I-OpenVPN keepalive noma ukuqalwa kabusha kwe-systemd: yikuphi okulungisayo?
Umlingani othule, inqubo efile kanye nohlelo lokusebenza olungasebenzi yizingxabano ezintathu ezihlukene. Nikeza i-OpenVPN i-keepalive, i-systemd inqubo, futhi uhlole isimo ngasinye.
Izinto ezintathu ezihlukene zingahamba kabi nge-tunnel, futhi zidinga izimpendulo ezintathu ezihlukene. Umlingani uyeka ukuphendula, inqubo ye-daemon iyafa, noma uhlelo lokusebenza olungemuva kwe-tunnel luyeka ukukhonza. Ukulungiselela okusungula kabusha isevisi kunoma yikuphi kwalokhu akukona ukuqapha ngokucophelela; kuyisenzo esisodwa esingacacile esisetshenziswa ekungafezekini okungahlobene. Ukuqhathanisa lokho okuyinto ngayinye engakubona ngempela kwenza ukwahlukaniswa komsebenzi kucace.
Izinkinga ezintathu ezibonakala njengeyodwa
Ukuthula komlingani kusho ukuthi elinye uhlangothi luyekile ukuthumela, futhi i-OpenVPN ingakuthola yona ngoba iphethe ukushaya kwenhliziyo. Ukufa kwenqubo kusho ukuthi i-daemon iphumile, lokho umphathi wesevisi akubonayo futhi i-OpenVPN ayikwazi. Ukwehluleka kohlelo lokusebenza kusho ukuthi i-tunnel ilungile futhi okuthile ngemuva kwayo akulungile, futhi azikho ezinye izindlela ezimbili ezinendlela yokukwazi lokho. Ngakunye kudinga impendulo ehlukile, futhi akukho okufanayo nokuqaphela ukuthi i-tunnel iyasebenza.
Lawa amasignali ahlukene avela ezingxenyeni ezihlukene, futhi ngalinye linomnini ongathatha isinyathelo ngaphandle kokuqagela. Ukuzihlanganisa kudala uhlelo olusungula kabusha ngezimpawu ezingakwazi ukuzichaza.
Bhala lezi zimo ezintathu ngaphambi kokushintsha noma yisiphi isibali sikhathi. Uhlu ngokwalo ngokuvamile lukhombisa ukuthi indlela eyodwa icelwa ukuba ihlanganise zontathu.
I-keepalive ikhula ibe yini ngempela
Umyalelo we-keepalive uyisifinyezo, futhi ukwanda kuyehluka ngemodi. Kuseva, keepalive 10 60 iba i-ping yasendaweni njalo ngemizuzwana eyishumi, isikhathi sokulinda sasendaweni sokulungisa kabusha esiyimizuzwana engu-120, kanye namavelu angu-10 no-60 adluliselwa kumaklayenti. Isikhathi sesiva senziwa saphindwa kabili ngamabomu ukuze iklayenti lithole ithuba lokulungisa kabusha ngaphambi kokuba iseva inikeze. Funda ifomu elandisiwe ekulungiseleleni okusebenzayo, hhayi isifinyezo esisekufakweni.
Lokho kuphindwa kabili yikho okwenza noma iyiphi incazelo ethi zombili izinhlangothi zilungisa kabusha ngemuva kwemizuzwana engamashumi ayisithupha ibe neputha. Kuchaza futhi ukuthi kungani izinhlangothi ezimbili zingashayi ngasikhathi sinye lapho indlela yeba kabi.
Ukushaya kwenhliziyo ukuthuthwa komlingani we-OpenVPN, hhayi ukuhlolwa kwe-ICMP kwesihambi esithile somphakathi. Impendulo ifakazela kuphela ukuthi uhlangothi olukude lwe-tunnel luyaphila. Ayisho lutho mayelana nesizindalwazi noma isevisi yewebhu umsebenzisi ayidinga ngempela.
I-Restart=on-failure ayikubheki ini
Funda iyunithi efakiwe ngaphambi kokwengeza okokubhala phezu. Restart=on-failure iphendula ezimweni zokwehluleka kwenqubo ezibhaliwe, okungafani nokubheka isimo sokuxhumana. Ayivuthi ngoba uxhumano lwangaphakathi luqalile, futhi ukuphuma okuhlanzekile kunencazelo ehlukile ekwehleni.
Umehluko lowo ubalulekile ngoba ukulungisa kabusha kwangaphakathi kugcina inqubo efanayo iphila. Iyunithi ayiboni lutho, i-tunnel iyalulama yona, futhi lowo umphumela ofanele.
Setha RestartSec nemikhawulo yokuqala ngamabomu, kungenjalo umjikelezo wokwehla uzoshaya i-gateway futhi ungcwabe iphutha langempela ngaphansi kwemilayezo yokulungisa kabusha. Umkhawulo wokulungisa kabusha oqhumayo ushiya iyunithi yehlulekile, lokho kuyabonakala, kanti umjikelezo ongenamkhawulo awubonakali.
I-ping-restart ne-ping-exit azikwazi ukushintshana
ping-restart iqala ukulungisa kabusha kwangaphakathi kwe-OpenVPN futhi igcina inqubo. ping-exit iqeda inqubo ngesikhathi esifanayo sokulinda, okudlulisela isinqumo kumphathi wesevisi. Azihambisani, futhi ukukhetha eyesibili kushintsha ukuthi ubani umnini wokululama. Umehluko ukuthi ubani unquma ukuzama futhi, nokuthi ingakanani imo esindayo ekuzameni.
Uma ukhetha ukuphuma ngesikhathi sokulinda, iyunithi idinga inqubomgomo yokulungisa kabusha nokuphathwa kwesimo sokuphuma okuhambisanayo, kungenjalo ukwehluleka kokuphila kubonakala njengokuma unomphela. Izinketho zokuqhubeka zingagcina izixhumanisi nemizila ngesikhathi sokulungisa kabusha kwangaphakathi kodwa hhayi ngesikhathi sokuphuma kwenqubo.
Khetha umjikelezo wokuphila owodwa ngokufakwa ngakunye bese ubhala ukuthi kungani. Iphrofayela ephethe imiyalelo yomibili iyiphrofayela engakazinzi.
Hlola ukwehluleka ngakunye njengesimo salo
Lingisa umlingani othule, i-daemon ebulewe kanye nohlelo lokusebenza olungatholakali esikhaleni esigunyaziwe, bese uhlola ukuthi yikuphi ukululama okwavutha. Umlingani othule kufanele akhiqize uxhumano lwangaphakathi kabusha, inqubo ebulewe ukulungiswa kabusha kweyunithi, kanti ukuphazamiseka kohlelo lokusebenza akufanele kukhiqize noma yikuphi kwalokho. Uma izimo ezimbili zikhiqiza isenzo esifanayo, ubunini busaxubile.
Ukululama okuphindaphindiwe nakho akulona ukulungiswa. Imininingwane yokungena enqatshiwe noma amaklayenti amabili abelana ngegama elisebenzayo azohlala eshintshana, futhi izibali zesikhathi ezisheshayo zenza lokho kushayisana kusheshe kakhulu.