Ukuqala kabusha isevisi ku-OpenVPN up: ama-hooks anqoba i-tun0.device

Ukuxhuma isevisi encikile ku-tun0.device kubukeka njengokubhalisela ithaneli, futhi akunjalo. Iyunithi yedivayisi ibonisa ukuthi i-interface ikhona, lokho okungahlala kuyiqiniso phakathi kokuxhumana okwehlulekile nokuxhuma kabusha okulandelayo. Isevisi ibe isenza ngesikhathi esingalungile, noma ingazenzi nakancane, kuye ngokuthi i-interface yanyamalala phakathi noma cha. I-hook echaza umcimbi okukhathaza ngempela i-hook edonswa yi-OpenVPN, hhayi leyo edonswa yi-systemd.

Nquma ukuthi yisiphi isimo isevisi esisidingayo ngaphambi kokukhetha isicupho, ngoba abazongenela ukhetho abathathu abashintsheki.

Iyini ngempela elandelelwa iyunithi yedivayisi

I-systemd idala iyunithi yedivayisi ngokombono wekherneli nge-interface yenethiwekhi, ngakho tun0.device iba nokusebenza lapho i-interface ivela futhi ingabi nokusebenza lapho isuswa. Nge-persist-tun, ukuqala kabusha okuthambileyo kugcina i-interface endaweni yayo, ngakho iyunithi ayijikijeli neze futhi akukho okubophile kuyo okuqaliswayo. Ngisho ngaphandle kokuqina, iyunithi ayisho lutho ngemizila, i-DNS noma ukuthi uhlangothi olukude luyaphendula yini.

Lokho kuyenza ibe indawo yokubambela embi ye-'VPN isilungile'. Umsitshi odinga ikheli lendawo kuphela angase aneliseke ngokuba khona kwe-interface, kuyilapho isevisi ebiza uhlelo lokusebenza kunethiwekhi ekude idinga imizila nokufinyeleleka, okungeke iyunithi yedivayisi ikwazi ukukuchaza.

I-up, i-route-up ne-up-restart zisho izinto ezihlukene

up isebenza ngemva kokuvulwa kwedivayisi ye-TUN/TAP nokuhlelwa kwe-interface, okuyisikhathi esifanele somsitshi obopha ikheli elinikeziwe. route-up isebenza ngemva kokufakwa kwemizila, ngaphansi kwanoma yikuphi ukubambezeleka komzila okuhleliwe, futhi ifanele umsebenzi odinga isigaba semizila siqediwe. Akukho kukho kokubili okufakazela ukuthi uhlelo lokusebenza olukude luyaphendula. Ukukhetha phakathi kwazo kuwumbuzo wokuthi isevisi idingani, hhayi ukuthi iyiphi i-hook ezwakala iqediwe kakhulu.

Nge-persist-tun, ukuqala kabusha kusebenzisa kabusha idivayisi, ngakho up akusebenzi futhi ngaphandle uma i-up-restart isethiwe. Leyo nketho ivumela iskripthi se-up somjikelezo wokuphila wokuqala kabusha obhaliwe, futhi imvelo yaso incishisiwe uma kuqhathaniswa nokuqala kokuqala. Iskripthi esicabanga imvelo ephelele sisebenza ekuxhumaneni kokuqala futhi sehluleke kokulandelayo.

Thumela isenzo ngaphandle kokusilinda

I-hook ebiza i-systemctl restart ngokuvumelanayo ingafinyelela ekubambeni okungapheli neyunithi uhlelo lwayo lulinda ithaneli. I-systemctl --no-block try-restart vpn-dependent.service ibeka umsebenzi emgqeni futhi ibuya, lokho okuvimbela i-hook ekuvimbeni ukuxhumana ebevumelana nakho. I-try-restart isebenza kuphela kuyunithi esebenzayo, kuyilapho i-restart iqala neyona engasebenzi; khetha ngenhloso, hhayi ngomkhuba.

Ukubeka emgqeni akukona ukuqinisekisa. I-hook ibuyisa impumelelo ngokushesha lapho umsebenzi wamukelwa, ngakho ukuhlola kumele kwenzeke kujenali yeyunithi eqondiwe noma esimweni sayo sangempela somsitshi.

Inqubomgomo yokuqala kabusha ihlala kuyunithi, hhayi ku-hook

Iyunithi ye-oneshot ene-RemainAfterExit=yes ihlala isebenza ngemva kokuba umyalo wayo uphumile, futhi isicelo sesibili sokuqala asenzi lutho ngoba i-systemd ibheka ukuthi isivele yaqalwa. Lokho kuyisici okumele kwakhiwe ngakho, hhayi iphutha elibalekwa ngezingcingo zokuqala eziphindaphindiwe. Uma isenzo kumele sisebenze kukho konke ukuxhumana, iyunithi idinga isimo esikuvumelayo.

I-After= ihlela amayunithi, futhi i-BindsTo= ibopha izikhathi zokuphila, kodwa akukho kukho okusho ukuthi 'qala kabusha lokhu njalo lapho i-VPN ixhuma kabusha'. Iyunithi ebophile kuthaneli iyama lapho ithaneli lima; ayiziqali kabusha lapho ithaneli ibuya ngaphandle uma okuthile iyiqala futhi.

Hlola ukuxhuma kabusha okuthathu, hhayi okukodwa

Ukuqalisa okubandayo, ukuqala kabusha okuphelele kwekliyenti nokuxhuma kabusha okuthambileyo konke kuzijwayeza indlela ehlukile. Ukuxhuma kabusha okuthambileyo yikho okuveza i-up-restart engekho, imvelo encishisiwe noma iyunithi yedivayisi engakaze ingabi nokusebenza. Gijima kukho kokuthathu futhi uqinisekise izinhlangothi zombili: isevisi iyasebenza lapho ithaneli inyuka, futhi ayiqali kabusha ezinguqukweni zoxhumano ezingahlobene njengokuzulazula kwe-Wi-Fi.

Gcina indlela yokululama ezimele lapho isevisi encikile ithwala ukufinyelela kwakho kokuphatha. I-hook eqala kabusha into oxhuma ngayo iyinguquko engakukhiya ngaphandle.