Indlela yokuhoxisa iseva ye-VPN ngaphandle kokushiya ukufinyelela

Iklayenti lakho lisaxhuma ngosuku okhishwa ngalo ithikithi lokuhoxiswa. Iphrofayela isekhona ku-app, iyaxoxisana, futhi ithaneli likhuphuka sengathi akukho okushintshile. Leso yisikhathi sokusebenza ngendlela ephambene naleyo owakha ngayo isevisi: qala ohlwini lwamaklayenti, phuma uye esilalelini, bese uya kubhayela, futhi ugcine ngemininingwane yokufakazela ephila isikhathi eside kunazo zonke. Ukucisha i-VM yisinyathelo sokugcina, hhayi esokuqala. Lesi siqondisi sicabanga ukuthi unokufinyelela kukhonsoli yomsingathi kanye negunya lokuhlela amarekhodi eklayenti ne-DNS.

Hamba uhlu lwamaklayenti kuqala

Vula noma yini esabalalisa amaphrofayela akho futhi ufunde uhlu ngaphambi kokuthinta iseva. Yonke into esohlwini iyithuluzi elicabanga ukuthi linokufinyelela: amafoni, amakhompyutha aphathwayo, irutha yegatsha, ikhontheyna exhumanisa njalo ebusuku. Khipha lolo hlu luyongena kuthikithi, ngoba uma umsingathi usungasekho akukho wg show elizokutshela ukuthi ubani owayexhumile.

Hlukanisa ithuluzi ngalinye libe indawo yokugcina yokushintsha, ayisadingeki, noma akwaziwa. Iqembu elingaziwa yilona elibalulekile, ngoba yilawa amaphrofayela umuntu azowathola edraweni ezinyangeni ezizayo futhi azame. Thumela isaziso kuleso sitesha osisebenzisa ezingxenyeni zokufinyelela, futhi ufake usuku lokuthi indawo yokugcina endala izoyeka nini ukuphendula.

Hoxisa ubunikazi, hhayi ifayela kuphela

Izenzo ezimbili ezahlukene zombili zibizwa ngokuthi ukuhoxisa. Ku-WireGuard, i-peer igunyazwa kuphela ngokhiye wayo womphakathi ovela esigabeni se-peer esinefayela le-AllowedIPs, ngakho ukususa ifayela lokuhlela kukhompyutha akushintshi lutho kuseva. Susa isigaba se-peer bese uphinda ufake ifayela ngaphandle kokulahla ama-peer ogewulayo, njengoba wg(8) incwadi ichaza:

wg show
wg set wg0 peer <CLIENT_PUBLIC_KEY> remove
wg syncconf wg0 <(wg-quick strip wg0)

wg syncconf yingxenye ekusindisa iwindi lokulungisa. Yakha kabusha i-interface isuka efayeleni endaweni, ngakho ukususa i-peer eyodwa akudilizi ithaneli wonke umuntu elisebenzisayo. Uma uhoxisa umsingathi wonke hhayi i-peer eyodwa, ukulandelana kusabalulekile, ngoba lezo khiye zingase zithenjwe kwenye indawo.

Kusethi ye-X.509, isinyathelo sokuhoxisa isitifiketi, hhayi ifayela: openssl ca -revoke client.crt bese kuthi openssl ca -gencrl -out crl.pem. Lokho kusebenza kuphela lapho umhloli eyifunda khona, okusho ukuthi OpenVPN iseva ene-crl-verify ehlelwe futhi yalayishwa kabusha ngemuva kwalokho. Uma leli getsheni liwukuphela komsebenzisi wale CA, i-CRL iyeke ukubaluleka ngosuku efa ngalo; uma i-CA efanayo isayina igetsheni lesibili, isitifiketi ongakaze usihoxise siyoqhubeka sisebenza lapho.

Ama-akhawunti yicala lesithathu futhi yilona elivame ukweqiwa. Uma igetsheni lifakazela ngokumelene ne-RADIUS, i-LDAP noma umhlinzeki wobunikazi ophethwe, i-akhawunti ihlala ngaphandle kwe-VPN. Yikhubaze kuhla lwemibhalo. Ukususa isigaba somsebenzisi kuseva kushiya imininingwane esemthethweni indawo yokugcina yokushintsha ezoyamukela ngokushesha uma isikhomba kuhla olufanayo.

Vala izilaleli nezindlela eziya kuzo

Misa isevisi ngendlela ehlala ngemuva kokuqalisa kabusha, bese uqinisekisa ngohlu lwamasokhethi hhayi ngesimo se-unit. systemctl disable --now wg-quick@wg0 imisa i-interface futhi isusa imizila nemithetho eyengezwe yi-wg-quick; systemctl disable --now openvpn-server@server yenza okufanayo nge-OpenVPN eyakhiwe ngesifanekiso. Landela noma iyiphi nge-ss -lunp ne-ss -ltnp. Umphumela ongenalutho wembobo endala uwubufakazi kuphela obalulekile.

