i-tun edalwe ngaphambili ku-OpenVPN: ukuqhathanisa izinhlobo ezimbili zobunikazi

Othile wadala i-tun1 ngaphambili, iphrofayela ithi dev tun1, futhi uxhumano alukaxhumani. Ukuba khona kwegama kusibungazeli cishe akusho lutho, ngoba ukuxhumana kuncike endaweni yamagama, uhlobo lwedivayisi, ukuthi ngubani ongumnikazi wesixhumanisi nokuthi i-daemon ivunyelwe ukwenzani. Ukusebenzisa kabusha idivayisi kuphoqa nesinqumo esifihlwa ukulungiselelwa okuzenzakalelayo: iyiphi ingxenye ebhala amakheli nemizila. Izindlela zokwehluleka zalezi zinhlelo ezimbili zihluke kakhulu kunezintambo zokulungiselelwa, ngakho nquma ngaphambi kokuhlela iphrofayela.

Igama akulona ukuxhumana

I-dev tun1 icela i-OpenVPN leyo interface enegama, futhi ukwakhiwa kwendabuko kwendawo yomsebenzisi kuzozama ukuyivula. Uma igama lingalandeli iphethini evamile ye-tun noma i-tap, iphrofayela idinga ne-dev-type ehambisanayo, ngoba uhlobo alukaze luthathwe kusichaza. Idivayisi ye-TAP ayiyona idivayisi ye-TUN enelinye ilebula: ukuxhuma okungalungile kwehluleka ngokushesha noma kwakha isixhumanisi esithwala amafremu okungekho okuwalindele. Hlola uhlobo ngaphambi kwakho konke okunye, ngoba konke ukuhlola okulandela kucabanga ukuthi izinhlangothi zombili ziyavumelana ngakho. Ngemva kwalokho, qinisekisa ukuthi inqubo ingayivula ngempela idivayisi, hhayi nje ukuyibona.

dev tun1
dev-type tun

I-interface yenethiwekhi ne-/dev/net/tun kuyizinto ezihlukene: enye iyisixhumanisi ngaphakathi kwendawo yamagama, enye iyidivayisi yezinhlamvu esetshenziswa uhlelo lwendawo yomsebenzisi ukuxhuma. Idokhumenti ye-Linux TUN/TAP ichaza leyo ndlela yokuxhuma nemithetho yobunikazi bezinto eziqhubekayo. I-shell ye-root engaqalisa i-ip link ibonisa kuphela ukuthi i-shell inamalungelo, hhayi ukuthi i-daemon inawo. Ubunikazi benodi yedivayisi, isethi yamakhono wesevisi kanye nomsebenzisi eqhutshwa ngaphansi kwakhe konke kufanele kuhambisane ngaphambi kokuba ukuvula kuphumelele.

Idivayisi ekhona kodwa engavuleki iyinkinga yobunikazi, hhayi inkinga yomzila. Yiphatha kanjalo ngesikhathi sokulungisa amaphutha, kungenjalo intambama izophela ngokufunda amathebula omzila ayengakaze abe yinkinga.

Ubani olungiselela isixhumanisi: izinhlobo ezimbili zobunikazi

Kuhlobo lokuqala i-OpenVPN ilungiselela amakheli nemizila njengengxenye yokuphakamisa uxhumano. Lokho kuwukuziphatha okuzenzakalelayo futhi kulula ukucabanga ngakho, ngoba ingxenye eyodwa idala isimo bese iyisusa futhi. Kuhlobo lwesibili umphathi wangaphandle ungowumnikazi we-interface, futhi i-ifconfig-noexec ivimbela i-OpenVPN ekuqaliseni imiyalo yayo yokulungiselela amakheli bese idlulisela amapharamitha kuma-skripthi. Ngaleso sikhathi umphathi kufanele asebenzise ngokwakhe ukulungiselelwa okuyikho kwasekhaya nokomlingani, okuwumsebenzi omkhulu kunalokho okushiwo igama lenketho. Ukukhetha phakathi kwalezi ezimbili kuwumbuzo wokuthi ubani angashintsha isixhumanisi ngenkathi siphezulu.

I-ifconfig-noexec ihlanganisa amakheli kuphela: ithebula lomzila alithintwa, futhi ukulungiselelwa kwemizila kungokwe-route-noexec. Phatha imiyalo emibili njengezilawuli ezihlukene ezinabanikazi abahlukene, ngoba ukusetha eyodwa nokucabanga enye kuwumthombo ojwayelekile wezixhumanisi ezilungiselelwe ngokwengxenye. Khetha umnikazi oyedwa ngqo esigabeni ngasinye, amakheli endaweni eyodwa nemizila endaweni eyodwa. Umphathi wenethiwekhi nomsizi we-VPN bobabili ababhala amakheli yiyo indlela ukuphuka okususa ngayo isimo ohlangothi olunye olusancike kuso.

