Isishintshi sokuphepha se-pf ku-macOS se-OpenVPN: imithetho evalayo

Ku-macOS, isishintshi sokuphepha silungile kuphela ngokwenqubomgomo yesihlungi samaphakethe esingemuva kwaso, futhi i-pf iyingxenye eqinisekisa leyo nqubomgomo. Inqubomgomo kufanele yenze izinto ezimbili eziphikisanayo ngesikhathi esisodwa: ivumele iklayenti ukuthi lifinyelele iseva yalo ukuze kube nomhubhe, futhi ivimbe konke okunye ukuthi kuphume ngqo. Izethi eziningi zemithetho ezishicilelwe zifeza okwesibili futhi zikhohlwe okokuqala, ngakho umshini ulahlekelwa uxhumano esikhundleni sokuthola ukuvikeleka. Inguqulo esebenzayo isho iphoyinti lokugcina, isixazululi kanye nomhubhe, futhi akukho okunye.

Isihlungi samaphakethe singanquma ini, futhi singanqumi ini

I-pf ibheka ama-interface, amakheli, izinombolo zeprothokholi namachweba, futhi iyema lapho. Ayikwazi ukwazi ukuthi iyiphi inqubo evule isokhethi, ngakho imvume ebhalelwe uhlelo olulodwa iba yimvume yalo lonke uhlelo olungafinyelela ichweba elifanayo. Yile ndlela isikhululo se-UDP esikhululekile esibuyisela isishintshi sokuphepha kunethiwekhi evamile. Ukuvimba okuqaphela uhlelo kungokweklayenti noma isandiso sohlelo, hhayi leli fayela.

Isihlungi asidali nemizila. Uma iklayenti liwa, umzila ozenzakalelayo usengakhomba emhubheni ofile, futhi i-pf iguqula lokho kube amaphakethe avinjiwe esikhundleni sokubuyela buthule ku-Wi-Fi. Ukuvinjwa kungumphumela ohlosiwe, hhayi iphutha okufanele ligwenywe.

Ukulandelana kunquma umphumela izikhathi eziningi kunombhalo womthetho. Ngaphandle kwe-quick, i-pf iyaqhubeka nokuhlola ngemva kokufana futhi umthetho wokugcina ofanayo uyawina, ngakho indlela ebanzi engezansi ishitsha ukukhululwa okuqaphelile okungenhla. Ukumaka izindlela nge-quick kwenza ukufana kokuqala kube okokugcina, futhi yilokho umbhali wenqubomgomo akuqondayo ngokuvamile.

Funda kuqala amaqiniso e-interface nephoyinti lokugcina

Ama-interface angenantambo awabalwa ngendlela efanayo kuwo wonke ama-Mac, futhi idivayisi yomhubhe ithola inombolo engashintsha phakathi kokuqalisa. Umthetho osho idivayisi engekho uhluleka ekuhlaziyeni, okunomsindo futhi kulula ukukubamba, kanti umthetho osho idivayisi ekhona engalungile uhlaziywa ngokuhlanzekile futhi uvumela ithrafikhi obufuna ukuyimisa.

Qoqa amaqiniso ngenkathi iklayenti lixhunyiwe, ngoba idivayisi yomhubhe ikhona kuphela ngaleso sikhathi. Udinga i-interface ephethe umzila ozenzakalelayo, idivayisi eyadalwa yiklayenti, kanye nekheli nechweba leseva elishayela kulo. Yilo kanye inani lokugcina izethi eziningi zemithetho elishiya ngaphandle, futhi ukulishiya ngaphandle yisizathu sokuthi isethi ekhoshiwe ivimbe umhubhe wayo uqobo.

route -n get default
ifconfig -l
scutil --nc list

Umyalo wokuqala usho i-interface ewina manje, owesibili ubalula yonke idivayisi eyaziwa yi-kernel, futhi owesithathu ukhombisa ukucushwa kwe-VPN uhlelo olungakuqalisa. Bhala lezo zimpendulo, bese ufunda ikheli nechweba leseva ekucushweni kweklayenti ngokwalo.

Bhala isethi yemithetho izungeze indlela yomhubhe

Ifayela elingezansi lenqaba ngokuzenzakalelayo futhi lamukele futhi izinto ezinhlanu: i-loopback, idivayisi yomhubhe, indlela yeklayenti eya kuseva yayo, isixazululi esisetshenziswa ngaphambi kokuba umhubhe ube khona, kanye nokushintshana okubili okugcina ukuxhumana okungenantambo kusebenziseka. Amagama e-interface nekheli leseva avela emshinini wakho, ngakho shintsha amanani okuqinisekisile. Inombolo yomhubhe nayo ngeke ihambisane neyakho.

set skip on lo0
block all
pass out quick on utun0
# maintain this line when the server address changes
pass out quick on en1 inet proto udp to 203.0.113.10 port 1194
# only the resolver the client uses before the tunnel exists
pass out quick on en1 inet proto udp to 192.0.2.53 port 53
pass out quick on en1 inet proto udp from any port 68 to any port 67
pass out quick on en1 inet proto udp to 224.0.0.251 port 5353

