Iseva ye-OpenVPN ne-nopool: memezela ibanga le-pool elicacile

Izinsiza zosekelo zeseva zihlela i-subnet bese ziyigcwalisa nge-pool eguqukayo yokuzikhethela kwazo. Lokho okuzimisela kusebenza kuze kufike lapho amanye amakheli kufanele ahlale ngaphandle kokwabiwa — kungakhathaliseki ukuthi abekelwe izabelo eziqinile noma agcinelwe ingxenye yesikhathi esizayo. Ukuvimba i-pool ezenzakalelayo nokumemezela ibanga ngokwakho kudinga imigqa emibili nesinqumo esisodwa esinengqondo sokuthi yimaphi amakheli angewona awokwabiwa. Okusele inqubo yokusebenza: ukubala, ukusebenzisa, ukuqinisekisa, nokuhlehlisa.

Lokhu ukushintsha kwesevisi esebenzayo, ngakho kuyiphatha njengomsebenzi wokusebenza: qala ngokubala, bese usebenzisa ngomjikelezo wempilo ojwayelekile, uqinisekise ngeklayenti elisha futhi ulungise ukuhlehlisa.

Qala nge-subnet ose uvele unayo

Funda ukuhlelwa kweseva kwamanje namakheli amaklayenti awagcinayo ngempela. Ukushintsha kwe-pool kunencazelo kuphela uma kuqhathaniswa naleyo nsimu, futhi isisekelo akusona njalo lokho okushiwo yifayela, ngoba umkhiqizo ophethwe noma umakhi wokuhlelwa angaba ngumnikazi wefayela olifundayo.

grep -nE '^(topology|server|ifconfig-pool|max-clients|client-config-dir)' /etc/openvpn/server/lab.conf
ip -4 addr show tun0

Qinisekisa i-topology esebenzayo. Ku-topology ye-subnet iklayenti ngalinye lithatha ikheli elilodwa ku-pool; izakhiwo ezindala ze-net30 zabela ibhlokhi elincane ngeklayenti ngalinye futhi izibalo zehluke ngokuphelele. Uma iseva iseku-net30, leli khasi liyincwadi yokuhamba engalungile futhi izinombolo ze-pool ngeke zisho lokho okukulindele. Hlola lowo mugqa ngaphambi kokukopisha izibalo zamakheli kwenye indawo.

Bhala ikheli leseva ngokwalo, zonke izabelo eziqinile kusikhombisi sokuhlelwa kwamaklayenti, nanoma yiliphi ikheli okuncike kulo umzila noma umthetho wokufinyelela. Yilawo makheli okufanele ahlale ngaphandle kwebanga eliguqukayo. Ukuwabhala kuqala kuyikho okwenza ibanga libe yisinqumo esikhundleni sokuqagela. Kunikeza nokuhlehlisa into eqinile ongayibuyisela.

Engeza i-nopool futhi umemezele ibanga

Igama elisemqoka losizo lamukela i-nopool, eligcina ukuhlelwa kwe-subnet futhi livimba i-pool eguqukayo ezenzakalelayo, njengoba incwadi ye-OpenVPN 2.6 ichaza. Bese umugqa ocacile we-ifconfig-pool unikeza ibanga elihlanganisayo oqonde kulo, futhi i-netmask yawo ihambisana ne-subnet. Yomibili imigqa ingeyebhlokhi yeseva elilodwa, ngoba i-pool engenayo i-subnet yayo ayinancazelo. Ukulandelana phakathi kwazo kubalulekile kuphela ekufundekeni, ngoba umsizi uvula lelo khopho lapho isevisi iqala.

topology subnet
server 10.70.0.0 255.255.255.0 nopool
ifconfig-pool 10.70.0.50 10.70.0.120 255.255.255.0

Yomibili imingcele iyahlanganisa, ngakho isibonelo sinikeza amakheli angamashumi ayisikhombisa nanye. Gcina ikheli leseva nayo yonke isabelo esiqinile ngaphandle kwalelo banga; isabelo esiqinile esiwela ngaphakathi kwebanga eliguqukayo sidala ukungqubuzana okuncike ekulandelaneni kokuxhumana, futhi lolo wuhlobo olubi kakhulu lokuxazulula. Shiya isikhala phakathi kwesethi egciniwe nebanga uma izabelo eziqinile kungenzeka zikhule.

Usayizi webanga nokwenzeka ngesikhathi esisodwa kuyimingcele ehlukene. Amakheli ayikhulu awasho amaklayenti ayikhulu ngesikhathi esisodwa uma i-max-clients isho okunye, futhi i-pool enkulu kunomkhawulo wokwenzeka ngesikhathi esisodwa ijwayelekile hhayi ukumosha. Okubalulekile ukuthi yomibili imingcele ikhethwe ngokuqonda esikhundleni sokuthola njengefa kusukela kokuzimisela.

