Vimba iklayenti elilodwa le-OpenVPN ku-LAN ngaphandle kokumisa ithuneli

Iklayenti elilodwa kuseva yakho ye-OpenVPN kufanele ilahlekelwe ukufinyelela kwe-LAN kuyilapho zonke ezinye izithuneli zisebenza. Uma ufuna lokhu, impendulo engcono kakhulu ivamise ukuthi idaemon ayikwazi, okuyiqiniso engxenyeni kuphela: i-OpenVPN ayinayo i-firewall yeklayenti ngalinye, kodwa umhambi ophetha ithuneli usevele ehlunga amaphakethe. Izinqumo ezimbili ezibalulekile ubunikazi obuvimbayo kanye nendawo yomthetho. Zenza kahle zombili futhi ushintsho lube umugqa owodwa ongawuhlola futhi uwususe.

Namathisela iklayenti ngaphambi kokubhala umthetho

I-OpenVPN iqashisa amakheli ethuneli kusuka echibini, ngakho-ke 10.8.0.6 iyisihlalo, hhayi umuntu. Uma iseshini iphela ukuqashisa kuyabuya futhi kungase kunikezwe uxhumano olulandelayo, okusho ukuthi umthetho obhalwe ngokumelene nalelo kheli ulandela isihlalo, hhayi umsebenzisi. Ngakho-ke qala ngokunquma ukuthi empeleni uvimbani: ikheli lokuhlola okufushane, noma isertifikhethi yomuntu ofuna ukumgcina ngaphandle.

Ukuze uhlanganise ikheli nesertifikhethi, dala ifayela kusikhombisi esishiwo yi-client-config-dir bese unikeza ifayela i-common name yesertifikhethi ngqo. Faka umyalelo owodwa kulo, ifconfig-push 10.8.0.6 255.255.255.0, futhi lelo klayenti ligcina ikheli lethuneli elifanayo lapho lixhuma kabusha. Izilungiselelo ezimbili kufanele zibe khona ukuze lokhu kusebenze: i-client-config-dir kufanele imenyezelwe ekulungiselelweni kweseva, futhi ikheli elithunyelwayo kufanele libe kusubneti eseva engayihambisa. Uma kushoda okukodwa, ifayela lishaywa indiva ngaphandle kwephutha, okwenza ukuhlolwa kwe-firewall okulandelayo kuduke.

Ukuvimba kwesikhashana kungasebenzisa ikheli lechibi, inqobo nje uma ithikithi libhala ukuthi iyiphi iseshini eyayinalo ngaleso sikhathi.

Ukulandelana kunquma ukuthi ukulahla kuzosebenza yini

Kusango le-Linux elidlulisela phakathi kwethuneli ne-LAN, amaphakethe adlula kuchungechunge lwe-FORWARD. Funda umyalo ngezansi njengomusho: faka esihlokweni se-FORWARD, fanisa ithrafikhi engena isuka ku-tun0, isuka kuleyo host eyodwa, iqondiswe kusubneti ye-LAN, bese uyilahla.

iptables -I FORWARD -i tun0 -s 10.8.0.6/32 -d 192.168.1.0/24 -j DROP

I--I iyona eyenza umthetho usebenze. Uma wengezwa nge--A, iwela ngaphansi kwanoma yikuphi ukwamukelwa okubanzi kwesubneti yethuneli futhi ayiboni phakethe. Qinisekisa indawo nge-iptables -vnL FORWARD --line-numbers, futhi ufunde nezibali: ukulahla okuphezulu okungabalanga lutho kusho ukuthi ithrafikhi iza ngomunye umzila.

Ikheli le-LAN lesango uqobo lungomunye umzila. Amaphakethe athunyelwa ebhokisini uqobo aya ku-INPUT, hhayi ku-FORWARD, ngakho iklayenti lingalahlekelwa i-host ye-LAN futhi livule ikhasi lokuphatha lomhambisi. Faka umthetho we-INPUT ohambisanayo lapho lokho kubalulekile.

