Amagama amaklayenti e-OpenVPN ku-dnsmasq: iskripthi noma amarekhodi anganyakazi?

Izinkinga ezimbili zamagama zivela cishe kuwo wonke amasango amancane e-OpenVPN. Awukwazi ukufinyelela ikhompyutha ephathekayo exhunyiwe ngegama elikusitifiketi sayo, futhi izinsizakalo ezingemuva komhubhe azinawo nhlobo amagama. Zibonakala njengenkinga eyodwa futhi zidinga ukwelashwa okuphambene, ngoba ikheli elilodwa lihamba ngeseshini ngayinye kanti elinye alihambi. Nquma ukuthi hlobo luni lwegama olwengezayo ngaphambi kokuhlela noma yini.

Nquma ngegama ngalinye, hhayi ngesango

Isivivinyo silula: ingabe leli kheli liyashintsha lapho iklayenti lixhuma kabusha? Uma kunjalo, igama kufanele lidalwe kusuka kuseshini ye-VPN. Uma kungenjalo, lingele-rekhodi elinganyaki elingakwazi ukulifunda nokulibuyekeza.

Ukuhlanganisa kokubili ukwehluleka okuvamile. Insizakalo egcizelelwe kufayela elidalwe iyanyamalala lapho iskripthi siyibhala kabusha okokuqala, futhi iklayenti elibhalwe kurekhodi elinganyaki likhomba kulowo owayenalo leli kheli ekugcineni. Womabili amaphutha ahlala engabonakali kuze kube yilapho igama lixazululeka kumshini ongafanele. Ngaleso sikhathi lowo ohlola iphutha ucabanga ukuthi i-DNS iphukile, hhayi ifayela.

Indlela esebenzayo: learn-address kanye nechibi

OpenVPN iyazi ukwabiwa, ngakho vumela ikutshele. Lezi zinketho zeseva zenza ukwabiwa kuqhubeke futhi kube nokwenzeka ukukubhala ngeskripthi:

client-config-dir /etc/openvpn/ccd
ifconfig-pool-persist /etc/openvpn/ip-pool 60
script-security 2
learn-address /etc/openvpn/learn-address.sh

learn-address isebenzisa iskripthi sakho njalo lapho ikheli lengezwa, libuyekezwa noma lisuswa, futhi idlulisa umsebenzi, ikheli kanye negama elijwayelekile. Iskripthi esincane sengeza umugqa owodwa iklayenti ngalinye futhi siwususa lapho kususwa:

#!/bin/sh
HOSTS=/etc/openvpn/hosts.lan
case "$1" in
  add|update) echo "$2 $3" >> "$HOSTS" ;;
  delete)     sed -i "/^$2 /d" "$HOSTS" ;;
esac
kill -HUP $(cat /var/run/dnsmasq.pid)

Kudivayisi ye-tun i-agumenti yesibili iyikheli lomhubhe weklayenti, ngakho umugqa ungasetshenziswa ngqo. Kudivayisi ye-tap i-OpenVPN idlulisa ikheli le-MAC leklayenti esikhundleni salokho, ngoba ingxenye ye-tap ingathwala ezinye izimiso ngaphandle kwe-IPv4, futhi lapho kufanele ufune ikheli kufayela lechibi ngegama elijwayelekile ngaphambi kokubhala noma yini.

Cacisa ukuthi ifayela elidalwe liyini: isithombe salabo abaxhunyiwe manje. Amagama ayanyamalala lapho kunqanyulwa uxhumano, okuyiyo kanye into oyifunayo kumakhompyutha aphathekayo ahamba phakathi kwamanethiwekhi futhi okuyiyo kanye into ongayifuni kuseva ehlala ivuliwe ubusuku bonke.

Indlela enganyakazi: address= kanye nokwandiswa kwesizinda

Khombisa i-dnsmasq kufayela elidalwe esikhundleni sefayela le-hosts lesistimu, futhi yinike isizinda ukuze amagama amafushane ande abe amagama agcwele afanelekile:

domain=corp.example
no-hosts
addn-hosts=/etc/openvpn/hosts.lan
listen-address=127.0.0.1,10.8.0.1
bind-interfaces

Lapho domain isethiwe, umugqa ofana no-10.8.0.6 alice uphendula kokubili alice kanye no-alice.corp.example. Gcina listen-address kusango lomhubhe kanye ne-loopback kuphela, ngoba isixazululi esishicilelwe ngephutha kusixhumi se-LAN siyinsizakalo obungahlosile ukuyinikeza.

Izinsizakalo ezingaveli echibini ziba namarekhodi azo. Zibeke kufayela le-drop-in elihlukile kusikhombisi sokulungiselela sokwabiwa ukuze ukuthuthukiswa kwephakheji kungakwazi ukuzibhala phezu kwazo:

address=/files.corp.example/10.8.0.20
address=/db.corp.example/10.9.0.5

Nikela isixazululi noma akukho okuzokwenzeka

Isixazululi okungekho muntu osibuzayo asishintshi lutho. Iseva kufanele isimemezele:

push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DOMAIN corp.example"

Amaklayenti e-Windows asebenzisa zombili izinketho ngokwawo. Iningi lamaklayenti e-Linux awakwenzi: adinga ukuhlanganiswa kwesixazululi okusekelwayo njengehuku le-update-resolv-conf lokwabiwa noma ukuphathwa kwe-DNS kwe-NetworkManager, noma isizinda sokusesha neseva yamagama esethwe ngesandla. Hlola isixazululi sangempela seklayenti esikhundleni sokucabanga ukuthi i-push ihlonishwe, ngoba i-push eshaywe indiva ibonakala ifana ncamashi neseva engaphenduli.

Qinisekisa ezigabeni ezintathu

Buza iseva ngqo kuqala, bese ubuza iklayenti, bese ubuza uhlelo lokusebenza:

dig +short @10.8.0.1 alice.corp.example
getent hosts files.corp.example

Uma imibuzo eqondile iphendula kanti uhlelo lokusebenza aluphenduli, iphutha lisekudluliseni kuklayenti hhayi esigabeni. Uma igama lixazululeka futhi uxhumano lusahluleka, igama lilungile futhi into elandelayo okufanele ibhekwe indlela noma isivikelo somlilo.

Bhala izigaba ezimbili eceleni kokulungiselela: yimaphi amagama adalwayo, yimaphi agcizelelwe, futhi yisiphi isitifiketi okufanele sihambisane naso ngayinye. Umuntu olandelayo ozofaka iseva uzokopisha iphethini yokuqala azoyithola.