I-OpenVPN route-nopull ivimbelani ngempela ekuthumeleni kweseva
I-route-nopull ilahla imizila nezinketho ze-DHCP ezithunyelwe, hhayi ukuxoxa kwesandla. Khetha phakathi kwayo, i-pull-filter noma lutho, bese ufaka imizila ngokwakho.
route-nopull uyifake kuphrofayili yeklayenti ukuze umhubhe ungaginyi umzila wakho ozenzakalelayo, futhi manje isubneti yasehhovisi ayifinyeleleki kuyilapho iklayenti lisathi lixhunyiwe. Kokubili kwalokhu okubonwayo kuyiqiniso, futhi akukho okuhlulekile. Le flagi itshela iklayenti ukuthi yeqe imizila nezinto ze-DHCP ezithunyelwa iseva, okuwumyalo omncane kunalokho abantu abaningi abakulindele lapho beyifaka. Okusele umhubhe osebenzayo ongenambono wokuthi yiziphi izindawo okufanele ziwusebenzise.
Leyo gebe iyisinqumo sonke le ndatshana. Kungaba iseva echaza inethiwekhi, kumbe iklayenti, futhi le flagi inikela lowo msebenzi eklayenti ngaphandle kokuwenzela wena.
Iflagi icisha ini ngesikhathi sokuxhuma
Iklayenti le-OpenVPN elidonsayo ngokuvamile lithatha inqwaba evela kuseva ngemva kokuqinisekisa: imizila, ukuhlanekezelwa kwegesi ewumkhawulo ozenzakalelayo, amaseva e-DNS, nemiyalelo embalwa yokulungisa. Uma i-route-nopull isebenza, iklayenti lisamukela iseshini, lisahlola izitifiketi, lisaxoxa ngama-cipher ne-keepalive, futhi lisakhuphula isixhumanisi. Elikulahayo ukusetshenziswa kwemigqa ye-route ethunyelwe nemigqa ye-dhcp-option ethunyelwe, kuhlanganise ne-DNS.
Ukudideka kuvela ekukhanyeni okuluhlaza okuhlezi eduze kohlelo lokusebenza olufile. Umhubhe ukhona; imephu esuka ezindaweni kuya kulo mhubhe ayikho. Akukho lutho kuphaneli yesimo yeklayenti oluhlukanisa "kuxhunyiwe futhi kuyadlulisa" kusuka ku-"kuxhunyiwe futhi akusebenzi", ngoba ngokombono womhubhe zombili ziyisimo esisodwa.
Kungani umhubhe ophilayo ungakwazi ukudlulisa lutho
Isixhumanisi sivela ngekheli saso siqu futhi, kuxhumaniso lwephoyinti eliya kwephoyinti, ngokuvamile akukho okucacile kunomzila wosokhaya oya kumlingani. Isubneti yangasese ifinyeleleka kuphela lapho umzila othile ukhomba kuleso sixhumanisi nge-prefix efanele, futhi njengoba ukuthunyelwa kuvaliwe lowo mzila awufiki. Iphrofayili elandiwe nayo ngokuvamile ayikwazi ukusiza, ngoba yabhalwa ngombono wokuthi iseva izonikeza khona lokhu kwaziswa. Yingakho isixhumanisi singabonakala siphilile kuyilapho isubneti ihlala imnyama.
Ngakho ukufunda iphrofayili akufakazeli okuningi. Kunalokho funda isimo esisebenzayo kumshini oxhunyiwe:
ip addr show tun0
ip route show dev tun0
ip route get 10.20.5.10Ikheli elingenawomzila wesubneti emyaleni wesibili wuphawu lwale nkinga. Umthetho wesithathu uphendula umbuzo abasebenzisi abawukhathalele ngempela, ngoba ubika isixhumanisi i-kernel engasikhetha endaweni ethile, hhayi uhlu obukhuluphela ukuthi luzosetshenziswa. Uma uphendula ngoxhumaniso lwakho lomzimba, umhubhe awukho nhlobo endleleni.
Ukuxazululwa kwamagama kuhluleka ngesizathu esihlobene, hhayi esihlukile. Izinto ze-dhcp-option DNS ezithunyelwe zeqiwa yileyo flagi, ngakho imibuzo yamakhasimende angaphakathi iya kunoma yisiphi isixazululi inethiwekhi yasendaweni esinikezile. Leso sixazululi asinayo indawo yehhovisi, ngakho umbuzo uyahluleka noma ubuyisela impendulo yomphakathi, futhi ukuhluleka kubonakala njengenkinga yeseva kuyilapho kuyinkinga yokuhlelwa kweklayenti. Ukuhlola ikheli ngaphambi kwegama yikho okuhlukanisa kokubili.
