I-OpenVPN ku-Android ayifaki umzila ngaphandle kwekheli le-tunnel

Iphrofayili yakho ye-OpenVPN ku-Android ayifaki umzila ngoba ucingo alunalo ikheli ku-interface ebonakalayo, ngakho akukho lutho umzila ongakhomba kulo. Imizila iphendula kuphela ukuthi amaphakethe kufanele aye kuphi. Ikheli le-tunnel liphendula ukuthi ucingo ungubani ngaphakathi kwe-tunnel, futhi iklayenti kufanele linikeze elilodwa ngaphambi kokuba i-interface ibe khona. Hamba ngazo zozine izivivinyo ngezansi ngokulandelana futhi ume ekwehlulekeni kokuqala, ngoba ukuhlela imizila ngaphambi kokuba ikheli libe khona kufihla inkinga yangempela.

Funda ukwehluleka ngokulandelana okukwenziwa yiklayenti

VpnService.Builder ye-Android ihlukanisa imiqondo emibili: addAddress() ibeka ikheli ku-interface ehliwa uhlelo lokusebenza, addRoute() yengeza isiqalo sendawo, futhi establish() iyenqaba ukudala i-interface kuze kufakwe okungenani ikheli elilodwa. Iklayenti le-OpenVPN lihlobanisa iphrofayili nezinketho ezithunyelwa yiseva ngqo kulezo zingcingo, ngakho ukuxhumana okungalokothi kuhlaziye ikheli akukwazi nhlobo ukwakha i-interface.

Yingakho umugqa wengqophamlando ewufundayo ungase usho umzila kuyilapho imbangela isinyathelo esisodwa ngaphambili. Iklayenti lifinyelela isigaba somzila kuphela ngemva kokuba i-interface ikhona; ngaphandle kwekheli, ucingo lomzila luhluleka ngokushesha noma alukaze lusebenze. Uma ingqophamlando ithi ayikwazi ukufaka umzila, qala ngekheli hhayi ngomthetho womzila.

Ukuhlola 1: ingabe iseva ifaka ikheli empendulweni?

Ngentshebenzo ye-OpenVPN enomzila, ikheli livela echibini leseva noma ekwabiweni kwiklayenti ngalinye, futhi i-topology yiyona enquma ukuma kwalo. Kuseva ye-OpenVPN 2.4 noma entsha kakhulu, insizakalo ene-topology ye-subnet ibukeka kanje:

topology subnet
server 10.8.0.0 255.255.255.0
client-config-dir ccd

Ngalokho kuma iseva ithumela into efana ne-ifconfig 10.8.0.6 255.255.255.0. Ukufakwa kwakudala kwe-topology net30 kuthumela ikheli lozakwabo esikhundleni salokho, isibonelo ifconfig 10.8.0.6 10.8.0.5, ngakho iphrofayili ehambiswa phakathi kwemodeli ezimbili ingabukeka ilungile kuyilapho ithwele imaski yenethiwekhi engalungile.

Funa engqophamlandweni yokuxhumana yeklayenti isethi yezinketho ezithunyelwe. Uma ingenawo umugqa we-ifconfig nhlobo, iseva ayikaze ithumele ikheli noma iklayenti lenqabile ukhetho. Kuseva esebenzisa i-client-config-dir, ifayela eliqanjwe nge-common name yesitifiketi kufanele libe khona futhi liqukathe ukwabiwa:

# ccd/phone-anna
ifconfig-push 10.8.0.6 255.255.255.0

Ukuhlola 2: ingabe iklayenti liyaligcina ikheli elilitholile?

Isihlungi esibanzi kakhulu siyimbangela yesibili evamile. I-pull-filter ikhona ku-OpenVPN 2.4 nangaphezulu, futhi lapho izihlungi eziningi zihlangana nokhetho olulodwa kunqoba okugcina okuhlangene, ngakho i-catch-all ekugcineni isusa ikheli ngaphandle kwephutha:

# removes every pushed option, including the address
pull-filter ignore "ifconfig"
pull-filter ignore "route"

Nciphisa isihlungi kukho kanye lokho okhetho ofuna ukukususa futhi ushiye ikheli njengoba linjalo:

# keeps the pushed address, drops one unwanted LAN route
pull-filter ignore "route 10.60.0.0"

Isiphakamiso sokucisha wonke ama-pull sivame ukuvela kumuntu ofuna ukususa umzila owodwa kuphela. I-route-nopull iyisishintshi esincane: igcina i-ifconfig nezinye izinketho ezithunyelwe ngenkathi yenza uphawu olubi emizileni ethunyelwe nasezinkethweni ezinjenge-DHCP. Yisebenzise lapho lokho kuyikho ngempela okukufunayo, futhi uphendule umbuzo wekheli ngokwehlukana.

