I-Pi eyodwa, izimo ezimbili ze-OpenVPN: yini umthamo ngamunye ayifundayo
Ama-daemon amabili e-OpenVPN ku-Pi eyodwa afunda amafayela okulungiselela ahlukene futhi aphuma ngama-hook ahlukene. Bonisa isimo ngasinye, bese uhlola indlela ye-payload ngokwahlukana.
Bala izinqubo ze-OpenVPN ngaphambi kokuthinta iphrofayela. I-Pi eyamukela abasebenzisi abazulazulayo futhi ishaye ucingo enkonzweni ephezulu igijimisa ama-daemon amabili, futhi ngalinye lifunda ifayela lokulungiselela elikhethwe igama lesimo olilithayiphile. Amathamplate wephakethe abese enikeza i-daemon ngayinye umkhombandlela wayo wokusebenza, ifayela layo lesimo sokusebenza kanye nedivayisi yayo yethuneli. Uma le ngxenye yahlukaniswa kabi, uzochitha ubusuku uguguqula isilungiselelo esifanele ngaphakathi kwefayela inqubo esebenzayo engalivuli neze.
Igama lesimo ngayinye likhetha eyalo ifayela
Kumafayela e-unit ahamba ne-OpenVPN 2.6, izimpikiswano zokuqala zithwala isibambeli sesimo esigcwaliswa ngombhalo osemva kophawu @. Ithamplate leseva lisebenza kusukela kumkhombandlela wokulungiselela weseseva futhi lixazulula impikiswano yalo ngokuqondene ne-%i.conf elapho, kuyilapho ithamplate leklayenti lenza okufanayo kusukela kumkhombandlela weklayenti. Ngakho [email protected] lifunda i-admits.conf kumkhombandlela weseseva futhi i-[email protected] lifunda i-uplink.conf kumkhombandlela weklayenti, futhi alikho igama kulawo elinencazelo ethile komunye umkhombandlela.
Qinisekisa ukuhlangana emshinini esikhundleni sokucabanga ukuthi iphakethe ligcine amazinga okuqala aphezulu. I-drop-in yokwabiwa ingashintsha ngokuphelele umkhombandlela wokusebenza noma impikiswano yokulungiselela.
systemctl cat [email protected]
systemctl cat [email protected]Funda umugqa we-WorkingDirectory kanye nempikiswano yokulungiselela kuleyo mphumela, ngoba i-unit enikwe amandla iyona kuphela enquma ukuthi yiliphi ifayela elilayishwayo. I-drop-in engeza i---config ku-ExecStart iyanqoba ithamplate ngisho noma indlela yethamplate ibonakala ilungile. Cela izindlela ze-fragment ne-drop-in uma ufuna ukwazi ukuthi ukushintshwa kwendawo kuyasebenza yini. Uma zombili izindima zixazululeka efayeleni elilodwa, unenqubo eyodwa ezama ukuba yiseva neklayenti ngesikhathi esisodwa, futhi inketho yakamuva kulelo fayela inqoba buthule.
Ukuthutha kwendawo kanye ne-payload edluliswayo kuhlangana nama-hook ahlukene
Ukuxhumana okubethelwe kweseva nomsebenzisi ngamunye ozulazulayo kwakhiwa ku-Pi uqobo, ngakho izimpendulo zayo zangaphandle ziphuma nge-hook yokukhipha yendawo. Ukuxhumana kweklayenti nozakwabo ophezulu nakho kuwukukhishwa okwakhiwe endaweni, nakuba kufinyelela kunethiwekhi ekude. I-payload edluliswayo iyingxenye yesithathu, futhi i-kernel iyifanisa kuphela ngemva kokuba isikhethe idivayisi ephumayo yephakethe.
| Flow | Hook that sees it | What to inspect |
|---|---|---|
| Roaming user handshakes to the server | Local input and local output | Listener socket, bind address, rule admitting the UDP port |
| User payload leaving through the upstream tunnel | Forward | IPv4 forwarding switch, selected route, permission rule, any translation |
| Pi's own connection to the upstream peer | Local output | Underlay route to the provider endpoint, not the tunnel route |
Umthetho ofanisa i-interface ephumayo ngaphakathi kochungechunge lwe-forward ungavumela noma ulahle iphakethe osekunikezwe yi-routing kuleyo interface, kodwa awukhethi i-interface neze. Lapho isiphathi esisodwa siqeda ithuneli elilodwa bese siqala elinye, inqubomgomo ethumela i-payload yabasebenzisi ethunelini eliphezulu kanye nenqubomgomo evikela izimpendulo ezibethelwe ze-Pi uqobo kuyizinqumo ezimbili ezihlukene. Zivame ukuhlangana ku-NIC eyodwa yomzimba, yingakho zididaniswa.
