Amaklayenti e-OpenVPN awaboni omunye nomunye: subnet noma net30?
Amaklayenti afinyelela kuseva kodwa awafinyeleli komunye nomunye. Hlukanisa iphutha nge-ping eyodwa, bese ukhetha i-subnet topology, client-to-client noma ingxenye ye-TAP enamabhuloho.
Amaphutha amabili angahlobene aletha isikhalo esifanayo. Kwelokuqala iklayenti elilodwa alifinyeleli kwelinye ngisho ngekheli le-tunnel, ngoba amakheli awakho ku-subnet eyodwa noma iseva ayiwudlulisi umsebenzi phakathi kontanga. Kwesibili i-ping iyasebenza kodwa uhlu lwamadivayisi wohlelo luhlala lungenalutho, ngoba ukutholwa kuncike ku-broadcast i-tunnel yesigaba 3 engakwazi ukuyithwala. I-ping eyodwa iyabahlukanisa, futhi ukulungiswa kwakho ngakunye akufani neze nokwelinye.
I-ping eyodwa ihlukanisa inkinga kabili
Kusuka kwiklayenti elilodwa, pinga ikheli le-tunnel lelinye iklayenti, hhayi igama laso futhi hhayi ikheli laso le-LAN. Uma lokho kwehluleka, ukudlulisa noma ukunikeza amakheli kuyinkinga futhi ukutholwa akubalulekile kuze kube kulungisiwe. Uma kuphumelela, ukudlulisa sekusebenza futhi okusalayo i-broadcast noma ukuxazululwa kwamagama.
ip addr show tun0Funda i-interface yeklayenti ngaphambi kwanoma yini, ngoba i-netmask ibiza i-topology. I-/24 noma enye imaski ye-subnet isho iphuli elabiwe; i-/30 enekheli lentanga isho ukuhlelwa kwakudala kwekuphoyinti-kuya-kwephoyinti, lapho iklayenti ngalinye linomakhelwane oyedwa kuphela, iseva.
net30 uma kuqhathaniswa ne-subnet, kufundwa ngasohlangothini lweklayenti
| What you observe | net30 | subnet |
|---|---|---|
| Client netmask | /30 with a peer address | The pool's own mask |
| Peers a client can address directly | One, the server | Every client in the pool |
| Addressing | One /30 block per client, with the server as the only peer | One pool mask shared by all clients |
| Effect of client-to-client | Required for any peer traffic | Required for peer traffic, still no broadcast |
Nge-net30 iseva inikeza ibhulokhi encane iklayenti ngalinye, ngakho akukho mzila oya ekhelini le-tunnel lelinye iklayenti ngaphandle uma iseva iyidlulisela. Nge-subnet iphuli lonke liyinekhithi eyodwa, iklayenti ngalinye lingakhuluma nayo yonke eminye, futhi iseva iyadlulisa phakathi kwazo. Yingakho ukuhlelwa kukaseva kungabonakala kuphilile kuyilapho i-ping phakathi kontanga yehluleka: akukho okugqekile, amaklayenti awakho kunekhithi eyodwa nje. Iklayenti libona isixhumanisi esisebenzayo nekheli lentanga elingaphenduli, okuyinto efundeka njenge-firewall kodwa empeleni iwukuhlelwa kwamakheli.
Ukushintsha i-directive ukuhlela ohlangothini lukaseva kanye nokuqalisa kabusha, futhi kusebenza kuxhumano olulandelayo hhayi kumaseshini asevele evuliwe. Xhuma kabusha amaklayenti ngaphambi kokuhlola ushintsho. Uma idivayisi iphinda ikhiqize ukuhlelwa kusuka ku-web interface, bhala phansi i-directive, ifayela nosuku, futhi wenze ukuhlela nge-interface uma ikhona, ngoba ukwakha kabusha kuzosula ukuhlela kwesandla ekugcineni okulandelayo.
i-client-to-client iyisango elihlukile
Ngisho ngaphakathi kwe-subnet eyodwa iseva ilahla amaphakethe avela kwiklayenti elilodwa futhi aqondiswe kwelinye ngaphandle uma i-client-to-client isethiwe. Lelo gama elingukhiye lenza iseva ibe umdlulisi womsebenzi phakathi kontanga esikhundleni sokuba yindawo yokugcina eyamukela kuphela. Yisimo sesibili abantu abasigeji ngemuva kokulungisa i-topology.
