Uhlu lokuhlola lwe-VPN router esilungiselwe ngaphambili: yini okufanele iqinisekiswe lapho kudluliswa

I-router elayishiwe ngaphambili iphethe i-akhawunti, i-firmware kanye nenqubomgomo yokuphuma yomthengisi. Hlola ukufinyelela komlawuli, ubunikazi be-akhawunti, indawo yokuphuma, izibuyekezo nenqubomgomo.

I-router elayishiwe ngaphambili ifika nezinqumo zomunye umuntu sezivele zibhakiwe ngaphakathi: iyiphi insizakalo ye-VPN eyishayelayo, i-akhawunti kabani ekhokhelayo, yiluphi uqhwebegwebe olukubayo nokuthi ubani ophethe iphasiwedi eguqula noma yikuphi kwalokho. Phatha ukudluliswa njengocwaningo, hhayi njengokuvulwa kwebhokisi. Izinyathelo ezinhlanu ezingezansi zihleliwe, futhi ngasinye sinesimo sokuma; uma isinyathelo sihluleka, izinyathelo ezilandelayo azikwazi ukukutshela lutho oluthembekile mayelana nedivayisi. Zidlulisele ne-router iphambi kwakho kanti ikhompyutha ephathekayo ingemuva kwayo.

Isinyathelo 1: thatha ukulawula kokuphatha idivayisi

Thola ikheli lokuphatha, ngena, futhi ushintshe iphasiwedi yomlawuli ngaphambi kokuxhuma noma yini ebalulekile. Ku-router yokuhamba yakwa-GL.iNet lelo kheli ngu-192.168.8.1 futhi isihloko sokuqala sokusetha sicela ukuthi usethe iphasiwedi; abanye abathengisi babhala ikheli labo futhi bangathumela ubufakazi obugxilile obunyathelisiwe kulebula. Uma idivayisi ifike nokusekelwa kude noma ukuphathwa kwafu kuvuliwe, ncika manje ukuthi lokho kuzohlala kunjalo yini.

ssh [email protected]
cat /etc/openwrt_release
ubus call system board

Lezo zinqumo ezintathu ziphendula ukuthi ubani wakha i-firmware, iyiphi inguqulo futhi iyiphi inguqulo yezingxenyekazi ozitholile ngempela. Bhala umphumela kurekhodi lokudluliswa, ngoba ucingo losizo lwakamuva luzoqala ngaleyo mibuzo ngqo. I-router ephendula i-SSH kodwa enqaba ukushintsha iphasiwedi, noma engenayo indlela yokubuyisela ebhalisiwe, ayiyona idivayisi ongayiphethe.

Ma ekhona lapha uma ungakwazi ukuthola ukufinyelela komlawuli okukhethekile. Konke ngemva kwaleli phuzu kucabanga ukuthi ungakwazi ukufunda nokushintsha ukulungiselela ngaphandle kokubuza umthengisi.

Isinyathelo 2: thola ukuthi i-akhawunti ye-VPN kabani esetshenziswa yithuneli

Ithuneli iwukubhalisa ngaphansi kwegama lomuntu, futhi ukudluliswa akuphelele kuze kube yilapho wazi ukuthi kungokabani. Cela umhlinzeki, umnikazi we-akhawunti, usuku lokuvuselela kanye nobufakazi obunembile obufakwe kudivayisi. Ukulungiselela okulayishiwe ngaphambili okwabelana ngobufakazi obubodwa phakathi kwabathengi abaningi akukwazi ukukhanselwa wena wedwa, futhi lokho kubalulekile ngosuku umthengisi alahlekelwa khona ukulawula.

wg show
uci show network | grep -i -E 'vpn|wireguard|openvpn'
ip route show table all | head -40

Ku-WireGuard umphumela usho uzakwethu kanye nesikhathi sokuxhawulana kokugcina; ku-OpenVPN iphrofayela ingaphansi kwe-/etc/openvpn futhi insizakalo esebenzayo ikhombisa ukuthi iyiphi iphrofayela esebenzayo. Bhala lokho okutholayo, ngoba ukuxhumeka kabusha okusebenzisa ngasese enye indawo yokugcina kuwushintsho ofuna ukuluthola esikhundleni sokuluchaza.

Ma ekhona lapha uma i-akhawunti ingakwazi ukudluliswa, ukuvuselelwa noma ukukhanselwa egameni lakho. Idivayisi ongayilawula kodwa ongakwazi ukuyilungiselela kabusha iba yisitini ngosuku ukubhalisa kuphelelwa yisikhathi.

