OpenVPN redirect-gateway: okwenziwa yilimuphi ifulegi emizileni

Xhumana ne-redirect-gateway kuphrofayela, futhi indlela ezenzakalelayo yomshini wakho ingase inyamalale, ihlukane kabili, noma ihlale khona kanye lapho ibikhona, kuye ngamafulegi okungekho muntu uwafunda kabili. Le nketho ishintsha isimo somzila kuphela hhayi okunye, ngakho ubufakazi obuphelele obuthembekile bokuthi yenzani ithebula iklayenti eliyifakile ngemuva kwalokho. Okulandelayo ithebula ngemuva kokuxhumana, umzila ogcina umhubhe uqobo uphila, kanye nokuhamba kwe-IPv6 umyalo ongakaze uthi uyakumboza. Isinyathelo ngasinye umyalo ongawusebenzisa kuklayenti ngesikhathi umhubhe uvuliwe.

Okwenziwa yilimuphi ifulegi endleleni ezenzakalelayo

Ngaphandle kwanoma yiliphi ifulegi, inketho isusa indlela evamile ezenzakalelayo bese ibeka umhubhe endaweni yayo, ngakho isango lakudala linyamalala ethebuleni ngesikhathi uxhumano luvuliwe. Engeza def1 futhi lokho okuzingenhloso kuhlala kuhlu, kanti imizila emibili encane yenza umsebenzi. Engeza bypass-dhcp futhi nomzila we-DHCP uyasinda, okubalulekile kunethiwekhi lapho iklayenti kusamele lifinyelele iseva ye-DHCP yasendaweni. Uhlu lwamafulegi ekhasini le-ncwadi ye-OpenVPN 2.6 lufushane ngokwanele ukuba lufundwe kanye, futhi ingxenye ngayinye ishintsha ukuthi yimiphi imizila efika ethebuleni.

Inketho eqhutshwayo iziphatha ngendlela efanayo uma ifika, ngakho iphrofayela yeklayenti ingase ingabi nakho lutho kuyilapho ithebula libonakala liguqulwe ngokuphelele. Lokho kujwayelekile: iseva ithumele amafulegi, iklayenti iwasebenzisile, futhi ifayela lasendaweni alizange likhulume ngomyalo. Uma ukusunduza kubonakala kungenzi lutho, hlola isihlungi sohlangothi lweklayenti esamukela noma silahle izinketho ezidonsiwe, ngoba inketho elahliwe ayidali iphutha ohlangothini olulodwa.

I-def1 iwina ngokucacileka ngaphandle kokuthinta okwakho okuzenzakalelayo

Imizila emibili engxenye yokuzenzakalelayo ihlanganyela ukumboza isikhala se-IPv4, 0.0.0.0/1 kanye ne-128.0.0.0/1. Ngayinye icace kune-0.0.0.0/0, ngakho ukusesha zikhetha kuyilapho indlela yangempela ezenzakalelayo ihlala ethebuleni kunoma yini efuna ukufana okuncane kakhulu okucacile.

Funda ithebula hhayi iphrofayela, ngoba ithebula kuphela elikhombisa ukuthi usesiphi salezo zimo. Imigqa emibili yanele ukuzihlukanisa:

ip route show default
ip route show | grep -E '^(0\.0\.0\.0/1|128\.0\.0\.0/1)'

Qaphela isixhumanisi kanye nesilinganiso emugqeni ngamunye, hhayi indawo kuphela. Indlela ezenzakalelayo ekhomba emhubheni kanye nemizila emibili engxenye ekhomba emhubheni kuchaza inhloso eyodwa futhi kwehluleka ngendlela ehlukile lapho umhubhe uwela, ngoba kwesinye isimo indlela eyisipele isekhona. Bhala zombili izinkambu kunothi loshintsho. Indlela eyisipele esindayo ngesinye isikhathi iyona egcina iseshini ekude iphila isikhathi esanele ukulungisa umhubhe, futhi iyona futhi evuza ukuhamba lapho inhloso ibiwumhubhe ogcwele.