Umugqa we-DHCP ukhona ngoba i-Mac icela ikheli ngaphambi kokuba ibe nalo, ngakho isicelo siphuma echwebeni 68 siya echwebeni 67 ngaphandle kwekheli lomthombo elisebenzisekayo. Umugqa we-multicast uvumela uhlelo ukuthi lihlole ukuthi ukuxhumana okungenantambo kufanelekile yini ukusetshenziswa, futhi ukukususa kudala umshini obika ukuthi akukho xhumano kunethiwekhi esebenzayo. Umugqa wephoyinti lokugcina yiwo OpenVPN ovumela ukuthi lifinyelele iseva yalo nhlobo; ngaphandle kwawo i-block all ilahla ukuxhawulana kwangaphandle futhi umhubhe awukhuphuki. Umugqa wesixazululi mncane kunemvume evamile ye-DNS, ngoba usho ikheli elilodwa nechweba elilodwa esikhundleni sawo wonke umbuzo owenzwa umshini.

Lezo zikhululo zephoyinti lokugcina nesixazululi yizona ezimbili okufanele zibe khona; konke okunye kuhlala kuvinjiwe. Uma iklayenti lishaya ikheli langempela, susa umugqa wesixazululi futhi ugcine umugqa wephoyinti lokugcina. Uma ikheli leseva lishintsha, buyekeza lowo mugqa ngaphambi koxhumano olulandelayo, noma gcwalisa ithebula le-pf kusukela ku-hook yeklayenti ngokwalo bese ufananisa ithebula esikhundleni salokho.

Yehlisa umhubhe, bese uqalisa kabusha

Hlaziya ngaphambi kokulayisha, ngoba iphutha lokwakheka komusho lishibhile ekuzameni okomile futhi liyabiza kuseshini ekude. Bese ulayisha ifayela, uvule isihlungi uma besivaliwe, futhi ufunde okusemthethweni ngempela. Ukufunda kabusha akusona isiko: elinye i-ankile lingangeza imithetho ongayibhalanga, ngakho qhathanisa isethi ephrintiwe nefayela lakho.

sudo pfctl -n -v -f /etc/pf.conf
sudo pfctl -f /etc/pf.conf
sudo pfctl -e
sudo pfctl -s rules
sudo pfctl -s Anchors
sudo pfctl -a <anchor> -s rules
sudo pfctl -s info

Nemithetho ilayishiwe, yehlisa umhubhe bese uzama ukulayisha ikhasi. Ithrafikhi evamile kufanele ime, futhi kufanele ihlale imile ngemva kokuba umshini ulele futhi uvuke, ngoba kusona leso sinkintsho isimo esidala siphinda singene. Xhuma futhi uqinisekise ukuthi ithrafikhi iyaqhubeka ngaphandle kokuthinta isethi yemithetho. Uma isiphequluli sisasebenza nomhubhe wehlisiwe, umthetho othile ubanzi kunalokho obukucabanga, futhi ukufunda kabusha ngokuvamile uyisho.

Ukuqalisa kabusha yingxenye abantu abayeqayo. I-macOS ifunda i-/etc/pf.conf ngesikhathi sokuqalisa, kodwa ukufunda ifayela akufani nokuvula isihlungi, ngakho isethi yemithetho esebenza manje ingase ingasebenzi ngemva kokuqalisa kabusha. Bese usebenzisa i-sudo pfctl -s info futhi uqinisekise ukuthi umugqa wesimo ubika isihlungi sivuliwe.

Gcina indlela yokuphuma neyokuqalisa kabusha ithembekile

Isethi yemithetho evimba konke ingakukhiya futhi ngaphandle komshini owuphethe kude. Hlela kusukela kuseshini yasendaweni uma unakho, gcina ifayela langaphambilini eceleni kwelisha, futhi wazi indlela yokubuyela ngaphambi kokuba uyidinge. Imiyalo engezansi icisha isihlungi futhi ilayishe kabusha ikhophi oyigcinile, futhi lokho ukulandelana okufanele kusetshenziswe kusukela kukhonsole hhayi ngomhubhe osumise wona. Ukubuyela emuva ngamasekhondi amahlanu kuhlula umthetho ohlakaniphile njalo.

sudo pfctl -d
sudo pfctl -f /etc/pf.conf.previous
sudo pfctl -s rules

Ukuqina kudinga i-daemon yokuqalisa esebenzisa i-pfctl -e futhi ilayishe ifayela lakho ngesikhathi sokuqalisa. Yiphatha njenganoma yimuphi omunye umsebenzi onegunya: izindlela eziqondile, ilogi ongayifunda kamuva, kanye nokuhlolwa kumshini ongafinyelela kuwo ngokomzimba. I-daemon ehluleka buthule ishiya umshini ungavikelekile futhi ubonakala ujwayelekile.

Bhala izikhala, uqale ngeklayenti lesibili le-VPN elidala idivayisi yalo yomhubhe. Imithetho yakho isho i-interface eyodwa yomhubhe, ngakho eyesibili ihlala ivinjiwe noma ibanjwa umthetho obanzi owengezwe kamuva. Ama-interface e-tethering ne-hotspot avela ngezikhathi ezithile kuphela futhi afanelwe umbhalo ofanayo. Asikho esinye salezo zikhala okuyisizathu sokweqa inqubomgomo; yizimo okusasebenza ngaphansi kwazo.