Gcina izabelo eziqinile ngaphandle kwebanga eliguqukayo

I-ifconfig-push eqondene neklayenti iyindlela ehlukile ekwabiweni kwe-pool, futhi kufanele isebenzise amapharamitha afanele i-topology esebenzayo. Kumodi ye-subnet iyikheli elilodwa ne-netmask; ukuletha ikhopho le-net30 ngenxa yokuthi lavela esibonelweni esidala kuyiphutha elivamile.

Umlando wokwabiwa uyinkomba, hhayi igunya. Ifayela le-persist likhumbula ukuthi iyiphi iklayenti eyayinaliphi ikheli, ngakho amaklayenti axhuma kabusha avame ukuthola elifanayo, futhi alibeki amakheli eceleni, aliwakhululi noma alithathi indawo yesabelo esiqinile. Uma idivayisi ethile kufanele ihlale inekheli elithile, sebenzisa isabelo esiqinile esikhundleni sokuthembela kufayela le-persist.

Bese uhlola izindlela ezincike kumakheli. Umzila ophushwa kumaklayenti, umthetho wodonga lomlilo ovumela i-subnet, noma ukuhlolwa kokuqapha okulindele isiphakamiso esithile kungenzeka kucabange ibanga elidala. Ukushintsha i-pool ngaphandle kokuzifunda kuhambisa ukwehluleka endaweni ebonakala ingahlobene.

Sebenzisa ngomjikelezo wempilo, bese uqinisekisa

Sebenzisa ushintsho ngendlela isevisi evame ukuthola ngayo ukuhlelwa — kungaba ifayela eliqondile nokuqalisa kabusha, noma isendlalelo sokuphatha esikhiqiza kabusha ifayela. Ukuhlela ngesandla kufayela elikhiqiziwe kuhlala kuze kufike ukukhiqizwa okulandelayo, hhayi isikhathi eside. Rekhoda ukuthi iyiphi indlela engumnikazi wefayela, ngoba umsebenzi olandelayo uzodinga ukwazi lapho enza khona ushintsho olufanayo. Bese uqalisa kabusha kanye futhi ufunde ilogi ngaphambi kokumema iklayenti.

systemctl restart openvpn-server@lab
journalctl -u openvpn-server@lab -n 30 --no-pager
# on a fresh client
ip -4 addr show tun0

Xhumanisa iklayenti elingakaze laxhumana futhi uqinisekise ukuthi ikheli liwela ngaphakathi kwebanga elimemezelwe nangaphandle kwesethi egciniwe. Bese uqinisekisa indlela yokubuya: iklayenti kufanele lifinyelele lokho inqubomgomo ekuvumelayo hhayi okunye. Ikheli elihambisana nohlelo kodwa elingenayo indlela esebenzayo akulona ushintsho oluyimpumelelo.

Xhumanisa futhi iklayenti elaliphethe ikheli elivela ebangeni elidala. Kufanele lithole ikheli elivela ebangeni elisha, futhi noma yisiphi isimo sezinga leseshini esiboshelwe ekhelini elidala kufanele kube sekuphelile. Uma liqhubeka liphethe ikheli elidala, kukhona okunye okulinikezayo futhi i-pool ayisona isiphathamandla osicabangayo.

Ukuhlehlisa ushintsho lwebanga

Gcina imigqa emithathu edlule kurekhodi lakho loshintsho, hhayi ifayela eledlule kuphela. Ukuyibuyisela nokuqalisa kabusha kubuyisela ukwabiwa ekuziphatheni kwakudala, futhi amaklayenti axhuma kabusha ngemva kwalokho azothola amakheli kukho.

Izixwayiso ezimbili zingeya kurekhodi. Amaklayenti asevele exhumene lapho uhlehlisa agcina amakheli awo amanje aze axhumane kabusha, ngakho ukuhlehlisa akusheshi ngaso leso sikhathi kuyo yonke imikhumbi. Futhi uma ibanga elidala lalihlangana nesabelo esiqinile, ukulibuyisela kubuyisela nokungqubuzana; lokho kuhlangana kwakuyisizathu soshintsho, futhi kudinga isixazululo esihlukile ekuhlehliseni.

Ushintsho lwe-pool luphela lapho iklayenti elisha lithola ikheli elingaphakathi kwebanga, ikheli eligciniwe linganikezwa neze, futhi izindlela nemithetho esebenzisa lawo makheli ziqhubeka nokuziphatha njengoba kuhloswe. Noma yini engaphansi kwalokho ishiyela umuntu olandelayo ukuthola ukuthi yikuphi kokuthathu okungeyona iqiniso.