Ukuhlola 3: ingabe ikheli ngeyakho ukulibhala?

Ukubhala ikheli ngesandla kusemthethweni kuphela lapho umqhubi ekunikeza khona inani. Uma uzibhalela lona, kufanele livele ku-subnet yeklayenti le-VPN, lihluke phakathi kwezikhathi ezisebenzayo futhi lihambisane ne-topology esetshenziswa yiseva. Ukukopisha ikheli lebhuloho ledeskithophu noma lomsingathi kwi-LAN ekude kuyahluleka kuzo zombili izimo: ucingo luzofuna ikheli esivele likhona kwenye indawo, futhi isango ngeke libe nendlela yokubuyela kulo.

Isiqalo se-LAN ekude emzileni siyindawo, akusoze kube ubunikazi bucingo. Umzila we-10.60.0.0/24 uthi fika kuleyo nethiwekhi ngokusebenzisa i-tunnel; awusho lutho mayelana nokuthi yiliphi ikheli le-10.60.0.x okufanele ucingo lube nalo, futhi ucingo akufanele lube nalo nelilodwa lawo. Ukwabiwa okungaguquki kungokohlangothi lwesera, lapho kungakwazi ukungqubuzana khona nechibi eliguqukayo.

Izikhathi ezimbili kubunikazi obubodwa ziveza ukungqubuzana okufanayo. Uma isitifiketi esifanayo sixhuma kabili futhi iseva ithumela ikheli elilodwa eliqinile kuzo zombili, isikhathi sesibili siphinda esokuqala, futhi isisombululo ubunikazi obuhlukene noma ukwabiwa okuhlukene hhayi ukuhlela ohlangothini lweklayenti.

Ukuhlola 4: ingabe okunye kugcwele indawo ye-tunnel?

I-Android ivumela insizakalo eyodwa ye-VPN esebenzayo ngesikhathi. Uhlelo lokusebenza lwe-VPN olunye, noma umugqa we-VPN ohlala uvuliwe oshiye uvuliwe kwiphrofayili engasasebenzi, kungathatha leyondawo ngaphambi kokuba iklayenti lakho le-OpenVPN libize i-establish(). Ngaleso sikhathi i-interface ayisoze yavela nakuba iphrofayili ivumelekile, ngakho nqamula enye i-VPN, cisha isilungiselelo sokuhlala sivuliwe futhi uxhume kabusha ngaphambi kokuthinta iphrofayili.

Insizakalo egcizelela ukubhulohwa kwe-Ethernet ingenye indlela ekhonjiwe. Uhlelo lokusebenza lwe-Android olungenayo i-root lungakha i-tunnel ye-IP, hhayi ingxenye ye-Ethernet ekhulisiwe, ngakho akukho kheli olibhalayo elizokwenza iseva ye-dev tap isebenze; umqhubi kufanele anikeze insizakalo enomzila. Uma ubika inkinga, faka igama lek layenti nenguqulo yalo, isethi yezinketho ezithunyelwe, i-topology kanye nesinyathelo esiqondile okwakufanele kubonakale kuso ikheli.

Uma zozine izivivinyo zidilika futhi ikheli likhona, lihluke futhi limaskwe ngendlela efanele, umbuzo womzila uba ojwayelekile: yiziphi iziqalo iseva ezivumelayo nokuthi iklayenti kufanele zizikhawulele kanjani. Bhala phansi ikheli le-tunnel, imaski yenethiwekhi kanye ne-topology ngaphambi kokushintsha okunye, ngoba lawo manani amathathu yiwona umqhubi adinga ukuwaqhathanisa nokubonakala kweseva.