pfSense njenge-VPN server nesikhalazo: izindlela ezimbili, i-router eyodwa

Idivaysi eyodwa ingabheka izinhlangothi ezimbili ngesikhathi esisodwa: abasebenzisi abahambayo baxhumanisa ngaphakathi, futhi lelo bhokisi lixhumanisa ngaphandle kumhlinzeki wokuphuma ukuze ithrafikhi ekhethiwe iphume ngolunye uxhumano. Ukunika amandla womabili amasevisi kuthatha amaminithi ambalwa; ukuwavumela ukuba ahlale ndawonye kudinga umklamo, ngoba indima yesibili ibhala kabusha ithebula lemizila okuncike kulo eyokuqala. Izimo ezintathu zinquma ukuthi lolu hlelo luyasebenza yini, okungukuthi ingabe isevisi engenayo igcina indlela yayo yokubuya, ingabe ithunjana eliphumayo lisafinyelela kumlingani walo, futhi ingabe ithrafikhi obuhlosile ukuyidlulisa iyakhethwa ukuze iphume. Uma wehluleka kwesinye, uthola amathunjana amabili anombiko wokuxhunyaniswa kokubili kuyilapho kungenakho okusizo okudlulayo phakathi kwawo. Izivivinyo ezingezansi zisungula isimo ngasinye ngokulandelana okuvamile ukuvela kwezinkinga.

Qamba amagama emisebenzi emibili ngaphambi kokuthinta noma yisiphi isilungiselelo

Bhala amaqiniso amane esigameko ngasinye: umlingani walo okude, into yokuqinisekisa, iphuli lamakheli eliwahlukanisayo, kanye namaxhumano angemuva kwalo. Izimo ezimbili ziyizinto ezihlukene kudivaysi futhi kufanele zihlale zihlukene nasemibhalweni yakho. Cishe zonke izimpawu ezididayo kamuva zivela ekuxutshweni kwamanani azo, futhi izimo ezimbili ezabelana ngesethi eyodwa yemibhalo yikho okwenza iphuli elingalungile liphelela endaweni engalungile.

Isevisi engenayo idinga uxhumano lwethunjana olungadleli phezu kwamakheli ethunjana eliphumayo noma kunoma yiluphi uxhumano oluyimfihlo idolobha eliluhambisayo. Ukudlela phezu kwayo yilona kuphela iphutha elikhiqiza izimpawu kuyo yomibili imisebenzi ngesikhathi esisodwa, futhi kubiza kakhulu ukuyibamba ephepheni. Qhathanisa womabili amaphuli kanye nayo yonke iminetha eyimfihlo ehambisiwe endaweni eyodwa ngaphambi kokumisa noma iyiphi isevisi.

Izingxenyekazi ezabiwe azisho ukuthi imininingwane yokungena yabiwe, futhi isitifiketi sekhasimende esivela kuphuli lokufinyelela kude akufanele sikhone ukusetshenziswa kumhlinzeki wokuphuma. Izinto ezihlukene zenza nokuhoxiswa kube isinqumo sendawo esikhundleni somcimbi wethimba lonke.

Gcina izimpendulo zesiphakeli emzileni we-WAN

Izimpendulo ezikhiqizwa yidivaysi ngokwalo ziyisisulu sokuqala somzila ojwayelekile ongakhathalelwanga. Lapho kufika iphakethe eligoqiwe lomsebenzisi ohambayo, impendulo iyithrafikhi evela endaweni futhi kufanele iphume ngesikhombo esingene ngaso lowo msebenzisi. Uma ikhasimende eliphumayo lifake umzila ojwayelekile owubambayo, impendulo ingena ethunjwaneni elingalungile futhi isikhathi siyama kuyilapho isevisi isabonakala iphilile.

Akukho bhokisi ellodwa lokumaka elixazulula lokhu, ngoba isinqumo simayelana nokuthi iyiphi ithrafikhi ikhasimende eliphumayo elingayibamba. Kuphakathi kokuthi ungadonsi mizila futhi uqondise kuphela lokho okukhethile, noma udonse imizila futhi wengeze okuhlukile okugcina amasevisi edivaysi ngokwalo esebenza. Bhala ukukhetha eceleni kwesigameko, uma kungenjalo umuntu olandelayo uzocabanga okunye.

netstat -rn | head -20
pfctl -sr | grep -i vpn
ifconfig | grep -A3 ovpn

Funda ithebula lemizila ngokufana okude kakhulu, hhayi ngokulandelana okuhlele ngakho into ethile. Umbuzo ngukuthi yiluphi ufakazi olunqobayo ekhelini lomlingani wokuphuma nokuthi yiluphi ufakazi olunqobayo empendulweni yesevisi engenayo, futhi lezi zimpendulo ezimbili zingahluka.

Ungavumeli ithunjana eliphumayo lidle indawo yalo yokugcina

Ikhasimende eliphumayo kufanele lifinyelele ikheli lomphakathi lomlingani walo ukuze lakhe ithunjana nje. Uma lelo kheli ngokwalo lihambiswa lingene ethunjwaneni, ikhasimende lijahe umsila walo: ukuthutha akukhuphuki nakanye, noma kuyakhuphuka bese kwehla ngaso leso sikhathi lapho umzila ufakwa khona. Ilogi ibonakala njengokuphelelwa yisikhathi kokuqinisekisa hhayi njengephutha lomzila, yingakho umzila ufanele ukuhlolwa kuqala.

