Iklayenti le-OpenVPN liyama lapho iseva yalo isebenza kusihambisi esifanayo

Nganginomshini welabhorethri owamukela ithuneli elivela endaweni ekude futhi washayela ngaphandle kunethiwekhi yomhlinzeki. Iphrofayela yokuphuma yayisebenze amasonto. Ngemva kokufakwa kweseva engenayo, eyokuphuma yaxhuma yabe isiyeka ukudlulisa ithrafikhi phakathi namasekhondi ambalwa, noma yenqaba ukuqala ngephutha lokuthi ikheli lisisetshenziswa. Amafayela wokucwangcisa awazange ashintshe; usihambisi wamane wathola inqubo yesibili ye-OpenVPN enombono wayo ngamaphothi nemizila.

Ukwehluleka akukona okungahleliwe, futhi akusiyo inkinga yokuqinisekisa. Ama-daemon amabili kumshini owodwa ayancintisana ngesokhethi yasendaweni efanayo nangethebula yomzila efanayo, futhi lowo oqala noma oxhuma kabusha ekugcineni uvame ukunqoba. Ukwazi ukuthi iyiphi kulezi zingozi ezimbili onayo kunquma lapho okufanele ubheke khona kuqala.

Funda uphawu ngokuhlehla

Qala ngokuthi ithuneli lifa nini. Iphutha le-bind ekuqaleni likhomba ohlangothini olulalelayo: into ethile isivele ingumnikazi waleyo phothi, futhi i-OpenVPN iyenqaba ukuqala esikhundleni sokuyabelana ngayo. Ithuneli elikhuphukayo bese lithula likhomba ekuhambiseni imizila, ngoba umzila ofakwe esinye isimo ungadonsa amaphakethe okuxhumana kwangaphandle endleleni yawo.

Womabili amacala akhiqiza isikhalo esifanayo somsebenzisi, yingakho imijikelezo yokuzama kabusha nezincwadi zokugada zingalungisi lutho. Zixhumanisa iklayenti emuva engxabanweni efanayo. Umbuzo wokuqala owusizo ukuthi ingabe inqubo isasebenza lapho ithrafikhi ima.

Isokhethi eyodwa nedivayisi eyodwa ngosimo ngamunye

Iseva elalelayo ibopha iphothi yayo; iklayenti eliphumayo lidinga futhi iphothi yasendaweni yethrafikhi yalo ehlanganisiwe. Lapho kokubili kuhlala kusihambisi esifanayo, ukuziphatha okuzenzakalelayo kweklayenti kungashayisana nephothi yeseva. Iphothi yasendaweni yeklayenti ingacindezelwa, futhi ukubopha kungadlulwa lapho ozakwabo engadingi iphothi yomthombo eqinile:

lport 1195
nobind
dev tun1

Lezo zinombolo ziyizibonelo, hhayi imfuneko. Okubalulekile ukuthi iklayenti liyeke ukuncintisana ngephothi yeseva nokuthi isimo ngasinye sithole idivayisi yet huneli ehlukile. Ama-daemon amabili abelana nge-tun0 abhalela phezulu isimo sedivayisi somunye nomunye ngisho lapho amaphothi awo ehlukile, ngakho idivayisi eyodwa ngethuneli ngayinye ayiyona into yokuzikhethela.

nobind ingeyesandla seklayenti. Iseva kusamele ibophe futhi ilalele, ngakho ungakopishi umugqa kukucwangciswa kweseva, futhi ungakhubazi ukubopha kuklayenti ozakwabo ahlunga ngayo iphothi yomthombo eqinile.

Khetha umnikazi oyedwa womzila ozenzakalelayo

Uxhumano olulodwa kuphela olungafaka umzila ozenzakalelayo. Uma zombili izimo ziqondisa yonke ithrafikhi, uxhumano lwesibili lushintsha lokuqala buthule, futhi olokuqala lubonakala luphukile. Noma gcina ithuneli eliphumayo lihlukanisiwe futhi usunduze iziqalo zomhlinzeki kuphela, noma linike ithebula yomzila ehlukile.

ip rule add from 10.9.0.2 table 120
ip route add default dev tun1 table 120
ip route get 10.9.0.2

Amakheli nenombolo yethebula ngenhla yizibambeli zendawo. Ngemva nje kokufaka umthetho, qinisekisa ukuthi ikheli leseva ye-VPN ngokwayo lisaxazululwa ngethebula evamile; ithebula elibamba ukuthuthwa kwangaphandle liphula ithuneli obekufanele lilivikele, futhi umjikelezo wokuxhuma kabusha olandelayo ubonakala njengomhlinzeki ongathembekile.

Kusethaphu okufanele imelane nokuxhuma kabusha nokuqalisa kabusha, i-namespace yenethiwekhi iwumngcele oqinile. Iklayenti lesibili lisebenza ngaphakathi kwe-namespace yalo ngamakhompiyutha ayo nemizila yayo, futhi kudalulwa izinsizakalo okufanele zeqe umngcele kuphela. Usihambisi ugcina umzila owodwa ozenzakalelayo, futhi ukuxhuma kabusha kwe-namespace akukwazi ukuwubhala kabusha.

Qinisekisa ngethebula, hhayi ngomugqa wesimo

Iklayenti elibika ukuthi lixhunyiwe liqinisekisa isiteshi salo sokulawula kuphela. Thwebula isimo sokuhambisa imizila ngaphambi nangemva kokuxhuma ngakunye, bese ubuza i-kernel ukuthi iyiphi idivayisi indawo yokwenyani engayisebenzisa:

ip route show
ip route get 10.40.0.20
ss -lunp | grep 1194

Uma idivayisi ekhethiwe yekheli lomhlinzeki ishintsha lapho ithuneli lesibili liqala, unokungqubuzana kwemizila. Uma zombili izinqubo zivela kuphothi yasendaweni efanayo, unokungqubuzana kwesokhethi. Ukulungisa okokuqala ngaphandle kwesibili kumane kudlulisele ukwehluleka ekuxhumweni kabusha okulandelayo.

Bhala amaphothi, amadivayisi, amathebula nomnikazi womzila encwadini yokusebenza yosihambisi. Uma kungenjalo umuntu olandelayo ofaka ithuneli lesithathu uzophinda athole ukungqubuzana okufanayo, futhi ubufakazi obubonakalayo kuphela kuzoba uxhumano olusebenza kuze kuqale kabusha i-daemon yomunye umuntu.