Ngabe amakhasimende kumaseva amabili e-OpenVPN ayakwazi ukufinyelelana?

Ukumisa iseva yesibili ye-OpenVPN kunikeza indawo yesibili lapho amakhasimende angaxhuma khona, futhi akukho okunye. Akubeki lawo makhasimende kunethiwekhi yeseva yokuqala, futhi inketho ebizwa nge-client-to-client ishintsha kuphela ukudluliswa ngaphakathi kwenqubo eyodwa yeseva. Lawa maqembu amabili aba inethiwekhi eyodwa lapho uhlela imizila phakathi kwawo ngamabomu, unomnini wendlela ngayinye. Konke okungezansi kucabanga imodi ye-TUN endaweni yomsebenzisi lapho lokho kudluliswa kwangaphakathi kuvaliwe, ngakho i-kernel yiyo ethatha isinqumo.

Inganekwane: uhlu olulodwa lwama-akhawunti, inethiwekhi eyodwa

Ukuqinisekiswa nokufinyeleleka kuyahlanganiswa ngoba kokubili kuhlala ekucushweni kweseva. Umsebenzisi ongakwazi ukungena kunoma iyiphi yamageyithiweji amabili ubonakala, ngaphandle, njengomsebenzisi ohlelweni olulodwa olunezicabha ezimbili. Ngaphakathi, iseva ngayinye inikeza amakheli aqhamuka eqenjini layo futhi ifaka imizila kuphela yamakhasimende ewugcinayo. Ngakho ikhasimende elikugeyithiweji A elithumela iphakethe kukhasimende elikugeyithiweji B licela indawo iseva yalo engakaze ike yizwe ngayo. Iphakethe liya emzileni ozenzakalelayo ka-A, liphuma kuthaneli, futhi lifika kufayela lomlilo elingakaze licelwe ukuba livume.

Ngakho ukwengeza iseva yesibili akwengezi ukuphindaphindeka, ukutholakala noma isizinda sokusakaza esabiwe. Kwengeza inethiwekhi enemizila edinga uhlelo, futhi uhlelo luqala ekwabiweni kwamakheli.

Nikeza igeyithiweji ngayinye iqembu layo nekheli lokudlula

Amabanga amabili angeke ahlangane nanoma yini enye, kanye noxhumo oluncane lokudlula phakathi kwabasingathi, yiwo wonke uhlelo lwamakheli. Gcina ukudlula kusegimenti yangasese oyilawulayo, futhi bhala lezo zinombolo ngaphambi kokuba noma iyiphi iseva ikhiphe ukuqashwa.

Phikisa isilingo sokunikeza amaseva womabili iqembu elifanayo ukuze amaphrofayili ahlale efana. Umzila we-kernel awukwazi ukusho ukuthi iyiphi kwabasingathi ababili ephethe ikheli elithile ngaphakathi kwebanga elabiwe okwamanje, ngakho ithebula lemizila lingakhomba igeyithiweji eyodwa futhi ikhasimende lingase lixhunywe kwelinye. Amagama e-interface ayizimiso zasekhaya, hhayi isimo esabiwe. Womabili abasingathi lapha babiza idivayisi yethaneli nge-tun0 kanye noxhumo lokudlula nge-transit0, okulungile ngoba alikho iphakethe elithwala lawo magama.

Faka umzila ezinhlangothini zombili

Igeyithiweji ngayinye idinga umzila oya eqenjini lenye ngokwekheli lokudlula, futhi ukudluliswa kufanele kuvuliwe ukuze noma iyiphi isebenze njengegxathu. Qinisekisa ithebula lamanje kuqala, bese wengeza okufakiwe futhi ukwenze kuphikelele ngomphathi wenethiwekhi womsingathi esikhundleni sehuku lokuxhuma kabusha.

sysctl net.ipv4.ip_forward
ip route add 10.64.20.0/24 via 172.28.44.2 dev transit0
ip route get 10.64.20.37

