Indlela yokuhlola ukuthi umhubhe we-VPN ku-Linux usebenza ngempela

I-Cron iqala kabusha i-VPN enempilo ngokuphelele njalo ngemizuzu eyishumi, futhi umsebenzi ofanayo ushiya eyofile isebenza isonto lonke. Zombili lezi zephutha zivela ekuthatheni «iyasebenza» njengeqiniso elilodwa kuyilapho kungamane kube ngaphezu kwamane. Idivayisi ingagunyazwa ngokomthetho, ihlelwe ngendlela efanele, ibethelwe ngokuphelele futhi ingathwali lutho olusizo. Hlukanisa imibono kuqala, futhi ukuhlola cishe kuzozibhala ngokwako.

Izimpawu zesixhumanisi zichaza idivayisi, hhayi umzila

Ukuhlola okukopishwa yiwo wonke umuntu kufuna ikheli lehadiwe elingamazero kuphela. Lelo qhinga lihlukanisa isixhumanisi sangempela kusibambeli kwabanye abashayeli futhi akufakazeli lutho kwabanye, ngoba idivayisi ye-tun ayinayo i-MAC ongayibika. ip -brief link show tun0 kunalokho inikeza izimpawu: UP kusho ukuthi umlawuli uvule idivayisi, futhi LOWER_UP kusho ukuthi umshayeli ubheka isixhumanisi njengesisebenzisekayo. Uma zifundwa ndawonye, zithi idivayisi ikhona futhi ayivalwanga ngokomthetho. Akukho kuzo okuthi iphakethe linendawo yokuya.

OpenVPN yakha idivayisi yayo ye-tun ngaphambi kokufakwa kwemizila, ngakho izimpawu zingabonakala ziphelele kuyilapho kungekho lutho oluhleliwe. Zithathe njengombandela wangaphambili, hhayi njengempendulo.

Buza ukuthi iphakethe lizokuya kuphi

Ukusesha komzila kuphendula umbuzo izimpawu ezingakwazi ukuwuphendula. ip route get 10.8.0.1 from 10.8.0.2 ibiza isixhumanisi, ikheli lomthombo kanye nethebula umnyombo ongayisebenzisa, futhi yilokho kanye okufanele uhlole umhubhe ohlukanisiwe ngakho. Ngaphandle kwekheli lomthombo ubuza enye into, futhi ngokuhlela okususelwa kunqubomgomo impendulo ingahluka ngesisekelo ngasinye. Lolu wuhlolo oluthembekile olushibhile, ngoba ludinga imithetho efanayo ezosetshenziswa ukuthunywa kwakho.

Kwe-WireGuard, engeza ukuxhawula. wg show iphrinta uphawu lwesikhathi lokuxhawula kokugcina kumlingani ngamunye, futhi uphawu oluyekile ukuqhubekela phambili lusho ukuthi umlingani akekho, noma ngabe izimpawu zesixhumanisi zithini. Isixhumanisi esilungiselelwe ngaphandle kokuxhawula kwakamuva kungenye yezinto ezingamanga ezivamile ekuqapheni okwenziwe ekhaya.

Ithebula 220 lixoxa indaba ye-IPsec

strongSwan ifaka imizila yabakhethi abaxoxiwe kuthebula 220 uma ukufakwa kwemizila kuvuliwe. ip route list table 220 ngakho ihlukanisa okuxoxiwe kokuhleliwe: ithebula elingenalutho eduze koxhumano olulayishiwe kusho ukuthi ama-SA e-IKE ne-CHILD akhuphukile kodwa akukho kuthunywa okuqondiswa kuwona. Hlola ip xfrm state eduze kwayo, ngoba ibala izinhlangano zokuphepha ezifakiwe kanye neziphetho zazo.

Inqubomgomo yogibe yiyo imeko okufanele uyiqaphele. Ilinda ukuthunywa okuthakazelisayo esikhundleni sokukuhlela, ngakho ithebula lihlala lingenalutho kuze kube yilapho okuthile kuqalisa umhubhe.

Isimo somphathi kanye nesimo se-daemon kuyizinhlu ezihlukile

I-NetworkManager ibala kuphela ukuxhumana ekungokwayo. nmcli -t -f NAME,TYPE connection show --active ayibuyiseli lutho kumhubhe oqalwe ngqo wg-quick noma i-daemon ye-OpenVPN.

Lowo mehluko ubalulekile lapho umbhalo wohlelo kufanele unqume ukuthi imuphi kumaphathi amabili okufanele ubuzwe. Khetha lowo ongumnikazi wangempela womhubhe kule ndawo bese ungakunaki ukuthula komunye. Uma kokubili kukhona, nquma ukuthi imuphi onegunya bese ukhubaza owesibili, ngoba abaphathi ababili ababhala kabusha imizila kusixhumanisi esisodwa bakhiqiza iziphambeko okungekho muntu ongaziphindaphinda. Umugqa ongekho ulwazi ngomphathi, hhayi ngomhubhe.

Beka isinyathelo esilandelayo kuhlolo elilusidingayo

Ukuhlola umkhombe we-UDP akufakazeli lutho ngokulungela, ngoba i-UDP ayinakho ukuxhawula futhi nc -u kuphumelela ngokushesha uma iphakethe liphuma. Hlola lokho isinyathelo esilandelayo esikusebenzisayo ngempela: ukuxhumana kwe-TCP emkhombeni odlulisiwe, isicelo kundawo engaphakathi komhubhe, igama elixazululwa lapho kuphela. Khawulela ukulinda ngesikhathi sokuphelelwa kanye nenombolo yemizamo, futhi wehluleka ngokuzwakalayo uma kuphela.

Amakhokho anqoba ukuhlola uma iklayenti iwanikeza. --up kanye --down imibhalo ye-OpenVPN isebenza ngemuva kokuthi isixhumanisi sishintshe isimo, okususa umncintiswano ngokuphelele, kodwa isebenza ngamalungelo i-daemon eyawagcina. Uma i-OpenVPN yehlele ku-akhawunti engenamalungelo nge- user kanye group, ikhokho lisebenza njengalowo akhawunti. Ukuqalisa kabusha isevisi yesistimu khona-ke kudinga i-sudo ukuze ivume lowo myalo kanye. Nika umzamo wokuphinda kumphathi wesevisi esikhundleni somjikelezo we-cron: inqubomgomo yokuqalisa kabusha enomkhawulo wokuqala iveza umhubhe ophukile, kuyilapho umjikelezo ongenamkhawulo uwufihla ungunaphakade.