Okungakwazi ukubonwa isihlungi

Ukuhlunga kwenzeka lapho iphakethe lihlolwa, ngakho iseshini ye-TCP esivele isunguliwe ingaqhubeka ize ivalwe noma isethwe kabusha. Uma ukuvimba kufanele kusebenze ngokushesha, sula imifudlana elandelelwayo yalowo mthombo nge-conntrack -D -s 10.8.0.6 ngemva kokufaka umthetho. Uma imizuzwana embalwa yokuhlangana yamukelekile, bhala leso sincumo esikhundleni sokusishiya singashiwo. Kunoma yikuphi, umuntu olandelayo kufanele azi ukuthi umthetho umisa ithrafikhi ephilayo noma ukuxhumana okusha kuphela.

Ithrafikhi phakathi kontanga ayilokothi ithinte i-firewall ye-host. Uma i-client-to-client ivuliwe, i-OpenVPN idlulisela lawa maphakethe ngaphakathi kwedaemon, ngakho kokubili i-FORWARD ne-INPUT awawaboni. Izixazululo kuphela ukuvala i-client-to-client noma ukwamukela ukuthi ontanga bangafinyelelana; umthetho we-iptables ngeke uwubone lowo mthwalo.

IPv6, i-firmware nokuhlala ngemva kokuqala kabusha

Umthetho we-IPv4 awusho lutho nge-IPv6. Uma ithuneli ne-LAN kuthwala zombili imindeni, umthetho olinganayo kufanele ube khona ku-ip6tables, noma kusethi yemithetho ye-nftables ephethe inqubomgomo kuleyo host. I-firmware yomhambisi ivamise ukufihla i-netfilter ngemva kokuzihlukanisa kwayo, ngakho isintaksi namagama amathebula akopishwe kunkundla kungenzeka angasebenzi.

Ku-OpenWrt, indlela ebhaliwe iyingxenye yokulungiselela i-firewall hhayi umugqa we-iptables obhalwe ngesandla, futhi umugqa obhalwe ngesandla ungase unyamalale lapho i-firewall ilayishwa kabusha. Ezinye izinzwa zibuyisela imithetho nge-netfilter-persistent, iyunithi yokuqalisa noma isitolo somhlinzeki, futhi lezo zindlela azishintshisani. Fakazela leyo oyikhethile ngokuqala kabusha, ngoba ukulayisha kabusha kuzijwayeza omunye umzila.

Qinisekisa ngomzila ngamunye, bese uhlehla ngokuhlanzekile

Hlola umzila ngamunye ngokwehlukana, ngoba ukuhlolwa okukodwa okuphumelelayo kufihla okunye. Iklayenti elivimbile kufanele lisafinyelela i-inthanethi ngethuneli kodwa lihluleke ku-host ye-LAN, iklayenti lesibili kufanele lifinyelele leyo host, futhi ikheli lesango nomzila kontanga kudinga ngakunye ukubhekwa kwako. Bhala imiphumela eduze komthetho ukuze ushintsho olulandelayo lube nesisekelo. Ithebula ngezansi yisethi efanele ukugcinwa ethikithini.

Ukuhlehla ukususa ngokwencazelo, hhayi i-flush: iptables -D FORWARD -i tun0 -s 10.8.0.6/32 -d 192.168.1.0/24 -j DROP isusa leyo ngxenye ngqo futhi ishiya okunye kuchungechunge kungashintshiwe. Susa umugqa ofanayo kunoma yiliphi ifayela elibuyisela imithetho lapho kuqalwa, lilayishe kabusha, bese uqinisekisa ukuthi iklayenti lifinyelela i-host ye-LAN futhi. I-flush ye-FORWARD ingabuyisela emuva nemithetho ongayibhalanga, okwenza ukuhlehla kube yisigameko sesibili.

Ngaphambi kokuvala ithikithi, qinisekisa izinto ezintathu: ikheli elinamathiselwe lihambisana nesertifikhethi, umthetho ungaphezu kokwamukelwa futhi isibali akusona uziro, futhi ifayela lokugcina liqukethe umthetho ofanayo ohlolile. Uma kukhona okushodayo, ukuvimba kuwumbono ongamanga kuseshini ye-shell.