Ukungenisa ku-NetworkManager kuyahluleka kumafayela e-OpenVPN ne-WireGuard

Ngakhetha Ngenisa kusuka kufayela… kuzilungiselelo ze-GNOME, ngakhetha iphrofayili esebenza neklayenti yomhlinzeki, futhi ingxoxo yavala ngaphandle kokwengeza lutho ohlwini. Kukhompyutha yesibili ukungenisa kwaqedwa, ukuxhumana kwavela ngaphansi kwegama lephrofayili, kwase kwehluleka esicelweni sokuqala sokuqinisekisa. I-NetworkManager ayilokothi isebenzise ifayela lakho le-.ovpn noma le-wg-quick njengoba linjalo. Ilinikela ku-parser, i-parser iyiguqula ibe yifomethi yokuxhumana ye-NetworkManager uqobo, futhi kusukela lapho umhubhe wakhiwa kusuka kuleyo nto ehlaziyiwe — izimfihlo, imizila, i-DNS nakho konke. Ngakho umbuzo owusizo awuwona wokuthi kungani ifayela lonakele, kodwa ukuthi ukuhlaziya kwenzekile yini nokuthi kwagcina ini.

Okwenziwa ukungenisa ngempela kufayela

Ku-OpenVPN, i-parser ihlala kuphakethe le-plugin, futhi ukuxhumana elikwenzayo kukhombisa kusevisi ye-D-Bus efana ne-org.freedesktop.NetworkManager.openvpn. Ngaphandle kwe-plugin, akukho parser: uhlobo alwaziwa yi-nmcli, futhi uhlu lwezithombe lokwengeza i-VPN kungenzeka lungabonisi ngisho nokufakwa kokungenisa. I-WireGuard ihluka endaweni eyodwa ebalulekile — i-NetworkManager inezilungiselelo zayo ze-WireGuard kusukela ochungechungeni lwe-1.30, ngakho akukho phakethe le-plugin elihlukile, kodwa umfundi we-wg-quick ukhona kuphela ezakhiweni eziletha.

Kungakhathalekile, ifayela lifundwa kanye. Umphumela ubhalwa njenge-keyfile ngaphansi kwe-/etc/NetworkManager/system-connections/, uqanjwe ngokuxhumana, uphethwe yi-root futhi awufundeki kwabanye abasebenzisi ngoba uqukethe impahla yokhiye. Leyo keyfile manje iwukuxhumana; ukuhlela i-.ovpn yokuqala ngemuva kwalokho akushintshi lutho.

Izimpawu ezintathu zingezigaba ezintathu ezihlukene. Ukungabikho kokufakwa kokungenisa noma uhlobo olungaziwa kusho ukuthi i-plugin noma inguqulo ayikho. Iphutha lokungenisa elisho umyalelo lisho ukuthi i-parser yafunda ifayela futhi yanqaba ingxenye yalo. Ukuxhumana okukhona kodwa okungaqali neze kusho ukuthi into ehlaziyiwe ayiphelele noma iseva iyanqaba. Nquma ukuthi yikuphi kwezimo ezintathu onakho ngaphambi kokuhlela noma yini.

Qinisekisa i-plugin ngaphambi kokulungisa iphrofayili

I-plugin engekho ibukeka njengephrofayili eyonakele ngqo, ngakho hlola iphakethe kuqala. Ku-Debian naku-Ubuntu ukusekelwa kwe-OpenVPN kuza njenge-network-manager-openvpn kanye nosizo lwedeskithophu; ku-Fedora amaphakethe yi-NetworkManager-openvpn ne-NetworkManager-openvpn-gnome; ku-Arch yi-networkmanager-openvpn.

dpkg -l network-manager-openvpn-gnome | tail -n 2
rpm -q NetworkManager-openvpn
pacman -Q networkmanager-openvpn

Bese ngenisa kusuka endleleni ephelele: nmcli connection import type openvpn file /home/you/profile.ovpn. Izindlela ezihlobene ngokuvamile ziyasebenza, kodwa i-shell eshintshe isiqondiso yenza ukungenisa okusheshayo kube umjikelezo. Kwe-WireGuard hlola i-nmcli --version futhi uqinisekise ukuthi uhlangothi lwe-kernel lukhona nge-modprobe wireguard; ukungenisa okuphumelelayo emshinini ongenawo umojuli kukushiya ngokuxhumana okungaveli neze idivayisi yako. isithenjwa se-nmcli sichaza umyalo ongaphansi i-import namagama ohlobo amukelwayo. Uma i-type wireguard inqatshwa ngqo, ukwakhiwa kudala kunalesi sici, futhi isinyathelo esifanele iphakethe lokusabalalisa noma i-backport — hhayi ukukopisha ukulungiselela endaweni engafanele ngethemba lokuthi okuthile kuzoyifunda.

