OpenVPN TAP ku-macOS: hlola iklayenti ngaphambi kokulungisa amaphutha

Iphrofayela endala ifika ku-Mac yesimanje, iklayenti iyayithulisa ngaphandle kwesikhalazo, futhi uxhumano luyehla noma aludluli uthutho nhlobo. Ngaphambi kokuchitha intambama yonke kumasertifikethi, funda umugqa wedivayisi kuphrofayela. Uma kuthi dev tap, ucelisa iklayenti isixhumi esibonakalayo sesitayela se-Ethernet, futhi ku-macOS iningi lalezi zikhathi liphelela kuleso sicelo.

Isinyathelo 1: qinisekisa ukuthi iphrofayela icela i-TAP ngempela

Amaphrofayela aqanjwa kabusha, asongwa futhi akhishwe kabusha, ngakho hlola ifayela owangenisa ngempela. Sesha umyalo wedivayisi nanoma iyiphi i-include engase iwudlule. Ezimweni eziningi imigqa emibili yokuphuma ixazulula umbuzo. Lapho kokubili i-dev ne-dev-type kuvela khona, umyalo wakamuva uyawina, futhi yileyo ncazelo efihlwa iphrofayela elikopishiwe.

grep -nE "^[[:space:]]*(dev|dev-type)[[:space:]]" client.ovpn
ls -l ~/Library/Application\ Support/ 2>/dev/null

Uma ifayela liqukethe i-dev tap noma i-dev tap0, iklayenti kufanele lenze isixhumi se-TAP. Uma liqukethe i-dev tun, ingxenye esele yale ndatshana ayisebenzi futhi iphutha likwenye indawo.

Bhala igama nevesini yeklayenti, ivesini ye-macOS, nokuthi iphrofayela ivela kuphi. Lezo zinto ezintathu zinisa ukuthi iyiphi kulezi zindlela ezimbili ngezansi engenzeka nhlobo.

Isinyathelo 2: yazi ukuthi imodi yedivayisi ishintsha ini ngempela

Isixhumi se-TUN sithwala amaphakethe e-IP. Iklayenti lifunda futhi libhala amaphakethe aqondiswe kumlingani we-IP, futhi uhlelo lokusebenza luwahambisa njenganoma isiphi esinye isixhumi.

Isixhumi se-TAP sithwala amafreyimu e-Ethernet, kuhlanganise nokusakaza ne-ARP. Yikho okuvumela iseva enebhuloho ukuthi isabalalise amakheli nge-DHCP futhi ivumele iklayenti ukuthi lithole amadivayisi ngokumemeza, futhi yingakho eminye imiklamo emidala incike kukho.

Izindleko ziwukuthi i-TAP idinga umshayeli oveza isixhumi se-Ethernet kuhlelo. I-Apple iyekile imodeli yokunwetshwa kwe-kernel eyayincike kuyo imishayeli emidala ye-TAP ye-Mac, futhi i-API yayo yokushintsha ayiveli ngomlingo kumaklayenti angakaze abuyekezwe ukuze ayisebenzise. Amandla eplatifomu nomkhiqizo okuthunyelwe kuyizinto ezimbili ezihlukene.

Isinyathelo 3: khetha phakathi kweklayenti elihambisanayo nokufuduka

Kunezindlela ezimbili eziqotho. Eyokuqala iyiklayenti umshicileli walo akushoyo, ngenguqulo yakho ye-macOS nangezinga lakho, ukuthi lisekela ukuhlelwa kwe-TAP okudingayo. Akuwona umbhalo weforum weminyaka emine edlule, futhi akusona isifaki esigciniwe: isitatimende samanje kanye noxhumano lokuhlola.

Eyesibili ukuhambisa isevisi ku-TUN, okuwushintsho lweseva olulingana noshintsho lweklayenti. Kudinga itopology enemigqa, ichibi lamakheli, imigqa eqhutshwayo yamanethiwekhi akude, nendlela yokubuya kusuka kuleyo nethiwekhi ibuyela echibini.

Okungasebenzi ukushintsha i-tap ibe i-tun kukhophi yakho yasendaweni bese uthemba. Iseva isabhuloha, iklayenti manje selikhuluma i-IP, futhi akukho okuhambisanayo.

Isinyathelo 4: qoqa amaqiniso ngaphambi kokushintsha isevisi esebenzayo

Shiya iphrofayela yokuqala ingathintwanga futhi wenze ikhophi yezivivinyo. Ifayela ongalibuyisela ngomzuzu lifanelekile kunefolda elihlelekile. Uma okungena esikhundleni sekusebenza, susa ikhophi ngamabomu esikhundleni sokushiya amaphrofayela amabili abukeka efanayo ohlwini. Lowo mkhuba owodwa uvimbela ingxenye enkulu yesiphithiphithi esilandelayo ngemva kokufuduka okuhlulekile. Rekhoda indlela yamanje yokuziphatha ukuze ukwazi ukufakazela okwashintshayo: ingabe ithunu iyenyuka, ithola ikheli, uyafinyelela kumsingathi owaziwayo, futhi ukuxazululwa kwamagama kuyasebenza.

Buza umnikazi wesango izinto ezintathu. Ingabe iseva isebenza kutopology enebhuloho noma enemigqa? Yimaphi amaphrefikhi akude okufanele afinyeleleke? Futhi ingabe ikhona iwindi lokunakekela lokushintsha ukucushwa, noma kulindeleke ukuthi kusebenze ngaphandle kokuthinta iseva?

Izimpendulo zazo zinquma ukuthi uxazulula inkinga yeklayenti ntambama namuhla noma uhlela ushintsho lwenethiwekhi ngesonto elizayo.

Isinyathelo 5: qinisekisa ukufuduka kuzo zombili izinhlangothi

Uma iseva inokucushwa okunemigqa futhi wena unephrofayela efanele, hlola ngalokhu kulandelana: ithunu iyasungulwa, iklayenti lithmba ikheli echibini elisha, umsingathi ohlangothini olukude uyaphendula, futhi igama lixazululwa ngesilungiselelo se-DNS esiqhutshwayo.

Bese uhlola lokho okwakuncike ekuziphatheni kwe-Ethernet ngaphambili. Uma uhlelo lwaluthola amadivayisi ngokusakaza, ngeke liwathole ngethunu enemigqa, futhi akukho inani lokucushwa kweklayenti elikubuyisayo lokho. Lolo hlelo ludinga ikheli elaziwayo, umsingathi osizayo wasendaweni, noma enye indlela yokuthola.

Qeda ngokuxhuma kabusha nokuqalisa kabusha kanye, ngoba iphrofayela esebenza kuphela emzamweni wokuqala ivamise ukusho ukuthi imigqa eqhutshwayo noma isilungiselelo se-DNS asisetshenziswa lapho kuxhunywana kabusha.

Uma kusahluleka, funda iphutha lokuqala

Iklayenti elingakwazi ukwakha isixhumi lisho lokho kulogi yalo, ngokuvamile emigqeni yokuqala. Iklayenti eliyakhayo bese lihluleka ekuqinisekiseni ubunikazi selidlule kudala umbuzo wedivayisi, futhi ukuqhubeka nokuxosha i-TAP kuchitha isikhathi sesikhathi.

Gcina iphrofayela yokuqala nokucushwa okusebenzayo kuze kufakazelwe okungena esikhundleni. Ukubuyisa ushintsho lweklayenti kuyashesha; ukwakha kabusha inethiwekhi enebhuloho eyahlakazwa othile ngokuqagela akusheshi.