route-gateway ma aha redirect-gateway: waxa dhab ahaan is beddela
Ikhtiyaarku wuxuu kaliya siinayaa boodhka xiga waddooyinka OpenVPN u rakibay. Ka saaristiisu ma daminayso tunnel buuxa la riixay, hagaajinta waxay ku taal dib-u-celinta.
Tunnel-kaagu wuu soo kacaa, subnet-ka gaarka ah wuu jawaabaa, iyo baaritaanka caadiga ah wali wuxuu ku lumayaa VPN-dii inkastoo qof ka tirtiray khadka gateway-ga profile-ka. Isku darkaas waa faraha aqoonsiga tilmaanta qalad ah ee la tafatiran. Waxa la saaray wuxuu macmiilka siinayay boodhka xiga waddooyinka uu rakibayo; waxa sii waday qabashada taraafikada wuxuu ka yimid meel kale oo server-ku riixay. Daboolka iyo boodhka xiga waa shaqooyin kala duwan, oo midkood oo kaliya ayaa go'aamiya haddii meelaha guud ay isticmaalaan tunnel-ka.
Khaddaad saartay waxay ahayd boodh xiga, ma aha switch siyaasadeed
Waddo kasta oo macmiilku rakibo waxay u baahan tahay cinwaan gateway oo loo tilmaamo, oo tilmaanta gateway-ga waa isha cinwaankaas marka waddadu aysan magacaabin midkeeda. Ka tirtir oo waddooyinkaas ma hayaan wax ay ku dhegganaadaan, sidaas darteed ama ma rakibmaan ama waxay ku dhacaan waddo aan meelna u horseedin. Subnet-ka gaarka ah waa isla waxa waddo sidan oo kale qaaday.
Dhanka kale dhaqanka badbaaday wuxuu leeyahay qoraa kale: ikhtiyaar dib-u-celin oo ku jira block-ka la riixay, kaas oo taraafikada baxa caadiga ah u guuriya tunnel-ka sida calaamadihiisa. Ka saarista gateway-ga ma damiso mana daciifiso. Natiijadu waa tan ugu xun labada xaaladood, iyadoo taraafikada guud wali la qabtay iyo meesha gaarka ah ee tunnel-ka qiil u ahayd hadda aan la gaari karin. Taasi waa sababta tafatirka labaad, oo lagu sameeyay isla ruuxa, uu isna waxna aan beddelin.
Afar kabaal, afar shaqo oo kala duwan
Dooddan afar tilmaamood ayaa si isdhaafsi ah loo xigtay, oo midkood oo kaliya ayaa maamula daboolka, taas oo ah meelaha ay tunnel-ka maraan. Midda labaad waxay dejinaysaa boodhka xiga ee waddooyinku isticmaalaan, midda saddexaad waxay rakibaysaa hal hore, midda afaraadna waxay tuurtaa wax kasta oo server-ku riixay, oo ay ku jiraan waddooyinka gaarka ah ee baahida loo qabo. Jadwalku wuxuu u kala hormariyaa waxa maamuluhu isku dayayo inuu beddelo ee ma aha magaca, sababtoo ah magacyada ayaa jahawareerka keena. U qaado afar go'aan oo kala duwan oo dooro tan aad run ahaan rabto inaad dib u celiso.
Ficil ahaan afartuba waxay inta badan ku yimaadaan hal block oo la riixay, khad khad ka dib, taas oo ka dhigaysa inay u ekaadaan qaybo hal dejinta ah. Ma aha, oo tixraaca OpenVPN wuxuu u diiwaangeliyaa sidii habab kala duwan sababtaas awgeed. Ogaanshaha go'aanka aad dib u celinayso waa shaqada; tafatirku waa hal khad.
