Kungani i-nc -uz ingakwazi ukufakazela ukuthi iseva ye-OpenVPN isilungile

Ukusebenzisa nc -uz kuyiseva ye- OpenVPN akulinganisi cishe lutho, futhi incwadi ye-OpenBSD ikusho lokho ezixwayisweni zayo: ukuskena kwe-UDP kuleyo modi kubika impumelelo kungakhathaliseki ukuthi kukhona okulalelayo noma cha. Isimo sokuphuma sibonisa ukuthunyelwa kwasekhaya, hhayi isimo esikude, ngakho umqaphi othembele kuso ugcina iseva efile imakwe njengenempilo inqobo nje uma ithebula lezinqubo libonakala likholakala. Ukushintsha kwayo kuqala ngokunquma ukuthi ukuhlola kufanele kuphendule muphi umbuzo, ngoba inqubo, umlaleli, ukuqinisekisa kanye nokufinyeleleka kohlelo yizinto ezine ezihlukene eziqashelwayo. Ukuhlola okusho okukodwa kuzo kuyasiza; ukuhlola okusikisela kuzo zozine kuwumthwalo.

Okungaqashelwa nokungenaqashelwa ukuhlola kwe-UDP

nc -uz kuthumela idathagramu bese kuyaphuma, futhi isimo esikubuyiselayo sichaza ukuthunyelwa kwasekhaya. Iphothi evaliwe ingase iphendule nge-ICMP port unreachable, kodwa ukuziphatha okubhaliwe kwale modi yokuskena akukushintshi lokho kube ukwehluleka, futhi iphothi elihlungiwe alinikezi mpendulo nhlobo. Ngakho ukuthula nempumelelo kusho into efanayo kumfoni.

Lokho kwenza ukuhlola kube ukuhlolwa kwesitaki sasekhaya, hhayi kweseva. Akugunyazi ukuthi umsingathi uyafinyeleleka, ukuthi iphothi liboshiwe, ukuthi inqubo ye-OpenVPN iyasebenza noma ukuthi iklayenti lingaqinisekisa. Ukuhlolwa kokuxhumana kwe-TCP kunamandla kakhulu ngoba ukuxhawulana kunikeza impendulo eqondile, kodwa kuphela lapho ukusetshenziswa kulalela ngempela ku-TCP. Ukushintsha ukuhlola kube yi-TCP kunombolo efanayo kuhlola umlaleli ongase ungabi khona, futhi kwiseva ene-UDP kuphela kuzokwehlulisa insiza enempilo.

Ukulinganisa ukuhlola nokuthuthwa okulungisiwe kuza ngaphambi kokwethemba noma imuphi wemiphumela emibili. Ukusetshenziswa kwe-UDP kudinga uphawu oluhlukile, hhayi iphrothokholi ehlukile.

Abafoni abathathu, imibuzo emithathu ehlukene

Ukulunga kuncike ekutheni ngubani obuzayo. Umphathi wensiza ovuselela inqubo ewile kufanele azi ukuthi isibonelo siqalile futhi sabopha umlaleli waso. Isilinganisi somthwalo kufanele sazi ukuthi iklayenti elifika manje lizokwamukelwa. Uhlelo lokuqapha kufanele lwazi ukuthi indlela evela kunethiwekhi yangempela isahambisa isikhathi seshini eya kumthombo ovunyelwe.

Lokhu akulona ukuhlola okukodwa, futhi ukuhlola okukodwa akukwazi ukumboza konke kuthathu ngobuqotho. Khetha umfoni kuqala, bese kuba ubufakazi.

Akha ukuhlola kusukela kusibonelo samanje

I-OpenVPN ibhala umugqa wokuqala lapho isibonelo siqeda ukuqalisa, futhi lowo mugqa uwubufakazi obusizayo mayelana nokuqalisa kwasekhaya. Yifunde kusukela ekuqaliseni kwamanje hhayi ekupheleni kwefayela elengezwayo, ngoba impumelelo yeviki eledlule ifundwa ngendlela efanayo nempumelelo yomzuzu odlule. Iseva ingase futhi iqede ukuqalisa ngaphambi kokuthi noma yiliphi iklayenti lixhume, ngakho umugqa awusho lutho mayelana nokuqinisekisa.