Gcina indawo yokuphela yomhubhe ifinyeleleka

Iklayenti lidinga umzila oya ekugcineni okude komhubhe ongabe uhamba ngomhubhe uqobo. OpenVPN ifaka lowo mzila womsingathi ngaphambi kokushintsha enye into, futhi ukuhlela umzila ngesandla noma iklayenti lesibili le-VPN kungawususa. Isibonakaliso ngemuva kwalokho uxhumano olubika ukuthi luxhunyiwe bese lungadlulisi lutho.

Buza ingqikithi ukuthi iyiphi isixhumanisi ezoyisebenzisa ikheli lendawo yokuphela ngesikhathi umhubhe uvuliwe. Impendulo kufanele isho isixhumanisi esibonakalayo kanye nesango laso, hhayi nhlobo i-tun0:

ip route get 198.51.100.20

Uma lokho kusesha kubuyisa idivayisi yomhubhe, umhubhe uthwala ezakho zokuhamba futhi uzowa ngokushesha lapho noma yiliphi iphakethe kufanele liphume. Amaqembu asendaweni, i-adaptha yesibili kanye nomzila ongokusekelwa inqubomgomo kusabalulekile lapha, yingakho ukuguqulwa okusebenza kukhompyutha ephathekayo ehlanzekile kungase kwehluleke kumsingathi onesixhumanisi sokuphatha kanye nemizila emibili ezenzakalelayo. Imvamisa iphrofayela isolwa ngalokho okwenziwe uhlelo lwamakheli.

Ukuhamba kwe-IPv6 kuqhubeka kusebenzisa ithebula lako

Ukuguqula i-IPv4 kuyeka i-IPv6 ngokuthula, futhi imindeni emibili ishintshwa amafulegi ahlukene. Kumsingathi onezingqimba ezimbili kanye nendlela ezenzakalelayo ye-v6 esebenzayo, ukuhamba kwe-v4 kungahlala ngokuphelele ngaphakathi komhubhe kuyilapho yonke indawo ekwazi i-v6 iphuma ngoxhumo olubonakalayo. Umsingathi obonakala ulungile kwelinye ithebula uvuza kwelinye.

Hlola ithebula le-v6 ngemuva kokuxhumana esikhundleni sokucabanga ukuthi umhubhe ulumbozile. Umyalo uthwala amafulegi omndeni wamakheli ngaso leso sizathu, futhi iphrofayela eyawushiyayo izuza lokho upulatifomu akwenzayo ngokuzenzakalelayo:

ip -6 route show default
ip -6 route get 2001:db8::10

Fakazela ukuthi iyiphi isixhumanisi esisetshenziswa uhlelo

Isimo sokuxhumana akusona isivimbelo, futhi ukushintsha komzila akusona iswishi yokubulala. Uma ukuhamba okuqondile kufanele kume lapho umhubhe wehluleka, leyo nqubomgomo ihlala kufirewall futhi idinga ukuhlolwa kwayo.

Hlola indlela uhlelo oluyihambayo ngempela hhayi indlela echazwa iphrofayela. Cela umzila kuqala, bese uhlanganisa isicelo kusixhumanisi ngasinye ngokulandelana futhi uqhathanise lokho ohlangothi olukude olukubikayo:

ip route get 203.0.113.10
curl -s --interface tun0 https://ifconfig.me
curl -s --interface eth0 https://ifconfig.me

Uma zombili izicelo zibuyisa ikheli elifanayo, uhlelo aluwusebenzisi umhubhe nakuba ithebula lomzila lithi kufanele. Uma kuphumelela kuphela isicelo esiboshelwe emhubheni, indlela ebonakalayo ihlungiwe yileyo ndawo futhi umhubhe wenza lokho obukucele. Bhala amafulegi, imizila efakiwe, ukusesha kwendawo yokuphela kanye nemiphumela yokuphuma yomibili kurekhodi loshintsho, ukuze umuntu olandelayo azuze amaqiniso hhayi isithombe sesikrini.