I-Pi njengomxhasi we-VPN: umphathi oyedwa noma iskripthi sakho?

I-Raspberry Pi edinga ukuvikela kuphela ukuhamba kwayo okuphumayo inemiklamo emibili engokoqobo: vumela umphathi wenethiwekhi ukuba abe ngumnikazi womhubhe, noma gcina iskripthi esiwumnikazi. Kokubili kungathwala ukuhamba. Kuyahluleka ezindaweni ezihlukene, futhi ukwehluleka ongakwazi ukukuxilonga kude ngehora lesibili ekuseni yikho okufanele ukukhethwe. Qhathanisa ngobunikazi, ngalokho umhubhe ogcwele okusho khona lapho i-IPv6 ne-DNS zibandakanyeka, nangalokho okwenzeka ngomzuzu umhubhe uwela ngawo.

Abanikazi ababili bomhubhe owodwa

Umklamo A iphrofayili engaphakathi kumphathi wenethiwekhi wesistimu: iphrofayili OpenVPN engenisiwe noma uxhumano lwe-WireGuard lwendabuko, olwenziwa lusebenze ngesikhathi sokuqala yisevisi efanayo ekhuphula i-Ethernet ne-Wi-Fi. Umklamo B iyunithi yakho esebenza umxhasi ngqo, ihlela ukucushwa kwesixazululi futhi ifake imizila yayo kanye nemithetho yodonga lomlilo. Kokubili imiklamo esemthethweni; iyahluka ngokuthi ubani ogunyaziwe ukushintsha ithebula lokuhamba.

Ukwehluleka kuyahluka ngoba abanikazi bayahluka. Ku-A, iphrofayili engasebenzi ishiya isixhumi esibonakalayo phezulu nomhubhe phansi, futhi amalogi omphathi asho ukuthi kungani. Ku-B, iskripthi esiphumelela ngengxenye sishiya imizila ephila ngemuva kwenqubo eyidale. Ukusebenzisa kokubili umphumela omubi kakhulu: izinqubo ezimbili zibhala umzila ozenzakalelayo, izinguquko ezimbili zesixazululi ziyancintisana ngesikhathi sokuqala, futhi amasethi amabili ezimfihlo okufanele ajikelezwe.

Khetha umnikazi oyedwa ngomhubhe ngamunye futhi ukhubaze omunye ngaphambi kokuhlola noma yini. Abanikazi ababili kusho nezindawo ezimbili zokubheka lapho umhubhe uphezulu futhi kungekho okuxazululwayo. Lowo mthetho owodwa uvimbela izimo eziningi ezididayo ezichazwe ezingxoxweni ze-Pi VPN.

Ukungenisa kudala ini, futhi akudali ini

Ku-Raspberry Pi OS Bookworm nangale kwalokho ithuluzi lokucushwa kwenethiwekhi elizenzakalelayo yi-NetworkManager, ngakho iphrofayili iyikhaya lemvelo lomhubhe womxhasi. Ukungenisa kudinga i-plugin efanele ifakiwe; ngaphandle kwayo ukungenisa kuhluleka ngomlayezo mayelana nohlobo lokuxhumana olungasekelwe, okuyisiginali eqotho yokuma nokufaka i-plugin.

nmcli connection import type openvpn file ./provider.ovpn
nmcli connection show
nmcli --ask connection up id provider-name

Ukungenisa kugcina iphrofayili. Akufakazi ukuthi uhlangothi olunye luyafinyeleleka, futhi akuqinisekisi ukuthi yonke imiyalelo efayilini yasinda ekuguqulweni. Funda kabusha uxhumano olwenzekile futhi uhlole izingxenye ezithwala ubunikazi nokuthembela: isitifiketi, umsingathi okude kanye nembobo, nokuthi ingabe iphasiwedi iyabuzwa noma iyagcinwa.

Ukwenza kusebenze nge---ask kugcina umusho wokungena ngaphandle komlando we-shell kumshini owabiwe. Ku-Pi engenakho ukuqashelwa, ekugcineni uzofuna iphrofayili ikhuphuke ngesikhathi sokuqala, okuyisinqumo esihlukile ekukhuphuleni kanye ngesandla.

