Ingabe isilaleli se-OpenVPN 2.5 ku-DD-WRT sifile? Funda ukulungiselelwa okukukhiqizile

Isilaleli esifile ku-DD-WRT ngokuvamile sisho ukuthi i-daemon yaphuma ngenkathi ihlaziya ukulungiselelwa kwayo, hhayi ukuthi umthetho we-firewall uvimbe imbobo. OpenVPN 2.5 yaqinisa amanani amaningi okuzenzakalelayo okwakuncike kuwo ukulungiselelwa okudala, futhi ukulungiselelwa okukhiqiziwe okwakusebenza kunguqulo endala kungase kwenqatshwe ngaphambi kokuthi isokhethi livulwe. Isizathu sisekulogi yerutha uqobo, futhi okokufaka kusefayeleni elikhiqiziwe. Ukufunda kokubili ngalolo hlelo kushesha kunanoma yikuphi ukubamba iphakethe.

I-daemon ayiyona i-firewall

Umehluko ubalulekile ngoba ukwehluleka kokubili kubonakala kufana ngaphandle: iklayenti lithumela i-handshake futhi akukho okubuyayo. Okunye inqubo engasebenzi, kanti okunye inqubo esebenzayo futhi ehluzayo.

Zihlukanise ngokuhlola okubili ngaphambi kokushintsha noma yini, ngoba ukuhlela i-firewall ku-daemon efile kwengeza kuphela okuguqukayo kwesibili.

Funda ukulungiselelwa okwakhiqizwa i-DD-WRT

I-DD-WRT ayinikezi i-OpenVPN umbhalo owuwubhale kusixhumi esibonakalayo sewebhu. Ibhala ukulungiselelwa okukhiqiziwe ku- /tmp/openvpn/openvpn.conf bese iqalisa i-daemon ngalelo fayela, ngakho izinkambu zesixhumi kanye nanoma yimuphi umbhalo ku-Additional Config kuhlanganiswa ngaphambi kokuthi i-OpenVPN izibone. Uma uhlola ifomu esikhundleni sefayela elikhiqiziwe, ufunda inhloso hhayi okokufaka kwangempela. Kopisha lelo fayela endaweni ehlala njalo ngaphambi kokuthi ukuqalisa kabusha /tmp kulisule.

Qhathanisa ifayela elikhiqiziwe nalokho obukuhlose, ikakhulukazi lapho isixhumi sibhala khona umyalo ongakaze uwukhethe. Imenyu yehla ekhipha inketho ephelelwe yisikhathi ayibonakali efomini futhi iyingozi ku-daemon.

Uma ifayela elikhiqiziwe lingenalutho noma lingekho, i-daemon ayizange ifinyelele ekuqaliseni, futhi inkinga ingaphezulu kwe-OpenVPN.

Yini i-OpenVPN 2.5 eye yayeka ukuyamukela

I-OpenVPN 2.5 yashintsha ncp-ciphers nge- data-ciphers, futhi yakhuphula inguqulo encane ye-TLS okuzenzakalelayo yaba ngu-1.2. Yashintsha nokuphathwa kokucindezela, ngakho umlingani onikela ngokucindezela uyenqatshwa ngaphandle uma ukulungiselelwa kukuvumela ngokusobala, futhi yaphawula njengeziphelelwe yisikhathi amagama ezinketho amadala njenge- ns-cert-type esikhundleni se- remote-cert-tls. Ngakunye kwalokhu kushintsha kuguqula ukulungiselelwa obekusebenza kube ukwehluleka kokuhlaziya noma kwengxoxo.

Indlela yokwehluleka incike kumyalo. Inketho engaziwa noma esusiwe imisa i-daemon ekuqaliseni, yilowo isilaleli sakho esifile. Ukungafani kwengxoxo kuyeka i-daemon isebenze futhi yenqabe amaklayenti, lokhu okubonakala kuyinkinga ye-firewall ngasohlangothini lweklayenti.

Funda iphutha lokuqala kulogi, hhayi lokugcina. Ukuhlaziya kuma kumyalo omubi wokuqala, futhi konke okulandela lokho kuwumsindo wokuvala.

Izimfuneko eziqondene ngqo ne-Broadcom

Ezingxenyeni ze-Broadcom idivayisi yomhubhe kumele ibe khona ngaphambi kokuthi i-daemon iyisebenzise. Hlola ukuthi imojula ye-tun ilayishiwe nokuthi /dev/net/tun ikhona, ngoba idivayisi engekho idala ukwehluleka kokuqalisa okungahlangene neze nezitifiketi. Kuyafana ngezincwadi eziyisizile ezenziwe yi-DD-WRT zemizila ne-DNS: uma zingekho noma zingakwazi ukusetshenziswa, i-daemon ingaqalisa futhi ingakwazi ukuqeda ukusetha kwayo.

Gijimisa i-daemon phambili ngemininingwane ethe xaxa phezu kokulungiselelwa okukhiqiziwe uma udinga umyalezo wangempela. Ukugijima phambili kuphrinta iphutha lokuhlaziya elagwinya iskripthi se-init.

Bese ubuyisela insizakalo evamile, ngoba i-daemon yaphambili kanye neskripthi se-init bazophikisana ngembobo.

Fakazela ukuthi isilaleli sikhona ngaphambi kokuhlola amaklayenti

Qinisekisa inqubo kanye nesokhethi ngokwehlukana: umyalo owodwa we-daemon egijimayo, omunye wembobo ye-UDP eboshelwe ekhelini elilindelekile. Inqubo engenasokhethi isho ukuthi isesimisweni noma iboshelwe kusixhumi esingalungile. Lezi zimbili ziwukuhlola okuwusizo ngoba ingxenye eyodwa ayikwazi ukuba yiqiniso ngaphandle kwenye.

Ukuhlola ohlangothini lweklayenti kunengqondo kuphela ngemva kokuba isilaleli sikhona. Ngaleso sikhathi hlola ukuthi i-cipher nezilungiselelo ze-TLS zeklayenti zihambisana nohlu lwe- data-ciphers lweseva kanye nenguqulo yalo encane, nokuthi imbobo idluliselwa ngempela kurutha.

Gcina ukulungiselelwa okukhiqiziwe kanye nomugqa welogi owafakazela ukulungiswa. Ukubuyekezwa kwefirmware okulandelayo kungase kushintshe amanani okuzenzakalelayo futhi, futhi lowo mbhalo uyiwona oguqula ukuphindeka kube ukuhlola kwemizuzu emihlanu.