Funda ukuxhumana kwe-OpenVPN, hhayi i-.ovpn

Uma ukuxhumana sekukhona, funda izilungiselelo ezihlaziyiwe esikhundleni sokuphinda ufunde ifayela: nmcli connection show "Work VPN" | grep -E '^vpn\.'. Ufuna i-remote nechweba, ukuthutha, impahla yobunikazi — ca, cert, key, tls-auth noma tls-crypt — kanye nendlela yokuqinisekisa. Kuphrofayili enephasiwedi yokhiye oyimfihlo, engeza i-sudo nmcli --show-secrets connection show "Work VPN" bese ubheka ama-secret flag: u-0 ngu-none, ngakho imfihlo ise-keyfile; u-1 ngu-agent-owned; u-2 ngu-not-saved, okusho ukuthi ayikaze ibhalwe ku-keyfile; u-4 ngu-not-required, okusho ukuthi ayikho imfihlo edingekayo neze. Lawa ngamabhithi, hhayi isikali, ngakho u-3 umane nje uyi-agent-owned kanye ne-not-saved. Imfihlo ebuzwa kanye ngesikhathi ngasinye sehlelo iyi-agent-owned (1), i-agent iyicela; ayikho inombolo yefulegi ehlukile yalokho. Ukungafani kwamafulegi yisizathu esivamile sokuthi iphrofayili ixhumane kusuka ku-applet yedeskithophu yehluleke kusuka kuskripthi noma ekwakheni.

Indlela esheshayo yokubona okwalahlwa i-parser ukucela i-plugin ukuthi ibhale ifayela futhi, bese uliqhathanisa: nmcli connection export "Work VPN" /tmp/roundtrip.ovpn. Imiyalelo enyamalalayo kuleyo diff ngeke ibe khona ngesikhathi sokuxhumana. Ama-hook ayizisulu ezijwayelekile — i-script-security, up, down ne-route-up zilindele iskripthi esiqhutshwa ngamalungelo aphezulu futhi ngamabomu azidluliswa. Unganciphisi ukuqinisekisa futhi unganiki amalungelo engeziwe ukuze ukungenisa kuphumelele; inketho engasekelwe ngokuvamile ibonisa isethi yezici ze-plugin hhayi iseva engafinyeleleki. Hambisa lokho kuziphatha kuskripthi se-dispatcher se-NetworkManager noma kunqubomgomo yohlangothi lweseva.

Futhi qinisekisa ukuthi izinkambu zobunikazi zisindile: isithenjwa se-CA, i-remote-cert-tls nanoma yikuphi ukuhlolwa kwegama iphrofayili eyayincike kukho. Ukuxhumana okuphuma ngaphandle kwazo kungenzeka kukhuluma nanoma yini ephendula kulelo kheli.

Funda ukuxhumana kwe-WireGuard, hhayi ifayela le-wg-quick

Ifayela le-wg-quick iyifomethi enencazelo ye-shell; ukuxhumana okungenisiwe kuyisethi yezilungiselelo. I-PrivateKey iba ukhiye oyimfihlo we-interface, i-Address iba ikheli elilodwa noma amaningi e-IPv4 ne-IPv6, i-DNS ihlelwa ezimpahleni ze-resolver ze-NetworkManager, i-MTU ihlelwa ku-wireguard.mtu (okungukuthi okuzenzakalelayo kwe-wg-quick uqobo ngu-1420), futhi yonke ibhlokhi ye-peer iba ukufakwa kwe-peer okunokhiye womphakathi, i-endpoint, ama-IP avunyelwe ne-persistent keepalive. Phrinta okugciniwe nge-nmcli --show-secrets connection show wg0; uma uhlu lwama-peer lungaveli kulokho okukhiphiwe, funda i-keyfile:

sudo sed -n '/^\[wireguard\]/,/^\[/p' /etc/NetworkManager/system-connections/wg0.nmconnection

Okungasindi ingxenye ye-shell ye-wg-quick. I-PreUp, PostUp, PreDown, PostDown ne-Table kuwukuziphatha kwalelo thuluzi, hhayi izimfanelo ze-interface ye-WireGuard, ngakho akukho okuzisebenzisayo ngemuva kokungenisa. Uma okokuqala kwakusebenzisa i-Table = off ukushiya umzila ozenzakalelayo ngokuthula, izinguqulo ezintsha ze-NetworkManager zinikeza i-ip4-auto-default-route ne-ip6-auto-default-route ngenjongo efanayo; zisethe ngokusobala esikhundleni sokucabanga ukuthi ukuxhumana kuziphatha njengeskripthi. I-hook eyayicindezela umzila okhethekile idinga lowo mzila kuzilungiselelo zomzila zokuxhumana, kungenjalo uzovele ungekho.