Umbhubhe ogcwele, uqhathaniswa kuyo yomibili imiklamo

Umbhubhe ogcwele isimemezelo mayelana nemizila, hhayi mayelana nenhloso, futhi imiklamo emibili iyiveza ngendlela ehlukile. Indlela yephrofayili icela umphathi ukuthi afake umzila ozenzakalelayo kanye nezilungiselelo zayo zesixazululi; indlela yeskripthi yenza lokho iskripthi esikushoyo, kufaka nokungenzi lutho. Akukho mklamo obandakanya i-IPv6 ngaphandle uma kushiwo, futhi umzila ozenzakalelayo we-IPv6 ongathintwanga uzothwala ukuhamba ngaphandle komhubhe ngenjabulo ngesikhathi i-IPv4 ibonakala iphelele.

ip -4 route get 198.51.100.23
ip -6 route show default
resolvectl query example.org

Sebenzisa ikheli ledokhumenti ekufunisiseni umzila bese ulifaka esikhundleni ngomsingathi ovunyelwe ukuba uwuhlole. Umyalo wokuqala ukhombisa ukuthi i-Pi ingasebenzisa isixhumi esibonakalayo esiphi endaweni evamile; owesibili ukhombisa ukuthi umzila ozenzakalelayo we-IPv6 usakhona yini; owesithathu ufakazela ukuthi isixazululi esiphi esiphendulile. Funda yomithathu ngaphambi kokukholwa isimemezelo sanoma yikuphi mayelana nomhubhe ogcwele.

Uma imiyalelo yomhlinzeki ithembisa umhubhe ogcwele kodwa umzila ozenzakalelayo we-IPv6 uhlala ukhona, i-Pi iyavuza. Khubaza i-IPv6 kusixhumanisi esiphezulu noma cela iphrofayili ukuba iyifune, futhi unqume ngamabomu esikhundleni sokukuthola kamuva.

Ukwehluleka okuvulekile ngokumelene nokuvaliwe

Lapho umhubhe uwela, ithebula lokuhamba elahlekelwa umzila walo ozenzakalelayo livele libuyele kusixhumanisi somzimba, futhi ukuhamba kuqhubeka obala. Lokho kungukwehluleka okuvulekile, futhi kungukuziphatha okuzenzakalelayo kwemiklamo yomibili ngaphandle uma okuthile kukuvimbela. Iningi labantu likuthola emavikini kamuva ngokufunda ilogi yodonga lomlilo.

Ukwehluleka okuvaliwe kukweba ukufinyelela kude lapho umhubhe uphansi, ngakho kudinga okuhlukile ngamabomu endleleni yokuphatha. Enye indlela umthetho ovumela kuphela ikheli lozakwethu we-VPN ngaphandle komhubhe:

sudo nft add table inet vpnkill
sudo nft 'add chain inet vpnkill out { type filter hook output priority 0; policy accept; }'
sudo nft add rule inet vpnkill out oifname != "tun0" ip daddr != 203.0.113.24 reject

Qhathanisa izindleko zokusebenza ngobuqotho. Iphrofayili ngokuvamile ayikwazi ukuveza lo mthetho, ngakho ukwehluleka okuvaliwe kukusunduza emklamweni weskripthi noma kuyunithi encane efaka umthetho ngaphandle komhubhe. Kunoma yikuphi, rekhoda ukunqatshwa isonto elilodwa: ukunqatshwa buthule kubonakala kufana nesevisi ephukile, futhi uzodinga isibali lapho umsebenzisi ebika ukuthi isayithi elilodwa liyekile ukulayisha.

Ukukhetha i-Pi engenasikrini

Uma isithombe sesivele sisebenza i-NetworkManager, umhubhe awudingi lutho oluyisimanga, futhi ufuna ukuthi ulandele isixhumanisi esiphezulu ngokuzenzakalela, thatha iphrofayili. Uma udinga ukuhamba ngemithetho, imihubhe eminingi ekhethwa ngendawo ngayinye, noma umthetho wokwehluleka okuvaliwe okufanele ube khona ngaphambi kokuthi umhubhe ukhuphuke, thatha iskripthi futhi ube ngumnikazi wazo zonke izingxenye zayo, kufaka ukulandelana kokuqala nokuhlanza. Ukuxuba imiklamo emibili kubiza kakhulu kunanoma iyiphi iyodwa.

Ukuthutha phakathi kwazo ikakhulukazi indaba yokulandelana: khubaza umnikazi omdala, qinisekisa ukuthi akukho mzila noma ukufakwa kwesixazululi okudlule isikhathi okusalayo, bese wenza okusha kusebenze futhi uqale kabusha kabili. Ukuqala kabusha kanye kungafihla umjaho ovezwa okwesibili. Qeda ngokuhlola i-Pi hhayi umhubhe: xazulula igama, thatha okuthile nge-IPv4, thatha nge-IPv6 uma uyigcinile, bese uwisa umhubhe futhi uqinisekise ukuthi ukuziphatha okukhethile kwenzeka ngempela. Isixhumi esibonakalayo ku-ip link siwukuqala kokuhlolwa, hhayi ukuphela.