I-route-gateway ayiyona i-redirect-gateway: yini eshintshayo ngempela
Le nketho inikeza kuphela igxathu elilandelayo emizileni efakwa yi-OpenVPN. Ukuyisusa akukucishi umhubhe ogcwele ophushwayo, futhi ukulungiswa kuseqhondweni lokuhlanjululwa.
Umhubhe wakho uyaphuma, inethiwekhi encane yangasese iyaphendula, futhi ukubhrowza okuvamile kusanyamalala ku-VPN nakuba othile esule umugqa wegesi kusuka kuphrofayela. Leyo nhlanganisela iwuphawu lwendlela okwakuhlelwe ngayo okungeyona. Lokho okwasuswa kwakunikeza iklayenti igxathu elilandelayo emizileni eyifakayo; lokho okuqhubeka nokubamba ithrafikhi kwavela kwenye indawo futhi kwaphushwa iseva. Ukumboza kanye negxathu elilandelayo kuyimisebenzi ehlukene, futhi kukodwa kuphela okunquma ukuthi izindawo zomphakathi ziyawusebenzisa yini umhubhe.
Umugqa owususile wawuyigxathu elilandelayo, hhayi iswishi yenqubomgomo
Wonke umzila ofakwa iklayenti udinga ikheli legesi okumele ukhombe kulo, futhi umyalelo wegesi uyiwona umthombo walelo kheli lapho umzila ungasho lona ngokwawo. Kuyisuse, futhi leyo mizila ayinandawo yokubambelela, ngakho-ke ayifakwa noma iwela endleleni engayanga ndawo. Inethiwekhi encane yangasese yiyona mpela into eyayithwalwa wumzila onjalo.
Buphakathi kwalokho ukuziphatha okwasindayo kunombhali ohlukile: inketho yokuqondisa kabusha kublokhi ophushwayo, ehambisa ithrafikhi evamile yokuphuma ingene emhubheni ngokwezimpawu zayo. Ukususa igesi akukucishi futhi akukwenti buthakathaka. Umphumela uyisimo esibi kunazo zombili izimo, ithrafikhi yomphakathi isabanjwa futhi indawo yangasese eyayithethelela umhubhe manje ayifinyeleleki. Yingakho nokuhlela kwesibili, okwenziwe ngomoya ofanayo, nakho kungashintshi lutho.
Amalevi amane, imisebenzi emine ehlukene
Kule ngxoxo imiyalelo emine icashunwa ngokushintshana, futhi munye kuphela kuyo olawula ukumboza, okungukuthi yiziphi izindawo ezihamba emhubheni. Owesibili ubeka igxathu elilandelayo elisetshenziswa imizila, owesithathu ufaka isiqalo esisodwa, kanti owesine ulahla konke okwaphushwa iseva, kuhlanganise nemizila yangasese edingwa ukuthunyelwa. Ithebula liwahlunga ngokwalokho umphathi azama ukukushintsha hhayi ngokwegama, ngoba amagama yiwo abangela ukudideka. Zithathe njengezinqumo ezine ezihlukene futhi ukhethe lowo ofuna ngempela ukuwuhlehlisa.
Ngokwenzayo zozine zivame ukuza kublokhi elilodwa eliphushwayo, umugqa ngemva komugqa, okwenza zibonakale njengezingxenye zesethingi esisodwa. Azinjalo, futhi incwadi yokubhekisa ye-OpenVPN iyazibhala njengezindlela ezihlukile ngenxa yalokho. Ukuthola ukuthi yisiphi isinqumo osihlehlisayo kungumsebenzi; ukuhlela kuwumugqa owodwa.
