VPN-ka Mac waa xiran yahay laakiin ip-up waligiis ma shaqayn: kici ilaalin launchd

Waxaad amar route gelisaa /etc/ppp/ip-up, dib u xirtaa tunnel-ka xafiiska, faylka waligiis ma shaqeeyo. Skriptiga wax qaldan kuma jiro: xiriirkaas gudbi maayo PPP. Macaamiisha gudaha Cisco IPSec iyo IKEv2 waligood ma bilaabaan pppd, sidaas darteed galka hooqka waligiis lama akhriyo, halka PPTP iyo L2TP oo IPSec kor mara ay weli maraan. Go’aanso kiiska aad haysato, ka dibna kici kiiska aan PPP ahayn shaqada ilaalinta launchd.

Hubi interface-ka ka hor intaadan wax ka beddelin hooq kasta

Laba amar ayaa go’aamiya habka shaqayn kara. Liis adeegyada la habeeyay, ka dibna liis interface-yada jira inta tunnel-ku shaqaynayo. Magaca interface-ka waa caddaynta; calaamada System Settings ma aha.

scutil --nc list
ifconfig -l | tr ' ' '\n' | grep -E '^(utun|ppp)[0-9]+$'

Adeeg soo saara ppp0 waxay maamushaa hooqyada PPP oo waxay fulin doontaa faylkaaga. Adeegga Cisco IPSec ama IKEv2 wuxuu beddelkiisa soo saaraa qalab utun, interface tunnel oo aan lahayn lakab PPP, sidaas darteed wax ku jira /etc/ppp ma gaari karo. Marka labada nooc ay muuqdaan, hubi adeegga aad ku xirtay. Dadku waxay lumiyaan galab hooq khaldan iyagoo akhrinaya magaca macmiilka.

Jidka PPP faylku waa inuu lahaadaa milkiilaha root oo uu noqdaa mid la fulin karo, maxaa yeelay pppd labadaba wuu hubiyaa ka hor inta uusan wax fulin. install hal tallaabo ayuu dhigaa milkiilaha iyo habka.

sudo install -o root -g wheel -m 0755 /dev/null /etc/ppp/ip-up
sudo ls -l /etc/ppp/ip-up

Fayl lagu abuuray Finder ama tifaftire garaaf ayaa inta badan ku dhamaadaa milkiilaha akoonkaaga, ama ma laha bit-ka fulinta, ka dibna si aamusan ayuu u guuldareystaa sida hooqka maqan. Hadda dhinacyadiisa dhig ip-down. Milkiilaha tiirka root iyo wheel oo lagu daray habka tiirka rwxr-xr-x waa waxa aad rabto.

U ogolow launchd inuu kiciyo skriptiga marka tunnel soo baxo

Macaamiisha aan waligood taaban PPP, kiciyaha waa inuu ka yimaado meel kale, iyo kaydka habaynta nidaamka waa isha daacadda ah: macOS wuu dib u qoraa mar kasta oo tunnel-ku is beddelo. Shaqada launchd ee ilaalinaysa galkaas waa la wacaa marka tunnel soo baxo ama uu libdho.

<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0">
<dict>
  <key>WatchPaths</key>
  <array><string>/Library/Preferences/SystemConfiguration</string></array>
  <key>Label</key><string>net.example.tunnel-watch</string>
  <key>ProgramArguments</key>
  <array><string>/bin/sh</string><string>/usr/local/sbin/tunnel-hook</string></array>
  <key>RunAtLoad</key><true/>
  <key>ThrottleInterval</key><integer>20</integer>
</dict>
</plist>

Ku rakib sidii launch daemon, ma aha wakiilka isticmaale kasta, maxaa yeelay hagaajinta waddooyinka waa mishiinka. bootstrap wuxuu beddelaa qaabka hore load -w ee noocyada hadda jira. RunAtLoad wuxuu ka dhigaa fulinta koowaad mid la arki karo, ThrottleInterval waxay ka hortagtaa in mawjadda isbeddelada isku xirka Wi-Fi ay skriptiga si isdaba joog ah u kiciso.

sudo install -o root -g wheel -m 0644 tunnel-watch.plist \
  /Library/LaunchDaemons/net.example.tunnel-watch.plist
sudo launchctl bootstrap system \
  /Library/LaunchDaemons/net.example.tunnel-watch.plist

Dabinku waa in galka la ilaalinayo uu is beddelo xitaa dhacdooyin aan wax xiriir ah la lahayn VPN-kaaga: isku xirka Wi-Fi, cusboonaysiinta DHCP, fiil la geliyo. Ilaaliyaha hoose wuxuu kiciyaha buuqa leh ka dhigaa hooq la isticmaali karo, khadka log-ka wuxuu sharraxaa waddo saacad qariib ah.

