Amakheli amile wamaklayenti e-OpenVPN ngemuva kwe-OPNsense
Ifayela le-pool lenza ikheli linamathele, hhayi unomphela. Bopha amakheli amaklayenti nge-override, khulisa ububanzi bomhubhe ngenxa yezibalo ze-/30, bese uwashicilela.
Amagama adinga amakheli angahambi, futhi ifayela le-pool le-OpenVPN lenza ikheli linamathele kuphela. Uma ulahlekelwa yilelo fayela, noma uphinde ukhiphe isitifiketi ngaphansi kwelinye igama elivamile, iklayenti elibuyayo lihlala kwenye indawo ku-pool, kuyilapho irekhodi lalo le-DNS lisakhomba ekhelini elidala. Impendulo ehlala njalo i-override eqondene neklayenti ebopha ikheli, kanye nenethiwekhi ebanzi yomhubhe ukuze amakheli aboshiwe abe ngaphandle kobubanzi obushintshayo. Izibalo ezisemva kwalokho kwandiswa yizona ezihlala kuzo ukudideka okuningi.
I-OPNsense igcina le-override kuzilungiselelo zeseva eziqondene neklayenti, ngokhiye wegama elivamile lesitifiketi, okwenza igama elivamile libe yingxenye yohlelo lwamakheli.
Ukuqashwa okunamathele akulona ikheli elimile
Ifayela le-pool libhala ukuhlangana kwekheli neklayenti futhi likubuyisela uma iklayenti elaziwayo lixhuma futhi. Lokhu kuwukulunga, hhayi isivumelwano: ifayela lingakhiwa kabusha, ukuhlangana kuyanyamalala uma ubunikazi beklayenti bushintsha, futhi amaseva amabili abelana nge-pool eyodwa ngeke avumelane ngakho. I-override eqondene neklayenti isebenza ngendlela ehlukile, ngoba ikheli livela ekulungiseleleni, hhayi emlandweni. Futhi iyamela ukuqala kabusha nokufakwa kabusha kwedivayisi, uma i-override igcinwe kanye nayo yonke enye ilungiselelo.
Enye indlela eguqukayo, okuwukuxhuma i-VPN ne-DNS ngeskripthi se-client-connect kanye nokubuyekezwa okuguqukayo, iyasebenza futhi idinga isixazululi esamukela ukubuyekezwa, kanye neskripthi kukho konke ukuxhuma. Kudivayisi ukhawulelwe kumaphakethe akhishwa umthengisi, futhi ngokuvamile yilapho luhlelo luphela khona.
Izibalo ze-/30 okungekho muntu ozijabulelayo
Ku-topology ye-net30 ezenzakalelayo, iklayenti ngalinye lithola i-/30 yalo: ikheli lokuqala elisebenzisekayo liya ohlangothini lweseva, elesibili liya eklayenti. Ngakho-ke ama-override kufanele abe ngaphandle kwenethiwekhi yomhubhe eguqukayo yeseva, okusho ukuthi kuqala kufanele kwandiswe leyo nethiwekhi. Iseva eku-10.8.0.0/24 ingaya ku-10.8.0.0/23, ishiya ingxenye eyodwa yobubanzi obudala kumaklayenti aguqukayo nenye ingxenye kuma-override. Engeza i-/24 yasekuqaleni njengenethiwekhi yendawo ye-IPv4 eyengeziwe ukuze ithrafikhi eya kuzo zombili izingxenye ingene emhubheni.
Ikheli ngalinye le-override kufanele liwe emngceleni we-/30, ngakho i-octet yokugcina iyisiphindaphindo sesine. I-/30 ku-10.8.1.0 inika iklayenti i-10.8.1.2, futhi yilolo kheli irekhodi le-DNS elilithwalayo. Ukukhetha i-10.8.1.3 esikhundleni salokho kuveza iklayenti elixhumayo kodwa elingakwazi ukudlulisa ithrafikhi, ngoba ikheli lingelolunye unethiwekhi encane umhleli wokwakheka ongakaze ayinikeze lona.
Uhlelo kulula ukulugcina uma ama-override abelwa kusukela phezulu kobubanzi obukhulisiwe kwehla, ukuze i-pool eguqukayo ikhule endaweni engenalutho hhayi izungeze iziqhingi ezingagudli.
Amanethiwekhi endawo kanye nendawo amaklayenti abuza kuyo
Ithrafikhi yeklayenti iya kweklayenti idinga imvume yayo. Uhlu lwamanethiwekhi endawo e-IPv4 eseva kufanele lufake zombili izingxenye zobubanzi, eziguqukayo nezimile; ngaphandle kwalokho iseva yamukela iphakethe elivela eklayentini elilodwa kodwa ayinayo inqubomgomo ekuvumela ukuba lidlulele kwelinye. Uphawu lubonakala njengokuhluleka kwe-DNS, ngoba igama liyaxazululwa kodwa ukuxhuma kusahluleka. Hlola isilungiselelo seklayenti-kuya-klayenti ngasikhathi sinye, ngoba ukufakwa kwenethiwekhi yendawo kuphela akwenza ukudlulisela phakathi kontanga kusebenze.
Shicilela amarekhodi endaweni amaklayenti akude abuza kuyo ngempela. Irekhodi endaweni esetshenziswa kuphela isixazululi se-LAN alibonakali eklayentini elinesixazululi esithunyelwe esikhomba kwenye indawo, futhi ukwengeza amarekhodi endaweni engalungile akukulungisi lokho. Qinisekisa inketho ye-DNS ethunyelwe kanye nesizinda sokusesha ngaphambi kokwengeza noma yini.
Yini okufanele ihlolwe ekuxhumaneni okusha
Xhuma iklayenti futhi uqinisekise ukuthi ikheli elinikeziwe lihambisana ne-override yalo ngaphambi kokuhlola enye into. Bese uxazulula igama kusuka eklayentini lesibili futhi uxhume kusevisi ngegama, okuhlola kanye irekhodi le-DNS, umzila kanye nodonga lomlilo. Qinisekisa umzila wempendulo ohlangothini lweseva, ngoba igama elixazululwayo kuyilapho isevisi ingafinyeleleki iyinkinga yomzila noma yenqubomgomo, hhayi yokuqamba amagama. Gcina ithebula lama-override eduze kohlu lwezitifiketi ukuze zombili zihlolwe kanye.
Isitifiketi esikhishwe kabusha ngaphansi kwelinye igama elivamile siyeka ukuhambisana ne-override yaso futhi sibuyisela iklayenti ku-pool eguqukayo. Kulindele lokho ngemva kwanoma yiluphi ushintsho lobunikazi.