I-pull-filter ye-OpenVPN ihambisana nokuningi kunomzila owawuqondile

Ufaka umugqa owodwa ukuze ugcine umzila wakho wokuzenzakalela wasendaweni, futhi ngemva kwalokho umhubhe awusafinyeleli kuseva ye-DNS yangaphakathi. Lowo mugqa wawungu-pull-filter ignore "route", okungasho ukuthi "ziba lo mzila". Kusho ukuthi "lahla yonke inketho eqhutshwayo okufanele umbhalo wayo uqale ngaleyo zinhlamvu ezinhlanu", futhi kuseva evamile lokho kufaka phakathi i-route-gateway, i-route-metric ne-route-ipv6 kanye nemizila ngokwayo. Uhlu lokuhlola olungezansi yilokho engikuhambayo ngaphambi kokuthinta iphrofayela okufanele isetshenziswe omunye umuntu.

Isihlungi sisebenza kuphela ezinkethweni eziqhutshwayo

I-pull-filter isebenza kuphela emigqeni yezinketho eseva eyithumelayo ngemva kokusungulwa komhubhe, futhi ayisebenzi kwenye into. Izinketho ezibhalwe efayeleni lakho lasendaweni azithinteki yilokho, kanjalo nokuhamba kwezinhlelo zokusebenza. Uma ubunethemba lokuvimbela inqubo ekusebenziseni umhubhe, leli yithuluzi elingalungile ngokuphelele futhi akukho nhlanganisela yezihlungi ezizokwenza lokho.

Lowo mkhakathi uwusizo, ngoba usho ukuthi ungashiya ukucushwa kweseva kunjalo futhi wenqabe ingxenye yakho endaweni. Kuyisikhawu futhi okufanele sikushiwo kuthikithi: isihlungi sishintsha lokho iklayenti elikwamukelayo, hhayi lokho iseva esikunikezayo. Asinawo umthelela kwabanye abasebenzisi bephrofayela efanayo. Futhi asihlali lapho ushintshela kwenye iklayenti elingayisebenzisi le nketho, okufanele ukwazi ngaphambi kokwakha uhlelo lokusebenza phezu kwayo.

Qinisekisa lokho iseva ekuthumelayo ngempela ngaphambi kokubhala iphethini. Ezingeni eliphezulu lokuningilika iklayenti liphrinta uchungechunge lwezinketho eziqhutshwayo elikutholile, futhi yilowo kuphela umthombo othembekile wombhalo oqondile oqhathanisa nawo:

sudo openvpn --config /etc/openvpn/corp.ovpn --verb 4
sudo grep -n 'pull-filter' /etc/openvpn/corp.ovpn

Funda umugqa oqhutshwayo njengohlu lwezinketho ezihlukaniswe ngokhefana, futhi qaphela ukuthi amagama ezinketho nezimpikiswano zawo ahlukaniswa ngezikhala. Umbhalo wesihlungi sakho uqhathaniswa nalowo mfudlana, yingakho izikhala zibaluleke kangaka esinyathelweni esilandelayo.

Ukufana kuyisiqalo, ngakho izikhala zinquma konke

Ukuqhathanisa kuyisiqalo sochungechunge, hhayi igama lenketho elihlaziyiwe. Ngakho i-"route" ifana ne-route-gateway 10.8.0.1, i-route-ipv6 2001:db8::/32 ne-route-metric 100. Isikhala esisodwa ekugcineni siyinciphisa sibe umkhakha obuwuhlobo owawuqondile, futhi isiqalo esiphelele siyinciphisa nakakhulu sibe indawo ethile.

Umugqa wokugcina yiwona obamba abantu ngesikhathi somsebenzi womhubhe ohlukanisiwe. Ukugcina isixazululi sakho kuyisinqumo esivumelekile, futhi kusho ukuthi lonke igama langaphakathi manje lincike kwisixazululi esingakwazi ukubona indawo eyimfihlo. Lokho kuwumphumela owamukelwa ngamabomu, hhayi umphumela oseceleni otholakala ekukhiqizeni.

Ukufana kwesiqalo kusho futhi ukuthi umthetho unganda ngokuthula kamuva. Lapho iseva yengeza inketho entsha eqala ngombhalo wakho, isihlungi sakho siqala ukusebenza kuyo ngaphandle kokuthi kube nomuntu ohlela iphrofayela yakho. Leyo yindlela yokwehluleka okufanele ukwakhiwe ngokumelene nayo, futhi ukunciphisa ukufanisa ingxenye enkulu kakhulu yenketho, hhayi encane kakhulu.

