Ikhleyenti ye-VPN ephathekayo ngaphandle kwamalungelo omlawuli: yini esaphukayo

Okuthi ephathekayo kuchaza isifaki, hhayi i-kernel. Ikhleyenti ingafika njengefayela elilodwa elisebenzayo ku-USB futhi isadinga idivayisi yethunge, umugqa kuthebula lemizila kanye nokubhala kusixazululi ngaphambi kokuba iphakethe lokuqala linyakaze. Ukuthi iyiphi kulezi zintathu imshini oqondiwe ezokuvumela ukuyithinta inquma ukuthi leso sakhiwo sisebenza lapho noma cha. Izivivinyo ezingezansi ziyayiphendula imibuzo ngokulandelana ikhleyenti ezoyihlangabeza ngakho.

Ephathekayo ihlanganisa izethembiso ezintathu ezihlukene, futhi eyodwa kuphela imahhala

Ukungabi nasifaki kusho ukuthi umthengisi akabhalisanga isevisi, akathumanga isisusi futhi akangezi umugqa wemenyu. Ukungabi nomlawuli kusho ukuthi i-akhawunti evamile ingaqalisa ikhleyenti futhi iqedele ukuxhumana. Ukungabi nashintsho kumsingathi kusho ukuthi umshini ubukeka ufana ngemva kokuba uphumile. Amakhasi okulanda athi ephathekayo ngokuvamile athembisa owokuqala kuphela, kanti amanye amabili yiwo lapho ukusetshenziswa kwehluleka khona. Isakhiwo singaba sikhona ngomqondo omncane futhi: sisebenza kusuka kumidiya yokufunda kuphela ngaphandle kokubhala kwefayela lamachashazi nhlobo, lokho okungakasho lutho mayelana nesitaki senethiwekhi.

Izethembiso ezibizayo yileso sesibili nesesithathu. Ifayela elilodwa elisebenzayo elidinga i-adaptha, umzila noma ukubhala kusixazululi licela uhlelo lokusebenza igunya isigxivizo sokuthi ephathekayo esingakaze sikusibekele.

Thola umsizi onelungelo ikhleyenti ezombiza

Cishe asikho isikhathi ikhleyenti ye-VPN ehambisa amaphakethe yodwa. Ku-Windows indlela yedatha idlula kuzihlungi ze-WFP kanye ne-Base Filtering Engine, ku-macOS idlula kumhlinzeki we-NetworkExtension umsebenzisi awuvumayo kuzilungiselelo zesistimu, futhi ku-Linux idlula kudivayisi ye-tun kanye nesitaki somzila. Ifayela le-binary olikopisile liyindawo yokulawula yalezo zingxenye, hhayi isikhundla sazo. Buza ukuthi iyiphi ingxenye ikhleyenti eyilindele, bese uqinisekisa ukuthi ifakiwe, iyasebenza futhi ingasetshenziswa i-akhawunti yakho.

I-Linux yindawo elula kakhulu yokufakazela lokhu, ngoba ukuhlola kuwukubiza kwe-sistimu okukodwa. Ukuvula i-/dev/net/tun nokucela idivayisi ku-kernel kudinga i-CAP_NET_ADMIN, futhi idokhumenti ye-kernel nge-TUN/TAP isho kokubili umthetho wobunikazi namandla. Sebenzisa ukuhlola nge-akhawunti ezoqalisa ikhleyenti, hhayi njenge-root.

ls -l /dev/net/tun
ip tuntap add dev vpntest mode tun
ip link delete vpntest

Iphutha lemvume emugqeni ophakathi yiyo impendulo obuyifuna: le akhawunti ayikwazi ukudala isixhumanisi sethunge, ngakho noma iyiphi ikhleyenti yendawo yomsebenzisi eyidingayo yehluleka ngesikhathi sokuxhuma hhayi ngesikhathi sokulanda. Umugqa wokugcina ususa idivayisi yokuhlola futhi awusho lutho uma isebenza. Uma yomibili imigqa iphumelela, umsingathi akashintshanga lutho unomphela.

