Indlela yakho endala ezenzakalelayo iphila ngamabomu ne-OpenVPN

Uxhuma umhubhe, usebenzisa i-ip route, futhi isango lokuqala elizenzakalelayo lisakhona lapho. Umqondo olandelayo ukuthi iklayenti lehlulekile ukuthatha indlela, ngakho ususa idefault ngesandla futhi ulahlekelwa ukuxhumana ngokuphelele. Leyo ntengo kufanele ihlale ikhona. Nge redirect-gateway def1, i-OpenVPN ifaka imizila emibili eqondile kakhulu edlula idefault evamile esikhundleni sokuyishintsha. Isango elidala lihlala futhi liyeka ukuthwala ithrafikhi obuyihlola.

I-def1 yenzani ngempela

Ifulegi lengeza i-0.0.0.0/1 ne-128.0.0.0/1, zombili zikhomba emhubheni. I-0.0.0.0/1 ithatha yonke ikheli eline-octet yokuqala engu-0 kuya ku-127, ne-128.0.0.0/1 ithatha u-128 kuya ku-255, ngakho yonke indawo ye-IPv4 inokufana okuqondile kakhulu kunedefault endala. Ubude be-prefix, hhayi i-metric, bunquma ukuthi iyiphi indlela enqobayo.

Ukushiya idefault yokuqala endaweni yayo kwenziwe ngamabomu. Iklayenti akudingeki likhumbule ukuthi lashintsha ini, futhi alibhali kabusha indlela ethwala ukuxhumana kwalo siqu ku-seva ye-VPN. Lapho linqamuka, lisusa imizila emibili eyingxenye futhi ithebula libuyela endaweni yalo.

Kungani /1 hhayi /0

Ukuhlela imizila kukhetha i-prefix ehambisanayo ende kakhulu, hhayi i-metric ephansi kakhulu, ngakho i-/1 inqoba i-/0 kungakhathaliseki ukuthi i-metric yedefault ithini. Izingxenye zombili zikhona ngoba i-/1 eyodwa ihlanganisa ingxenye yendawo kuphela; uma i-0.0.0.0/1 kuphela ikhona, konke kusukela ku-128.0.0.0 kuye phezulu kusalandela idefault endala, okukhiqiza uphawu oludidayo lapho amanye amasayithi esebenza kanti amanye awasebenzi.

Ukuphakamisa noma ukwehlisa i-metric yedefault endala akushintshi lutho, futhi idefault ene-metric ephansi kwesinye isixhumanisi ayiyebi ithrafikhi. Ubude be-prefix bunquma kuqala, futhi yizona prefix ezilinganayo kuphela ezibuyela ku-metric.

Funda ithebula langempela lemizila

Umkhandlu oxhunyiwe ungabonisa wonke amantengo amathathu ngesikhathi esisodwa, umhubhe uthwala izingxenye kanti isango lokuqala lisafakwe ohlwini. Amakheli ayizibonelo hhayi ukucushwa okufanele kukopishwe, ngoba amagama ezixhumanisi, isakhiwo somhubhe nemizila eyengeziwe kuyahluka ngepulatifomu neklayenti.

default via 192.168.50.1 dev wlan0
0.0.0.0/1 via 10.8.0.1 dev tun0
128.0.0.0/1 via 10.8.0.1 dev tun0

Okubalulekile ubudlelwano: izingxenye ezimbili ezithile ngaphezu kwedefault eyodwa evamile. Umugqa wesango elidala uhlala khona ngoba akukho okushintshele endaweni yawo.

Hlola indlela iphakethe eliyithathayo ngempela

Imizila eqondile kakhulu isengaqhobana: umzila wobubanzi obucashile, isabnethi yendawo noma ikheli lesiqu se-seva ye-VPN linde kune-/1. Umhubhe udinga indlela yangaphandle eya kuseva yawo, futhi ukuthumela lokho kuxhumana kubuyele emhubheni kungayiphula ngokushesha. Ku-Linux, buza i-kernel esikhundleni sokufunda ithebula ngamehlo: i-ip route get nendawo okhathalelayo iphrinta umzila okhethiwe, isixhumanisi nomthombo. Uma ukuhlelwa kwemizila kwenqubomgomo kulungisiwe, hlola nemithetho, ngoba umthetho ungakhetha elinye ithebula ngaphambi kokubuzwa kwelokuthi elikhulu.

Uma ingxenye ye-IPv4 kuphela eziphatha kabi, qinisekisa ukuthi izingxenye zombili zifakiwe bese ufuna okuhlukile okuhambisana nendawo ehlulayo. Ukususa idefault endala akusona isixazululo, futhi kususa indlela iklayenti eliyidingayo ukuze liqede umhubhe kahle.

I-def1 ayikuhlanganisi ini

Amantengo amabili e-IPv4 awasho lutho nge-IPv6: umkhandlu onokuxhumana kwe-IPv6 uqhubeka usebenzisa eyawo idefault kuze kube yilapho okuthile kuqondisa leyo mkhakha ngokwehlukile, yingakho ithrafikhi ethile ibonakala idlula umhubhe kunethiwekhi ye-dual-stack. Amanye amaklayenti nabaphathi benethiwekhi basebenzisa ukuhlelwa kwemizila yomhubhe ogcwele ngendlela ehlukile, futhi amathebula abo ngeke afane. Ukuziphatha kwe-def1 okuchazwe lapha kungokwefulegi ebhalwe phansi ye-OpenVPN, hhayi yawo wonke ama-VPN emshinini.

I-kill switch iphendula umbuzo ohlukile: umshini wenzani lapho umhubhe uwa. Ukubaluleka kokuhlela imizila kunquma ukuthi ithrafikhi iyaphi ngesikhathi umhubhe uvuliwe; akunqumi ukuthi i-firewall yenzani ngemva kwalokho. Ukulandelana komsebenzi: funda ithebula, qinisekisa ukuthi izingxenye zombili zikhona, sebenzisa i-ip route get endaweni ehlulayo, hlola imithetho yenqubomgomo, bese ubheka i-IPv6 ngokwehlukile. Shiya idefault endala lapho ikhona.