Kuxhunyiwe ku-OpenVPN kodwa akukho okulayishwayo: uhambo olusuka kuklayenti luya ngaphandle

Iwindi leklayenti lithi Connected, ikheli lethuneli likhona, kodwa isiphequluli sisazungeza. Le nhlanganisela ijwayelekile, ngoba ukuxhawula okuphumelelayo kufakazela kuphela ukuthi ithuneli lakhiwe; akusho lutho mayelana nokuthi iseva izodlulisa amaphakethe akho, ibhale kabusha umthombo wawo, noma iphendule imibuzo yakho ye-DNS. Iphutha abantu abaningi abalenzayo ukuvula ukumiswa kweseva kuqala. Esikhundleni salokho sebenza usuka kuklayenti uye ngaphandle, ngoba isinyathelo ngasinye esingezansi sisho ukuthi esilandelayo sifanele ukuhlolwa yini.

Qala kuklayenti bese uya ngaphandle

Yenza izivivinyo ezintathu ngalolu hlelo bese ubhala ukuthi eyokuqala yehluleka kuphi. Finyelela nge-ping ekhelini lethuneli leseva, lokho kufakazela ukuthi ithuneli ngokwalo lithwala ithrafikhi. Finyelela nge-ping ekhelini lomphakathi ngenombolo, lokho kufakazela ukudluliswa nokuhunyushwa ngaphandle kokubandakanya ukuxazululwa kwamagama. Bese uzama ukuxazulula igama lomsingathi, okuyisivivinyo esisodwa kuphela esisebenzisa i-DNS. Umsuka ngamunye ususa isendlalelo esiphelele ekusoleni.

Ungagxumi esivivinyweni sesithathu ngoba isiphequluli sizwakala sishesha. Ukulayisha ikhasi okuhlulekileyo kuhlanganisa zonke izendlalelo ezintathu ngesikhathi esisodwa, futhi yilapho abantu beqala khona bese bakha kabusha ithuneli elalisebenza. Ikhasi elihlulekayo alisho ukuthi iyiphi kwezintathu ephukile.

Ukubamba okubili kubonisa lapho amaphakethe ayeka khona

Ngenkathi i-ping iya ekhelini lomphakathi ihamba isuka kuklayenti, thatha ukubamba okukodwa ku-interface yethuneli nokunye kusixhumanisi esiphezulu okufanele sifinyelele i-inthanethi. Sebenzisa kokubili ngesikhathi esisodwa ukuze izimpawu zesikhathi zihambisane.

sudo tcpdump -ni tun0 -c 20 icmp
sudo tcpdump -ni enp1s0 -c 20 icmp

Uma izicelo zivela kuthuneli futhi zingaveli neze kusixhumanisi esiphezulu, iseva iziphonse phakathi kwethuneli nentambo, futhi imbangela ukudluliswa noma inqubomgomo yodonga lomlilo yokudluliswa, hhayi i-NAT. Uma zivela kukho kokubili, iseva yenza ingxenye yayo futhi impendulo ilahlekile kude nakakhulu, lokho kukhombisa ukuhunyushwa, isihlungi esiphezulu noma umkhawulo ovela kumhlinzeki.

Thatha igama lesixhumanisi esiphezulu etafuleni lokuhlela, hhayi encwadini yokufundisa. Izithombe zamafu nama-adaptha aqanjwe kabusha akuvamisile ukuhambisana ne-interface yesibonelo emhlahlandlelweni, futhi ukubamba okwenziwe kudivayisi engalungile kubukeka njengeseva engadlulisi:

ip -4 route get 9.9.9.9

Inkambu ye-dev kuleso sikhathi sokuphuma iyigama izodingeka ngayo inqubomgomo ye-NAT kamuva, ngakho yigcine.

Ukudluliswa kuyiswishi ku-kernel kanye nenqubomgomo yodonga lomlilo

I-kernel kufanele ivume ukudlulisa nhlobo. Funda inani lamanje, bese wenza ukumiswa kube okuhlala njalo esikhundleni sokukubhala ku-kernel esebenzayo kuphela:

sysctl net.ipv4.ip_forward
printf 'net.ipv4.ip_forward=1\n' > /etc/sysctl.d/70-vpn-forward.conf
sysctl --system

Ukudluliswa kuyingxenye eyodwa kuphela. Kusibungu esisebenzisa i-UFW inqubomgomo yokudluliswa isethwa ku-/etc/default/ufw futhi kufanele ibe yi-ACCEPT ngaphambi kokuthi ukulayisha kabusha kusebenze. Ukulahla okuzenzakalelayo endleleni yokudluliswa kushiya ukuxhawula kunempilo ephelele kodwa kuthela ngokuthula wonke amaphakethe azama ukuphuma ethunelini, futhi yilokho kanye uphawu owaqala ngalo.

