Yimaphi amachweba i-OpenVPN Access Server elalela kuwo ngempela?
Hamba uhlu lwamasokhethi kusibungu se-Access Server: bona abalaleli abazenzakalelayo, hlukanisa i-loopback namachweba ashicilelwe, futhi uhlole ukudluliswa ngaphambi kokuvala ichweba.
Uqalisa ss -lntup kusibungu se-Access Server futhi uthola uhlu olude ngokuphindwe kabili kunalokho obekulindelekile. Ingxenye yokungena amachweba amise okwe-daemon okungekho muntu owasho ngesikhathi sokusethwa. Ukusabela kuwukuthi uvale konke okungeyona u-443 noma u-1194, futhi yileyo ndlela abantu abaphula ngayo ingosi yabo yamakhasimende.
I-Access Server ayilona umlaleli oyedwa. Iyisevisi ye-VPN, isevisi yewebhu futhi iyingxenye yeklasta, futhi ingakhiqiza amachweba angeziwe akhethekile e-daemon kanye nokuphinda kuqondiswe kwe-firewall kuye ngokuthi mangaki ama-daemon e-TCP owawasethile.
Hamba uhlu ngokulandelana: funda amasokhethi, hlela lawo ajwayelekile, hlukanisa okusele ngokomnini nokubopha, bese uhlola ukuthi yini ngempela ewashicilelayo.
Qala ngomyalo owodwa wokufunda kuphela
sudo ss -lntup ikunikeza ukuthuthwa, ikheli lendawo, ichweba kanye nenqubo yomnini kusokhethi ngayinye elalelayo. Amafulegi abalulekile: -l ukulalela, -n izinombolo, -t TCP, -u UDP, -p inqubo. Ngaphandle kwe-root uthola amasokhethi kodwa awamatholi amagama ezinqubo, futhi yilowo kholomu owudingayo ukuze uhlukanise.
Qopha izinkambu ezine ngomugqa ngamunye ngaphambi kokwakha noma imuphi umbono: iphrothokholi, ikheli lokubopha, ichweba kanye nomyalo. Gcina inguqulo ye-Access Server kanye nenani lama-daemon asethiwe eceleni kwalolo hlu, ngoba kokubili kushintsha okulindelekile.
Imigqa emibili ebukeka ifana ayifani. I-TCP ne-UDP kunombolo eyodwa amasokhethi ahlukene anokuchayeka okuhlukene, futhi 0.0.0.0 kanye :: ukubopha okuhlukene kwemindeni yamakheli ehlukene. Isevisi eboshelwe kuphela ku-127.0.0.1 ayifinyeleleki ngqo isuka kwesinye isibungu, nakuba ukuphinda kuqondiswe kwendawo kusengayishicilela.
Abalaleli okufanele ubabone
Lawamavelu azenzakalelayo ahlanganisa iningi lokusetshenziswa futhi akunikeza isisekelo sokuqhathanisa. Lawa mavelu azenzakalelayo, hhayi uhlu oluphelele lwezigunyazwe.
| Socket | Role to confirm |
|---|---|
| UDP 1194 | OpenVPN UDP tunnel listener |
| TCP 443 | OpenVPN TCP listener, optionally forwarded to the web service |
| TCP 943 | Admin and client web interfaces, and cluster control in Access Server 3.0 and later |
| TCP 945 | Cluster control in older configurations that predate the move to 943 |
Konke okudlula lokho kudinga incazelo, hhayi umcabango. Uzovame ukubona abalaleli bendawo kuphela abangaphansi kwezingxenye ezifakwa umkhiqizo ngokwawo. Baqinisekise nge-PID nangokulungiselelwa kwesevisi esikhundleni senombolo yechweba okhumbula yona, futhi ungathathi ichweba elingaziwa njengesitha ngenxa nje yokungaziwa.
Isokhethi elingaphandle kombhangqwana ojwayelekile nakho akusona ngokuzenzakalela insalela. Uma ama-daemon e-TCP amaningi esethiwe, i-Access Server yenza abalaleli nge-daemon ngayinye futhi iqondisa ukuthuthwa kubo, ngakho inani labo namavelu amachweba alandela lokho kulungiselelwa.
Hlukanisa ngaphambi kokuvala noma yini
Kumugqa ngamunye ongaqinisekile, phendula imibuzo emithathu ngalokhu kulandelana.
