I-OpenVPN iroute nomzila wekhreneli: Iyiphi Engenekho?

Iphakethe eliya ku-10.77.20.0/24 lithatha izinqumo ezimbili ezihlukene kuseva ye-OpenVPN: uhlelo lokusebenza kufanele likunikeze i-VPN interface, futhi OpenVPN kufanele yazi ukuthi iyiphi iklayenti exhunyiwe engumnikazi walesi siqu. Umzila wekhreneli ongekho uwisa iphakethe ngaphambi komhubhe, kanti umzila wephara ongekho uwisa ngemuva kwawo. Ukwehluleka kokubili kubonakala kufana uma kubhekwa kusukela ku-LAN ekude, futhi ukuthola ukuthi yikuphi okukuwe kudinga umyalo owodwa ohlangothini ngalunye.

Emzileni wemininingwane wendabuko we-userspace, umzila wekhreneli ungenisa iphakethe enqubeni yomhubhe futhi i-iroute itshela leyo nqubo ukuthi iyiphi iphara okufanele ilithole. Akukho okubuyisela okunye esikhundleni, futhi ukuhlelwa okunokukodwa kuphela kuzobonakala kunengqondo kuze kufike i-ping yokuqala.

Izinqumo Ezimbili, Hhayi Umzila Owedwa

Cabanga ngesixhumanisi se-site-to-site lapho i-10.77.20.0/24 ingemuva kweklayenti elilodwa. Umzila wekhreneli wesevera, isibonelo ip route add 10.77.20.0/24 dev tun0, uthumela amaphakethe ahambisanayo kudivayisi yomhubhe. I-OpenVPN ibe isibheka ithebula layo langaphakathi, elakhiwe ngamarekhodi e-iroute kudayirekhithri yokuhlelwa kweklayenti, ukuze inqume ukuthi yikuphi ukuxhumana kwephara okuzowamukela. Ngaphandle komzila wekhreneli iphakethe alifinyeleli enqubeni, futhi ngaphandle komzila wephara lifinyelela enqubeni kodwa aliyi ndawo.

Kulula ukukhohlwa lokho kwehlukaniswa, ngoba umugqa owodwa womzila kuphrofayela yeklayenti ungabonakala wenza imisebenzi yomibili. Akwenzi: ukuthumela umzila kutshela amaklayenti ukuthi yini okufanele bayithume ngomhubhe, kanti i-iroute itshela iseva ukuthi ngubani umnikazi webanga lamakheli elingemuva kweklayenti. Zihlala kumafayela ahlukene, zifundwa izinhlangothi ezihlukene, futhi zihluleka ezinhlangothini eziphambene.

I-iroute Ihamba Kuphi Nokuthi Ithini

Irekhodi liya kufayela likaklayenti ngalinye eliqanjwe nge-common_name yeklayenti, ngaphansi kwe-client-config-dir, ngendlela iroute 10.77.20.0/24. Ukufana kwegama lefayela akukona nje kobuhle: i-OpenVPN ibheka ubunikazi obuqinisekisiwe bese ifunda ifayela elinegama elifanayo ncamashi, ngakho ifayela elibizwa nge-site-a lisebenza kuphela kuklayenti eline-common name engu-site-a. Engeza i-ccd-exclusive uma amaklayenti angenalo lifayela kufanele enqatshwe ngokushesha, okuyisilungiselelo esifanele lapho wonke amaklayenti eyi-gateway yesayithi. Gcina ifayela elilodwa nge-gateway ngayinye futhi uliqambe nge-subject yesitifiketi oyikhipha ngempela.

Hlola irekhodi kusuka kuseva ngaphambi kokusola i-LAN ekude. Ifayela lesimo libala amaklayenti axhunyiwe namagama awo e-common, futhi iseva esebenza nge---verb 4 ibhala kungobo yomlando ukufakwa kwe-iroute lapho iphara ixhumana. Uma kungabonakali lutho ngesikhathi sokuxhumana, ifayela lisekhabetheni elingalungile noma liqamba ubunikazi obungalungile.

Ugibe: Ifayela Likho, Ubunikazi Abulungile

I-iroute ebukeka ilungile kodwa exhunywe kuphara engalungile ilahlekela isikhathi esiningi kunefayela elingekho, ngoba konke kudiski kubonakala kulungile. Ukuqanjwa kabusha kwesitifiketi, ama-common name aphindayo, kanye ne-username-as-common-name eshintsha ubunikazi obusebenzayo konke kukhiqiza lokhu. Hlola ukuthi iseva iqinisekise ubuphi ubunikazi esikhundleni salokho obukulindele: umphumela wesimo ungumbhalo othembekile, kanti igama lefayela liwukhiye wokubheka kuphela.

Umzila ungaphila isikhathi eside kunomnikazi wawo. Imizila ye-static namarekhodi e-iroute achaza isiqu esithile, hhayi isiqinisekiso sokutholakala, ngakho ithrafikhi ingaqhubeka iqondiswa iphara elingaxhunyiwe okwamanje.

Qedela Umzila Ngale Kwephara

Ubunikazi bephara ingxenye yaphakathi yomzila, hhayi ukuphela kwawo. Iklayenti kufanele lidlulisele amaphakethe kusuka kumhubhe liye ku-LAN yalo, okusho ukuthi i-IP forwarding kufanele ivuliwe kuleyo hosti futhi kube nomthetho we-firewall ovumela ukudlula. Amahosti aku-LAN ekude adinga umzila wokubuya wekheli lomhubhe: kungaba umzila okhomba emuva ku-gateway noma idizayini ye-NAT eyenzelwe ngamabomu ohlangothini lweklayenti. Qinisekisa isilungiselelo sokudlulisa kuklayenti nge-sysctl net.ipv4.ip_forward esikhundleni sokucabanga inani elizenzakalelayo le-distribution.

Uma amanye amaklayenti e-VPN kufanele afinyelele leyo sub.net, ukuhlelwa kukhula futhi: iseva idinga i-client-to-client, futhi lawo maklayenti adinga ukuhambisa isiqu ngomhubhe. Akukho kwalokho okushiwo yithebula lomzila leseva uqobo.

Qinisekisa indawo eyodwa isuka kumthombo wangempela esikhundleni sokusuka kuseva uqobo. I-ping esuka kuhosti ye-LAN engahlobene iya kuhosti engemuva kweklayenti ihlola umzila wokubuya, umthetho wokudlulisa kanye nobunikazi bephara ngakunye, kanti i-handshake ephumelelayo ifakazela ubunikazi kuphela. Bese unqamula iphara elingumnikazi futhi urekhode ukuthi umzila wenza ini, ngoba leyo mpendulo iyindlela yakho yokwehluleka.