Isinyathelo 3: hlola indawo yokuphuma kusuka kuklayenti, hhayi ku-router

Izwe elinyathelisiwe ebhokisini, izwe ekukhangisweni komthengisi kanye nezwe lekheli lomphakathi zingamaqiniso amathathu ahlukene. Kungelokugcina kuphela okuthinta lokho okuwubona isizindalwazi, futhi kukhiqizwa yindawo yokugcina yomhlinzeki, hhayi ikheli lokuthumela. Yenza ukuhlola kusuka kukhompyutha ephathekayo engemuva kwe-router ngesikhathi ithuneli ivuliwe, hhayi kusuka ku-shell ye-router uqobo.

curl -s https://ifconfig.me
curl -s https://ipinfo.io/json
dig +short myip.opendns.com @resolver1.opendns.com

Qhathanisa izimpendulo ezintathu. Uma zingavumelani, kukhona okuthile phakathi kwekleyenti nendawo yokugcina okubhala kabusha noma okudlulisa uqhwebegwebe, futhi kufanele uthole ukuthi kuyini ngaphambi kokwethemba indawo. Izisekelo zedatha yendawo ziyizilinganiso eziphakelwa abasebenzisi, ngakho ikhodi yezwe ehambisanayo iyubufakazi obusekelayo hhayi ubufakazi bendlela yomzimba.

Ma ekhona lapha uma ukuphuma kuhluke kulokho okwenza isivumelwano ngakho, noma uma impendulo ishintsha phakathi kwemibuzo. Ukuphuma okuzungezayo noma okungahambisani kuphula izinsizakalo ezincike esifundeni futhi kwenza konke ukulinganisa kwakamuva kube nokungaqondakali.

Isinyathelo 4: bophela i-firmware kanye nesiteshi sezibuyekezo

Amadivayisi alungiselwe ngaphambili avame ukufika nokwakhiwa okudala nokulungiselela komthengisi okugqamile phezu kwe-OpenWrt. Ngaphambi kokwamukela noma yikuphi ukubuyekeza, thola ukuthi ukuthuthukisa kugcina iphrofayela ye-VPN yini, ukuthi umthengisi uhlinzeka ngephrofayela yokushintsha yini nokuthi ubani okulindeleke ukuthi enze ukuthuthukisa. Funda amanothi okukhishwa emodelini onawo ngempela, hhayi emodelini esesithombeni sokukhangisa. Uma umthengisi engaphenduli noma yimuphi wale mibuzo, phatha izibuyekezo njengezingasekelwe futhi umise ukwakhiwa onawo.

cat /etc/openwrt_release
cat /etc/glversion 2>/dev/null
opkg list-installed | wc -l

Gcina ikhophi yokulungiselela okusebenzayo ngaphandle kwedivayisi ngaphambi kokushintsha noma yini: okhiye be-WireGuard, iphrofayela ye-OpenVPN kanye nemithetho ye-firewall eqhuba inqubomgomo yokuhamba. Ukusetha kabusha kwefektri ngaphandle kwaleyo khophi kususa ngqo ukulungiselela okukhokhele kukho, futhi umthengisi angase angakukhiphi futhi.

Isinyathelo 5: ncika ukuthi ithuneli ihlanganisa ini nokuthi kwenzeka ini uma yehluleka

Ukuhamba kwenethiwekhi yonke, ukuhamba kwamadivayisi akhethiwe, ukuphathwa kwe-DNS, i-IPv6 kanye nokuziphatha kwe-kill switch kuyizilungiselelo ezihlukene i-interface evame ukuzihlanganisa zibe iswishi eyodwa. Zihlole ngazinye, ngoba i-router exhunyiwe ifakazela kuphela ukuthi i-router uqobo iyafinyelela endaweni yokugcina. Hlola kusuka kuklayenti engaphansi ngesikhathi ithuneli ivuliwe, bese uphinda uyivale.

ip route get 1.1.1.1
ip -6 route get 2606:4700:4700::1111
nft list ruleset

Uma i-IPv6 ivuliwe ku-LAN kodwa ingahambiswa phakathi kwethuneli, amaklayenti angase ayithande futhi ashiye ngokuphelele indlela ye-VPN kuyilapho i-IPv4 isabonakala ivikelwe. Uma i-kill switch icishiwe, ithuneli ephukile ibuyela endleleni ye-ISP, okuyisinqumo esihle kuphela uma ukwenze ngamabomu. Zombili izimo azibonakali kudashibhodi yomhlinzeki.

Bhala ukwabiwa kosizo ngaphambi kokuba ukudinga. Umthengisi wezingxenyekazi, umgcini we-firmware kanye nomqhubi we-VPN bangamacala amathathu anemigudu emithathu ehlukene yokubuyisela, futhi uxhumano olulodwa lungase luhlanganise izindima eziningi kodwa hhayi zonke. Ukudluliswa kuphela lapho usukwazi ukuphatha idivayisi, ukuvuselela noma ukukhansela i-akhawunti, ukuphinda ukhiqize ukuphuma okuhlosiwe, ukubuyekeza i-firmware ngaphandle kokulahlekelwa iphrofayela nokusho ngqo ukuthi kwenzeka ini uma ithuneli iwa.

Izihloko ezihlobene