Soo-dejinta NetworkManager way guuldareysataa faylasha OpenVPN iyo WireGuard

Waxaan doortay Ka soo dejiso fayl… ee Dejinta GNOME, waxaan doortay borofiil la shaqeeya macmiilka bixiyaha, wuuna xirmay wada-hadalka isagoo aan wax ku darin liiska. Laptop labaad, soo-dejintu waa dhammaatay, isku xirku wuxuu u muuqday magaca borofiilka, ka dibna wuu ku guuldareystay codsiga xaqiijinta koowaad. NetworkManager waligiis ma fuliyo faylkaaga .ovpn ama wg-quick sidii uu yahay. Wuxuu faylka u gudbiyaa falanqeeye, falanqeeyuhu wuxuu u beddelaa qaabka isku xirka NetworkManager, wixii ka dambeeyana tunnel-ka waxaa laga dhisaa shaygaas la falanqeeyay — sirta, waddooyinka, DNS iyo wax walba. Marka su'aasha waxtarka leh ma aha sababta faylku u xun yahay, laakiin haddii falanqayntu dhacday iyo waxa ay hayso.

Waxa soo-dejintu dhab ahaan ku sameyso faylka

Xagga OpenVPN, falanqeeyuhu wuxuu ku nool yahay baakadda plugin-ka, isku xirka uu abuurana wuxuu tilmaamaa adeeg D-Bus sida org.freedesktop.NetworkManager.openvpn. Plugin la'aan, falanqeeye la'aan: nooca nmcli ma yaqaan, liiska garaafka ee lagu daro VPN-na waxaa laga yaabaa inuusan waligiis tusin gelitaanka soo-dejinta. WireGuard waxay ku kala duwan tahay hal qodob oo muhiim ah — NetworkManager waxay leedahay dejinta WireGuard u gaar ah tan iyo taxanaha 1.30, sidaas darteed ma jiro baakad plugin gooni ah, laakiin akhristaha wg-quick wuxuu ku jiraa oo kaliya buildyada soo saara.

Si kasta oo ay tahay, faylka mar qudha ayaa la akhriyaa. Natiijada waxaa loo qoraa keyfile ahaan /etc/NetworkManager/system-connections/ hoostiisa, oo loogu magacaabo isku xirka, waxaa iska leh root oo dadka kale ma akhriyi karaan sababtoo ah waxaa ku jira maaddada furaha. Keyfile-kaas hadda waa isku xirka; tafatirka asalka .ovpn dabadeed waxba ma beddelo.

Saddex calaamadood waxay ka tirsan yihiin saddex marxaladood oo kala duwan. Maqnaanshaha gelitaanka soo-dejinta ama nooc aan la aqoon waxay ka dhigan tahay in plugin-ka ama nooca maqan yahay. Khalad soo-dejin oo magacaaya tilmaame waxay ka dhigan tahay in falanqeeyuhu akhriyay faylka oo uu diiday qayb ka mid ah. Isku xir jira laakiin aan waligiis firfircoonaan waxay ka dhigan tahay in shayga la falanqeeyay uu aan buuxin ama server-ku uu diidayaa. Go'aanso saddexda kiis midkaa aad leedahay ka hor intaadan wax tafatirin.

Xaqiiji plugin-ka ka hor intaadan borofiilka cilad-baarin

Plugin maqan wuxuu u eg yahay si sax ah borofiil xun, sidaas darteed marka hore hubi baakadda. Debian iyo Ubuntu, taageerada OpenVPN waxay timaadaa network-manager-openvpn iyo caawiye desktop ah; Fedora baakadaha waa NetworkManager-openvpn iyo NetworkManager-openvpn-gnome; Arch waa networkmanager-openvpn.

dpkg -l network-manager-openvpn-gnome | tail -n 2
rpm -q NetworkManager-openvpn
pacman -Q networkmanager-openvpn

Kadib ka soo dejiso waddo buuxda: nmcli connection import type openvpn file /home/you/profile.ovpn. Waddooyinka qaraabada ah badanaa way shaqeeyaan, laakiin shell beddelay galka ayaa soo-dejin degdeg ah u beddela waddo dheer. WireGuard, hubi nmcli --version oo xaqiiji in dhinaca kernel uu jiro modprobe wireguard; soo-dejin ku guuleysata mishiin aan modul lahayn waxay kaa tagtaa isku xirka aaladdiisa waligiis soo muuqanayn. tixraaca nmcli waxay diiwaangelisaa amarka hoose ee import iyo magacyada nooca la aqbalay. Haddii type wireguard si toos ah loo diido, build-ku wuu ka duwan yahay muuqaalkan, tallaabada saxda ahna waa baakad qaybin ama backport — ma aha in konfigurashka lagu koobiyeeyo galka aan loo baahnayn iyadoo la rajaynayo in wax uu akhriyo.

