FreeBind ngokumelene ne-After=: ukubopha i-socket ye-systemd ekhelini le-VPN

Ngesikhathi sokuqalisa, iyunithi ye-socket ebopha ikheli le-VPN elingaguquki ingase ihluleke ngaphambi kokuba ithumbu linikeze lona, futhi insizakalo engemuva kwayo ayiqali neze. Izishintshi ezimbili zibukeka njengezilungiso futhi zixazulula izingxenye ezihlukene zale nkinga. I-FreeBind ivumela i-systemd ukuthi yakhe umlaleli ngenkathi ikheli lingekho. I-After= ihlela imisebenzi kuphela, ngakho ishintsha ukuthi izinto ziqala nini ngaphandle kokwenza ikheli lifike ngokushesha.

Izinkinga ezimbili ezihlukene, izishintshi ezimbili ezihlukene

Inkinga yokuqala ukuhluleka kokubopha: i-kernel iyenqaba ukulalela ekhelini umsingathi ongekho, ngakho iyunithi ye-socket ihluleka ngokushesha futhi insizakalo ayivuliwe neze. Inkinga yesibili ukuhluleka kokulungela: ikheli likhona ekugcineni, kodwa okuthile kuzama ukulisebenzisa ngaphambi kokuba ithumbu lithwale ithrafikhi. I-FreeBind ixazulula eyokuqala futhi ayenzi lutho ngeyesibili. Imiyalelo yokulandelana ayixazululi noma yikuphi ngqo, ngoba ininquma kuphela ukuthi yini eqala ngaluphi ukulandelana. Ukusho igama lokuhluleka onawo ngempela yisona sinqumo sonke.

Qinisekisa ukuthi yikuphi kokubili onawo kusuka kujenali, hhayi encazelweni yensizakalo. Ukuhluleka kokubopha kusho ikheli futhi kubika ukuthi alinikezwa. Ukuhluleka kokulungela ngokuvamile kuvela kamuva, njengokuphela kwesikhathi noma uxhumano olunqatshiwe olubonwa kolunye uhlangothi, kuyilapho kumarekhodi kuneyunithi ye-socket enempilo ephelele.

FreeBind: umlaleli ukhona ngaphambi kwekheli

I-FreeBind itshela i-kernel ukuthi ivumele ukubopha ekhelini elingeyona eyasekhaya, ukuze i-systemd yakhe i-socket elalelayo ngesikhathi sokuqalisa futhi iyinikeze uhlelo lokusebenza noma nini lapho uhlelo luqala. Yilokho okushiwo ukusebenza kwe-socket, futhi yisizathu esenza i-socket iphile isikhathi eside kunensizakalo engemuva kwayo.

[Socket]
ListenStream=
ListenStream=10.8.0.1:8443
FreeBind=yes

Isabelo esingenalutho sisusa amarekhodi okulalela azuzwe njengefa kuyunithi yomhlinzeki ngaphambi kokufaka elisha, lokhu okuvimbela umlaleli we-wildcard osele ukuthi aphendule kuzo zonke izixhumanisi. Shintsha ikheli nechweba ngezakho futhi uqinisekise iyunithi esebenzayo, hhayi ifayela le-drop-in kuphela. Sebenzisa i-drop-in ngaphansi kwegama leyunithi esikhundleni sokuhlela ifayela lephakethe endaweni yalo, ngoba isibuyekezo sephakethe esilandelayo sizosula ukuhlela futhi asiyikushiya uphawu lwenhloso. Bese uyisebenzisa ngenqubo yokulayisha kabusha nokuqalisa kabusha elindelwe iyunithi ye-socket.

Isithenjwa se-socket ye-systemd sibhala ukuziphatha kwe-IPv4 ne-IPv6 ngemuva kwale nketho, futhi imininingwane ebalulekile ukuthi isebenza ekubopheni hhayi ekuhambiseni. Akukho lutho kuso okwabela ikheli noma okuqalisa i-VPN. I-FreeBind imvume enikezwa umlaleli, hhayi into esikhundleni sesixhumanisi.

