Netgear OpenVPN: i-TUN ne-TAP zilalela emachwebeni ahlukene

Ucingo luxhuma ku-VPN yerutha ngaphandle kwesikhalazo, kuyilapho ikhompyutha ephathekayo esebenzisa iphrofayela evela ekhasini elifanayo lokulanda iphela isikhathi. Akukho okushintshile ngezitifiketi phakathi kwale mizamo emibili, ngoba ikhompyutha ayizange ifinyelele endaweni lapho izitifiketi zibalulekile khona. Irutha ishicilela izilaleli ezihlukene ze-TUN ne-TAP, futhi iphrofayela esebenzayo kufanele ikhethe leyo ehambisana nohlobo lwedivayisi yayo.

Ukunquma ukuthi yikuphi kokungalungi okuthathu okungenzeka okufanele kulandelwe yiwona wonke umsebenzi lapha: ichwebe, uhlobo lwedivayisi, noma ukuxoxisana nge-cipher yesiteshi sedatha.

Izinto ezintathu okufanele zivumelane

Uhlobo lwedivayisi, umugqa we-interface wephrofayela nechwebe lesilaleli kwakha ukukhetha okukodwa, hhayi kuthathu. Iphrofayela ememezela dev tun futhi eqondiswe kwisilaleli se-TAP ayikwazi ukuqedela iseshini, futhi okuphambene nakho kwehluleka ngendlela efanayo. Ngemodeli yakho ne-firmware, funda ichwebe kukhasi le-VPN lika-rutha uqobo hhayi kumhlahlandlela, ngoba izinombolo ziyashintsha phakathi kokwakhiwa. Bhala imodeli nenguqulo ye-firmware eceleni kwaleyo nombolo ukuze umuntu olandelayo akwazi ukuqinisekisa.

Imibiko yasensimini ikhuluma ngambhangqwana onjengo-12973 we-TUN no-12974 we-TAP ku-firmware eyodwa, nenye inombolo kwenye. Zifunde njengobufakazi bokuthi ukwakhiwa kuyahluka, hhayi njengezinto ezingaguquki okufanele zikopishwe. Ngemuva kwalokho iphrofayela idinga igama lomsingathi elifanele ibanga: igama le-DNS eliguqukayo lika-rutha hhayi ikheli le-WAN elizoshintsha.

Ngemuva kokulungisa ichwebe nomugqa we-interface, iphrofayela ibukeka njengokucushwa okujwayelekile kweklayenti okunomugqa owodwa we-remote nomugqa owodwa we-dev. Uma kokubili kungavumelani, akukho nani lokuzama kabusha okukhiqiza iseshini.

Funda ilogi ngokulandelana ekhishwa ngakho

Iklayenti le-OpenVPN libika izehlakalo ngokulandelana okwenzeka ngakho, ngakho umugqa wokugcina ngaphambi kokuthula ukhomba isendlalelo okufanele sihlolwe. Lapho ukusebenza kuphela ku-TLS Error: TLS key negotiation failed, noma kumane kulinde impendulo yokuqala bese kuyeka, ukuqhathaniswa kwezitifiketi akuzange kwenzeke. Lokho kukhomba ekufinyelelekeni, kwisilaleli, noma echwebeni okungekho lutho ngemuva kwalo. Akukho kulokho okulungiswa ngokushintsha ifayela le-CA.

Ukusebenza okufinyelela ku-VERIFY OK bese kwehluleka kukwelinye indawo ngokuphelele, nezizathu zako. Ukuhlukanisa le miphumela emibili ngaphambi kokuthinta amafayela kuvimbela umzila ojwayelekile wokuzungeza emabhakedeni ezitifiketi angakaze abuzwe. Lapho ukuxhawana kwezandla kuqediwe kodwa ithumbu lingaphumi, bheka ukuxoxisana nge-cipher hhayi ukufinyeleleka.

Engeza uhlu lwama-cipher olulindelwe yiklayenti lesimanjemanje

Amaklayenti e-OpenVPN akamuva enqaba izinto ezimisiwe ezindala eziqhubeka zinikezwa yi-firmware yasekhaya, futhi uphawu ukwehluleka kokuxoxisana ngokuqondile ngemuva kokuxhawana kwezandla okuphumelelayo. Ukulungisa umugqa owodwa wephrofayela oveza lokho iklayenti elizokwamukela: setha i-data-ciphers kube AES-256-GCM, AES-128-GCM, CHACHA20-POLY1305 ne-AES-128-CBC ngalolo kulandelana. Noma iyiphi i-algorithm irutha engayisebenzisi ayikhethwa neze, ngakho uhlu olude alubizi lutho ngaphandle kokuxoxisana okude kancane.

Ukufaka ama-cipher ohlwini akufundisi irutha elinye elinganalo. Uma ukuxoxisana kusahluleka, hlola ukuthi ikhasi lika-rutha linokuhlelwa kwayo kwe-cipher yini nokuthi lokho kuhlelwa kufaka okungenani okufakiwe okukodwa okwamukelwa yiklayenti. Imihlu emibili engenalungu elabiweyo ikhiqiza ukwehluleka okufanayo ncamashi nokwechwebe elingalungile, yingakho izinhlangothi zombili zifanelwe ukubukwa.

Ngenisa kanye esikhundleni sokuhlela amakhophi ngesandla

Ukungenisa ifayela elilungisiwe ku-NetworkManager kugwema ifolda egcwele amaphrofayela ahluke kancane: nmcli connection import type openvpn file client.ovpn, bese uyiphakamisa ngegama. Gcina iphrofayela engenisiwe iyikhophi eyodwa oyihlelayo, futhi susa amakhophi anqwabelanayo avela ekulandeni okuphindaphindiwe.

Bese uhlola ngaphandle kwe-LAN. Ukuxhuma kusuka kunethiwekhi efanayo kufakazela okuncane kakhulu, ngoba ithrafikhi ingase ingadluli nhlobo ethumbini. Qinisekisa ukuthi isicelo siphuma ngempela ngaphakathi kwerutha, hhayi nje ukuthi iklayenti likhombisa isimo sokuxhunyiwe.

Nquma ukuthi wenzenjani ngezixwayiso

I-firmware yasekhaya ivamise ukwakha isiphathimandla sayo sezitifiketi, futhi amaklayenti akhononda ngokuqinisekisa ngezindlela i-firmware engakwazi ukuzicindezela. Hlola ukuthi lokho kukhononda kubalulekile yini kulokho okukuvikelayo esikhundleni sokuthatha zonke izixwayiso njengezibulalayo, futhi ungacimi ukuqinisekisa emhlabeni wonke ukuze uthulise umlayezo owodwa. Isixwayiso osihlolile siyingozi ebhaliwe; ukuhlelwa kokuqinisekisa okukucimile akubhaliwe.

Lapho i-firmware inganikezi indlela esekelwayo yokulungisa isixwayiso esibaluleke ngempela, leso sikhala sikhulumela ukusingatha i-VPN kwenye indawo. Ukukhetha phakathi kokulungisa iphrofayela, ukwamukela isixwayiso nokuhambisa iphoyinti lokugcina kuyisinqumo mayelana nokuthi uyethemba kangakanani leso sitifiketi. Yithathe ngenhloso, futhi ubhale ukuthi yikuphi okukhethile, esikhundleni sokuchofoza izingxoxo kuze kube yilapho isithonjana siba luhlaza.