Maxay OpenVPN u dhacdaa ka dib marka laptop-ku soo jeedo?

Hurdadu waxay dili kartaa fadhiga OpenVPN iyadoo ka tagaysa tun0. Tijaabi tunnel-ka, ka dibna dib u bilow unugga laga bilaabo hook-ga hurdo ee systemd, ma aha aaladda.

Jiifso makiinada, soo jeedi, ka dibna ka hor inta aadan taaban wax qaabeyn ah, saddex waxyaabood ku xaqiiji sidan: in tun0 weli jiro, in dariiqa cinwaan gudaha ah weli doorto, iyo in server-ku weli liis garaysto peer-kan. Aaladda hurdada ka badbaadda iyadoo dariiqu meel kale tilmaamayo waa hadhaag, ma aha tunnel. Marka dariiqu sax yahay oo gaadiidku wali dhinto, khaladku wuxuu ka sarreeyaa tunnel-ka oo dib u bilowga client-ka ma beddelo. Otomaatigga dib u bilowga wax macne leh kaliya ka dib marka tijaabo gacan ah ay muujiso saddexdan kiis kee ayaad haysataa.

ip -br address show tun0
ip route get 10.20.0.10
journalctl -u openvpn-client@office -b --no-pager | tail -30

Soo jeedka dib u soo saar ka hor inta aadan otomaatiggin

Hurdadu waxay badanaa dhamaysaa fadhiga sirta ah inta ay ka egtahay aaladda. Qulqulka UDP ee tunnel-ka nool ka dhigayay wuu istaagaa, server-ku wuu tuuri karaa peer-ka, client-kuna wuu ogaadaa oo dib u xirmaa ama wuxuu hayaa interface aan waxba ka dambeeyn. Kalin baaritaanka interface-ku wax yar ayuu caddeeyaa, sababtoo ah aalad duug ah waxay u eg tahay sida mid shaqaynaya ilaa baakaduhu ay dhex maraan. Orod raadinta dariiqa iyo hal codsi dhab ah oo tunnel-ka dhex mara, ka dibna akhri joornaalka agagaarka daqiiqadda soo jeedka.

Haddii client-ku iskiis u soo noqdo, hook-ku wuxuu ku darayaa qasab halkii lagu kalsoonaan lahaa. Haddii uusan waligiis soo kaban, otomaatiggu waa xalka daacadka ah.

Halka hook-ga hurdada systemd uu dhab ahaan ku nool yahay

Tilmaamo badan oo hore waxay tilmaamaan /etc/pm/sleep.d, oo ah gal ku leh pm-utils oo hurdo ku saleysan systemd waligeed la tashan. systemd wuxuu hooks ka akhriyaa /usr/lib/systemd/system-sleep/ iyo /etc/systemd/system-sleep/, isagoo marka hore u gudbinaya wejiga kadibna hawlgalka, sidaas darteed pre iyo post waa qiyamka kaliya ee hook-ku ku laamo. Ku hay nuqulka maxalliga ah /etc hoostiisa halkii aad wax ka beddeli lahayd fayl la duubay, oo xusuuso in script-ku u shaqeeyo sidii root bartamaha gudbinta, sidaas darteed waa inuu si degdeg ah u soo noqdaa.

#!/bin/sh
case "$1" in
  post)
    systemctl --no-block try-restart [email protected]
    ;;
esac
exit 0

try-restart wuxuu taabtaa unug kaliya marka uu horey u firfircoon yahay, sidaas darteed tunnel-ka aad ula kac u damisay wuu damanayaa inta soo jeedka oo dhan. --no-block wuxuu ka joojinayaa hook-ka inuu sugto inta client-ku wada hadlayo, taas oo muhiim ah marka shabakaddu aanay wali kicin. Labada calamadood oo wadaag ah waxay ka dhigan yihiin hook si aamusnaan u guuldareysta halkii uu celin lahaa dhammaan taxanaha soo jeedka. Marka unuggu horey u joojmay waxba ma dhacaan, taas oo si sax ah u tahay natiijada aad halkaas ka rabto.

Soo celi adeegga, tun0 keligiis u daa

Hoos u dhigista tun0 gacan ahaan waxay ka tagtaa daemon-ka oo kormeera interface uusan hadda lahaan, oo isbeddelka xaaladda xiga wuxuu soo saaraa khaladaad jahawareer leh. Bartilmaameed u samee adeegga ama profile-ka xiritaankiisa halkii interface-ka; marka hore hubi magaca saxda ah ee unugga, sababtoo ah baakadaha qaybinta, OpenVPN 3 iyo NetworkManager dhammaantood waxay doortaan kuwo kala duwan. Profile-ka NetworkManager wuu soo noqdaa marka xiriirkaas dib loo wareejiyo, sidaas darteed unugga systemd halkaas ma aha bartilmaameedka. Hab kasta oo ay tahay, waa inay tahay isla ficilkii aad gacan ku xaqiijisay.

Dib u bilowgu wuxuu dib u rakibaa dariiqyada client-ku riixay markii uu xirmayay. Inta badan soo jeedka waxay rabaan taas. Makiinada aad ku dartay dariiqyo gaar ah ma rabto, sidaas darteed kuwaas dib u hubi halkii aad ka fikiri lahayd in soo kabashadu soo celisay, oo ku qor meel soo jeedka xiga uu ka heli karo.

La qabso waqtiga aadan kontorooli karin

Isku xirka wireless-ka iyo DHCP waxay inta badan dhammaadaan ka dib marka hook-ku shaqeeyo, sidaas darteed dib u bilowgu wuu guuldareysan karaa iyadoo aan wali jidin dariiq server-ka. Wax yar sug cinwaankaas, hal mar kale isku day, oo natiijada qor.

Xallinta magacyadu waa tartan gooni ah, sababtoo ah stack-ga shabakadda desktop-ku wuxuu soo celin karaa DNS ka dib marka tunnel-ku horey u kaco. Baaritaannada si gooni ah ugu tijaabi resolvectl query internal.example halkii aad ka soo saari lahayd dariiq shaqaynaya. Tunnel-ka si sax ah u jiheeya oo waxna xallin waaya waa dhibaatada DNS, ma aha dhibaatada hook-ga.

Go'aanka hook-ga muuqda ku hay adigoo joornaalka ku qoraya wejiga, magaca unugga iyo natiijada. Ku qor qoraallada makiinada tijaabada soo jeed ee aad waday, si soo kabasho shaqaynaysa looga garto mid nasiib leh. Dooro ficilka ugu yar ee carqaladeeya ee adeegga soo celiya, oo u daa client-ka iskiis u soo kabanaya inuu taas sameeyo. Dib u bilow buuxa wuxuu tuurayaa fadhiyada socda, taas oo qiimo dhab ah ku leh laptop-ka maalintii dhowr jeer soo jeeda.

Maqaallo la xiriira