Hal Pi, laba OpenVPN oo kala duwan: waxa ay qayb kastaa akhrido
Laba daemon OpenVPN oo hal Pi ku jira ayaa akhriya faylal jaangooyo oo kala duwan oo ka soo baxa shaqooyin kala duwan. Sawir istans kasta, kadib si gooni ah u tijaabi wadada xamuulka.
Tiri howlaha OpenVPN ka hor inta aadan taaban profile. Pi qaata isticmaalayaasha roaming oo sidoo kale waca adeeg sare wuxuu ordiyaa laba daemon, mid kastaa wuxuu akhriyaa fayl jaangooyo oo lagu doortay magaca istans ee aad qortay. Template-yada xirmada ayaa markaas siinaya daemon kasta galkiisa shaqo, faylkiisa xaaladda orodka iyo qalabkiisa tunnel. Haddii aad qaybtan khalad ka dhigto, waxaad habeen ku qaadan doontaa beddelka dejinta saxda ah ee faylka uu howlaha socda waligii aan furin.
Magac kasta oo istans wuxuu doortaa faylkiisa
Faylalka unugga ee la socda OpenVPN 2.6, doodaha bilowga waxay wataan meel-bannaan istans oo lagu buuxiyo qoraalka ka dambeeya calaamadda @. Template-ka server-ka wuxuu ka shaqeeyaa galka jaangooyada server-ka oo dooddiisa ku xalliyaa %i.conf ee halkaas, halka template-ka macmiilku isla waxaas ka sameeyo galka macmiilka. Sidaas darteed [email protected] wuxuu akhriyaa admits.conf galka server-ka, [email protected] wuxuu akhriyaa uplink.conf galka macmiilka, mana jirto mid ka mid ah magacyadaas oo macne ku leh galka kale.
Xaqiiji khariidadda mishiinka dushiisa halkii aad ka malayn lahayd in xirmadu hayso qiimayaasha caadiga ah. Drop-in-ka qaybinta wuxuu si buuxda u beddeli karaa galka shaqada ama doodda jaangooyada.
systemctl cat [email protected]
systemctl cat [email protected]Akhri sadarka WorkingDirectory iyo doodda jaangooyada ee soo-saarkaas, sababtoo ah unugga daaran kaliya ayaa go'aamiya faylka la rarto. Drop-in ku daraya --config ExecStart wuxuu ka guuleystaa template-ka xitaa marka jidka template-ku u eg yahay mid sax ah. Weydii jidadka fragment-ka iyo drop-in-ka marka aad rabto inaad ogaato haddii beddelaad maxalli ah jiro. Haddii labada doorba ay ku xallimaan hal fayl, waxaad haysataa hal howle oo isku dayaysa inuu noqdo server iyo macmiil labadaba, oo doorashada dambe ee faylkaas si aamusan ayay guuleysataa.
Gaadiidka maxalliga ah iyo xamuulka la gudbiyay waxay ku dhacaan shaqooyin kala duwan
Xiriirka sirta ah ee server-ku la leeyahay isticmaaleye kasta oo roaming ah waxaa lagu abuurayaa Pi-ga laftiisa, sidaas darteed jawaabihiisa dibadda waxay ka soo baxaan shaqada wax-soo-saarka maxalliga ah. Xiriirka macmiilka uu la leeyahay lamaanihiisa sare sidoo kale waa wax-soo-saar maxalli ah lagu abuuray, in kastoo uu gaaro shabakad fog. Xamuulka la gudbiyo waa qaybta saddexaad, kernel-ku wuxuu isbarbardhigaa kaliya ka dib markii uu horey u doortay qalabka soo-baxa ee xirmada.
| Flow | Hook that sees it | What to inspect |
|---|---|---|
| Roaming user handshakes to the server | Local input and local output | Listener socket, bind address, rule admitting the UDP port |
| User payload leaving through the upstream tunnel | Forward | IPv4 forwarding switch, selected route, permission rule, any translation |
| Pi's own connection to the upstream peer | Local output | Underlay route to the provider endpoint, not the tunnel route |
Qaanuun ku habboon interface soo-baxa gudaha silsiladda forward wuxuu ogolaan karaa ama tuuri karaa xirmo uu marin-ku horey u qoondeeyay interface-kaas, laakiin waligiis ma doorto interface-ka. Marka hal marti-geliye dhammeeyo hal tunnel oo bilaabo mid kale, siyaasadda u dirta xamuulka isticmaalayaasha tunnel-ka sare iyo siyaasadda ilaalinaysa jawaabaha sirta ah ee Pi laftiisu waa laba go'aan oo kala duwan. Waxay si shil ah ugu soo degaan isla NIC jireed, taasina waa sababta loo khaldo.