Ukukhetha phakathi kweflagi nesihluzi se-prefix
Lezi zinketho ezimbili zixazulula izimo ezahlukene zesikhalo esisodwa, futhi ukukhetha kabi yikho okukhiqiza isimo sokuxhunyiwe kodwa okungenamsebenzi. Eyodwa ishintsha inqubomgomo ethunyelwe iyiphelele, kanti enye iyihlela nge-prefix. Ithebula linikeza inguqulo emfushane, futhi isigaba esilandelayo sikhuluma ngengxenye ebamba abantu.
| Setting | What the client keeps | Reasonable when |
|---|---|---|
| no option | every pushed route and DHCP entry | the server's view of the network is correct |
route-nopull | the session, none of the pushed routing or DNS | you will write the full local policy yourself |
pull-filter | everything except lines matching your prefixes | the push is nearly right and one or two lines are wrong |
pull-filter isihlukanisi se-prefix esinezenzo ezintathu, ngakho singamukela umkhakha wemigqa, siyidele isithule, noma senqabe ukuxhumana ngokuphelele lapho kuvela i-prefix. Ukuziphatha kokugcina yikho okufanele kwaziwe: umthetho wokwenqaba uguqula ukungezwani kwenqubomgomo kube ukuxoxa kwesandla okwehlulekile esikhundleni sokweqiwa buthule. Incwadi ye-OpenVPN 2.6 ibala ama-prefix amukelekayo nencazelo eqondile yesenzo ngasinye.
Indlela evamile ephakathi ukwenqaba i-redirect-gateway kuphela nokuvumela imizila yasehhovisi ne-DNS ukuthi ifike njengoba kuhlosiwe. Lokho kugcina ukuthunyelwa kusebenza ezingxenyeni iseva eziqonda kangcono kunawe, kuyilapho kuvimbela umugqa owodwa ongathatha umzila wakho ozenzakalelayo.
Ukufaka imizila nesixazululi ngesandla
Uma ugcina iflagi, iphrofayili kufanele isho lokho iseva eyayizokusho. Imiyalelo ye-route yohlangothi lweklayenti isetshenziswa ngemva kokusungulwa kokuxhumana, ngakho isebenza kanye neflagi hhayi ukuvinjelwa yiyo. Zifake kuphrofayili, hhayi kumugqa womyalo osebenzisanayo, kungenjalo ukuxhuma kabusha okulandelayo ngeke kuphinde kukhiqize isimo esisebenzayo.
route-nopull
route 10.20.0.0 255.255.0.0
dhcp-option DNS 10.20.0.53Umugqa we-DNS ukhona endaweni engakhululekile: uwumyalelo wohlangothi lweklayenti, kodwa amanye amaklayenti awusebenzisa kuphela ngokuhlanganiswa kwe-DNS kwepulatifomu, okungase kuwususa lapho kushintsha uxhumaniso. Kusokhaya se-systemd, ukusetha isixazululi ngqo kusixhumanisi somhubhe kuqaguleka kalula kunokuthemba ukuthi iklayenti lizowina umncintiswano wokubaluleka:
resolvectl dns tun0 10.20.0.53
resolvectl domain tun0 ~corp.example.comIsizinda sokudlulisa sibaluleke njengekheli. Ngaphandle kwaso, imibuzo yamagama omphakathi nayo ingase ithunyelwe kusixazululi sangaphakathi, futhi noma yisiphi isixazululi sangaphakathi esenqaba ukuphindaphinda sizokwephula ukuphequlula kuyilapho indawo yangasese isasebenza. Ngaso, kuphela amagama angaphansi kwaleso sijobe athunyelwa kusixazululi somhubhe futhi konke okunye kulandela uxhumaniso lomzimba.
Ukuhlola umphumela: ikheli, igama nomzila wangaphandle
Izivivinyo ezintathu zihlukanisa ukwehluleka okungenzeka. Thatha ikheli langasese nge-IP, bese kuba umsokhaya ofanayo ngegama, bese kuba isayithi lomphakathi elivamile. I-IP esebenzayo negama elihlulekayo kukhomba kusixazululi; i-IP ehlulekayo negama elisebenzayo kukhomba ekudluliseni; kokubili kuhluleka ngokuvamile kusho ukuthi umhubhe awukho endleleni.
Bese ubheka ngaphandle hhayi ngaphakathi. Umzila wesiqu sika-endawo yomhubhe kufanele usinde ushintsho, futhi noma yikuphi ukuvinjwa kokwehluleka kufanele kubekwe emkhawulweni womhubhe ngaphandle kokubamba eya-endawo. Iklayenti eliqhubeka nokuphequlula ngemva kokuwa komhubhe iyinkinga yenqubomgomo, hhayi yokudlulisa, futhi ngeke ivele kuzivivinyo ezintathu ezingenhla.
Bhala uhlu lokugcina embhalweni wephrofayili: imizila, isixazululi, izizinda, nesizathu sokuba khona ngakunye. Ukuxhuma kabusha okukhiqiza ithebula elifanayo kuwubufakazi kuphela bokuthi inqubomgomo yasendaweni iphelele. Uma izinhlelo zisahluleka umhubhe ukhuphukile futhi zivivinyo zontathu ziphasa, indawo elandelayo okufanele ibhekwe isigaba sezinkinga zokuxhunyiwe kodwa okungaxhunyiwe, hhayi izitifiketi esezivele zaqinisekiswa.