Okokuhlola kokuqalisa, hlanganisa isimo senqubo nobufakazi belogi bamanje kanye nomlaleli ohambisana nokuthuthwa okulungisiwe. Ukuhlola kufanele kwehluleke lapho inqubo isebenza kodwa ingakaqedi ukuqalisa, okusho ukuthi umbuzo welogi kufanele ukhawulelwe kulokhu kuqalisa nakule yunithi.

systemctl is-active openvpn@server
sudo journalctl -u openvpn@server -b --no-pager | grep "Initialization Sequence Completed"
ss -lunp | grep 1194

Imiphumela emithathu, izimangalo ezintathu: iyunithi iyasebenza, lokhu kuqalisa kukhiqize umugqa wokuqalisa, futhi kukhona okubambe iphothi le-UDP. Akukho kulokhu okusho ukuthi iklayenti lingaxhuma. Zibekezehlukanise ekhasini lesimo ukuze isigameko singawi ekhoneni elilodwa eliluhlaza.

Yephula ngamabomu bese ubheka ukuhlola

Ukuhlola kuthembekile kuphela ngemva kokuba ukubonile kwehluleka. Misa iseva, sebenzisa ukuhlola bese uqinisekisa umphumela owulindele. Bese uyivusa futhi uqinisekise ukuthi ukuhlola kuyalulama ngaphandle kwanoma yiluphi olunye ushintsho.

sudo systemctl stop openvpn@server
nc -uz 203.0.113.10 1194; echo "exit=$?"
ss -lunp | grep 1194
sudo systemctl start openvpn@server
ss -lunp | grep 1194

Funda ibhlokhi umugqa ngomugqa. Umyalo we-netcat uphrinta exit=0 kuyilapho kungaboshiwe lutho, futhi yiyo yonke inkinga emugqeni owodwa. Eyokuqala ss ayiphrinti lutho, ukuvusa kabusha kuyaphumelela, futhi eyesibili ss ikhombisa umlaleli futhi. Uma ukuhlola kwakho kudlula kwiseva emisiwe, kukala isitaki sasekhaya hhayi enye into.

Ukwehluleka okuphambene nakho kubalulekile. Ukuhlola okwehluleka kwiseva enempilo kubangela ukuvusa kabusha obekungadingeki, futhi umjikelezo wokuvusa kabusha ngokwawo uwukuphazamiseka. Hlola izinhlangothi zombili ngaphambi kokuxhuma ukuhlola kunoma yini engase yenze okuthile ngakho.

Umugqa wesimo kufanele uthini

Rekhoda ukuthi ukuhlola ngakunye kumboza muphi umngcele: inqubo, umlaleli, ukuqinisekisa noma uhlelo. Ukuhlola okukodwa akuvamisile ukumboza okungaphezu kokukodwa, futhi ikhasi lesimo elicindezela konke kube “up” lifihla umehluko obalulekile phakathi kwesigameko. Endleleni yenethiwekhi, sebenzisa iklayenti langempela elinesazisi esikhethekile, liyeke liqede ukuxhawulana nomsebenzi owodwa ovunyelwe ongenabungozi, bese uyanqamula. Lokho kuqeqesha isiteshi sokulawula, inqubomgomo yokuqinisekisa kanye nomlaleli esinyathelweni esisodwa.

Gcina leso sazisi sehlukile kubasebenzisi bangempela futhi usinikeze izimvume eziphansi kakhulu ezidingwa ukuhlola. Ukuhlola kokulunga okunokufinyelela okubanzi kuyindawo entsha yokuhlasela eyengezwe ukuze kube lula. Shintsha izifakazelo zaso njenganoma iyiphi enye i-akhawunti, ngoba ukuhlola okumisa ukuqinisekisa kubukeka ncamashi njengeseya eyeka ukwamukela amaklayenti.

Shono umngcele embhalweni wesixwayiso, ukuze umphenduli wokuqala azi ukuthi kufanele abheke iyunithi, isokhethi, isitifiketi noma umzila. Ukuhlola okungakwazi ukusho ukuthi kufakazeleni kuzothenjwa ngesizathu esingalungile, futhi yiyo indlela ukuhlola kwe-netcat okwasinda ngayo ekuqaleni.