Izikhala zamagama zenethiwekhi ze-Linux ze-VPN: azihlukanisi ini

Isikhala samagama sihambisa ama-interface, imizila namasokhethi, hhayi amafayela noma ama-akhawunti. Nakhu okumbozwa yi-VPN ku-netns yayo, nalapho ithrafikhi isaphuma khona.

Qala i-VPN ngaphakathi kwesikhala samagama sayo, sebenzisa uhlelo olulodwa lapho, futhi ithrafikhi isaphuma ngomzila womsingathi. Akukho okwephukile: isikhala samagama silawula izinqubo ezingena kuso kuphela, futhi ukuvuza kwavela kunqubo engazange ingene. Ama-interface, amakheli, imizila, imithetho yodonga lomlilo namasokhethi yikho okuphethwe yisikhala samagama. Amafayela, ama-akhawunti namasevisi asevele esebenza akunjalo, futhi iningi lezinto emangazayo livela lapha.

Yini ephethwe isikhala samagama, futhi isokhethi izalwa kuphi

Hambisa i-interface esikhaleni samagama futhi umsingathi uzolahlekelwa yiyo; akha ithuneli ngaphakathi futhi umsingathi akakwazi ukuyibona. Lona umshini we-VPN elinganiselwe esikhaleni samagama: idivayisi nemizila eqondise kuyo ihlala endaweni okungafinyelela kuyo izinqubo ezikhethiwe kuphela. Umsingathi ugcina umzila wawo wokuzenzakalela, ngakho konke okungaphandle kuhlala kungathintekile.

Ku-WireGuard isimo sokudala sibaluleke ngokulingana nendawo yamanje: isokhethi ye-UDP iboshelwa esikhaleni samagama lapho i-interface yadalwa khona, ngisho nangemva kokuba idivayisi isihambile iye kwenye indawo. Ukuthi iyiphi ithebula yomzila elandelelwa amaphakethe abethelweyo incike kuleyo ndawo yokuzalwa. Uma isokhethi ihlala endaweni engenawo umzila oya kozakwabo, i-interface iyasesha futhi ukuxhawana kwezandla akukaze kuphume. Hlola indawo yaso yokuzalwa, bese ubheka indawo yamanje.

Yini engayihlukanisi isikhala samagama

Akukho lutho lapha oluhlukanisa amasistimu amafayela, ama-akhawunti noma izimfihlo, futhi awekho kuleyo mikhawulo ovelayo ngenxa yokuthi wenze isikhala samagama. Ukuhlelwa kwesixazululi kuyifayela, ngakho inqubo engaphakathi isengafunda isilungiselelo esikhomba kusixazululi somsithi futhi ithumele umbuzo wayo ngaphandle ngomzila okushiwo yilokho. Uhlelo olunikeza isicelo kumxhumanisi noma isevisi yesistimu esivele isebenza luhilela inqubo endaweni ehluke ngokuphelele. Kokubili izicelo umkhawulo ongakaze uhloselwe ukuwaphendula.

Isixazululo yifayela lesikhala samagama ngasinye ku-/etc/netns/<name>/resolv.conf, noma i-bind mount yefayela elilungisiwe, eqondiswe kusixazululi esifinyeleleka ngaphakathi. Ukuhlela i-/etc/resolv.conf kumsithi akushintshi lutho kulokho okubonwa yisikhala samagama.

Ukubekwa kwezinqubo yikho ukulawula

Ukwehlukaniswa okukutholayo kucishe kufane nokwehlukaniswa kwezinqubo ozisebenzisa ngaphakathi. I-shell eqalwe ngosizo lwe-exec lwesikhala samagama, nakho konke ekukhiqizayo, kuhlala ngaphakathi; uhlelo lwedeskithophu olwethulwe kusuka kuseshini yomsithi aluhlali. Dala isimo, hambisa idivayisi, bese ufakazela izinhlangothi zombili:

ip netns add vpn1
ip link set wg0 netns vpn1
ip netns exec vpn1 wg show
wg show

Funda i-wg show yokuqala ngaphakathi kwesikhala samagama neyesibili kusuka kumsithi, futhi ulindele ukuthi eyodwa yazo kuphela ezobala uzakwabo. Uma zombili zenza njalo, idivayisi ayizange ihambe; uma kungekho neyodwa, ihambile iye kwenye indawo. Uma umqalisi engumphathi wamasevisi, ifayela le-unit yilo okufanele lihlelwe, hhayi isinqamuleli sedeskithophu. I-unit engenaso isilungiselelo sesikhala samagama iqala i-daemon esimweni somsithi bese icisha umklamo buthule.

Hlola kusuka esimweni sohlelo

Sebenzisa ukuhlola nge-binary efanayo nangomsebenzisi ofanayo osetshenziswa uhlelo, ngaphakathi kwesikhala samagama. Faka i-DNS kanye nemindeni yamakheli yomibili, ngoba umzila we-IPv6 ongakaze uwucabange uyindlela evamile yokuphuma. Ukuhlola okuvela ku-shell yakho siqu kubonisa kuphela ukuthi i-shell yakho yehlukene.

Bese usebenzisa ukuhlola okufanayo kumsithi futhi uqinisekise ukuthi izimpendulo ziyahluka: ikheli lethuneli nokuphuma okuhlosiwe ngaphakathi, umzila womsithi nokuphuma kwehhovisi ngaphandle, kanye nesixazululi ngegama. Qamba izikhala zamagama ngokusho kokusetshenziswa hhayi ngeprothokholi, ukuze iskripthi sokuhlanza singadidanisi ezimbili zazo.

Ukudlulisela, inqubomgomo yokwehluleka nokuhlanza

Kwi-geytheyidi, vula ukudlulisela ngamabomu futhi unqume ukuthi kufanele kwenzeke ini lapho ithuneli liwa. Isikhala samagama asivimbi imizila oyifaka ngaphakathi, ngakho umzila wokubuyela kumsithi uzosetshenziswa uma uwudala. Lesi yisinqumo senqubomgomo, futhi kufanele sibhalwe phansi ngaphambi kokuba ukuphazamiseka kusivivinye.

Qopha amagama ezikhala zamagama, ama-interface nokuthi ukuhlelwa kungokabani, ukuze ukuhlanza kususe kuphela okudalwe ukusetshenziswa. Ukusetha kabusha inethiwekhi yomsithi ngesikhathi sokubuyisela emuva kuguqula ukuhlanza kube ukuphazamiseka. Ikhasi network_namespaces(7) lifushane futhi kufanele lifundwe ngaphambi kokuba udwebe lolo hlelo.

Izihloko ezihlobene