Hlola umzila ngaphambi kwemininingwane yokungena futhi uphinde ngemuva kokuthi ithunjana likhuphukile, ngoba ufakazi lungase lube lulungile ekuqaleni futhi lungalungile ngemuva komzuzu. Ikheli lomlingani kufanele likhombe emzileni ojwayelekile we-WAN, hhayi nakanye kudivaysi yethunjana. Lapho ukuthutha kuzinza, umbuzo othakazelisayo udlulela kuthrafikhi edlulisiwe, futhi leso yisinqumo esilandelayo.

netstat -rn | grep -F '198.51.100.10'
traceroute -n 198.51.100.10

Khetha ukuthi yibaphi abasebenzisi abathola ukuphuma

Inqubomgomo yomthombo ingeyokungena lapho ithrafikhi ingena khona kudivaysi, ngakho khetha iphuli lokufinyelela kude, noma ubunikazi obuncane ngaphakathi kwalo. Gcina izindawo eziyimfihlo kanye nokuhlukile kokuphatha okungafanele kuthunyelwe ekuphumeni nakanye, futhi ubeke leyo mithetho ngaphambi komthetho obanzi. Umzila wokuphuma ke udinga ukuhumusha kwawo noma uhlelo lokubuya oluhambisiwe, okusho ukuthi emikhakheni eminingi i-NAT ephumayo kusikhombo sokuphuma esimboza iphuli. Ukuhumusha akukhethi ukuphuma; kubhala kabusha kuphela okuvele kwaphuma, ngakho umthetho we-NAT ku-WAN engahlobene awushintshi lutho ekukhetheni.

Qinisekisa ukuthi uhlangothi olukude luvumela ithrafikhi edlulisiwe kusukela kulomu mklamo, ngoba abanye abahlinzeki bayavuma abanye abavumi. Umehluko ubonakala njengethunjana elixhumanayo kodwa elingathwali lutho, okulula ukukufunda njengephutha lendawo. Hlola imifudlana emithathu ngokwehlukana, ngoba yehluleka ngokuzimela, futhi emibili kwemithathu umklamo owakhiwe uhhafu.

openvpn --config user07.ovpn
curl -sS https://ifconfig.me
curl --interface 10.10.10.1 -sS https://intranet.corp.example/health

Umyalo wokuqala uxhumano lwangaphandle lomsebenzisi ohambayo, futhi usebenza lapho ikhasimende libika ukuthi ukulandelana kokuqala kuphelile. Owesibili ugijinywa kuleyo khompyutha yokukhwela exhunyiwe futhi kufanele kubike ikheli lomhlinzeki wokuphuma esikhundleni sekheli lakho le-WAN. Owesithathu ugijima kudivaysi uboshelwe ekhelini elivela kuphuli, futhi uhlola inqubomgomo yomthombo yethrafikhi edlulisiwe ngaphandle kokubandakanya umsebenzisi okude nhlobo. Uma impendula ivela ku-WAN esikhundleni salokho, inqubomgomo ayizange ihambelane, futhi akukho nani lokuhlela i-NAT elilungisa inkinga yokukhetha.

Nquma ukuthi kwenzekani lapho ukuphuma kwehluleka

Bhala indlela yokwehluleka ngaphambi kokuba kwenzeke: lapho ithunjana eliphumayo liwa, ingabe abasebenzisi babuyela ku-WAN ojwayelekile noma bayavinjwa kuze kube yilapho ukuphuma kubuyile? Zombili izimpendulo ziyavikeleka, futhi idivaysi ngeke ikukhethele. Umzila osusiwe noma inqubomgomo ekhomba esangweni elifile akukhiqizi ngokuzenzakalela umphumela wokuvinjwa ngokuphelele. Uma ufuna ukuvinjwa, inqubomgomo kufanele ikusho ngokusobala, futhi kufanele kuhlolwe ngokususa ukuphuma hhayi ngokucabanga ngakho. Uma ufuna ukubuyela, kumemezela lokho kubasebenzisi, ngoba ithrafikhi ethatha ngasese umzila ojwayelekile yiyo kanye ithrafikhi umuntu ayecabanga ukuthi imboziwe.

Khubaza isigameko sekhasimende, bheka ukuthi umsebenzisi oxhunyiwe usafinyelela ini, bese usiqalisa futhi. Isicelo esiphelelwa yisikhathi siwumphumela wokuvinjwa ngokuphelele owukucelile; leso esiphendula ngekheli le-WAN siwukubuyela ongakubhalanga. Phinda isivivinyo se-IPv6 ne-DNS, ngoba inqubomgomo ebhalelwe i-IPv4 ayisho lutho ngenhlekelele ye-AAAA futhi isixazululi esisunduzwa yinoma yiliphi ithunjana siphendula lapho umbuzo uphuma khona ngempela.

pfSsh.php playback svc stop openvpn client 2
curl --max-time 6 -sS https://ifconfig.me
pfSsh.php playback svc start openvpn client 2

Iresiphi ye-Netgate ye-OpenVPN ehambisiwe ibonisa ukuthi inqubomgomo yomthombo, ukwabiwa kwesikhombo kanye nokuhumusha okuphumayo kuhlangana kanjani, futhi ububanzi bayo besiza nesiza yiyo ingxenye okungafanele ikopishwe yonke. Engakutshelanga yona ukuthi yisiphi sezimo ezintathu ezingenhla esivele saphulwa umklamo wakho.