa, telefoonkuna waa inuusan yeelan midkoodna. Qoondaynta joogtada ah waxay ka tirsan tahay dhinaca server-ka, halkaas oo aysan kula dhici karin barkada dhaqaaqa.

Laba fadhi oo hal aqoonsi ah waxay daaha ka qaadaan isku dhac la mid ah. Haddii isla shahaadada ay laba jeer isku xirto oo server-ku labadaba u soo diro hal cinwaan go'an, fadhiga labaad wuxuu nuqul ka sameeyaa kii hore, xalkuna waa aqoonsiyo gooni ah ama qoondayn gooni ah ee ma aha wax ka beddel dhinaca macmiilka.

Hubin 4: ma wax kale ayaa haysta booska tunnel-ka?

Android wuxuu oggolaanayaa hal adeeg VPN oo firfircoon mar kasta. App VPN kale, ama gelitaanka VPN had iyo jeer-shaqaynaya oo loo dayay barnaamij aan shaqaynayn, ayaa qaadan kara booskaas ka hor inta macmiilkaaga OpenVPN uusan wicin establish(). Markaas interface-ku waligiis ma soo baxo inkastoo barnaamijku ansax yahay, sidaas darteed jar VPN-ka kale, dami dejinta had iyo jeer-shaqaynaya oo dib u xiriir ka hor inta aadan taaban barnaamijka.

Adeeg ku adkaysta buundada Ethernet waa dariiqa kale ee xiran. App Android oo aan root lahayn wuxuu abuuri karaa tunnel IP, ma aha qayb Ethernet la buundaysiiyay, sidaas darteed cinwaan kasta oo aad qorto ma shaqeyn doono server dev tap; hawlgalku waa inuu bixiyaa adeeg waddo leh. Marka aad soo sheegto dhibaatada, ku dar magaca macmiilka iyo nooca, kooxda xulashooyinka la soo diray, topology-ga iyo tallaabada saxda ah ee cinwaanku ku muuqan lahaa.

Haddii afarta hubin ay gudbaan oo cinwaanku jiro, gaar yahay oo si sax ah loo daboolay, su'aasha waddadu waxay noqotaa tan caadiga ah: prefix-yada server-ku oggol yahay iyo sida macmiilku u xaddido. Qor cinwaanka tunnel-ka, maaskaro shabakadeedka iyo topology-ga ka hor inta aadan wax kale beddelin, sababtoo ah saddexdaas qiime ayaa hawlgalku u baahan yahay inuu la barbardhigo aragtida server-ka.