Lokho okwengezwe yi-wg-quick, i-wg-quick iyakususa. Lokho okwengeze ngesandla kuyahlala: umthetho we-NAT ohlala njalo, imvume yokubhayela, ukudlulisa umbobo kwerutha, umthetho wokungena weqembu lokuphepha lesifu, isilaleli sesilinganisi somthwalo. Lezo zidinga ukususwa ngokusobala, kanjalo nerekhodi le-DNS, okusho i-A, i-AAAA nanoma iyiphi i-CNAME ekhomba kulelo gama. Igama elixazulula kumsingathi ofile lehluleka ngendlela ehlukile kunegama elingaxazululi, futhi lowo mehluko uzobiza umuntu intambama.

Ikhophi oyikhohlayo iyikhophi eyakhiwe. Isithombe esigciniwe noma i-VM ebuyiselwe kukhophi isagcina okhiye bomsingathi nohlu lwama-peer endala, futhi uma kukhona okubuyisa endaweni efanayo, amaklayenti aphinda axhumane nesevisi ocabanga ukuthi ihoxisiwe. Faka ilebula kusethi yekhophi ukuthi ingeyesevisi eshiyiwe futhi uyigcine ingekho ezindlelini zokubuyisela okuzenzakalelayo.

Landelela lokho okusakhomba endaweni yokugcina endala

Amaphrofayela agcinwe kunqolobane aphila isikhathi eside kune-DNS. Ukuhlela okugciniwe okunekheli yezinombolo kuqhubeka kushaya ngemuva kokunyamalala kwerekhodi, futhi iklayenti elihlala livuliwe liphinda lizame njalo uma inethiwekhi ishintsha. Lowo umsindo hhayi ukufinyelela, ngoba isilaleli sivaliwe, kodwa ukwazi ukuthi ubheke kuyiphi kuyanquma ukuthi uphendula kanjani ithikithi.

Bese ushanele ukuncika okungekho muntu okufaka ngaphansi kwe-VPN: izivivinyo zesikhathi sokusebenza ezihlola umbobo, imisebenzi yekhophi edonsa ukuhlela kumsingathi, imininingwane yokuzenzakalela esetshenziselwa ukuthumela ama-peer, ama-akhawunti okubuyisela adalelwe le ndawo yokugcina kuphela. Ngakunye kuyindlela yokufinyelela enesikhathi sayo kanye nomnikazi wayo, ngakho ngakunye kuthola isinqumo hhayi ukususwa buthule.

Qinisekisa, bese ukubhala phansi

Ukuhoxiswa kuphela uma isivivinyo esivela ngaphandle sehluleka ngendlela oyilindele. Kusuka kunethiwekhi ongayilawuliyo, xhuma ekhelini endala nembobo. Umphumela ohlungiwe noma owenqatshiwe uyicala lokuphumelela. Ku-app yeklayenti, qinisekisa ukuthi iphrofayela isusiwe hhayi ukuthi icishiwe, nokuthi ayikho iphrofayela yokuphatha eyingeza buthule.

Bese ubhala phansi enze: indawo yokugcina, usuku, okhiye namasitifiketi ahoxisiwe, ama-akhawunti akhubaziwe, ukuthi izikhophi zikuphi. Umuntu ozothola ukuhlela okudala ngokulandelayo udinga ukuphendula ukuthi kwahoxiswa noma kwaususwa nje, ngaphandle kokuqagela, futhi ithebula elifushane kuthikithi liyakwenza lokho.

Ngaphambi kokuvala ithikithi:

• Amaphrofayela eklayenti asusiwe noma ashintshiwe, amathuluzi angaziwa axazululiwe
• Ama-peer asusiwe futhi ukuhlela kwaphindwa kufakwa, noma amasitifiketi ahoxisiwe futhi i-CRL yashicilelwa
• Ama-akhawunti ohla lwemibhalo akhubaziwe, hhayi amafayela endawo kuphela asusiwe
• Isevisi ikhubaziwe, akukho silaleli esisele embotsheni endala
• Ubhayela, ukudlulisa umbobo, iqembu lokuphepha namarekhodi e-DNS asusiwe
• Izikhophi zifakwe amalebula, isithombe esigciniwe sikhishiwe ezindlelini zokubuyisela
• Imininingwane yokuqapha neyokuzenzakalela ihoxisiwe

Qinisekisa indawo yokushintsha ngokwehlukile, kusuka kuklayenti elingakaze libe nephrofayela endala. Leso sivivinyo esisodwa sikutshela ukuthi uhoxise isevisi noma washintsha igama lenkinga kuphela.