I-OpenVPN iyaxhuma kodwa akukho okugelezayo: thola ungqimba lapho iphakethe liwa khona

OpenVPN ithi ixhunyiwe futhi akukho mkhondo wokuhamba onyakazayo, umusho ohlanganisa okungenani izinkinga ezinhlanu ezingahlobene. Ukuhlela imithetho yodonga lomlilo ngaphambi kokwazi ukuthi yiluphi ungqimba oluhlulekayo kuphindaphinda okungaziwa futhi kushiyela unjiniyela olandelayo isiphithiphithi. Sebenza kunalokho kusukela enqubweni ukuya ngaphandle, ngoba isinyathelo ngasinye esingezansi sisusa isigaba esisodwa noma sinciphisa lapho iphakethe lifa khona. Ukulandelana kubalulekile lapha: ukubamba okuthathwa ngaphambi kokwazi ukuthi iyiphi ikheli eboshiwe kuzofakazela okuthile, hhayi lokho okudingayo.

Isokhethi iyaboshwa noma ayiboshwa

Insizakalo ebika ukuthi iyasebenza isengaboshwa ekhelini noma ekuthuthweni ongakaze ukuhlose. Buza isokhethi ngokwayo: ss -lunp ibala izilaleli ze-UDP futhi ss -ltnp ibala i-TCP, futhi ikholomu efanele ifundwe ikheli lendawo, hhayi isimo.

Impendulo engenalutho ngokuvamile isho enye yezinto ezintathu: inqubo isiphumile ngemva kokuqala, ilayishe elinye ifayela lokucushwa, noma ilalela ekhelini elihlukile kunalelo okushayelwa kulo ucingo.

ss -lunp | grep 1194
ss -ltnp | grep 1194

Umyalelo local ubophela isilaleli ekhelini elilodwa, ngakho iklayenti eliqondise kwenye indawo kulelo host liyanqatshwa kuyilapho insizakalo ingaphandle isabonakala iphilile. Igama lesenzakalo lingase futhi likhombe ifayela ongakaze ulihlele, lokhu okwenzeka kuma-host agcina amaphrofayili amabili eduze.

Bamba iphakethe langaphandle, hhayi ithuneli

Hlunga kusixhumi esibonakalayo nembobo yangempela, ngokufaka esakho isixhumi: tcpdump -ni eth0 udp port 1194. Amaphakethe aphumayo angenalutho olubuyayo akhomba kulokho okuhlezi phezulu: ukuhlunga komhlinzeki, idivayisi ye-NAT, noma ikheli elikude okungewona lowo ocabanga ukuthi unguwo. Ukuthula kuzinhlangothi zombili kukhomba ekuhambeni kweklayenti noma kudonga lomlilo lendawo. Izimpendulo ezifika ngaphandle kwenqubekela phambili yethuneli zikhomba esiteshini sokulawula, okusho ukungafani kokhiye noma kwe-cipher, hhayi ekuhlungweni.

Bamba izinhlangothi zombili futhi ugcine ifayela lifushane. Ukubamba okude kungcwaba imizuzwana emithathu ethakazelisayo, futhi impendulo cishe ihlala isekushintshaneni kokuqala.

Izibali kuqala, umkhondo kuphela lapho ziqamba amanga

Qala ngezibali, ngoba azibizi lutho. Noma nft list ruleset noma iptables -L -n -v iphendula umbuzo oyedwa obalulekile lapha: ingabe umthetho ufanile? Ukulandelana kunquma umphumela, ngoba ukufana kokuqala kuyanqoba, yingakho i-DROP ebanzi ngaphambi kwe-ACCEPT yakamuva ishiya leyo ACCEPT ifile futhi yingakho ukwengeza umthetho akuvamisile ukulungisa lutho.

Ubunikazi futhi bukhubeka abantu. I-kernel ihlobanisa amaphakethe akhiqizwe endaweni nenqubo evule isokhethi, futhi i-OpenVPN ivamise ukusebenza njenge-root, ngakho umthetho oboshwe ku-ID yomsebenzisi ojwayelekile awuwona umkhondo wokuhamba wethuneli ngokwalo. Hlola i-UID yomnikazi ngaphambi kokunquma ukuthi umthetho awulungile.

Kuphela lapho izibali zihlala zingacaci khona ilogi ifanele umsindo, futhi nalapho kuphela ngesiqephu esincane: umthetho we-iptables okhawulela ijubane futhi ofaka isiqalo emugqeni walo, noma umthetho we-nftables ophethe meta nftrace set 1 ngenkathi nft monitor trace isebenza. Umkhondo uqamba uchungechunge nomthetho owamukele noma owalahla iphakethe. Ngemva kwalokho susa kokubili futhi ugcine ukuloga komthwalo ngaphandle.

Hlola ukuthutha futhi. Insizakalo yodonga lomlilo ekhawulelwe ku-TCP ayisho lutho ngesilaleli se-UDP kuleyo nombolo, ngakho umthetho ofundwa kahle usengalahla wonke amaphakethe.

Ukuhamba nendlela yokubuya

Iphakethe elamukelwe kodwa elinyamalalayo lidinga ukuhlolwa kwendlela yalo yokuyisa. ip route get ibika umzila okhethwe ikheli elilodwa, futhi ukuhlunga komzila ophambene kungalahla impendulo efika ngesixhumi esingeke sikhethwe ithebula eliyinhloko. Isibonakaliso sibukeka njengokulahla kodonga lomlilo, yingakho lokhu kuhlola kuza ngaphambi komunye umthetho we-NAT.

Esangweni, hlola ukudlulisela kanye nochungechunge lwe-forward esikhundleni sochungechunge lwe-input. Bese uqinisekisa ukuthi uhlangothi olukude luyazi ukuthi lungafinyelela kanjani ekhelini lomthombo, ngoba indlela ephumayo esebenzayo ngaphandle kwalutho olubuyayo iwukuthula kuzo zombili izimo.

Okufanele ikusho irekhodi

Kukho konke ukushintsha, bhala isigaba osihlolile, ubufakazi obufundile kanye nenani lesibali kuzo zombili izinhlangothi zaso. Yilo rekhodi elenza "manje iyasebenza" ihlale isekhona ekubuyekezweni okulandelayo.

Izindlela ezimbili ezimfushane zigcina irekhodi lithembekile. Iphakethe elingakaze lisuke kusihambisi alikwazanga ukulahlwa umthetho kwenye indawo, noma ngabe ukucushwa kohlangothi olukude kubukeka kunengqondo kangakanani. Iphakethe elaphuma labuya lihambisa umbuzo ngaphezu kongqimba lwenethiwekhi, lapho izibali zodonga lomlilo zingasenayo enye into yokukutshela.