I-OpenVPN iyawa ngemva kokuvuselelwa kwe-DHCP: gcina umzila wendawo yokugcina

Ithumbu liyaxhumana, bese kuthi ukuvuselelwa kwesivumelwano sokuqasha kusixhumanisi sokufinyelela kulibulale, futhi ilogi isola isikhathi esiphelile esikhundleni somzila. Akukho lutho olushintshile ekucushweni kwe-VPN, futhi yilokho okuyisikhombisi: kukhona okushintshile ngaphandle kwayo. Umcimbi we-DHCP wabhala kabusha ikheli noma igethiweji, futhi umzila we-host owawugcina indawo yokugcina yethumbu ifinyeleleka manje ukhomba isinyathelo esilandelayo esingasekho. Lena inkinga yobunikazi ngaphambi kokuba yinkinga yomzila.

Qhathanisa uphawu nemizila engu-half-default

Nge-redirect-gateway def1, i-OpenVPN ifaka i-0.0.0.0/1 ne-128.0.0.0/1 esikhundleni sokushintsha umzila ozenzakalelayo. Kanyekanye labo ababili bakhwela yonke indawo yamakheli, futhi banqoba i-0.0.0.0/0 ngobude be-prefix kuphela. Ngakho-ke noma iyiphi indawo engenakho ukufana okuqondile kakhulu ingena ethubhini.

Indawo yokugcina idinga okuhlukile. I-OpenVPN yengeza umzila we-host oya ekhelini leseva ngokusebenzisa igethiweji yokufinyelela yasekuqaleni ngaphambi kokuba ama-half-default angene, ukuze amaphakethe afakwe kusikhwama akwazi ukuphuma. Lapho lokho kuhlukile kunyamalala, noma kugcina isinyathelo esilandelayo esingasekho, amaphakethe angaphandle ethumbu ngokwalo ayafana ne-half-default futhi abuyiselwa ethubhini. Umphumela uyi-ukuxhumana ofa ekugcineni kokuphila noma ekuxhaweni okulandelayo, ngaphandle kwanoma yini elogini ebukeka njengephutha lomzila.

Qinisekisa ukuma kwethebula ngaphambi kokuthinta noma yini enye. I-ip route show kufanele ibale izingxenye zombili kanye nomzila we-host wekheli leseva; uma umzila we-host ungekho, ukuphenya okusele kunendawo yokuqala ecacile.

Kungani ama-half-default anqoba ngaphandle kokushintsha i-metric

I-metric ephansi ayinqobi i-prefix ende. Imizila /1 iyanqoba ngoba i-kernel iqala ngokufanisa umzila oqondile kakhulu, ngakho-ke ukunyusa i-metric kumzila ozenzakalelayo akushintshi lutho mayelana nokuthi ukuhamba okubheke ethubhini kuyaphi. Ukulandela ama-metric yikhona okuyiphutha elivame kakhulu kulesi sifo.

Hlola ukukhetha nge-ip route get 203.0.113.10, ufake ikheli langempela leseva. Impendulo isho i-interface nesinyathelo esilandelayo i-kernel ebesizosebenzisa ngempela, okunolwazi oluningi kunokufunda ithebula nokucabanga ngalo.

Sebenzisa lowo myalo ngaphambi kokuba ithumbu liqale, ngesikhathi lisebenza, nangemva komcimbi wesivumelwano. Izimpendulo ezintathu kumyalo owodwa, futhi indawo yokuhlukana iyabonakala.

Thatha izithombe ezintathu, hhayi eyodwa

Qoqa ikheli lokufinyelela, igethiweji yokufinyelela, indawo yokugcina, umzila okhethiwe nanoma yimiphi imithetho yenqubomgomo ngezikhathi ezintathu: ngemva kokucushwa koxhumano lokufinyelela, ngemva kokuxhumana kwe-VPN, nangemva komcimbi wesivumelwano noma womhlinzeki. Isithombe ngasinye siyisandla sezimyalo, futhi zinesizotha kuphela uma zikanyekanye. Isithombe esisodwa ngemva kokwehluleka sibhala isimo hhayi ukuguquka. Bhala imiyalo kusikripthi esincane ukuze isithombe ngasinye sithathwe ngendlela efanayo.

Gcina izithombe kufayela elilodwa elinezimpawu zesikhathi, ngoba umbuzo othakazelisayo kamuva ukulandelana. Ingabe umcimbi we-DHCP ufike ngaphambi noma ngemva kokuba i-OpenVPN ivuselele umzila wayo? Impendulo inquma ukuthi ubani okufanele ayilungise. Uphawu lwesikhathi oluvela ewashini elingalungile lubi kunokungabi nalo, ngakho-ke thatha kusibungu esiphethe ithebula lomzila.

Uma indawo yokugcina icushwe njengegama esikhundleni sekheli, yixazulule nakusithombe ngasinye. Ushintsho lwe-DNS kuxhumano lokufinyelela lungahambisa indawo yokugcina ngaphandle kokuthinta noma yimuphi umzila.

Nquma ukuthi iyiphi ingxenye evuselela okuhlukile

Kusistimu ye-dhcpcd, ama-hook asebenza kusuka kufolda yama-hook naku-hook yokuphuma, futhi imodi yomphathi iyahluka ngobubanzi kumodi ye-interface ngayinye. Noma yini eyenziwa i-hook kumele ibe idempotent, ngoba ukuvuselelwa kungafika ngamaqembu.

Umnikazi othembekile ukuhlanganiswa osekwazi izinhlangothi zombili: umphathi wenethiwekhi ophethe ukuxhumana kwe-VPN, noma iyunithi ehlelwe ngemva kokuba uxhumano lokufinyelela lukhuphuke. Umzila oqinile owengezwa i-hook usebenza kuze kube ushintsho lwegethiweji olulandelayo, bese wehluleka ngendlela efanayo. Uma usebenzisa i-hook, yenza ifunde igethiweji yamanje ngesikhathi sokusebenza esikhundleni sokubhala ngqo leyo oyibone namuhla.

Bhala umnikazi ngaphakathi kokucushwa. Umuntu olandelayo ozolungisa ukuxhumana kabusha udinga ukwazi ukuthi i-hook, hhayi i-VPN, inesibopho somzila wokuhlukile.

Hlola umjikelezo wokuphila, hhayi ukuxhumana kabusha kuphela

Phoqa ukuvuselelwa nge-dhcpcd -n eth0 noma ngokudedela nokuthatha kabusha isivumelwano, bese uhlola futhi i-ip route get yendawo yokugcina. Kwenze kabili, ngoba umzuliswano wesibili ubamba ama-hook engeza imizila ephindiwe. Bese uqalisa kabusha, ngoba ukuqina kuyisici esihlukile kunokunemba.

Ithumbu elisinda ukuvuselelwa nokuqaliswa kabusha linomnikazi nokuhlukile okusebenzayo. Lelo elisinda ukuqalisa kabusha ngesandla kuphela alinakho kokubili, futhi lizohluleka kumcimbi olandelayo ongakwazi ukuwuhlela.