| What you are trying to change | Directive that decides it | What it leaves alone |
|---|---|---|
| Which destinations use the tunnel | redirect-gateway | Per-prefix routes and resolver choice |
| The next hop a pushed route points at | route-gateway | Coverage of public destinations |
| One reachable prefix | route | Every other destination, default path included |
| All pushed routing and DNS at once | route-nopull | Nothing, which is the problem |
Hlunga umugqa ophushwayo, gcina igxathu elilandelayo
Uma ukumboza okuphikisana nakho kufika njengenketho ephushwayo, impendulo encane iwukushaya indiva leyo nketho ngegama futhi ushiye ingxenye esele yebloki eliphushwayo ingathintwanga. Uma kubhalwe njengesihlungi, kubukeka njengomugqa ongezansi, futhi indawo yako kusephrofayela yeklayenti ethintekile, hhayi ekulungiselelweni kweseva.
pull-filter ignore "redirect-gateway"Ubuncane wumbono oyisisekelo. Njengoba isihlungi siqhathanisa isiqalo sombhalo, iphethini emfushane nayo ihambisana nomyalelo wegxathu elilandelayo, okukhipha kanye ulwazi imizila yangasese encike kulo futhi iphinde iphutha lokuqala ngengubo entsha. Isihlungi sisebenza kuphela ezinkethweni eziphushwayo, ngakho-ke asikaze sithinte umugqa olinganayo obhalwe endaweni noma ophoqwe umphathi wenethiwekhi. Xhuma futhi ngemva kwalokho, ngoba iseshini ephilayo ayihloli kabusha lokho okwaphushwa iseva.
Funda ukusesha, hhayi ithebula
Ngemva kokulayisha kabusha iphrofayela, buza i-kernel ukuthi izindawo ezimbili zizoya kuphi ngempela: enye ngaphakathi kwesiqalo sangasese futhi enye ku-inthanethi yomphakathi. Ukukhipha konke kwethebula eliyinhloko kunzima ukukufunda futhi kulula ukukufunda kabi, ngoba umzila ungaba khona futhi nokho wehlulwe ukufana okuqondile kakhulu. Ekuhambiseni okusekelwe kunqubomgomo, umthetho, ithebula nekheli lomthombo nakho kuyingxenye yokuhlola.
ip route get 10.40.7.25
ip route get 203.0.113.77
ip rule showUkuhluka kwe-def1 kufanele kwaziwe, ngoba kushiya ingxenye yokuqala endala ibonakala ngesikhathi ipheya yengxenye yokuqala iwina ukusesha. Ngakho-ke umugqa ongu-0.0.0.0/0 kokukhiphayo awufakazi lutho ngokwawo. Ukusesha kuphendula umbuzo okubonakala sengathi uhlu luyawuphendula.
I-DNS, i-IPv6 nomzila wangasese kusamele kusebenze
Ukwala ukuqondisa kabusha okukodwa kwe-IPv4 akusho lutho mayelana nesisombululi, ngakho-ke inketho ye-DNS ephushwayo ingaqhubeka ithumela imibuzo emhubheni ngesikhathi imizila ibonakala ilungile. Okuzenzakalelayo kwe-IPv6 kungenza okufanayo emkhakheni wamakheli ongakaze uthintwe ukuhlolwa kwe-IPv4. Kokubili kudinga isinqumo esicacile esikhundleni somcabango. Bese uqinisekisa ukuthi insizakalo yangasese isaphendula, ngoba umhubhe ohlukanisiwe olahlekelwe umzila wawo wangasese awuwona umhubhe ohlukanisiwe, uwumhubhe ophukile.
Ithuluzi elilodwa elibanzi lifanelwe isexwayiso: i-route-nopull ilahla wonke umzila ophushwayo nayo yonke inketho ye-DNS ephushwayo, lokho okuqinisekile ukuthi kumisa umhubhe ogcwele futhi kuqinisekile ngokufanayo ukuthi kwephula imizila yangasese ukuthunyelwa okuncike kuyo, ngakho-ke iyisando esikhulu kakhulu kunesihlungi segama esiqondiswe enkethweni eyodwa. Hlola indawo yangasese, indawo yomphakathi nesisombululi ngemva kwanoma yiluphi ushintsho, futhi uthatha ukuxhawula okuqediwe njengobufakazi balutho ngaphandle kokuxhawula.