Akhri isku xirka OpenVPN, ma aha .ovpn

Marka isku xirku jiro, akhri dejinta la falanqeeyay halkii aad dib u akhri lahayd faylka: nmcli connection show "Work VPN" | grep -E '^vpn\.'. Waxaad rabtaa remote iyo dekedda, gaadiidka, maaddada aqoonsiga — ca, cert, key, tls-auth ama tls-crypt — iyo habka xaqiijinta. Borofiil leh furaha sirta ah ee gaarka ah, ku dar sudo nmcli --show-secrets connection show "Work VPN" oo eeg secret flags: 0 waa none, marka sirta waxay ku jirtaa keyfile; 1 waa agent-owned; 2 waa not-saved, taas oo macnaheedu yahay waligeed lama qoro keyfile; 4 waa not-required, taas oo macnaheedu yahay sir looma baahna gabi ahaanba. Waa bits, ma aha miisaan, sidaas darteed 3 waa si fudud agent-owned iyo not-saved. Sir hal mar kasta oo fadhi la weydiiyo waa agent-owned (1), iyadoo agent-ku codsanayo; ma jiro lambar calan gaar ah oo taas ah. Khilaafka calanka waa sababta caadiga ah ee borofiilku uga xirto applet-ka desktop-ka oo ugu guuldareysto script ama boot.

Habka ugu dhaqsiyaha badan ee lagu arko waxa falanqeeyuhu tuuray waa in la weydiisto plugin-ka inuu faylka dib u qoro kadibna la barbardhigo: nmcli connection export "Work VPN" /tmp/roundtrip.ovpn. Tilmaamayaasha ku lumiya diff-kaas ma jiri doonaan waqtiga xiritaanka. Hook-yada waa tuhmanayaasha caadiga ah — script-security, up, down iyo route-up waxay filayaan script lagu socodsiiyay awood sare oo si ula kac ah looma gudbiyo. Ha hoos u dhigin xaqiijinta oo ha siin mudnaan dheeraad ah si soo-dejintu u guuleysato; ikhtiyaar aan la taageerin badanaa wuxuu ka tarjumaa jaantuska plugin-ka ee aan ahayn server aan la gaari karin. U rar habdhaqankaas script dispatcher NetworkManager ama siyaasad dhinaca server-ka.

Sidoo kale xaqiiji in beeraha aqoonsiga ay ku noolaayeen: tixraaca CA, remote-cert-tls iyo wax kasta oo hubin magac ah oo borofiilku ku tiirsanaa. Isku xirka soo baxa iyada oo aan lahayn waxay laga yaabaa inuu la hadlayo wax kasta oo ka jawaaba ciwaankaas.

Akhri isku xirka WireGuard, ma aha faylka wg-quick

Faylka wg-quick waa qaab leh macne shell; isku xirka la soo dejiyay waa jaantus dejinta. PrivateKey wuxuu noqdaa furaha gaarka ah ee interface-ka, Address wuxuu noqdaa hal ama in ka badan ciwaanno IPv4 iyo IPv6, DNS waxaa lagu sawiraa sifooyinka resolver ee NetworkManager, MTU waxaa lagu sawiraa wireguard.mtu (qaabka caadiga ah ee wg-quick laftiisu waa 1420), block kasta oo peer-na wuxuu noqdaa gelitaan peer leh fure dadweyne, endpoint, IP la oggol yahay iyo persistent keepalive. Daabac waxa la kaydiyay nmcli --show-secrets connection show wg0; haddii liiska peer-ku uusan ka muuqan wax soo saarkaas, akhri keyfile:

sudo sed -n '/^\[wireguard\]/,/^\[/p' /etc/NetworkManager/system-connections/wg0.nmconnection

Waxa aan sii noolaan waa qaybta shell ee wg-quick. PreUp, PostUp, PreDown, PostDown iyo Table waa habdhaqanka qalabkaas, ma aha sifooyinka interface WireGuard, sidaas darteed waxba ma fuliyaan ka dib soo-dejin. Haddii asalku isticmaalay Table = off si uu uga tago waddada caadiga ah, sii-dejinta NetworkManager ee dhowaan waxay soo bandhigaan ip4-auto-default-route iyo ip6-auto-default-route isla ujeedkaas; si cad u dhig iyaga halkii aad ka malayn lahayd in isku xirku u dhaqmo sida script-ka. Hook riixay waddo gaar ah wuxuu u baahan yahay waddadaas dejinta waddooyinka isku xirka, haddii kale si fudud way maqnayn doontaa.

