Xhumanisa amaklayenti amabili e-OpenVPN kusibunguzi esisodwa se-Linux nge-fwmark

Ukufaka iklayenti lesibili le-OpenVPN kusibunguzi esisodwa se-Linux kwehluleka kwelinye lamabala amabili. Kungenzeka iklayenti langaphakathi lingakwazi ukufinyelela iseva yalo ngoba umhubhe wangaphandle usuthathe lokho kuthutha, noma iklayenti lesibili libhala kabusha ithebula lemizila bese umhubhe wokuqala uyeka ukusebenza. Zombili lezi zinkinga zisemizileni, hhayi ekubetheni, futhi zombili zixazululwa ngaphambi kokuba umhubhe omusha uthwale noma yikuphi ukuthutha kohlelo lokusebenza. Amakheli lapha ayizibonelo: i-tun0 ingumhubhe wangaphandle, i-203.0.113.9 iyiseva yangaphakathi, futhi i-TCP 9999 ingumgudu okufanele usebenzise indlela yangaphakathi.

Izindlela ezimbili zokwehluleka, ithebula elilodwa lemizila

Iklayenti langaphakathi livula isokhethi ye-UDP kuseva yalo, futhi leyo sokhethi ilandela ithebula lamanje lemizila njenganoma iyiphi enye. Uma umhubhe wangaphandle usuvele unomzila ozenzakalelayo, amaphakethe okuxhawula angena kumhubhe wangaphandle. Lokho kusebenza kuphela uma iseva yangaphandle ifinyelela iseva yangaphakathi futhi uhlangothi olunye luvuma ukuthwala umgudu; uma kungenjalo ukuxhawula kuyama futhi iklayenti lizama futhi.

Ukwehluleka kwesibili kuvela ku-push yeseva. I-push evamile yi-redirect-gateway def1, efaka u-0.0.0.0/1 no-128.0.0.0/1 esikhundleni sokushintsha umzila ozenzakalelayo. Ngakho amaklayenti amabili, ngalinye lifaka ipheya lalo le-/1, ayashayisana, futhi ipheya elisha kakhulu liyawina cishe kuzo zonke izindawo. Sesha lezi ziqalo ezimbili ethebuleni uma umhubhe ufa ngemuva kokuxhumana kwesibili, ngoba umzila ozenzakalelayo ngokwawo kungenzeka awukaze ushintshwe.

Maka umgudu bese uwunikeza ithebula

Qondisa ukuthutha okukhethiwe ngokukushaya uphawu kuthebula le-mangle nokufanisa uphawu kumthetho wenqubomgomo. Umthetho ukhomba ithebula elikhethekile omzila walo ozenzakalelayo uyidivayisi yangaphakathi, ngakho amaphakethe anomaka kuphela athatha indlela yangaphakathi.

iptables -t mangle -A PREROUTING -p tcp -m multiport --dport 9999 -j MARK --set-mark 0x9999
ip rule add fwmark 0x9999 table 200 pref 1000
ip route add default dev tun1 table 200

Iningi lokwehluleka kulesi sethi somthetho livela emaphutheni amabili. Inani lophawu elibekwa yi-firewall kanye nenani elifaniswa umthetho kufanele kufane, ngoba ukungafani akulethi phutha noma umphumela. Futhi i-PREROUTING ibona kuphela amaphakethe angena ngaphandle, ngakho ukuxhumana okuqalwa kulesi sibunguza kudinga umthetho we-OUTPUT onokufanisa okufanayo ngaphambi kokuba kushaywe uphawu.

Thathela iklayenti lesibili ubunikazi bemizila

Izinketho ezimbili zivimbela iklayenti lesibili ukuhlela ithebula, futhi zisebenza ezindaweni ezahlukene. I-route-nopull iziba izinketho zomzila ezithunyelwe nge-push, ngakho akukho okufakiwe. I-route-noexec yamukela izinketho ezithunyelwe endaweni yeklayenti kodwa ishiya ushintsho lwethebula ku-hook, futhi yilokho okufunayo lapho udinga ukubona okwanikezwa iseva.

I-hook isebenza ngamanani athunyelwe endaweni yayo, futhi kufanele yengeze kuphela izinto ozivumile. Yenze ibe idempotent: sula ithebula eliliphethe ngaphambi kokulakha kabusha, futhi ungacabangi ukuthi ukusebenza kwangaphambilini kwashiya isimo esihlanzekile. Ukuxhumana kabusha kubiza i-hook futhi, futhi i-hook engeza ngaphandle kokusula iqongelela imizila ephindiwe.

Khetha umnikazi oyedwa bese uwubhala phansi. Iphrofayela ebeka zombili izinketho, noma i-hook eqhudelana neskripthi sesandla, ikhiqiza ithebula okungekho muntu ongalichaza kamuva.

Gxilisa womabili amakheli eseva

Iseva yangaphakathi idinga umzila we-host odlula kudivayisi yangaphandle ngaphambi kokuxhumana kweklayenti langaphakathi. Leyo nto yilona egcina ukuthutha kwangaphakathi ngaphakathi komhubhe wangaphandle esikhundleni sokukuvumela ukuba kulandele okuzenzakalelayo.

ip route add 203.0.113.9/32 dev tun0
ip route get 203.0.113.9

Faka nomzila we-host ofanayo wesewa yangaphandle kuthebula eliyinhloko, uma kungenjalo ukuxhumana kabusha kungaqondisa ukuthutha kweklayenti langaphandle ngokwalo kumhubhe walo. Ukulandelana akusikho okuzikhethela: faka lezi zinto ngemuva kokuba i-interface efanele ikhona, okusho i-hook noma iskripthi esisebenza ngemuva kokuxhumana. Umzila okhomba kudivayisi evaliwe uyasuswa noma uyazitshwa, ngakho into ebhalwe ngesikhathi sokuqalisa ayidluli ukulandelana obukucabanga.

Hlola ukusesha esikhundleni sokufunda lonke ithebula. Umphumela wokusesha umzila usho idivayisi nekheli lomthombo okuzosebenzisa i-kernel, futhi yilokho kanye okutholwa iklayenti lapho livula isokhethi yalo.

Hlola iketango futhi wenze ukwehluleka kubonakale

Bamba ku-interface yangaphandle ngesikhathi iklayenti langaphakathi lixhumana. Ukuxhawula kwangaphakathi kufanele kuvele njengomthwalo obethelwe ngaphakathi komhubhe wangaphandle; uma kuvela njenge-UDP evamile eya ku-203.0.113.9, umzila we-host awukho futhi iketango alikaze lakhiwe.

Iketango elibuyela buthule ku-uplink yomzimba liwumphumela omubi kakhulu, ngoba isimo se-interface asimemezeli lutho futhi ukuthutha kwangaphakathi kuphuma ekhelini lomthombo elingalungile. Uma iklayenti lesibili lingakwazi ukuxhumana kabusha ngqo lapho umhubhe wangaphandle uwa, khubaza leyo ndlela noma uyibophe ku-interface yangaphandle ukuze ukwehluleka kubonakale.

Qeda ngemigudu emibili nokukhipha umthetho owodwa: ukuxhumana okunomaka nokunganamaka kufanele kuthathe izindlela ezahlukene, futhi i-ip rule show kufanele ibale ukubaluleka obukuhlosile. Uma yomibili imigudu ithatha indlela efanayo, uphawu alusetshenziswa lapho ucabanga khona.