Ukuphuka kwe-OpenVPN njalo ngehora: ukuxoxisana kabusha noma ukuxhuma kabusha kwangempela?

Amaminithi angamashumi ayisithupha, noma angamashumi amathathu, noma ikhulu namashumi amabili: ukuphuka okuhla esikhaleni esiyindilinga cishe akukho neze ukuthi yi-network. OpenVPN ivuselela ngesibali sikhathi izinto zokhiye ezivikela isiteshi sedatha, futhi isibali sikhathi esifushane kunaleso obukade ucabanga sibonakala sifana ncamashi nesixhumanisi esihluleka njalo. Abasebenzisi babika uxhumano oluphukile kuyilapho ukubhalwa kubika ukushintshana kokhiye okuphumelelayo. Umhlahlandlela ongezansi uhlukanisa lokho kuvuselela nokuqala kabusha kwangempela, ufunda inani elisebenza ngempela, futhi ulishintsha kuphela ngemva kokuba izindleko zibekwe etafuleni.

Yenza izinyathelo ngokulandelana, ngoba esokuqala sinquma ukuthi ingxenye esele yekhasi ikuthinta noma cha. Uma weqa phambili, uzochitha ubusuku uhlela isibali sikhathi ngenxa yephutha elingenakho ukuxhumana nakho.

Hlukanisa ukusetha kabusha okuthambile nokuqala kabusha

Umugqa wokubhalwa uyingqondo yonke yokuxilonga. Ukuxoxisana kabusha kubhala ukusetha kabusha okuthambile bese kuba ukushintshana okusha kokhiye ngaphakathi komhubhe ofanayo: isixhumanisi sigcina ikheli laso, imizila ayengezwa futhi, futhi izikhathi ze-TCP ezisunguliwe zivame ukusinda ngokumisa. Ukuqala kabusha kwangempela kuklebhula isikhathi, kwakha kabusha isixhumanisi, kungase kunikeze ikheli elihlukile lekhasimende, futhi kubulale konke ukuxhumana okude. Zombili izehlakalo zivamile; eyodwa yazo kuphela echaza ucingo oluphukile.

journalctl -u openvpn-client@office -b --no-pager | grep -nE 'soft reset|Connection reset|reneg|TLS Error'
openvpn --version | head -n 1

Umugqa wenguqulo ubalulekile ngoba amagama okubhalwa ashintsha phakathi kwezinguqulo, futhi umyalezo owukhumbulayo kusukela ku-2.3 ungase ubhalwe ngendlela ehlukile ku-2.6. Funda ukubhalwa kwakho, hhayi isiqeshana seforamu somunye umuntu. Cabanga umugqa oqondile uma ucela usizo, ngoba ukusho ngenye indlela kulahlekelwa imininingwane ekhomba isehlakalo. Uma ikheli lesixhumanisi lingashintshanga phakathi nesehlakalo futhi uhlu lwezikhathi lusaphila, ubona ukuvuselela futhi izigaba ezisele ziyasebenza.

Funda isibali sikhathi esisebenza, hhayi ifayela lakho

reneg-sec inani lamasekhondi phakathi kokuxoxisana kabusha kwesiteshi sedatha futhi inani lalo elizenzakalelayo ngu-3600. Uhlangothi ngalunye luthwala inani lalo, futhi elincane kula mabili yilona eliqala ukuvuselela ngempela. Lowo mthetho owodwa uchaza iningi lemibiko: iphrofayela yekhasimende ebeka inombolo enkulu isasetshenziswa kabusha njalo ngehora uma iseva igcina inani elizenzakalelayo.

grep -Rn --include='*.conf' -E 'reneg-sec|reneg-bytes' /etc/openvpn
# server side, including included files
grep -Rn -E '^reneg-sec' /etc/openvpn/server/

Funda futhi ukucushwa okusebenzayo kweseva, kuhlanganise nakho konke elikuthumelayo, ngaphambi kokuphetha ngokuthile kusukela kufayela lekhasimende. Bese ukhuphula izinga lemininingwane futhi ubuke isikhala esisodwa kusukela ekuqaleni kuze kube sekupheleni: izinga 3 selivele likhombisa imigqa yokuxoxisana kabusha, futhi izimpawu zesikhathi zitshela ukuthi isehlakalo siphinda njalo ngamasekhondi angu-3600 noma silandela umsebenzi.

Kushintshe lapho kuthunyelwa khona ngempela

Umuthi ojikelezayo umugqa owodwa kuphela kwiphrofayela yekhasimende, futhi cishe ingxenye yesikhathi iyindawo engalungile. Ngoba inani eliphansi lohlangothi liyawina, ikhasimende elibeka isibali sikhathi ku-zero lisengaqoshwa kabusha yiseva engashintshanga.