Farqigaas wuxuu sharraxayaa guuldarro nus ah oo caadi ah. Isticmaalayaashu way xirmayaan, handshake-ku wuu dhammaadaa, haddana taraafikoodu wuxuu ka soo baxaa jid khaldan, sababtoo ah handshake-ku wuxuu ahaa mid maxalli ah, xamuulkuna forward, oo mid keliya oo labada ka mid ah ayaa la tijaabiyay.
Jid la soo dejisan ayaa liqi kara jawaabaha isticmaalayaashaada
Dejinta amniga profile-ka macmiilka ayaa go'aamisa waxa dhinaca sare ku riixi karo shaxda marin-ka ee Pi, oo dib-u-celin ballaaran waa doorashada marti-geliyaha laba-door ah ee shaqeeya u beddela mid jaban. Haddii jidka la riixay uu daboolo cinwaannada dadweynaha ee isticmaalayaasha roaming, jawaabaha server-ku u abuuro waxay raaci karaan jidka cusub oo galaan tunnel-ka sare halkii ay ka soo bixi lahaayeen underlay. Dadku waxay inta badan xaqiijiyaan in tunnel-ka bixiyeedu wali shaqeeyo oo halkaas ayay joogsadaan, sababtoo ah taraafikadaas waa gaadiidka tunnel-ka laftiisa oo sii socda inta wax kasta oo kale si khaldan u dhaqmayaan.
Siyaasadda ku saleysan isha ama mark ayaa ah habka labada qulqul loo kala duwan yahay. Doorashada mark ee Linux ee OpenVPN waxay calaamadiso xirmooyinka sirta ah ee daemon-ka calaamad firewall, oo qaanuunka marin-ku markaas u diri karo shax gaar ah. Cinwaannada isha sidoo kale si la mid ah ayay u shaqeeyaan marka jawaabaha dibadda ee server-ku had iyo jeer ka soo baxaan hal cinwaan underlay. Labada habba waxay u baahan yihiin jidad ansax ah oo ku jira shaxda ay doortaan iyo ka-reebista endpoint-ka bixiyaha, haddii kale tunnel-ka laftiisu ma soo baxo.
Weydii kernel-ka jidka uu jawaabtu dhab ahaan qaadan lahayd ka hor inta aadan qorin wax qaanuun ah. Cinwaannada hoose waa meel-bannaan cinwaanka underlay ee Pi iyo cinwaanka dadweynaha ee hal isticmaale roaming ah.
ip rule show
ip route get 198.51.100.7 from 192.0.2.10Xaqiiji kala-qaybsanaanta, kadib jooji hal door markiiba
Saddexda qulqul si gooni ah u tijaabi, sababtoo ah handshake shaqeeya waxba kama caddeeyo labada kale. Aqbal xiriir cusub oo soo-gala, u dir hal codsi la ogolaaday bixitaanka sare, oo xaqiiji in labada howleba wali gaaraan lamaanayaashooda.
Kadib jooji doorka macmiilka oo fiiri waxa doorka server-ku hayo. Kani waa habka ugu jaban ee lagu helo qaanuun jid ama mark oo loogu talagalay hal istans lana adeegsaday labadaba.
systemctl stop [email protected]
systemctl status [email protected] --no-pager
ss -lunp | grep openvpn
journalctl -u [email protected] -n 20 --no-pagerWaxa aad rabto inaad aragto waa dhegeyste wali xidhan, qalabka tunnel-ku wali jira, iyo log-ga oo ka madhan khaladaad cusub inta doorka macmiilku xidhan yahay. Haddii joojinta macmiilka ay sidoo kale goyso jawaabaha server-ka ee isticmaalayaasha jira, labada door waxay wadaagaan wax ay ahayd in lagu xaddido mid ka mid ah. Qor istans kasta, fayl jaangooyo kasta iyo mulkiilaha qulqul kasta oo isbeddel kastaa taabtay, haddii kale qofka xiga ee debug-gaynaya martigeliyahan wuxuu isla helitaankaas ka celin doonaa eber.