Lowo mehluko uchaza ukwehluleka okungu-half engxenyeni. Abasebenzisi bayaxhuma, i-handshake iyaphela, futhi ukuhamba kwabo kusaphuma ngendlela engalungile, ngoba i-handshake yayiyendawo kanti i-payload yayiyi-forward futhi okukodwa kuphela kwezimbili okwake kwahlolwa.
Indlela elethiwe ingagwinya izimpendulo eziya kubasebenzisi bakho
Isilungiselelo sokuphepha sephrofayela yeklayenti sinquma ukuthi uhla oluphezulu lungasunduza ini efayeleni lokuhlela lwe-Pi, futhi i-redirect ebanzi iyinketho eguqula isiphathi esisebenza esinezinhlobo ezimbili sibe esiphukile. Uma indlela esunduziwe ihlanganisa amakheli omphakathi abasebenzisi abazulazulayo, izimpendulo iseva ezakhela bona zingalandela indlela entsha zingene ethunelini eliphezulu esikhundleni sokuphuma nge-underlay. Abantu bavame ukuqinisekisa ukuthi ithuneli eliya kumhlinzeki lisebenza bese bema lapho, ngoba lokho kuhamba kuwukuthutha kwethuneli uqobo futhi kuyaqhubeka nokugeleza ngenkathi konke okunye kuziphatha kabi.
Inqubomgomo esekwe kumthombo noma ku-mark iyona ndlela yokugcina imifudlana emibili ihlukene. Inketho ye-mark ye-Linux ku-OpenVPN ibeka uphawu lwe-firewall kumaphakethe abethelwe e-daemon, umthetho wokuhlela ongawathumela kubhodi elikhethekile. Amakheli omthombo nawo asebenza kahle lapho izimpendulo zangaphandle zeseva zihlala ziphuma ekhelini elilodwa le-underlay. Zombili izindlela zidinga izindlela ezivumelekile kubhodi elikhethayo kanye nokukhululwa kwe-endpoint yomhlinzeki, kungenjalo ithuneli ngokwalo alisakhuphuka.
Buza i-kernel ukuthi impendulo izothatha yiphi indlela ngaphambi kokubhala noma yimuphi umthetho. Amakheli angezansi ayizibambeli zekheli le-underlay le-Pi nekheli lomphakathi lomsebenzisi oyedwa ozulazulayo.
ip rule show
ip route get 198.51.100.7 from 192.0.2.10Qinisekisa ukwehlukana, bese umisa indima eyodwa ngesikhathi
Hlola imifudlana emithathu ngokwahlukana, ngoba i-handshake esebenzayo ayifakazeli lutho ngezinye ezimbili. Yamukela ukuxhumana okusha okungenayo, thumela uhlelo olulodwa oluvunyelwe ngokukhishwa okuphezulu, futhi uqinisekise ukuthi zombili izinqubo zisafinyelela ozakwabo.
Bese umisa indima yeklayenti bese ubheka ukuthi indima yeseva igcina ini. Le yindlela eshibhe kakhulu yokuthola umthetho wendlela noma we-mark owawenzelwe isimo esisodwa kodwa wasetshenziswa kuzo zombili.
systemctl stop [email protected]
systemctl status [email protected] --no-pager
ss -lunp | grep openvpn
journalctl -u [email protected] -n 20 --no-pagerOfunayo ukukubona ukuthi isilaleli sisaboshiwe, idivayisi yethuneli isekhona, futhi ilogi ayinazo iziphambeko ezintsha ngenkathi indima yeklayenti imisiwe. Uma ukumisa iklayenti kusika nezimpendulo zeseva kubasebenzisi abakhona, izindima ezimbili zabelana ngokuthile obekufanele kube ngumkhawulo kwenye yazo. Bhala ukuthi isiphi isimo, iliphi ifayela lokulungiselela kanye nomnikazi wamuphi umfudlana okuthintwa yinoma yiluphi ushintsho, kungenjalo umuntu olandelayo ohlupha le ndawo uzophinda athole lokho kusukela kuqanda.