Lokhu akudluleli ku-broadcast. Ukuhlelwa kudlulisa i-unicast phakathi kwamaklayenti; akwenzi i-tunnel ibe ingxenye eyabiwe, futhi asikho isilinganiso salo esizoletha umbuzo wokutholwa we-multicast kuwo wonke amatangana.
TUN uma kuqhathaniswa ne-TAP, nokuthi yikuphi okungathwala ini
| Property | TUN | TAP |
|---|---|---|
| Layer | Layer 3, IP packets | Layer 2, Ethernet frames |
| Broadcast and multicast | Not carried | Carried |
| Bridging to the LAN | Not applicable | Required for a shared segment |
| Client platform support | Everywhere | Missing on Android and iOS, limited on macOS |
Ukubhuloha idivayisi ye-tap kungene ku-LAN kubeka amaklayenti akude esigabeni se-broadcast sehhovisi, okuxazulula ngokuphelele ukutholwa. Intengo iwamapulatifomu angayisebenzisi i-TAP, ibhuloho okumele libekhona kuseva, nesigaba sokuwohloka lapho isiphepho se-broadcast kukhebula lehhovisi sifinyelela yonke ilaptop ekude.
Kumasteshini okusebenza amabili noma amathathu adinga ukuxazululwa kwamagama, ukufakwa kwe-hosts noma ikheli le-unicast kushibhe kakhulu kunebhuloho. Phendukela ku-TAP lapho iphrothokholi ongakwazi ukuyishintsha incike ekutholweni kwesigaba 2, hhayi ngaphambi kwalokho.
Amaklayenti e-subnet efanayo ngaphandle kwebhuloho
Ukunikeza ikheli kusuka kububanzi be-LAN akubeki iklayenti kukhebula. Iseva ihamba phakathi kwe-tunnel ne-Ethernet, ngakho i-ARP yalelo kheli ima ku-interface yaseva futhi ingxenye esele ye-LAN ayikwazi ukwazi ukuthi lihlala kuphi.
ip neigh add proxy 10.50.1.250 dev eth0I-Proxy ARP ivala leso sikhala ngokwenza iseva iphendule egameni leklayenti. Kububanzi, i-parpd iphethe okufakiwe njengoba amaklayenti engena futhi ephuma, kuyilapho i-sysctl net.ipv4.conf.eth0.proxy_arp=1 iphendula konke okuhanjiswa kwenye indawo, okubanzi ngokwanele ukudala izimanga zayo esigabeni esimatasa.
Noma yimuphi umzila owukhethayo, susa i-NAT phakathi kwe-tunnel nekhebula. Umthetho we-MASQUERADE ufihla impela umbuzo wamakheli ozama ukuwuphendula. Futhi ushiyela umuntu olandelayo i-topology angakwazi ukucabanga ngayo kusuka ohlangothini lweklayenti.
Ngaphambi kokushintsha noma yini, bamba umzamo owodwa kuseva nge-tcpdump -ni tun0 bese uqinisekisa ukuthi iphakethe lentanga liyafika yini. Ukufika bese kulahlwa kukhombisa i-client-to-client; ukungafiki neze kukhombisa i-topology noma ukuhamba. Incwadi ye-OpenVPN 2.6 ibhala womabili amagama angukhiye kanye ne-topology ezenzakalelayo, okufanele kuqhathaniswe nenguqulo yakho ngaphambi kokukopisha umugqa kusuka kokuthunyelwe kwenkundla.
- I-interface ye-tun ikhombisa imaski yephuli hhayi ipheya lentanga le-/30.
- I-ping eqondile iya kwelinye ikheli le-tunnel iyaphumelela ngaphambi kokuthi uhlole ukutholwa.
- Ukuhlelwa kukaseva kufaka i-
client-to-clientnoma nini lapho amatangana kufuneka ashintshisane amaphakethe. - Shono igama lephrothokholi yokutholwa oyihlolayo esikhundleni sokuthi uhlelo luyahluleka.
- Sebenzisa i-TAP kuphela uma wonke amapulatifomu eklayenti eqenjini eyisekela.
- Gcina i-NAT ingekho emzileni phakathi kwe-tunnel ne-LAN lapho ukufinyeleleka ngaphakathi kwe-subnet efanayo kubalulekile.