Ukwehluleka kokubopha kwasekhaya kwe-OpenVPN ekuqaleni: ukulinda noma ukuphinda
Lapho ikheli lasekhaya lingakavulwa, i-OpenVPN ayikwazi ukubopha. Qhathanisa ukulinda okulinganiselwe nenqubomgomo yokuqalisa kabusha, futhi ubone ukuthi kungani i-network-online.target ingesona isiqinisekiso.
Kuseva ye-OpenVPN engaqali ekuqaleni kunikezwa izixazululo ezimbili: ukulinda ikheli, noma ukuvumela insizakalo ukuthi iphinde izame kuze kube yilapho ukubopha kuphumelela. Zombili zibhekana nophawu olufanayo kodwa ziziphatha ngendlela ehlukile lapho kwehluleka. Ukulinda kubeka isimo esithile esidingekayo obala futhi kwehluleka ngomsindo lapho singekho; ukuphinda kufihla leso simo futhi kuqhubeke kuzama. Ukuthi yikuphi okufanele i-unit yakho kuncike ekutheni lelo kheli liwukuncika okuklanyelwe noma ingozi yesikhathi nje.
Kokubili kungcono kunokulala okungaguquki, okungalindeli lutho futhi okungabiki ukuthi kwakulindeleni.
Okudingwa ngempela yinketho ethi local
local ibeka ikheli i-daemon ebopha i-socket yayo kulo, futhi ukubopha ekhelini elingakabi khona kwehluleka ngokushesha ngephutha eliphathelene nekheli eliceliwe. Uma inketho ingekho, i-daemon ilalela kuwo wonke amakheli, yingakho iphrofayela efanayo isebenza emshinini o-isikhombisi-msebenzi sakhe singakavulwa: ilalela yonke indawo esikhundleni sekheli elilodwa olushilo. Lowo mehluko ukuwo wonke ukwehluleka, futhi uhlala ungabonakali kuze kube ukuqalisa kabusha.
Isidingo akusona ukuthi isikhombisi-msebenzi sivulekile ngomqondo ojwayelekile. Ikheli kufanele labiwe esikhombisini-msebenzi esifanele ngaso leso sikhathi sokubopha, futhi kufanele kube isikhombisi-msebenzi esingaphansi hhayi ithaneli i-daemon efanayo eyayizokwakha kamuva. Ukuhlolwa okwenziwa ngemuva kwemizuzu embalwa ngemuva kokungena akufakazi lutho mayelana nokulandelana kokuqalisa.
Ukulinda ikheli ngokuqhathanisa nokuphinda ukubopha
Ukulinda kusho ExecStartPre ebuza kuze kube yilapho ikheli livela, nenani elilinganiselwe lemizamo kanye nokuphuma okungeyona uziro lapho isikhathi siphela. Ukuphinda kusho ukuvumela inqubo eyinhloko ukuthi yehluleke nokucela umphathi wensizakalo ukuthi ayiqalise futhi, isibonelo Restart=on-failure kanye RestartSec=5. Okokuqala kubika isimo esidingekayo esingekho njenge-unit ehlulekile, kanti okwesibili kubika njengochungechunge lokuqalisa kabusha olugcina lumile; ku-journal lokhu kunomsindo kodwa kumelana nekheli elifika ngemuva ngesizathu ongakwazi ukuzibikezela.
Khetha ukulinda lapho ikheli liwukuncika okuklanyelwe, futhi khetha ukuphinda lapho ikheli livama ukuvela kodwa isikhathi salo siyahlukahluka. Ukuhlanganisa kokubili kuyezwakala: ukulinda okulinganiselwe kuhlanganisa isimo esijwayelekile futhi inqubomgomo yokuqalisa kabusha ihlanganisa okungajwayelekile. Okungafanele kwenziwe yikho kokubili ukusebenza phakade, ngoba i-unit ephinda ngokungapheli ifihla ukulungiselelwa okungalungile esikhundleni sokukubika.
Kungani i-network-online.target ingenelisi
network-online.target ithembisa kuphela lokho ukuqaliswa kwenethiwekhi okusebenzayo okushiwo yi-online, futhi akukho okunye. Nge-systemd-networkd, systemd-networkd-wait-online inquma ukuthi lowo mkhakha ufinyelelwa nini, futhi umqondo wayo wokuqala we-online ungagcwaliseka ngaphambi kokuba ikheli lakho elithile libekhona. Ngaphansi kwe-NetworkManager, insizakalo ye-wait-online isebenzisa imithetho yayo. Ukuhlela ngemuva komkhakha kuyisisekelo esiqinile, hhayi isiqinisekiso sokuthi ikheli elilodwa, impendulo ye-DNS noma i-peer ekude isilungile.
Ukucabanga okufanayo kususa ezinye izindlela ezijwayelekile. Isingeniso sokuqalisa ngokuzenzakalela kudeskithophu silinda isikhathi somsebenzisi okungenzeka singavulwa neze kuseva, futhi umyalo we-cron obambezelwe wengeza isikhathi esedlule ngaphandle kokusho insiza obekulindeleke ukuthi ivele. Kokubili kungabonakala kuyimpumelelo izinyanga bese kwehluleka ekuqaliseni okukodwa okubalulekile.
Hlola ukubopha ngemuva kokuqalisa okubandayo
Qinisekisa ngokuqalisa okubandayo kwangempela, hhayi ngokuqalisa kabusha insizakalo, ngoba ukuqalisa kabusha kuzuza njengefa ikheli okwakufanele ukulandelana kokuqalisa kukwake. Ngemuva kokuqalisa, ss -lntp noma ss -lunp ikhombisa ikheli lasekhaya umlaleli ngamunye alibophe ngempela, futhi journalctl -b -u openvpn-server@server ikhombisa ukuthi umzamo wokuqala wehlulekile yini. Qhathanisa ikheli eliboshiwe nalelo elisephrofayelini, bese uphinda ukuqhathanisa ngemuva kokuxhuma kabusha inethiwekhi.
Uma iphrofayela yayingakaze idinge ikheli elingaguquki, ukususa local kuwukwenza lula okusemthethweni, kodwa kwenze kube isinqumo sokuphepha hhayi umkhuba wokuxazulula izinkinga.
Ukunweba umlaleli kushintsha ukuthi ubani angakufinyelela, ngakho hlanganisa lolo shintsho nenqubomgomo ye-firewall obekufanele ibikade ikuvimbela. Insizakalo eqala ngokuthembeka kukho konke isikhombisi-msebenzi ayikaxazululi inkinga yokuqala; isisusile inkinga yayisa emaphethelweni enethiwekhi.