Hlola izinguquko zomzila nesixazululi ngaphambi kokuxhumana kokuqala

Ithunge elihlukanisiwe liguqula ukuxhumana kube isinqumo somzila, kanti ithunge eligcwele likuguqula kube ukushintshwa komzila ozenzakalelayo. Kokubili kuwukubhala esitakini senethiwekhi yomsingathi, futhi kokubili kuyahluleka ku-akhawunti engenalo ilungelo ngisho nalapho ikhleyenti ngokwayo iqala ngokuhlanzekile. Isixazululi siwukubhala kwesithathu, futhi kumasingathi we-systemd ngokuvamile yiso esiphuka ekugcineni. Lolo hlelo lubalulekile uma unquma ukuthi uzosebenzisa kuphi ukufakwa okukhulisiwe.

Uvivinyo lomzila ludinga indawo oyikhathazayo ngempela, ngakho shintsha isibambi sikhala esingezansi nge-subnet evela kuphrofayela yakho. Igama ledivayisi kumele libe khona ukuze umzila unamathele kokuthile.

ip route add 10.20.0.0/16 dev vpntest
ip route del 10.20.0.0/16
resolvectl query intranet.example.internal

Uma umugqa wokuqala ubuyisela i-RTNETLINK answers: Operation not permitted, i-akhawunti ayikwazi ukufaka umzila oyimfihlo odingwa uphrofayela. Umugqa wesibili ufakazela lelo lungelo ngokuphambene, lokho okubalulekile ngoba ikhleyenti ekwazi ukwengeza imizila kodwa ingakwazi ukuyisusa ishiya ithebula eliphukile ngemuva kwayo. Bese umbuzo wesixazululi ubonisa ukuthi amagama ayimfihlo axazululwa ngethunge noma ayaviza aye kusixazululi umsingathi asevele esithembile.

Sebenzisa zontathu ngesikhathi idivayisi yokuhlola isekhona, bese uyisusa. Umzila okhomba idivayisi esehambile iyisizathu esivamile sokuthi ikhompyutha ephathekayo ilahlekelwe uxhumano ngemva kokuxhumana okuhlulekile.

Nquma ukuthi yini okufanele isinde esikhathini

Ukususa ifolda akusilo uhlelo lokuhlanza. Ama-adaptha, imizila, izilungiselelo zesixazululi, izitifiketi ezithenjwayo kanye nobufakazi obugciniwe kungase kuphile isikhathi eside kunenqubo, futhi isevisi ngesikhathi sokuqalisa ingabuyisela ezinye zazo ngaphandle kokubuza. Bhala ukuthi ikhleyenti ivunyelwe ukushiya ini ngemuva kwayo ngaphambi kokuba uyisebenzise, hhayi ngemva kokunqamuka kokuqala okuhlulekile.

Umgomo osebenzayo ukuthatha isithombe sezingaphezulu ezintathu ozozishintsha bese uzixoxisa ngemuva kwalokho. Rekhoda ama-interface, ithebula eliyinhloko lomzila kanye nesimo sesixazululi ngaphambi kokuxhumana kokuqala, bese uphinda ukufunda okuthathu okufanayo uma ikhleyenti isiphumile.

ip -brief addr show
ip route show table main
resolvectl status

Noma yini ekhona ekubanjweni kwesibili futhi engekho kokuqala idinga umnikazi. Kusuka kube ikhleyenti eyisusa ekuhambeni, noma uyisusa ngemiyalo efanayo eyayidale, futhi lokho kususa kungokwamanothi okusetshenziswa, hhayi enkumbulweni yomuntu ngokwenzeka. Ku-Windows ukufunda okulingana yi-Get-NetAdapter, i-Get-NetRoute ne-Get-DnsClientServerAddress, ezingadingi ukukhuliswa kodwa zibonisa izinsalela ezifanayo.