Amabungu aphethe i-nftables ngqo anombuzo ofanayo ngolunye uhlelo lokubhala. Bheka izibali kuketanga yokudluliswa ngenkathi isivivinyo seklayenti siqhubeka, ngoba iketanga okubuzwa kuyo neketanga elahla kubukeka kufana efayeleni lokumiswa.

Qamba i-interface yokuphuma yangempela kumbuso we-NAT

Ukuhunyushwa komthombo kungokwe-interface eshiya isibungu ngempela, kanye nechibi iseva esabela ngayo. Zombili izingxenye zalowo mthetho kufanele zichaze iqiniso, futhi akukho ngxenye eyodwa engaziphathi.

iptables -t nat -A POSTROUTING -s 10.44.0.0/24 -o enp1s0 -j MASQUERADE

Ukwehluleka okujwayelekile umthetho okhishwe emhlahlandlelweni othi -o eth0 kumsihini i-adaptha yawo ebizwa ngenye indlela. Umthetho uyafakwa ngaphandle sesexwayiso, awuhambisani nalutho, futhi iklayenti alinayo i-inthanethi. Ichibi nalo liyingxenye yesibili yephutha elifanayo: uma iseva isabela i-10.44.0.0/24 futhi umthetho uhlanganisa i-10.8.0.0/24, akukho okuzohambisana nanini.

Bheka izibali esikhundleni sokwethemba umbhalo womthetho. Uhlu lubika amaphakethe ngomthetho ngamunye, futhi umthetho ongahambisani nanini uhlala kuziro noma ubukeka ulungile kangakanani. Yinike umzuzu wethrafikhi yeklayenti yangempela ngaphambi kokufunda okuthile kuleyo nombolo:

iptables -t nat -L POSTROUTING -v -n

Isibalo samaphakethe esiyiziro ngemva kwesivivinyo seklayenti yangempela sisho ukuthi ukuhambisana akulungile, hhayi ukuthi ithuneli liphukile. Uma sekuhambisana, gcina isethi yemithetho ukuze yeqe ukuqalisa kabusha; isilungiso esihlala emlandweni we-shell yakho kuphela siyanyamalala ekuqalisweni kabusha kokuqala.

Uma iseva futhi iyisibonelo se-NAT samafu, ipulatifomu nayo inezwi. Isibonelo esihumusha amakheli ngokuvamile sidinga ukuhlolwa komthombo nendawo okuvaliwe lapho umhlinzeki enikela ngokumiswa kwalokho, futhi imbobo ye-VPN ngokwayo kufanele ifinyeleleke ngaphandle.

I-DNS ukwehluleka kwesibili ngemva kokokuqala

I-ping ngekheli esebenzayo ngenkathi amagama ehluleka iyinkinga yesixazululi, futhi inembangela yayo. Iklayenti eligcina isixazululi saso sendawo sithumela leyo mibuzo ethunelini eligcwele futhi lilinde impendulo engasoze ifike, ngoba isixazululi sendawo manje siseceleni okungalungile somzila.

Phusha isixazululi sisuka kuseva ukuze iklayenti lazi lapho lizobuza khona. Amafayela amabili anikeza iklayenti indlela yokubalekela uma eyokuqala ingafinyeleleki, futhi womabili kufanele kube yizixazululi ithuneli elizivumelayo ngempela.

push "dhcp-option DNS 9.9.9.9"
push "dhcp-option DNS 149.112.112.112"

Amaklayenti e-Windows angase abuyele kusixazululi sendawo noma kunjalo, futhi yilokho kanye i-block-outside-dns ekhona ukuze kugwenywe, ngezindleko zokulahlekelwa amagama enetworki yasendaweni kuphela engawaxazulula. Amaklayenti e-Linux asebenzisa i-systemd-resolved ngokuvamile awanaki isixazululi esiphushiwe ngaphandle uma umbhalo uwufaka, ngakho hlola i-resolvectl status yedivayisi yethuneli ngaphambi kokuphetha ngokuthi ukushushisa kwashaywa indiva.

Qeda uhambo ngendlela umsebenzisi ayibona ngayo. Layisha ikhasi langempela kuklayenti, qinisekisa ukuthi liphuma kuyiphi ikheli, qalisa kabusha iseva, xhuma futhi, bese uphinda izivivinyo ezintathu. Lowo mjikelezo wesibili kuphela ofakazela ukuthi imithetho egciniwe, inqubomgomo yodonga lomlilo kanye nesixazululi esiphushiwe konke kwasinda ndawonye.