Milkiilaha wuxuu daboolaa plist iyo sidoo kale skriptiga. Daemon fuliya fayl ku jira gal akoonkaaga uu wax ku qori karo wuxuu akoonkaas siiyaa root.

Ilaali skriptiga si fulinta labaad waxna uusan u beddelin

Skriptigu marka hore wuxuu go’aamiyaa in tunnel-ku jiro, haddii uusan jirin si aamusan ayuu u baxaa. Wax kasta oo ka dambeeya waa inuu badbaado u noqdaa soo-celinta, maxaa yeelay kiciyaha wuxuu shaqeeyaa marar badan oo ka badan hal xiriir. Xalliso interface-ka waqtiga fulinta halkii aad adkayn ku qori lahayd index is beddela xiriirka xiga.

#!/bin/sh
set -u
TUN=$(ifconfig -l | tr ' ' '\n' | grep -m1 '^utun[0-9]' || true)
[ -n "$TUN" ] || exit 0
netstat -rn -f inet | grep -q '^10\.42' && exit 0
route -n add -net 10.42.0.0/16 -interface "$TUN"

route add wuxuu ku baxaa xaalad aan eber ahayn marka waddadu hore u jirto, sidaas darteed skriptiga u qaata xaalad kasta oo aan eber ahayn inay tahay guuldarro wuxuu soo sheegaa hooq jabay mar kasta oo uu sameeyo waxa saxda ah. Imtixaanka netstat ee sare wuxuu kiiskaas ka dhigaa no-op cad.

Joogitaanka interface-ka waa caddayn ka daciif ah inta la arko, maxaa yeelay macaamiisha kale ee VPN iyo qaar ka mid ah deegaannada weelasha waxay sidoo kale abuuraan qalab utun. Weyddii adeegga laftiisa scutil --nc status "Office VPN" oo dalbo xaaladda xiran ka hor intaadan taaban waddooyinka. Jawabta ku hay khadka log-ka, maxaa yeelay toddobaad kadib diiwaankaas waa sharraxaadda kaliya ee aad haysato.

Soo celi albaabka adigoon jebin DNS

Marka tunnel-ku qaato waddada caadiga ah, baaritaanka caadiga ah wuxuu ka baxaa xafiiska oo jidka internetka maxalliga ah wuu joogsadaa. Marka hore qabso router-ka interface-ka jirka, ka dibna u jeedi caadiga ah dib ugu noqo isaga. DHCP wuu ka fiican yahay falanqaynta shax aan hore u hayo caadiga tunnel-ka laftiisa.

PHYS=en0
GW=$(ipconfig getoption "$PHYS" router)
[ -n "$GW" ] && sudo route -n change default "$GW"

Xalliyeyaashu waa lakab gaar ah oo leh qalab gaar ah, hagaajinta waddada ma hagaajiso iyaga. Fiiri scutil --dns waxa dhaqan gal ah, ka dibna hagaaji waxa soo saara: nidaamka adeegyada iyo gelitaanka DNS ee adeegga jirka. Nadiifinta kaydka waxay baartaa raadin xanniban kadib isbeddel shabakad; ma aha wax la qorsheeyo.

Tunnel ka badbaada isbeddelka Wi-Fi halka DNS istaago waa cillad saddexaad: sudo killall -HUP mDNSResponder wuxuu xalliyaha ka dhigaa inuu dib u akhriyo habayntiisa. Isticmaal hal mar, gacan.

Caddee in shaqadu iyada is kiciso

Ku qasab hal orod kickstart -k ka hor intaadan aaminin jidka ilaalinta, ka dibna akhri xaaladda bixista ee shaqadu diiwaangelisay. Bixitaan nadiif ah wuxuu caddeeyaa in skriptigu shaqeeyo; ma caddeeyo in kiciyuhu shaqeeyo. Ka dib jar oo dib u xir adigoo shaqada raran, oo fiiri orod aadan codsan.

sudo launchctl kickstart -k system/net.example.tunnel-watch
sudo launchctl print system/net.example.tunnel-watch | grep -E 'last exit code|state ='

Hubi scutil --nc status ka hor iyo kadib isku day kasta. Skript ku shaqeeyay inta tunnel-ku hoos jiray waxba ma caddeeyo jidka xiriirka.

Laanta duminta waxay mudan tahay daaweyn la mid ah laanta xiriirka: gacan ku qaad waddada, u ogolow shaqada inay socoto, oo xaqiiji inay soo noqoto. Hooq waddo ku dara oo waligiis tirtirin wuxuu ka tagaa mishiin toddobaad kadib si xun u dhaqma, iyadoo aan waxba isku xirin labada dhacdo. Marka labada dabeecad ay taagan yihiin, sudo launchctl bootout system/net.example.tunnel-watch shaqada si nadiif ah ayuu u hawlgeliyaa. Daemon ilaalin oo raran oo la dayacay waa jidka uu hagaajin hal-mar ah bilo kadib u noqdo waddo aan la sharraxin.