ifconfig-push: ikheli le-peer ku-net30 noma i-netmask ku-subnet?

Ingxabano yesibili ye-ifconfig-push iyikheli le-peer ku-net30 kanye ne-netmask ngaphansi kwe-topology subnet. Qhathanisa i-topology esebenzayo ngaphambi kokuhlela ifayela le-CCD.

Amaklayenti ashintshayo axhuma futhi ahamba kahle, kodwa iklayenti elilodwa elinekhili eligxilile alikwazi ukufinyelela iseva nhlobo. Akukho okushintshile ku-firewall, futhi umugqa we-CCD ubonakala unengqondo. Imbangela evamile iyimpikiswano yesibili ebhalelwe i-topology ye-TUN ehlukile kunaleya esetshenziswa iseva. Ukwehluleka kuthule: iklayenti livuka linekhili futhi iseva lamukela uxhumano, kodwa akukho traffic edlulayo.

Ku-net30 leyo nkambu iyikheli le-peer; ku-subnet iyi-netmask. Lezi zinhlobo ezimbili ziyizinye, hhayi ukulandelana.

Izinhlobo ezimbili, ngokuhambisana

Ekufakweni kwe-net30 evamile iklayenti ngalinye linobhloko lwe-/30: ikheli lenethiwekhi, amakheli amabili asebenzisekayo kanye nekheli lokusakaza. ifconfig-push ithatha ikheli leklayenti nekheli le-peer, futhi i-peer iyikheli elinye elisebenzisekayo kulo mbloko, elisetshenziswa uhlangothi lweseva lwesixhumanisi se-point-to-point.

# net30: client address and its peer
ifconfig-push 10.99.0.6 10.99.0.5
# topology subnet: client address and the pool netmask
ifconfig-push 10.99.0.20 255.255.255.0

Ngaphansi kwe-topology subnet iklayenti labelana ngesubnet eyodwa neseseva, futhi umyalo ofanayo uthatha ikheli ne-netmask. Ikheli leseva ngokwalo livela kumyalo we-server, hhayi enkambini yesibili. Ukuhlanganisa izinhlobo kukhiqiza iklayenti elicabanga ukuthi lisekuxhumaneni kwe-point-to-point ngenkathi iseva liyihambisa njengomsingathi wesubnet, noma okuphambene. Yingakho i-netmask ingalokothi ihlanganiswe ne-net30.

Imigqa yomibili kubhloko iyimigqa ehlukene yefayela le-CCD. Iklayenti elilodwa lithola eyodwa yayo ngqo.

Funda i-topology iseva esetshenziswa ngempela

Funda ukucushwa okusebenzayo hhayi okuzenzakalelayo kwephakheji, ngoba i-topology kungenzeka yasetwa eminyakeni edlule futhi yakopishwa phambili. Bheka i-topology subnet noma ukungabikho kwayo, bese uhlola ukuthi umugqa we-server wabela kanjani amakheli. Ukucushwa okungasho neze i-topology akufani nalokho okusetha i-subnet.

Bese ufunda izilungiselelo iklayenti elizitholile. Ikheli, i-netmask ne-peer elikubikayo kukutshela ukuthi iseva isebenzise yiphi incazelo.

Gcina ikheli eligxilile ngaphandle kwedamu elishintshayo

Ikheli eligxilile kufanele libe ngaphandle kwedamu elishintshayo, ngaphandle kwalokho amaklayenti amabili angathola ikheli elifanayo. Nge-topology ye-subnet, i-nopool kumugqa we-server icindezela idamu elizenzakalelayo, futhi ibanga elicacile le-ifconfig-pool lichaza lokho amaklayenti ashintshayo akutholayo.

dev tun
topology subnet
server 10.99.0.0 255.255.255.0 nopool
ifconfig-pool 10.99.0.100 10.99.0.210 255.255.255.0
client-config-dir /etc/openvpn/ccd

Iseva ithatha i-10.99.0.1 yayo, futhi ikheli leklayenti eligxilile liseduze kwedamu. Ifayela le-CCD liqanjwa ngobunikazi obusebenzayo beklayenti, hhayi ngegama lefayela lephrofayela, futhi alithathi isandiso esengeziwe. Uma i-username-as-common-name isebenza, igama lomsebenzisi eliqinisekisiwe liwubunikazi okufanele buqondaniswe. Amadivayisi amabili abelana ngobunikazi obubodwa azabelana nangekheli eligxilile, okuyinkinga yenqubomgomo hhayi yokuhamba kwemizila.

Qinisekisa isabelo iklayenti elisitholile ngempela

Xhuma kabusha iklayenti okuhlosiwe futhi uqinisekise ukuthi yiliphi ifayela le-CCD elikhethiwe ngaphambi kokuhlola noma yini enye. Bese uqinisekisa ikheli, i-netmask noma i-peer, kanye nomzila obuyela eseveni. Iklayenti elibonisa ikheli le-peer ekufakweni kwe-subnet lisasebenzisa indlela engalungile.

Ukushintsha i-topology kuthinta iklayenti ngalinye nakho konke ukubhala ngaphezulu, ngakho-ke kubheke njengokufuduka hhayi ukulungisa iklayenti elilodwa. Ukulungisa umugqa ongagxilile ukuze uhambisane ne-topology esetshenziswayo ngokuvamile ukushintsha okuncane. Isithenjwa se-server-options sichaza umsizi kanye nokubhala ngaphezulu okuqondene neklayenti.

Izihloko ezihlobene