Izenzo ezintathu, imiphumela emithathu ehlukene

I-accept, i-ignore ne-reject akuzona izipelingi ezintathu zomqondo owodwa. Ziyehluka kulokho iklayenti elikwenzayo ngokufana nasekutheni ukuthi kukhona yini umuntu okwaziyo.

I-ignore ilahla inketho efanayo ngokuthula, okuyikho okufunayo kusilungiselelo osishintshe ngamabomu. I-reject iyilahla futhi yenza iklayenti likhononde, okuyikho okufunayo lapho ukungabikho kwayo kufanele kubonakale kulogi hhayi ukutholakala kamuva. I-accept iyisimo esihle, isetshenziswa lapho wakha uhlu lwezimvume hhayi lapho ususa izinketho ngazinye.

Noma yisiphi isenzo osisebenzisayo, izihlungi zisetshenziswa ngokulandelana kwazo, ngakho imithetho emibili ehlangana iyanikeza umphumela oncike ekulandelaneni futhi okunzima kakhulu ukuwubuyekeza. Gcina umthetho owodwa ngenhloso eyodwa futhi ufake umbhalo ocacile kakhulu kumthetho ngamunye. Uma udinga uhlu lwezimvume, khetha imithetho embalwa ye-accept kunesixuku semithetho ye-ignore ehlangana kokufanayo. Ngaleso sikhathi ababuyekezi bangafunda ifayela ukusuka phezulu kuya phansi futhi babikezela umphumela, futhi lokho kuyisivivinyo kuphela esikhulayo.

Hlola umzila nesixazululi okusetshenzisiwe, hhayi iphrofayela

Isihlungi esibukeka silungile efayeleni singakushiya nomhubhe ongahambisi lutho olusizo. Qinisekisa umthelela kusistimu esebenzayo, lapho izinketho eziqhutshwayo sezivele zisetshenzisiwe noma zilahlwa:

ip route show default
ip route show | grep -c 'proto static'
resolvectl status | grep -A4 'Link.*tun0'
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 5 https://intranet.example.internal/

Imigqa emibili yokuqala ikutshela ukuthi umzila wokuzenzakalela oqhutshwayo ufikile yini nokuthi zingaki izinto ezimile ezasinda. Umbuzo wesixazululi ukhombisa ukuthi iyiphi iseva esetshenziswa ngempela isixhumanisi somhubhe, futhi ngokuvamile yilapho kuvela khona isimangaliso se-DNS. Umugqa wokugcina uphendula umbuzo owodwa obalulekile kumsebenzisi.

Hlola izinhlangothi zombili ngenkathi ulapho. Umthetho ogcina i-inthanethi yakho yasendaweni isebenza kodwa uphula ngokuthula ukuxazululwa kwamagama angaphakathi udlula ukuhlola okungaphezulu futhi wehluleka emsebenzini wokuqala wangempela, ngakho faka insiza yangaphakathi eyodwa nesizindalwazi somphakathi esisodwa esivivinyweni esifanayo.

Bhala phansi okuhlukile nokuthi ngubani umnikazi wakho

Isihlungi siwukuhlukile kumklamo womqhubi, ngakho sibhale phansi nesizathu kanye nephuzu lokubuyekeza. "Iziba imizila eqhutshwayo ukuze igcine okuzenzakalela kwasendaweni" kuyabuyekezeka; umugqa ongenalutho kuphrofayela awubuyekezeki, futhi umuntu olandelayo uzowususa noma awandise ngokuqagela.

Inguqulo nayo ibalulekile lapha. Ukuziphatha kokufana kanye nesintaksi eqondile eyamukelwayo kuye kwathuthukiswa kuyo yonke i-OpenVPN 2.4, 2.5 ne-2.6, ngakho qinisekisa iphethini nencwadi yokuhola yokwakhiwa okukuthumelayo, hhayi ngokuposa kwinkundla mayelana nokukhishwa kwakudala. Incwadi yokuhola ye-OpenVPN 2.6 ibhala le nketho nomthetho wayo wokufana.

Ekugcineni, vumelana ngokuhlukile nalowo ophethe iseva. Isihlungi sohlangothi lweklayenti esiphikisana nenqubomgomo yeseva eyenziwe ngamabomu siyisigameko sokusekelwa esilindele ukucwaningwa okulandelayo, futhi kushibhe kakhulu ukusixazulula ngaphambi kokuthi iphrofayela ithunyelwe kunokuba kwenziwe ngemva kokuba umuntu eqaphela ukuthi imizila ayikho.