Ithuneli eliphelele le-OpenVPN linqamula isikhathi sakho se-SSH: lungisa indlela yokubuya

Ukuvula iklayenti le-OpenVPN elinethuneli eliphelele kumshini owufinyelela ngawo nge-SSH kungase kunqamule isikhathi phakathi nesekhondi, futhi umshini awenzi lutho olungalungile. Ithuneli alishintshi indlela amaphakethe afinyelela ngayo kuseva; lishintsha indlela izimpendulo eziphuma ngayo. Ngokushesha lapho indlela ezenzakalelayo ikhomba ku-tun0, impendulo eya kuklayenti lakho le-SSH ingena kunethiwekhi yomhlinzeki, engenayo indlela yokubuyela ekhelini lakho. Ukuxhumana kulenga, umzamo olandelayo uhluleka ngesikhathi, futhi i-daemon iqhubeka ilalela kuphothi 22 isikhathi sonke.

Funda ithebula lokuhamba ngaphambi kokufunda ilogi ye-VPN. Ilogi izothi ithuneli likhuphukile, futhi ilunga. Umbuzo ukuthi yisiphi isixhumanisi esinikezwa impendulo ngayinye, futhi lokho ukusesha kwephakethe ngalinye ohlwini olusanda kubhalwa kabusha ithuneli.

Kungani impendulo iphuma ngomnyango ongafanele

Amaphakethe angenayo asafika esixhumanisini somzimba, ngoba iklayenti le-VPN alikwazi ukushintsha indlela i-inthanethi efinyelela ngayo ikheli lomphakathi leseva yakho. Izimpendulo ziyisinqumo esihlukile: kuwo wonke iphakethe, i-kernel ibheka indawo ekuyiwa kuyo, futhi ngemva kwe---redirect-gateway umugqa ozenzakalelayo uthi ithuneli. Ukuphuma komhlinzeki kubona indawo engayisebenzeli bese kuwisa iphakethe.

Ukuvikelwa kwe-OpenVPN ngokwako kuhlanganisa ngqo indawo eyodwa. Incwadi ye-2.6 ichaza i---redirect-gateway njengokulandelana: yengeza indlela yomsingathi ye-peer ye-VPN ngegalaji elalisetshenziswa ngaphambi kwethuneli, ukuze ithrafikhi ebethelwe ingakwazi ukubuyela kuyo ngokwayo, bese ishintsha indlela ezenzakalelayo. Leyo ndlela yomsingathi ingeyakwa-peer kuphela. Iklayenti lakho le-SSH likheli le-inthanethi nje elinye futhi alitholi sikhathi esikhethekile.

Kufanele kuqedwe kusenesikhathi iphutha elilodwa lesiqalo. I-ip route add -net 0.0.0.0 gw 10.8.0.1 dev tun0 engenabo ubude ihambisana nekheli elilodwa u-0.0.0.0, hhayi i-inthanethi; kufanele ibe i-0.0.0.0/0. Futhi uma ukuthatha okuzzenzakalelayo kuphula ukuthutha kwethuneli ngokwalo, engeza indawo yokuphela njengendlela yomsingathi ngesixhumanisi somzimba, usebenzisa ikheli langempela lomhlinzeki.

Phina ikheli leklayenti lakho le-SSH ukuze kulungiswe ngokushesha

Ukulungiswa okusheshayo i-ndlela yomsingathi yekheli leklayenti lakho ngegalaji elasetshenziswa iseva ngaphambi kokuthi ithuneli libe khona. Ngasohlangothini lwakho, thola ikheli iseva ezolibona, bese ufunda ithebula leseva ukuze wazi igalaji elidala:

curl -s https://ifconfig.co
ip route

Kuseva, engeza okukhethekile ngaphambi kokuthi iklayenti liqale. Amakheli lapha ayizikhala; ukuma kwawo okubalulekile:

sudo ip route add 80.128.240.55 via 192.168.178.1

Lokhu ukulungiswa okwasetshenziswa esimeni esibikiwe, futhi kusebenza ngokushesha. Futhi kubuthakathaka ngezindlela ezimbili ezingabikezelwa: indlela iyanyamalala lapho kuqalwa kabusha, futhi iba nephutha ngomzuzu lapho i-ISP yakho ikunikeza ikheli elihlukile. Kuyiphatha njengesinyathelo esiphuthumayo futhi uyenze ihlale njalo ngamabomu, ngesisetshenziswa senethiwekhi noma nge-hook ye-dispatcher, noma wamukele ukuthi kungokwesikhashana bese ubhala phansi indlela yokubuyisela.