Nika ukuxhumana umnikazi oyedwa ngqo

Ukwehluleka okulandela okuvamile ukuxhumana okusebenza kuze kube ukuqala okulandelayo bese kungena kumjikelezo. Ngokuvamile i-[email protected] yayisasebenza kusuka ekuhloleni kwangaphambili, noma iklayenti yomhlinzeki yayiqalisa i-daemon yayo, futhi abanikazi ababili babebhala imizila ne-DNS endaweni efanayo. I-NetworkManager isetha i-resolver ngendlela yayo, i-wg-quick ibhala nge-resolvconf, futhi okuwukugcina okubhalayo kuyanqoba — ngakho ukuxazululwa kwamagama kuyasebenza, bese kuyama, bese kuphinda kusebenze. Hlola i-systemctl status wg-quick@wg0, i-nmcli connection show --active ne-ip link show type wireguard, bese ukhubaza umnikazi wesibili esikhundleni sokulungisa i-metric yakhe.

Uma ngempela udinga kokubili, banike ama-interface ahlukene nama-IP avunyelwe angahlangani, futhi vumela oyedwa ngqo wawo ukuthi afake umzila ozenzakalelayo. Imizila emibili ozenzakalelayo enama-metric ahlukene akuwona i-split tunnel; kuwumncintiswano onqunywa isevisi eqala okwesibili. Futhi ngemuva kokuxhuma kabusha, hlola isimo esisetshenzisiwe futhi — ukuhlelwa ngesandla kwe-resolver kanye kuphela okwenza izinto zisebenze akubona ubufakazi bokuthi ukungenisa kuphelele.

Qinisekisa ngethrafikhi futhi usinde ekuqaleni kabusha

Phakamisa ukuxhumana nge-nmcli connection up "Work VPN", bese ufunda isimo, ikheli nemizila esikhundleni sokuthemba isithonjana: nmcli device show wg0 | grep -E 'GENERAL.STATE|IP4.ADDRESS|IP4.ROUTE', ip route show default kanye nophenyo lwangempela lwegama oluxazululwa ngaphakathi komhubhe kuphela. I-handshake noma i-ping ephumelelayo ifakazela kuphela ukuthi ukubethela kuyasebenza; ayisho lutho mayelana nokudluliswa, amaprefikhi e-split tunnel noma i-DNS yangasese, futhi yizo lezo zingxenye ezivame ukwephuka.

Bese uqala kabusha futhi uphindele. Ukuziphatha kwe-autoconnect, i-interface eqanjwe kabusha ne-plugin elayishwa ngemuva kwedivayisi konke kungukwehluleka okubona kuphela ekuqaleni okumsulwa. I-journalctl -u NetworkManager -b --no-pager | tail -n 40 ikhombisa okwenziwa yi-daemon ngalokhu kuxhumana kulokhu kuqala. Kukhompyutha yesibili kopisha i-keyfile futhi uyigcine iphethwe yi-root ngemodi engu-600, noma sebenzisa i-nmcli connection export kwe-OpenVPN bese ungenisa kabusha i-.ovpn evelayo — indlela yokukhipha ayinakho okulingana kwe-WireGuard, ngakho leyo ndlela iwukukopisha ifayela noma ukungenisa okusha kusuka kokokuqala okuvikelwe.

Inguqulo emfushane, ngokulandelana: qinisekisa i-plugin noma inguqulo ye-NetworkManager, ngenisa kusuka endleleni ephelele, funda izilungiselelo ezihlaziyiwe kuhlanganise nama-secret flag, qhathanisa ukukhipha kwe-OpenVPN nokokuqala, hlola ama-hook nemizila ohlangothini lwe-WireGuard, khubaza noma yimuphi umnikazi wesibili, bese ngemuva kokuqala kabusha uqinisekise ukuxazululwa kwegama nethebula yemizila. Uma ukuxhumana kudlula konke lokho, ifayela lephrofayili elikuqalile lingabuyela esigcini esivikelwe.