Gcina imizila yangasese futhi ususe ukuqondisa kabusha: umhubhe ohlukanisiwe we-OpenVPN
Umhubhe wamanethiwekhi angasese kuphela udinga imithetho emibili: iziqalo zangasese zidlula kuwo, ukuphequlula okuvamile kugcina indlela yaso yasendaweni. Ukususa umzila ozenzakalelayo akusona isu.
Umhubhe uyaphakama, uhlelo luyalayisha, bese kuthi konke okunye kukhompyutha ephathekayo kuqale ukuziphatha ngendlela exakile. Lona wuhlelo oluvamile lwenqubomgomo yasese kuphela eyenziwe ngokususa umugqa owodwa. Ukususa umzila ozenzakalelayo ophushisiwe kuyashintsha ngempela ukuthi ithrafikhi iya kuphi, kodwa akusho ukuthi ithrafikhi kufanele iye kuphi esikhundleni salokho, futhi akuthinti nhlobo ukuxazululwa kwamagama. Inqubomgomo idinga izingxenye ezimbili ezinhle ngaphambi kokuba ihlolwe.
Ukususa ukuqondisa kabusha kuyingxenye eyodwa kuphela yoshintsho
Ukuqondisa kabusha komhubhe ogcwele kanye nenqubomgomo yasese kuphela kuyahluka kulokho abakushoyo ngomhlaba. Ukuqondisa kabusha kufuna yonke indawo okuyiwa kuyo, kanti inqubomgomo yasese ifuna uhlu futhi ishiye okunye ngokuthula. Ukususa isimangalo ngaphandle kokubhala uhlu kukhiqiza iklayenti elingafinyeleli lutho ngaphandle kwenethiwekhi yasendaweni, okubonakala njengokwehluleka komzila kunokuba kube igebe enqubomgomeni. Bhala uhlu ngaphambi kokususa isimangalo, bese ukulandelana kwalezi zinyathelo ezimbili akusaba balulekile.
Izingxenye zombili ziyizidingo hhayi okuzenzakalelayo. Iziqalo zangasese kufanele zingene emhubheni, futhi izindawo ezivamile kufanele zigcine indlela ebezinayo ngaphambi kokuxhumeka.
Uma inhlangano iphoqa umhubhe ogcwele, akukho kulokhu okusebenzayo. Umklamo wangasese kuphela ungowokufakwa lapho ukuqondisa okuhlukanisiwe kugunyaziwe.
pull-filter ukufanisa, hhayi iswishi
Umyalelo we-pull-filter ususa izinketho eziphushisiwe ezinamagama afana nesiqalo, futhi yilokho kuphela akwenzayo. Ukushaya indiva ukuqondisa kabusha kushiya yonke enye inketho ephushisiwe endaweni yayo, okuvamise ukuba yikho okukufunayo: imizila, izilungiselelo ze-DNS kanye nenani lesango lomzila kuyafika. Futhi awukwazi ukususa umyalelo obhalwe kuphrofayela yasendaweni, ngoba ukuhlunga kusebenza kulokho okupushwa iseva.
Melana nesihe sokushaya indiva yonke inketho eqala nge-route. Lelo phethini liphonsa futhi imizila yangasese edingwa ukuxhumeka, futhi lingalahlekelwa ulwazi lwesango umhubhe oncike kulo.
route-nopull isinqumo esibanzi kunalokho okubonakala kungcono. Ivimbela iklayenti ekuthatheni imizila ephushisiwe nezinketho zesitayela se-DHCP njengeqembu, okuyinqubomgomo ehlukile ekuhlungeni inketho eyodwa.
Bhala uhlu lwemizila kusuka kuhlelo ukuya ngaphandle
Qala ngalokho umsebenzisi akuvula ngempela, bese wengeza izingxenye ezisekelayo. Uhlelo oluku-10.60.20.15 lusho inethiwekhi yalo encane 10.60.0.0/16, futhi igama langasese lisho isixazululi esiyiphendulayo. Ngakho-ke umsebenzisi ocele uhlelo olulodwa udinga izindawo ezimbili nesinqumo esisodwa se-DNS. Konke okudlula lolo hlu kuphuma kububanzi ngokwakhiwa, futhi yikho okugcina inqubomgomo ibuyekezeka.
Kuseva ebambisana, lezo ziba yimizila emibili ephushisiwe, futhi akukho kuyo okuqondisa kabusha. Gcina isakhiwo somhubhe kanye namanani esango lomzila ahlinzekwa yisevisi ekhona.
Lapho abasebenzisi abathile bodwa bedinga le nqubomgomo, yisebenzise kuklayenti ngayinye noma eqenjini ngalinye. Ukushintsha ukuqondisa kwawo wonke umuntu ukuze kulungiswe isidingo seqembu elilodwa yiyo indlela umhubhe ohlukanisiwe ophenduka ukuphazamiseka ngayo.
| Destination | Intended path |
|---|---|
10.60.0.0/16 | Tunnel, for the approved application services |
10.61.0.53/32 | Tunnel, to reach the internal resolver |
corp.example queries | Internal resolver, selected per namespace |
| Everything else | Local path and local resolver |
Vumela i-DNS ilandele indlela efanayo
Umzila oya kusixazululi awusona isu lesixazululi. Kuklayenti ye-systemd-resolved umphumela wencazelo yisizinda sokuqondisa somkhathi wamagama wangasese esikhomba kusixazululi sangaphakathi, futhi yikho okwenza kuphela lawo magama asisebenzise. Iklayenti le-Windows lidinga esikhundleni salokho indlela yalo yenqubomgomo yomkhathi wamagama. Umugqa wesiseva se-DNS kuphrofayela awufaki noma yikuphi kwalokhu ngokwawo.
Hlola lokho okukhethwe uhlelo lokusebenza hhayi lokho okufunwe uphrofayela. Ku-Linux i-resolvectl status ibonisa isizinda nesiseva ngokuxhumeka ngakunye; ku-Windows ithebula lenqubomgomo yomkhathi wamagama lingubufakazi obulinganayo.
Gcina isixazululi sifinyeleleka ngomhubhe, kungenjalo inqubomgomo ikhomba ikheli elingakwazi ukubuzwa. Ikheli lesixazululi umhubhe ongafinyeleli kulo liguqula inqubomgomo esebenzayo ibe ukuphela kwesikhathi.
Qinisekisa izingxenye zombili ekuxhumekeni kabusha
Xhuma kabusha iklayenti ngemva koshintsho bese uhlola umzila osebenzayo oya ekhelini langasese nakuya kwelomphakathi. Bese uxazulula igama langasese negama lomphakathi futhi uqinisekise ukuthi ngalinye lisebenzise isixazululi esihlosiwe. Ukulayisha kwewebhusayithi yomphakathi kufakazela ingxenye yesibili kuphela, futhi ngokuvamile iyona ngxenye esebenza ngengozi.
Rekhoda inqubomgomo eqediwe emshweni owodwa: lezi ziqalo namagama asebenzisa lokhu kuxhumeka, konke okunye kulandela indlela yasendaweni. Bese uyigcina kuphrofayela esikhundleni sokulungisa izilungiselelo ze-adaptha ngemva kokungena ngakunye.