# on both ends, or on the side that owns the pushed configuration
reneg-sec 0

Lapho amaphrofayela akhiwa ngendlela emaphakathi, hlela ithempulethi hhayi ikhophi esetshenzisiwe, ngaphandle kwalokho ukugijima kokuhlinzeka okulandelayo kuzobuyisela inani osanda kulikhipha. Qinisekisa ngokubuka izikhala ezimbili, hhayi esisodwa: ihora elilodwa elithule lihambisana nesibali sikhathi esibekwe ku-7200.

Nquma futhi ukuthi kwenzeka nini ekusabalaliseni okuxubile. Uma usabalalisa ushintsho kubakhasimende kuqala, kusala iwindi lapho iseva isaqala ukuvuselela khona; lokho akunabungozi kodwa kuyadida uma ubuka ukubhalwa ukuze uqinisekise. Shintsha uhlangothi olunenani elincane kuqala futhi uphawu luyonyamalala endaweni oyilindele.

Yini oyekayo ngokuvala ukuxoxisana kabusha

Ukuxoxisana kabusha okuvamile kunciphisa isikhathi iqoqo elilodwa lokhiye besiteshi sedatha livikela ngaso ithrafikhi. Ukucisha isibali sikhathi akwephuli umhubhe, futhi kumaroja yasekhaya noma isango lehhovisi elincane ukuchayeka okungokoqobo kumaphakathi. Kusewukushintshana, futhi ukushintshana kufanele kushiwo ngaphambi kokuba ukwenze. Okushintshayo ukuthi iqoqo elilodwa lokhiye livikela isikhathi esingakanani, hhayi ukuthi umhubhe uyasebenza noma cha.

Isizathu esizwakalayo sokuvala ukusetha kabusha okwephula into engenakuqhubeka: ucingo oluphukayo, isikhathi sedeskithophu elikude okufanele sisungulwe kabusha, ikhophi yokugcina eqala kusukela ekuqaleni. Uma ukumisa kungabonakali kubasebenzisi, ukushiya inani elizenzakalelayo akubizi lutho futhi kugcina ukujikeleza kokhiye okunikeziwe.

Khetha ukulungisa imbangela uma iphethini ivuma. Ukuvuselela okwehluleka phakathi nendawo kuyilapho ukuxhawulisana kokuqala kuphumelele kukhombisa indlela hhayi isibali sikhathi: funa inkinga yosayizi wephakethe ekushintshaneni okukhulu kwesiteshi sokulawula, i-firewall enesimo elahla ukugeleza, noma isiphakamiso esiphumelela kuphela emzameni wokuqala. Ngakunye kwako kushiya umkhondo ekubhalweni okufanayo okusanda kukufunda. Ukucisha isibali sikhathi kufihla lobo bufakazi.

Lapho isikhala sikhomba kwenye indawo

Okomelwane ababili ekucushweni bakhiqiza izimpawu ezifanayo nezilungiso ezihlukile. I-ping-restart iqala kabusha umhubhe uma kungangeni lutho isikhathi esibekiwe, kuyilapho i-ping-exit yehlisa ikhasimende ngokuphelele. Ukuphuka ngesikhathi sokungenzi lutho ngaphandle kokuxoxisana kabusha noma kuphi ekubhalweni kungokwalokhu, noma kwedivayisi ye-NAT eyavumela imephu ye-UDP ukuthi iphele ngokohlelo layo.

Amaroja abathengi, ama-hotspot eselula kanye ne-NAT yezinga lomhlinzeki konke kuvumela izikhathi ze-UDP ezingenzi lutho ukuthi ziphele ngaphandle kokutshela muntu. Lokho kwehluleka kulandela ukungenzi lutho hhayi iwashi, futhi yilokho okuyisibonakaliso: isikhathi esiphuka ngemva kwemizuzu eyishumi ethule futhi sisinda ihora lethrafikhi ezinzile asixoxisani kabusha.

Bhala izinto ezintathu ngaphambi kokushintsha eyesine: isikhala osikala, inani elisebenzayo olenzile, kanye nomyalo owalikhombisayo. Uma isikhala sihamba lapho isibali sikhathi sihamba, indlela isivele yaziwa futhi ukulungisa kuyisinqumo mayelana nokushintshana okungenhla. Uma singahambi, buyisela isethingi bese uqhubeka ubheka i-keepalive, isimo se-NAT nokulahleka kwamaphakethe.