Hlola idivayisi kusukela endaweni yamagama ebalulekile

Hlola idivayisi kusukela endaweni yamagama lapho inqubo ye-VPN isebenza khona, hhayi lapho i-shell yakho yenzeka khona. Imiyalo emibili engezansi iphendula imibuzo ehlukene, futhi umehluko ubonakala lapho isibungazeli sibona i-interface engayiboni i-container. Yiqalise ngokulandelana okunikeziwe, ngoba eyesibili inencazelo kuphela uma usukwazi ukuthi isixhumanisi sikhona yini.

ip -details link show dev tun1
ip tuntap show

Umyalo wokuqala uphrinta isixhumanisi ngendlela i-kernel esibona ngayo, kanye namafulegi nohlobo lwe-interface, futhi kanjalo uqinisekisa ukuthi le yidivayisi oyayiqonde. Eyesibili ibala amarekhodi e-tun/tap aqhubekayo, akhona ngaphandle kokuthi kunenqubo ewabambayo. I-interface elinde umnikazi wayo omisiwe iyisimo esihlukile kunethumbu eliphilayo elixhunywe kwenye i-VPN, futhi eyesibili kuphela echaza ukuthi kungani ukuxhuma kwakho kwehluleka. Thola inqubo ebamba idivayisi ngaphambi kokushintsha noma yini, ngoba irekhodi eliqhubekayo ne-interface ematasa kunezixazululo ezihlukene.

Ukusekelwa kwemigqa eminingi kuwukuhlelwa okuthile kwedrayiveri okunezidingo zako, hhayi imvume yokuthi izinqubo ezingahlobene zabelane nge-interface eyodwa. Iseshini ephilayo yomunye umnikazi iyinkinga yokuxhumanisa, futhi akukho ukuhlela iphrofayela okuxazulula lokho.

Izinhlobo ezimbili zokuqhubeka

Ukuqhubeka kwe-kernel ne-persist-tun kuchaza izikhathi zokuphila okulula ukuzidida futhi okubiza uma kwenziwe iphutha. Idivayisi eqhubekayo ikhona ngaphandle kwanoma iyiphi inqubo, ngakho yeqa ukuma futhi ukuqalisa okulandelayo kungayisebenzisa futhi. I-persist-tun igcina izinsiza phakathi kokusethwa kabusha okuthambile okusekelwayo ngaphakathi kwenqubo eyodwa ye-OpenVPN, umkhathi omfushane kakhulu. Akukho kokubili okuthembisa ukuthi ukumisa isevisi kuzoshiya imizila namakheli endaweni yawo, futhi i-interface ehlala ibonakala ayibona ubufakazi beseshini ebethelwe esebenzayo.

Qinisekisa ne-backend, ngoba i-interface edalwe ngaphambili ayisho lutho mayelana nokuthi yikuphi ukuqaliswa okuzoyivula. Ukwakhiwa komphakathi okunomzila wokudatha oqondile kuzozama ukuwusebenzisa ngaphandle uma idizayini isho okunye. Lapho inguqulo isekela isishintshi, i-disable-dco ikhetha indlela yendawo yomsebenzisi esikhundleni salokho; izinjini ezindala namanye amaklayenti azinawo umyalo onjalo, ngakho gcina umbandela wenguqulo eceleni kwenketho esikhundleni sokucabanga ukuthi uyasebenza.

Yini ephukayo uma kuhlolwa ukuqalisa kuphela

Isivumelwano sobunikazi singadlula ukuhlolwa kokuqala futhi sehluleke kokugcina, okwenza ukuqalisa kube ukuhlolwa okubuthakathaka kukodwa. Kunalokho bheka ukudlula okubili: ukusethwa kabusha okuthambile, nokuma okuphelele okulandelwa ukuqalisa.

systemctl status openvpn-client@lab
ip -details link show dev tun1

Ukuqalisa yisimo esilula: iyunithi iyaphakama, isixhumanisi siyavela, futhi umphumela wesimo usho iphrofayela elayishiwe. Ukuxhuma yisikhathi lapho i-daemon ivula idivayisi, ngakho qalisa ukuhlola kwesixhumanisi ngemva kokuthi iyunithi ibike ukuthi iyasebenza, hhayi ngaphambili. Uma isixhumanisi sikhona ngenkathi isimo sisasebenza, ubheka idivayisi eqhubekayo okungekho muntu okwamanje oxhunywe kuyo, hhayi ithumbu elisebenzayo. Dlulisa ithrafikhi yangempela ngesixhumanisi ngaphambi kokuqhubeka, ngoba i-interface exhunyiwe engenawo umzila osebenzayo iseyihluleka.

kill -SIGHUP $(pidof openvpn)
journalctl -u openvpn-client@lab -n 40
systemctl stop openvpn-client@lab
ip -details link show dev tun1

Ukusethwa kabusha okuthambile kufanele kushiye iseshini isebenziseka futhi izinsiza zingaphazamisekile, futhi lowo ngumsebenzi owenziwa yi-persist-tun. Ukuma okuphelele yindawo lapho umphathi wangaphandle aziveza khona: uma isixhumanisi noma amakheli aso edlula ukuma, kukhona omunye umuntu ongumnikazi wawo, futhi lokho kungaba yisimo osibhalile noma iphutha osanda kulithola. Bhala kokubili ukubona eceleni kwephrofayela, ukuze ushintsho olulandelayo luqale ebufakazini hhayi kumdwebo.