I-IP yesiphakeli efanayo, izindlela ezimbili: ukumaka ukugeleza kwangaphandle kwe-OpenVPN

Ukuvikelwa komjikelezo okuvamile kuyindlela yomsingathi: thumela ukugcwala ekhelini lomphakathi lesiphakeli se-VPN ngaphandle nge-uplink ukuze isikhathi esibethelwe singalokothi singene emhubheni waso. Lokho kusebenza kuze kufike isikhathi lapho nawe ufuna ukufinyelela insizakalo yewebhu kuleso siphakeli ngomhubhe, ngoba ukukhululwa kubotshelwe endaweni ekuyiwa kuyo futhi indawo ekuyiwa kuyo iyafana. Indlela yokuphuma ukuyeka ukuhlukanisa ngendawo ekuyiwa kuyo bese uqala ukuhlukanisa ngokuthi iyiphi isokhethi ethumele iphakethe.

Qala ngemifudlana emibili ofuna ukuyihlukanisa

Umfudlana owodwa ukuthuthwa kwe-OpenVPN okubethelwe ngokwako, okufanele kuphume nge-uplink, ngaphandle kwalokho umhubhe uzothwala ukuxhumana kwawo kwangaphandle. Omunye isicelo se-HTTPS esijwayelekile kulelo kheli lomphakathi, ofuna ukuba ngaphakathi komhubhe ukuze sifike ensizakalweni sivela emthonjeni womhubhe. Indawo eyiwa kuyo efanayo, ezimweni eziningi inombolo yechweba efanayo, indlela edingekayo ehlukile.

Kulolu hlelo, cabanga iklayenti liku-10.90.0.10 nge-tun1, ikheli lomphakathi lesiphakeli elingu-198.51.100.25, nethebula eliyinhloko elingakathintwa elinomzila walo ozenzakalelayo okhomba ku-uplink ojwayelekile. Uhlangothi lwesiphakeli kufanele futhi lwamukele insizakalo yewebhu emzileni wangaphakathi futhi lubuyisele ukugcwala emthonjeni womhubhe; ukuthumela iphakethe ekhelini lomphakathi akukususi isilaleli noma inqubomgomo ye-firewall yesiphakeli.

Ngaphambi kokushintsha noma yini, bhala imithetho yamanje yomsingathi bese ukhetha amanani okungekho omunye umuntu owasetshenzisayo: umaka, inombolo yethebula kanye nokubaluleka kwemithetho emithathu. Gcina indlela yokubuyela emshinini engahambi ngalokhu kuxhumana, ngoba iphutha lapha lisusa ukufinyelela kwakho kude, hhayi nje ukwephula ithebhu yesiphequluli.

Maka isokhethi ethwala isigaxa

Ukucushwa kweklayenti kuthola umaka wamaphakethe akho aphumayo abethelwe futhi kuyeka ukufaka imizila ngokwako, ukuze inqubomgomo yokushintsha ibe yiyo kuphela enquma imizila:

mark 42
route-noexec
disable-dco

Idesimali engu-42 yi-hexadecimal 0x2a, futhi ifomu le-hexadecimal yilona imithetho yomzila ezohambisana nayo. Isithenjwa se-link-options sichaza mark njengento esebenza kumaphakethe aphumayo abethelwe ku-Linux, okuyisokhethi ngqo okudingeka ulawule umzila wayo. Ukucisha i-offload yesiteshi sedatha kugcina lesi sibonelo emzileni wendawo yomsebenzisi, lapho ukuziphatha komaka kuyikho okuchaziwe.

I-route-noexec icindezela ukwengezwa nokususwa kwemizila okuzenzakalelayo kwe-OpenVPN. Ayifaki lutho esikhundleni yako, ngakho kusukela manje umnikazi wemizila kufanele anakekele wonke umzila odingwa umhubhe. Uma indawo eyimfihlo inyamalala ngemva koshintsho, leyo yinqubomgomo yokushintsha engekho, hhayi iphutha kumaka.

Ungagcini umzila womsingathi kuthebula eliyinhloko we-198.51.100.25 ngenkathi wenza lokhu. Umzila onjalo ubuyisela ngqo ukukhululwa okuhloswe yidizayini ukukunciphisa, futhi uzokunqoba kumfudlana we-HTTPS ngaphambi kokuba kuhlanekezelwe noma iyiphi inqubomgomo engezansi.

Thumela konke okunye kuthebula lomhubhe

Lapho isixhumi somhubhe sikhona futhi sibambe ikheli laso, inqubomgomo ibukeka kanje:

ip -4 route add default dev tun1 src 10.90.0.10 table 47100
ip -4 rule add priority 20000 lookup main suppress_prefixlength 0
ip -4 rule add priority 20001 not fwmark 0x2a lookup 47100
ip -4 rule add priority 20002 not fwmark 0x2a unreachable

Umthetho wokuqala ugcina imizila ethile yomsingathi ibonakala, kufaka phakathi noma iyiphi inethiwekhi yasendaweni evunyelwe, kuyilapho kwenza umzila ozenzakalelayo wethebula eliyinhloko ungabonakali kulokhu kusesha. Lowo mehluko ubalulekile: ukucindezela okuzenzakalelayo akufani nokushaya indiva ithebula, futhi ukukhululwa kwasendaweni okusadingeka kuwe kusinda ngenxa yalokho. Funda lokho kukhululwa ngakunye esikhundleni sokucabanga ukuthi umphumela uyiswishi yezimo eziphuthumayo yomhlaba wonke.

