Iseva eyodwa ye-TAP noma eziningi? Amaklayenti e-OpenVPN ebhulohweni
Amaklayenti e-TAP ahlanganyela ibhuloho elilodwa kanye nenqubo yesiseva eyodwa, futhi lokho kusho nesizinda esisodwa sokusakaza. Qhathanisa i-Ethernet enamabhuloho ne-TUN eqondisiwe ngaphambi kokukhetha.
Amaklayenti amaningi e-TAP awadingi inqubo yesiseva eyodwa, imbobo ye-UDP eyodwa kanye nedivayisi ye-TAP kusibungazwa ngayinye. Iseva eyodwa ye-OpenVPN kumodi ye-Ethernet ingamukela amaklayenti amaningi aqinisekisiwe futhi iwaxhumanise nebhuloho elilodwa, futhi leyo iyindlela ebhaliwe yokwandisa ingxenye yosongelo lwe-2. Idizayini yenqubo eyodwa iyona ebhalwe encwadini yesandla, futhi ngokuvamile iyilona lokuzenzakalela elifanele.
Umbuzo wangempela ukuthi ngabe lawo maklayenti kufanele ahlanganyele leyongxenye. Inani lezinqubo aliyiphenduli, ngoba izici zokwehlukanisa zivela kusakhiwo hhayi ekutheni zingaki izinqubo ezigijimayo. Ingxenye esele yalokhu kuqhathanisa imayelana nezakhiwo ezimbili nokuthi ngasinye sikwenza kwenzeke kalula ngani.
Izakhiwo ezimbili, hhayi izilungiselelo ezimbili
Ukusetshenziswa kwe-TUN eqondisiwe kunikeza iklayenti ngalinye isixhumanisi sephoyinti-kuya-phoyinti esiya esizindeni sokuqondisa sesiseva. Ukusakaza kuyama kuseva, amaklayenti awakwazi ukubona amafreyimu omunye nomunye, futhi ukuhamba phakathi kwamaklayenti, uma kukhona, kufanele kuqondiswe futhi kuhlungwe ngokusobala.
Ukusetshenziswa kwe-TAP enamabhuloho kwenza amaklayenti abe ngamalungu engxenye eyodwa ye-Ethernet. Abona ukusakaza, bangathola omunye nomunye nge-ARP, futhi bathembela kunqubomgomo yebhuloho kanye ne-firewall esikhundleni sokuqondisa ukuze bahlale behlukene. Lokho kuyasiza lapho amaklayenti kufanele abonakale sengathi axhunywe kuswishi efanayo.
Ngakho-ke ukuqhathanisa kumayelana nokuthi amaklayenti kufanele afinyelele ini, hhayi ukusebenza kahle. Khetha isendlalelo kuqala, bese unquma ukuthi zingaki izinqubo ezizosisebenza.
Isisizi se-server-bridge senzani
Isisizi server-bridge silungiselela imodi ye-Ethernet yamaklayenti amaningi. Ifomu laso lechibi lamakheli lithatha isango, imaski yenethiwekhi kanye nebanga elikhethekile ngaphakathi kwenethiwekhi encane enebhuloho, isibonelo isango ku-192.168.50.1 nechibi elisuka ku-192.168.50.160 kuya ku-192.168.50.199.
Gcina lelo banga ngaphandle kwanoma yisiphi esinye isabelo se-DHCP noma esinqunyiwe. Isisizi sabela amakheli kulo, kodwa asisebenzisani nomyabi omunye engxenyeni efanayo, futhi amachibi amabili anqamulanayo akhiqiza amakheli aphindwe kabili abonakala njengokwehluleka kokuxhumana okungahleliwe. Bhala ibanga eligciniwe kuhlelo lwamakheli lesizinda ukuze umuntu olandelayo angaphindi alisebenzise. Ukuphawula kusilungiselelo seseva kuyisikhundla esingesihle salowo mbhalo.
Kukhona ifomu eline-proxy ye-DHCP lokusetshenziswa lapho iseva yangaphandle isabisa amakheli khona. Linezimo zalo zangaphambilini, futhi ukuhlanganisa izinhlobo ezimbili kuveza impikiswano efanayo okuxwayiswa ngayo emibhalweni. Khetha umabi oyedwa wenethiwekhi encane enebhuloho.
Ukwehlukanisa akusuki enanini lezinqubo
Izinqubo eziyisishiyagalombili ze-OpenVPN ezixhunywe ebhulohweni elilodwa elingenamingcele zisahlanganyela isizinda esisodwa sokusakaza. Amaklayenti angathumela i-ARP kwelinye linamanye ngaphesheya kwebhuloho, futhi inani labalaleli alizange lishintshe lutho ngalokho.
Uma imfuneko iwukuthi amaqembu amaklayenti angabonani ku-2 wosongelo, idizayini idinga amabhuloho ahlukene noma izixhumanisi ze-VLAN, kanye nemithetho yokufinyelela ehamba nazo. Lesi isinqumo sokuklanywa kwenethiwekhi, futhi siyisinqumo esifanayo noma inqubo yesiseva eyodwa noma eziyisishiyagalombili zihilelekile. Ukuhlunga kwebhuloho kungakhawulela ukuhamba okuthile, kodwa akudali izizinda zokusakaza ezihlukene. Kubheke njengesengezo sokuhlukanisa, hhayi njengesikhundla sako.
Uma imfuneko iwukuthi amaklayenti afinyelele izinsiza ezithile ze-IP kuphela, idizayini ye-TUN eqondisiwe ngokuvamile ilula kunokwakha ibhuloho kanye nokuhlunga. Iklayenti ngalinye lithola isixhumanisi saso, futhi inqubomgomo ihlala emithethweni yokuqondisa nase-firewall hhayi ngaphakathi kwebhuloho.
Lapho izinqubo eziningi zisalungile
Izinqubo ezihlukene zingathethelelwa ngezidingo zokusebenza: ama-backend ahlukene okuqinisekisa, iziphathimandla ezahlukene zezitifiketi, imijikelezo ehlukene yokuthuthukisa, noma amasethi ezinketho angahambisani. Lezi izizathu zangempela futhi azincikile enanini lamaklayenti.
Uma usebenzisa eziningi, nikeza ngayinye isilaleli sayo kanye nobunikazi bedivayisi, futhi uxhumanise amabanga amakheli. Amaseva amabili womabili akholelwa ukuthi anechibi elifanayo ebhulohweni elifanayo ekugcineni azonikeza ikheli elifanayo.
Bese uqinisekisa idizayini ngamaklayenti amaningi ngesikhathi esisodwa. Hlola ukuthi amakheli ahlukile, ukuthi ukuhamba okuhlosiwe phakathi kwamaklayenti kuyasebenza, nokuthi ipheya okungafanele lixhumane nalo alikwazi. I-ping ephumelelayo yeklayenti elilodwa ayihloli lutho ekuklanyweni kwamaklayenti amaningi.
Funda ibhuloho kanye nemodi yeseva kusibungazwa esisebenzayo ngaphambi kokuthemba umdwebo. Isilungiselelo esibalulekile yileso umgogodla ne-daemon abasilayishe ngempela, futhi yileso futhi umbuyekezi angasihlola.