- Umnikazi nenhloso. Hlobanisa i-PID neyunithi noma ngenqubo bese ufunda ukulungiselelwa kwaleyo sevisi. Uma ungakwazi ukusho umnikazi, awukakulungeli ukunquma noma yini mayelana nesokhethi.
- Ubukhulu bokubopha. I-loopback yindawo yasekhaya yesikhala samagama. Ukubopha kwe-wildcard kufinyeleleka kuphela uma ukuhlela imizila, ukuhlunga kwesibungu nanoma yimiphi imithetho yezinga lefu kwikuvumela, ngakho ikheli lokubopha liyadingeka kodwa alanele. Hlola i-IPv4 ne-IPv6 njengezinqumo ezihlukene.
- Indlela eshicilelwe. Dinga ukudluliswa kwesevisi, ukuphinda kuqondiswe okukhethekile kwe-daemon, i-proxy yangaphandle kanye nenqubomgomo ye-firewall esebenzayo. Lesi yisinyathelo abantu abasidlulayo, futhi yisona esishintsha ichweba le-backend elibonakala lingenangozi libe indlela yokuphatha efinyelelekayo.
Umbuzo ofanayo ufundwa ngendlela ehlukile ngaphandle kwesibungu. Ichweba elingenamthetho we-firewall yesibungu lingase livalwe iqembu lezokuphepha lefu, futhi ichweba elinomthetho wesibungu ovumelayo lingase lingafinyeleleki ngoba akukho okuhlela imizila kuyo. Bheka zombili iziphetho ngaphambi kokubhala isiphetho sohlu.
Lapho indlela eshicilelwe ihluka kuhlu lwamasokhethi
Idokhumenti ye-Access Server uqobo ihlanganisa icala elidala ukudideka okukhulu: uma ama-daemon amaningi e-TCP egijima, ichweba langaphambili lidlulisela emachwebeni akhethekile e-daemon, futhi ukuhleleka okubonakalayo kuyeka ukuvumelana nohlu lwamasokhethi. isifundo sokuhlunga isixhumanisi sewebhu sichaza leyo mithetho nokuthi kungani isihlungi esibhalelwe kuphela ichweba elicacile singase sigeje ngokuphelele indlela eqondisiwe.
Ukulawulwa kweklasta indawo yesibili lapho inguqulo ibalulekile. Kusukela ku-3.0 ihlanganyela i-943; ukulungiselelwa kweklasta okudala kwakusebenzisa i-945. Ukuvula noma ukuvimba okukodwa kukho ngaphandle kokuhlola inguqulo kukhiqiza uhlu olubukeka lucwebelekile futhi olungalungile.
Ngakho indawo ebonakala ngaphandle iyinhlanganisela yezinto ezintathu: amasokhethi alalelayo, imithetho yokudluliswa ewashicilela kabusha kanye nezilawuli zenethiwekhi phambi kwesibungu. Noma yiluphi uhlu oluqopha okokuqala kuphela aluphelele, futhi noma yiluphi ushintsho olucabangela okokuqala kuphela luzoshiya indlela ivulekile noma lusike isevisi.
Qinisekisa ngemuva kwanoma yiluphi ushintsho
Shintsha izilungiselelo zomlaleli ngomnini wokulungiselelwa osekelwe futhi ugcine ikhonsoli yokubuyisela ivulekile ngenkathi wenza lokho. Ukulahlekelwa ukufinyelela kokuphatha kusixhumanisi sewebhu kusibungu esikude akubuyiseki nge-VPN oyikhiphe kanye kuphela.
Bese uqinisekisa izinto ezine ezivame ukudingwa ukusetshenziswa: iklayenti le-VPN liyaxhuma, ingosi yamakhasimende iyalayisha, ukufinyelela kokuphatha kuyasebenza, futhi ukuxhumana kweklasta kusasebenza uma ugijima amanodi angaphezu kwelilodwa. Ukuhlolwa kwe-VPN kuphela kudlula ngokunethezeka ngenkathi ingosi iphukile.
Qeda ngokubhala indlela evunyelwe yesevisi ngayinye: iyiphi isokhethi, ukuphi ukubopha, umuphi umthetho wokudluliswa, ukuphi ukulawulwa kwenethiwekhi. Leyo dokhumenti iwumphumela wokuphepha owusizo. Inani elincane lamasokhethi akulona, futhi nokuhlela kabusha okukhulu okuvala abalaleli okungekho muntu oqedile ukubakhomba nakho akulona.