After= ne-Wants=: ukulandelana akukona ukulungela

Ukulandelana nesidingo kuyimiphakathi ehlukene, futhi ukuzihlanganisa kukhiqiza amayunithi aqala ngokulandelana okufanele futhi ahluleke. I-After=vpn-client.service isho kuphela ukuthi uma yomibili imisebenzi iqalisiwe, lena ilinda enye ukuthi iqalisiwe. Ayingeni i-VPN futhi ayilindi ukuthi i-VPN iqede ukuxhuma.

Imiyalelo yesidingo njenge-Wants= ne-Requires= ibheka ukusebenza, futhi iyahluka kulokho okwenzeka lapho ukuncika kuhluleka: enye iyaqhubeka futhi enye iyama. Akukho kuzo okwazi ukuthi kusho ukuthini ithumbu elixhunyiwe. Inqubo ye-VPN ingase isebenze ngaphandle kwekheli elinikiwe, noma inekheli elinikiwe futhi ingenayo indlela eya kumlingani, futhi zombili lezi zimo ziyasikhokhela isidingo. Uma uhlelo ludinga ukuthi ikheli libe khona, yenza isibonelo salowo mbandela ngokusobala esikhundleni sokuthatha ukuqala kwenqubo njengobufakazi bokulungela.

Hlola ukuthi iyunithi imemezela ini ngempela nge-systemctl cat ne-systemctl show -p After -p Wants -p Requires. Ama-drop-in avela kumafolda amathathu ahlukene angangeza imiyalelo ongakaze uyibhale, futhi i-systemd ifunda iyunithi esebenzayo kuphela.

Lokho i-network-online.target engakwenzi

Iyunithi ehlelwe ngemuva kwe-network-online.target ilinda umphathi wenethiwekhi ukuthi amemezele ukuthi inethiwekhi iyasebenziseka, okuyiphuzu lokuvumelanisa ngesikhathi sokuqalisa hhayi umbandela oqhubekayo. Ayisho lutho mayelana nokuthi ithumbu elithile liphezulu yini, futhi ngeke iphinde ivuleke lapho i-VPN ixhuma kabusha ntambama. Ukuyithatha njengomqaphi wokuxhuma kabusha ukufunda okungalungile okuvame kakhulu kwalelo qoqo.

Iphrojekthi ye-systemd ibhala lowo mehluko ngqo, futhi umphumela ongokoqobo ukuthi noma yini edinga ikheli lethumbu kufanele ibe nokuncika ngokwayo. Iyunithi elinda i-network-online bese ibopha ikheli lethumbu ilungile kuphela lapho ithumbu likhuphuka kuqala ngesikhathi esifanayo, futhi lokho kuyingozi hhayi umklamo.

Hlola umjikelezo wempilo owukhethile ngempela

Hlola ukuqalisa okuhlanzekile, isicelo ngemuva kokuvela kwekheli, nokuziphatha ngemuva kokuthi i-VPN iwe futhi ibuye. Lezo zimo ezintathu zihlukanisa umlaleli osebenzayo nensizakalo esebenzayo.

systemd-analyze verify myapp.socket
systemctl cat myapp.socket
ss -ltn "sport = :8443"

Umyalo wokuqala ubamba amaphutha efayela leyunithi ngaphambi kokuqalisa kabusha, owesibili ukhombisa iyunithi ehlanganisiwe, futhi owesithathu ufakazela ukuthi umlaleli ukhona yini nokuthi ukuliphi ikheli. Umlaleli ekhelini le-wildcard lapho ubulindele ikheli lethumbu yisalelo esifanayo okwakufanele lisuswe yi-ListenStream engenalutho. Phinda umyalo wesithathu ngemuva kokuxhuma kabusha kwe-VPN ukuze ubone ukuthi ikheli lihambile yini.

Khetha umjikelezo wempilo ngamabomu: kungaba umlaleli oboshwe ngokukhululekile olinda ukubuya kwekheli elizinzile, noma insizakalo ema nethumbu futhi iqale futhi lapho kululama. Lezi ziwumklamo ohlukene futhi zihluleka ngezindlela ezihlukene. Bese ugcina inqubomgomo yokufinyelela iboshwe emithonjeni nasezindleleni obuhlose zona, ngoba ukubopha ikheli lendawo oya kuyo akudingi ukuthi amaphakethe amukelwe afike ngesixhumanisi esethenjwayo.