Vimbela iklayenti ukuthi lingathathi indlela ezenzakalelayo

Ukukhetha okuhlanzekile ukuvimbela ithuneli ukuthi lingashintshi indlela ezenzakalelayo nhlobo. I-route-nopull, isetshenziswa ne---client noma i---pull, yamukela izinketho ezicindezelwe ngaphandle kwezindlela, i-block-outside-dns nezinketho zesitayela se-DHCP njengeziseva ze-DNS, ngakho ungeza kuphela iziqalo ozidingayo. Ithuluzi elincane isihlungi sokudonsa, esilahla umyalo owodwa onenkinga bese sigcina okunye:

route-nopull
pull-filter ignore "redirect-gateway"

Sebenzisa okukodwa noma okunye, hhayi kokubili, futhi uqonde ukuthi yini eshintshayo. Ngaphandle kwendlela ezenzakalelayo ethunelini, iseva ayisaphenyi i-inthanethi ngomhlinzeki; ifinyelela kuphela lokho okukuhambisile ngokucacile. Uma ithuneli eliphelele laliyinjongo yonke yokuhlela, lona isiswishi esingalungile futhi indlela yomsingathi engenhla iyona elungile.

Hlukanisa indlela yokubuya ngokomthombo noma ngokuxhumana

Uma ikheli elingenayo lizinzile, umthetho womthombo ugcina izimpendulo zisendaweni ngaphandle kokuthinta izindlela zethuneli ngokwalo. Nika ikheli lesixhumanisi somzimba ithebula lalo eliqukethe isiqalo se-LAN nokuzzenzakalelayo komzimba, bese ukhetha lelo thebula kuthrafikhi evela lapho:

ip rule add from 192.168.1.11 table 128
ip route add table 128 to 192.168.1.0/24 dev eth0
ip route add table 128 default via 192.168.1.1

Lokhu kuyasebenza ngoba izimpendulo zokuxhumana kwe-SSH okungenayo zivela ekhelini iklayenti elixhumeke kulo. Isimo esibikiwe lapho yonke insebenzo engenayo kwakufanele iqhubeke isebenza sasebenzisa ngqo lesi simo. Uma ikheli elingenayo lintanta noma indlela iguquguquka, maka ukuxhumana esikhundleni salokho: beka uphawu lwe-conntrack kuphakethe lokuqala elivela esixhumanisini somzimba, kopisha kumaphakethe ezimpendulo ku-OUTPUT, futhi uqondise amaphakethe amakiwe ngethebula elikhomba egalajini lomzimba.

iptables -t mangle -A PREROUTING -i eth0 -m conntrack --ctstate NEW -j CONNMARK --set-mark 1234
iptables -t mangle -A OUTPUT -m connmark --mark 1234 -j MARK --set-mark 4321
ip route add default via 192.168.1.1 dev eth0 table 3412
ip rule add fwmark 4321 table 3412

Gcina uphawu lokuxhumana, uphawu lwe-firewall nenombolo yethebula kuhlukene ngesikhathi sokuhlola. Ukusebenzisa kabusha inombolo eyodwa kumindeni emibili kwenza umthetho obonakala ulungile futhi oshaya amaphakethe angalungile. Umugqa ozenzakalelayo wethebula nawo udinga i-via negalaji le-LAN kusixhumanisi esijwayelekile se-Ethernet; i-dev eth0 engenalutho isebenza kuphela uma isixhumanisi siyiphuzu-kuya-phuzu noma uma ukweqa okulandelayo kuxazululwa ngenye indlela. Umsingathi uJessie obikiwe wayekusixhumanisi lapho ukuma okungenalutho kwakusebenza khona, futhi lokho akusona isimiso sokusabalalisa okufanele kukopiswe.

Hlola ngaphandle kokuzivalela ngaphandle

Ungahloli ngokunqamula. Gcina isikhathi sokuqala sivuliwe, khuphula ithuneli, futhi ubuze i-kernel ukuthi iyiphi indlela ikheli lakho elizoyithatha:

ip route get 80.128.240.55

Impendulo kufanele isho isixhumanisi somzimba negalaji elidala, hhayi ithuneli. Bese uvula ukuxhumana kwesibili kwe-SSH; yilokho ukuhlolwa kwangempela, ngoba isikhathi esidala singase siphile esimweni okuxhumana okusha okungeke kukukhiqize. Uma eyesibili ilenga kuyilapho eyokuqala isaphendula, umthetho awukaze uhlangane nethrafikhi ebalulekile, futhi izimpawu noma ikheli lomthombo yilapho okufanele ubheke khona.

Gcina ikhonsoli engaphandle kwebhendi itholakala phakathi nayo yonke imisebenzi. Iseva okuwukuphela kwendlela yayo yokungena ithuneli olimazile manje ayikwazi ukulungiswa ngalelo thuneli, futhi ukuhlehla kwangemuva kulula uma ubhale phansi izinombolo zamathebula neziqalo ozingezile.