Si isku xirka hal milkiile oo sax ah

Guuldarada caadiga ah ee xigta waa isku xir shaqeeya ilaa boot-ka xiga kadibna loop galo. Badanaa [email protected] ayaa wali shaqeynayay tijaabo hore, ama macmiil bixiye ayaa bilaabay daemon u gaar ah, iyo laba milkiile ayaa qorayay waddooyin iyo DNS isla meesha. NetworkManager wuxuu dejizaa resolver waddadiisa, wg-quick wuxuu wax ku qoraa resolvconf, waxaana guuleysta kan ugu dambeeya qora — sidaas darteed xallinta magacyada way shaqaysaa, kadib way istaagtaa, kadib mar kale way shaqaysaa. Hubi systemctl status wg-quick@wg0, nmcli connection show --active iyo ip link show type wireguard, kadibna jooji milkiilaha labaad halkii aad hagaajin lahayd metric-kiisa.

Haddii aad runtii u baahan tahay labadaba, sii interface gooni ah iyo IP la oggol yahay oo aan is gelin, oo u oggolow mid qudha inuu rakibo waddada caadiga ah. Laba waddo caadi ah oo metric kala duwan ma aha split tunnel; waa tartan uu go'aamiyo adeegga labaad bilaabma. Iyo ka dib dib u xirid, mar kale baadh xaaladda la dabaqay — tafatir gacan ah oo hal mar ah oo resolver-ka ah oo wax walba shaqeeya ma aha caddayn in soo-dejintu dhamaystiran tahay.

Ku xaqiiji taraafikada oo ka badbaado dib u bilow

Kor u qaad isku xirka nmcli connection up "Work VPN", kadibna akhri xaaladda, ciwaanka iyo waddooyinka halkii aad aamin lahayd calaamadda: nmcli device show wg0 | grep -E 'GENERAL.STATE|IP4.ADDRESS|IP4.ROUTE', ip route show default iyo weydiin dhab ah oo magac ku xallima tunnel-ka gudihiisa oo keliya. Handshake ama ping guuleystay waxay caddeynayaan oo keliya in sir-garayntu shaqeyso; wax ma sheegto ku saabsan gudbinta, horgalayaasha split tunnel ama DNS gaar ah, kuwaas oo ah qaybaha badanaa jabaa.

Kadib dib u bilow oo ku celi. Habdhaqanka autoconnect, interface magac beddelay iyo plugin ka dambeeya aaladda ayaa dhammaantood ah guuldarrooyin aad ku aragto oo keliya bilow nadiif ah. journalctl -u NetworkManager -b --no-pager | tail -n 40 wuxuu muujinayaa waxa daemon-ku sameeyay isku xirkan bilowgan. Kombiyuutar labaad, koobi keyfile-ka oo ku hay milkiilaha root iyo mode 600, ama isticmaal nmcli connection export OpenVPN oo dib u soo deji .ovpn ka soo baxa — waddada dhoofinta ma laha wax u dhigma WireGuard, sidaas darteed jihadaas waa koobi fayl ama soo-dejin cusub oo ka timid asalka la ilaaliyay.

Nooca gaaban, si kala horreysan: xaqiiji plugin-ka ama nooca NetworkManager, ka soo deji waddo buuxda, akhri dejinta la falanqeeyay oo ay ku jiraan secret flags, barbardhig dhoofinta OpenVPN iyo asalka, hubi hook-yada iyo waddooyinka dhinaca WireGuard, jooji milkiile kasta oo labaad, kadibna ka dib dib u bilow xaqiiji xallinta magaca iyo shaxda waddooyinka. Marka isku xirku dhammaan ka gudbo, faylka borofiilka ee bilaabay wuu ku noqon karaa kaydka la ilaaliyay.