Ukugcwala okungamakiwe bese kuwela kuthebula lomhubhe, kuthatha umthombo womhubhe futhi kuphume nge-VPN. Ukugcwala okumakiwe kwehluleka ukuhlolwa kwe-fwmark kule mithetho emibili elandelayo futhi kuqhubeke kuya ekusesheni okuyinhloko okujwayelekile phansi kuhlu, lapho umzila ozenzakalelayo we-uplink usakhona. Umthetho wokugcina we-unreachable yiwo ovimbela umfudlana ongamakiwe ukuthi ungeweli ngokuthula ubuyele ku-uplink lapho umzila womhubhe ungekho. Isikhethi ngumaka kusukela ekuqaleni kuze kube sekugcineni, futhi ikheli lendawo ekuyiwa kuyo alilokothi lingene esinqumweni.

Gcina lowo mqaphi endaweni yakhe phakathi kokuphuka, futhi uwufake kanye nayo yonke inqubomgomo hhayi ngesandla. Umthetho onyamalalayo nesixhumi awuyona inqubomgomo, kungukwenzeka nje. Ukususa inqubomgomo lapho umhubhe uwa kushintsha indlela yokwehluleka isuke ku-“kuvinjiwe” iye ku-“kuvuzele”, futhi umzila womhubhe ophelelwe yisikhathi oxhuga kamuva uyinkinga elula kakhulu ukuyichaza kunokugcwala okuphume ngesixhumi esingalungile.

Vumela indlela yokubuyela ibone umaka ofanayo

Amamaka aphumayo ayingxenye kuphela yomshini, futhi lena ingxenye okushiywa yiningi lokukhiqizwa kabusha. Izimpendulo zesikhathi esibethelwe zifika ku-uplink futhi zingaphansi kokuqinisekiswa kwendlela yokubuyela, okubuza ukuthi umthombo uzophindiselwa emuva ngendlela efanayo yini. Ngaphandle kosizo, lokho kusesha kusebenzisa inqubomgomo yakho yomhubhe engamakiwe futhi kuphetha ngokuthi iphakethe lise-sixhumi esingalungile.

Isilungiso singumnikazi we-firewall: gcina umaka kuxhumano oluphumayo, uwubuyisele kumaphakethe angenayo afanele futhi unike amandla ukuphathwa komaka okuqinisekiswe umthombo emzileni ofanele. Ukuthi i-OpenVPN ibeka umaka wesokhethi akwenzi lutho kulezi zinto ezintathu, futhi iresiphi edweba kuphela izinketho zeklayenti ayiphelele. Cela lokho kuxhumana ngokubhala, ngoba ingxenye yedizayini engabonakali kakhulu futhi elula kakhulu ukulahleka ekwakheni kabusha.

Ukuhlola kwendlela yokubuyela okuxegayo nakho akusona isikhundla. Imodi exegayo isadinga ukuthi kube khona umzila womthombo, futhi umqaphi we-unreachable owengezile ususa owodwa ngamabomu ekusesheni okungamakiwe. Qeda futhi ubuyekeze ukuxhumana komaka wokuxhumana ngaphambi kokuthembela kule dithizayini, futhi thatha izihlungi zomsingathi njengombuzo ohlukile: umaka wuphawu lomzila, hhayi imvume. Uma ukuxhumana kungelo, uphawu isikhathi esisungulayo bese sithula ngokushesha lapho izimpendulo ziqala ukufika.

Kufakazele ngezindlela ezimbili zokusesha umzila

Qhathanisa lokho i-kernel ekunqumayo kuzo zombili izimo, futhi funda izinkambu ze-dev ne-src esikhundleni sesimo sokuphuma:

ip -4 route get 198.51.100.25
ip -4 route get 198.51.100.25 mark 0x2a

Ukusesha kokuqala kufanele kuxazululele ku-tun1 nomthombo womhubhe, futhi kwesibili ku-uplink. Lokhu kusesha kwesinthetiki, ngakho kubonisa inqubomgomo hhayi inqubo esebenzayo: qinisekisa ngokwehlukile indlela yangempela yokuthutha yeklayenti elisebenzayo, bese wenza isicelo se-HTTPS sangempela nokuqinisekiswa kwesitifiketi kusavuliwe.

Bhala lokho idizayini engakuhlanganisi ngaphambi kokuyimemezela iqedile. I-DNS, i-IPv6 nomjikelezo wokuphila wemithetho ngakunye kudinga isinqumo sako, futhi lesi yisibonelo somzila we-IPv4, hhayi ukucushwa okuphelele kobumfihlo. Inani layo yisikhethi: isigaxa sithola ukukhululwa kwe-uplink, futhi insizakalo ejwayelekile ekhelini elifanayo akudingeki iyizuze njengefa.