Waxa ay persist-tun iyo persist-key dhab ahaan ka badbaadaan OpenVPN
Labada ikhtiyaar waxay daboolaan dib u bilow jilicsan oo ku dhex jira geeddi-socod nool. Kama sii hayaan interface-ka joojinta ka dib, mana aha siyaasad xanniba taraafikada.
Joojinta adeegga waxay meesha ka saaraysaa interface-ka xitaa iyadoo persist-tun la dejiyay. Taasi waa ikhtiyaarka shaqaynaya sida la diiwaangeliyay, ma aha fashil. Ikhtiyaarku wuxuu qeexayaa hal waddo dib u bilow ah oo ku dhex jirta geeddi-socod socda, oo systemctl stop ma aha waddadaas.
Akhri labada magac wada, naqshaddu way caddaataa. Mid wuxuu hayaa deskriptor, kan kalena wuxuu hayaa walxo fure, labaduna waxay jiraan sababta waxa dhaca ka dib marka xukunada la dhaafo.
Laba kheyraad iyo dib u habaynta ay ka tirsan yihiin
OpenVPN waxay calaamadiso dib u bilowgeeda laba xaaladood oo caadi ah. SIGUSR1 cad ayaa sidaa sameeya, iyo ping-restart oo ay keento lammaane dhintay ayaa isla sidaa sameeya. Labaduba waxay geeddi-socodka ka dhigaan mid nool oo waxay mar kale fuliyaan habaynta xidhiidhka, oo halkaasay ikhtiyaarradu ka kasbadaan booskooda.
| Event | TUN/TAP device | Key and auth files | Addresses and routes | up/down hooks |
|---|---|---|---|---|
Soft reset, from SIGUSR1 or from a ping-restart the daemon sends itself | survives only with persist-tun | survive only with persist-key | survive with the device, otherwise rebuilt | run again only when restart hooks are enabled |
Configuration reload, SIGHUP | recreated | re-read from disk | rebuilt once the device returns | run again |
| Service stop | lost | re-read at the next start | removed | run at the next start |
Kaliya safka dib u bilowga jilicsan ayaa ah waxa labadan ikhtiyaar beddelaan, shaqada ay seegana waa qaybta qaaliga ah ee xidhiidhka mashquulka ah. Dib u furista qalab waxay dumisaa cinwaannada iyo wadooyinka ku xidhan, dib u dhiskaaguna wuxuu tuuri karaa baakado ku jiray waddada markii dib u bilowgu bilaabmay. Joojintu waxay baabi'isaa isla waxyaalahaas iyada oo aan lahayn ikhtiyaar lagu ilaaliyo.
Sababta ay ikhtiyaarradan u jiraan gabi ahaanba
Server OpenVPN adkaysan ah wuxuu inta badan ku bilaabmaa root ahaan, wuxuu furaa furayaashiisa iyo qalabkiisa, ka dibna wuxuu u gudbaa isticmaale aan xukun lahayn. Gudubkaas ka dib qaar ka mid ah hawlgallada si fudud way lumaan. Akhriska fayl fure oo qaab 0600 ah, abuurista interface shabakadeed ama beddelidda wadooyinka dhammaantood waa la diidi karaa.
La'aanta ikhtiyaarrada persist, lammaanaha aamusan waqti ku filan si uu u kiciyo ping-restart wuxuu ku qasbi lahaa isla hawlgalladaas. Dib u xidhiidhku wuu dhici lahaa xitaa haddii aan waxba ka beddelmin habaynta. Geeddi-socodku wuxuu u ekaan lahaa mid si sabab la'aan ah u dhinta, log-na wuxuu muujin lahaa khalad ogolaansho halkii khalad shabakadeed.
Iyaga, dib u bilowga jilicsan wuxuu dib u isticmaalaa waxa marxaladda xukunka leh horey u heshay. Ma jiro sixir oo geeddi-socodku waxba kama badbaado. Helitaanka kheyraadka si fudud ayaa loo dib dhigay.
Akhri khaladka ugu horreeya, ma aha kan ugu dambeeya
Marka dib u bilowgu fashilmo, akhri khaladka ugu horreeya halkii kan ugu dambeeya. Fure la ilaaliyay, fayl auth, ioctl interface iyo jillaab dibadeed waa afar kheyraad oo kala duwan. Mid hayntiisu wax kama sheegto gelitaanka kuwa kale. Jillaabka u yeedha qalab firewall weli wuxuu u baahan yahay xukunada qalabkaasi dalbado.
Jillaabtu waxay leeyihiin beddelkooda gaar ah. Buugga OpenVPN wuxuu ikhtiyaarrada persist ku lammaaneeyaa up-restart, kaas oo go'aamiya in skriptiyada up iyo down mar kale socdaan dib u bilowga ka dib. Sidaas darteed interface-ka kor u hadhay wax kama sheegto in is-dhexgalkaaga resolver-ka la cusboonaysiiyay.
# which restart path just happened?
journalctl -u openvpn-client@office --since '10 min ago' | grep -E 'SIGUSR1|ping-restart|Restart pause|NOTE:'
# did the interface survive, and do its routes still exist?
ip -brief link show tun0
ip route show dev tun0Labadan amar waxay kala soocaan labada qaab fashil sekund gudahood. Interface jira laakiin wadooyin ka maqan waa dhibaato jillaab ama waddo. Interface-ka lumay macnaheedu waa geeddi-socodku dhab ahaan dhammaaday.
Interface-ka la hayay ma aha kill switch
Haddii shuruuddu tahay in taraafikadu waligeed ka bixin tunnel-ka, qalab la hayay taas ma bixiyo. Wadooyinka qoyska cinwaanka kale, waddo caadi ah oo labaad, iyo kiiska geeddi-socodku gabi ahaanba baxo dhammaantood waxay ka baxsan yihiin baaxadda ikhtiyaarka.
U maamul labada shuruud si gooni gooni ah. Haynta shayga tunnel-ka inta u dhaxaysa dib u xidhiidhka waa fududayn daemon-ka. Xanniba bixitaanka marka tunnel-ku hoos yaallo waa siyaasad firewall leh xeerar u gaar ah iyo imtixaan u gaar ah. Isku qasiddoodu waxay soo saartaa habayn u eg difaac oo u dhaqma sida dib u xidhiidh dadaal ugu fiican.
U magacow dhacdada ka hor intaadan baaritaan. Dib u bilow jilicsan, isku day xidhiidh fashilmay iyo joojin adeeg waa saddex dhacdo oo leh saddex dabeecad, oo kaliya tan ugu horreysa ayaa ah waxa ikhtiyaarradani qeexaan.