Kulingise lokhu komsingathi othile ngokushintsha amaqembu. Ukwengeza umzila ofanayo ngokuphindaphindiwe kusukela kuskripthi esingahlobene yikho okwenza umsingathi ube namakhophi amaningi kanye noshintsho oluyimfihlakalo ngokuzayo lapho othile efunda ithebula. Uma uxhumo lokudlula lona ngokwalo luyithaneli, umzila ukhomba ku-topology yalelo thaneli futhi igxathu kufanele lisinde ekuxhumekeni kwalo kabusha. Ikheli lokudlula elinyamalala imizuzwana engamashumi amathathu lihamba nomzila ophakathi kwamaqembu, okuyisici somklamo okufanele sishiwo kunokuba sitholwe.

Phusha umzila wekhasimende ngaphandle kokuzenzisa ubunikazi

Amakhasimende adinga umzila oya eqenjini elikude, ngaphandle kwalokho uhlelo lwawo lokusebenza luthumela iphakethe kugeyithiweji ozenzakalelayo futhi ithaneli alikaze liyibone. Ukucushwa kweseva yindawo yemvelo yokuyiletha.

push "route 10.64.20.0 255.255.255.0"

Faka umugqa wokulingisa ekucushweni kwesinye iseva, bese uxhuma kabusha ikhasimende lokuhlola futhi ufunde ithebula lalo. Ikhasimende elinganaki imizila ephushiwe lidinga ukucushwa kwalo okugunyaziwe, futhi umzila ongafiki neze awuwona ukulawulwa kokufinyelela. Unganikezi ikhasimende i-iroute yeqembu lonke lelinye igeyithiweji. Leso siqondiso sikhona sesubnethi engemuva kwekhasimende elilodwa elixhunyiwe, futhi ukusisebenzisa ukufihla umzila ongekho phakathi kwamageyithiweji kukhiqiza iseva ekholelwa ukuthi iphethe amakheli engakwazi ukuwafinyelela.

Fakazela isicelo esisodwa bese wenqaba esinye

Khetha ukusebenza kwangempela, isibonelo i-HTTPS esuka kukhasimende eliku-10.64.10.21 iya enkonzweni eku-10.64.20.37, futhi uvume lokho ngqo kubo bobabili abasingathi. Ifayela lomlilo ngalinye lamukela isicelo ohlangothini olungenayo kanye nempendulo elandelelwayo ohlangothini olubuyayo; inqubomgomo yenkonzo yendawo yokufika kufanele isayamukele.

iptables -A FORWARD -i tun0 -o transit0 -s 10.64.10.21 -d 10.64.20.37 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -i transit0 -o tun0 -d 10.64.10.21 -s 10.64.20.37 -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Lapho kunemizila emibili, i-NAT yomthombo ayidingeki futhi ilimaza ngokusebenzayo lapha: ukuhumusha umthombo kufihla ukuthi yiliphi ikhasimende elenze isicelo futhi kwehlula inqubomgomo esekelwe emthonjeni ngasohlangothini lwendawo yokufika. Hlola ukuthi umthetho we-masquerade okhona wokuphuma ku-inthanethi awubamboli lo mzila. Bese uhlola ukunqaba. Inkonzo okufanele ihlale yasendaweni eqenjini B kufanele ihlale ingafinyeleleki lisuka eqenjini A, futhi izithandani zamakhasimende kugeyithiweji elilodwa nazo zidinga ukuhlolwa, ngoba inqubomgomo yokudluliswa oyishintshile isebenza nakuzo.

Enye ilungiso kumodeli wengqondo: uxhumo lokudlula luthwala amaphakethe angaphakathi asusiwe ukubethelwa, ngakho lungumngcele wokuthembana hhayi isiqinisekiso sangasese. Uma lunqamula inethiwekhi ongayilawuli, vikela lelo gxathu ngethaneli ebethelwe evunyiwe futhi uhlele umzila ngokwe-topology yalo yangempela. I-TLS yaphela-naphela isaqinisekisa uhlelo lokusebenza ngokwalo, yingakho inkonzo yangaphakathi kufanele iqhubeke nokulusebenzisa.