| What you are trying to change | Directive that decides it | What it leaves alone |
|---|---|---|
| Which destinations use the tunnel | redirect-gateway | Per-prefix routes and resolver choice |
| The next hop a pushed route points at | route-gateway | Coverage of public destinations |
| One reachable prefix | route | Every other destination, default path included |
| All pushed routing and DNS at once | route-nopull | Nothing, which is the problem |
Filter khadda la riixay, hayso boodhka xiga
Haddii daboolka aad ka soo horjeedo uu yimaado sida ikhtiyaar la riixay, jawaabta cidhiidhiga ah waa inaad iska indhatirto ikhtiyaarkaas magaca oo aad ka tagto inta kale ee block-ka la riixay iyada oo aan la taaban. Marka loo qoro sida filter, waxay u ekaanaysaa sida khadda hoose, oo meesheeda waxay ku taal profile-ka macmiilka la saameeyay, ma aha habaynta server-ka.
pull-filter ignore "redirect-gateway"Cidhiidhka ayaa ah qodobka. Maadaama filter-ku is barbardhigo hore oo qoraal ah, qaab ka gaaban ayaa sidoo kale u dhigma tilmaanta boodhka xiga, taas oo ka qaadaysa si sax ah macluumaadka ay waddooyinka gaarku ku tiirsan yihiin oo ku celisa khaladka asalka ah oo ku jira lebis cusub. Filter-ku wuxuu sidoo kale kaliya ku shaqeeyaa ikhtiyaarrada la riixay, sidaas darteed marnaba ma taabto khad u dhigma oo gudaha lagu qoray ama maamule shabakadeed uu ku qasbay. Dib u xiriir ka dib, sababtoo ah fadhiga nool dib uma qiimeeyo waxa server-ku riixay.
Akhri raadinta, ma aha shaxda
Ka dib markaad dib u soo rarto profile-ka, weydii kernel-ka halka laba meelood run ahaan ay aadaan: mid gudaha hore ee gaarka ah iyo mid internet-ka guud. Soo bandhigidda buuxda ee shaxda ugu weyn way adag tahay in la akhriyo oo sahlan tahay in khalad loo akhriyo, sababtoo ah waddo way jiri kartaa oo haddana way ka guul-darraysan kartaa isku-dhac gaar ah. Marka la raacayo siyaasadaha, qaanuunka, shaxda iyo cinwaanka isha ayaa sidoo kale ku jira hubinta.
ip route get 10.40.7.25
ip route get 203.0.113.77
ip rule showNooca def1 waa in la ogaado, sababtoo ah wuxuu ka tagaa gelitaanka caadiga ah ee hore mid muuqda inta laba qaybood oo badh-caadi ah ay guuleystaan raadinta. Sidaas darteed khad 0.0.0.0/0 oo ku jira soo-saarka keligiis waxba ma caddeeyo. Raadintu waxay ka jawaabtaa su'aasha ay liistadu uun u muuqato inay ka jawaabto.
DNS, IPv6 iyo waddada gaarka ah wali waa inay shaqeeyaan
Diidmada hal dib-u-celin IPv4 waxba kama sheegto xallinta, sidaas darteed ikhtiyaarka DNS ee la riixay wuxuu sii wadan karaa dirista su'aalo tunnel-ka inta waddooyinku u eg yihiin kuwo sax ah. Caadi IPv6 ah ayaa sidaas oo kale sameyn kara qoys cinwaan ah oo aan hubinta IPv4 waligeed taaban. Labaduba waxay u baahan yihiin go'aan cad halkii ay ahaan lahaayeen malo. Kadib xaqiiji in adeegga gaarku wali jawaabayo, sababtoo ah tunnel kala qaybsan oo lumiyay waddadiisa gaarka ah ma aha tunnel kala qaybsan, waa mid jaban.
Hal qalab ballaaran ayaa u qalma digniin: route-nopull wuxuu tuuraa waddo kasta oo la riixay iyo ikhtiyaar kasta oo DNS la riixay, taas oo si hubaal ah u joojisa tunnel-ka buuxa oo si la mid ah hubaal ah u jabisa waddooyinka gaarka ah ee baahidu ku tiirsan tahay, marka waa burin aad uga weyn filter magac oo ku wajahan hal ikhtiyaar. Hubi meesha gaarka ah, meel guud iyo xallinta ka dib isbeddel kasta, oo u qaado gacan-qaadid dhamaystiran caddayn wax kale ma aha gacan-qaadidka.