Hola i-akhawunti eyodwa ye-Linux nge-OpenVPN usebenzisa umthetho we-UID

Ukuhlelwa kwendlela okususelwa ku-akhawunti kufanele lapho isokhethi ngayinye ye-IPv4 ephethwe umsebenzisi oyedwa we-Linux kufanele iphume ngethuneli ekhona, futhi akufanele lapho udinga ukuhlukaniswa ezingeni lohlelo. Ikhetha nge-UID, ngakho konke okusebenza ngaphansi kwaleyo akhawunti kusemkhakheni, kuhlanganise nomsebenzi weqembu oyikhohliwe. Xazulula lowo mbuzo ngaphambi kokuthinta i-ip rule eyodwa.

Isibonelo esingezansi sithatha i-akhawunti yesiphequluli ezinikezelwe ku-UID 1500, idivayisi yethuneli i-tun-office ephethe ikheli lendawo 10.80.0.11, kanye ne-VPN evumela izindawo okukhulunywa ngazo. I-daemon ngokwayo isebenza ngaphandle kwaleyo UID.

Imibandela emithathu ekhetha indlela

Khetha umthetho we-UID lapho ubunikazi obenzayo umsebenzi kuyi-akhawunti, lapho ukuhambisa konke ukuxhumana kwayo kwamukelekile, nalapho i-namespace ingaba nzima kunalokho umsebenzi okufanele. Khetha i-namespace yenethiwekhi lapho umthwalo womsebenzi udinga izixhumanisi zayo, isixazululi nethebula yendlela. Khetha i-proxy noma ukubopha ngokwenqubo ngayinye lapho uhlelo olulodwa kanye kufanele lunyakaziswe kuyilapho ingxenye esele yesikhathi sokuxhumana ihlezi endleleni yendawo. Ukubhala lezi zintathu kuvimbela umthetho ogubuzela ngokuthula okungaphezu kwalokho obekuhlosiwe.

Iphutha okufanele ligwenywe ukucabanga ukuthi isiqalisi sichaza umnikazi. Isiphequluli esinikezwe i-URL yisikhathi sokuxhumana somunye umsebenzisi asizange sidale amasokhethi ngaphansi kwe-UID 1500, futhi awukho umthetho ozohambisa ukuxhumana okukhiqizwayo.

Ithebula, umthetho kanye nonogada

Ngemva kokuhlola imithetho ekhona nokukhetha izinombolo zethebula nezinga ezingasetshenzisiwe, ukuhleleka kufushane: indlela ezenzakalelayo ethebuleni elizinikele ephethe ikheli lomthombo wethuneli, umthetho odlulisela ukusesha kwe-akhawunti kulelo thebula, kanye nomthetho wokugcina ovimbela indlela yokubuyela. Uma kubhaliwe, lokho ukushintshwa kwendlela okungaguquguquki, ip -4 route replace default dev tun-office src 10.80.0.11 table 51820, okulandelwa ngu-ip -4 rule add priority 12100 uidrange 1500-1500 lookup 51820.

Unogada ngu-ip -4 rule add priority 12101 uidrange 1500-1500 unreachable, futhi ubaluleke ngaphezu kwalokho obonakalisiwe ubude bawo. Ngaphandle kwawo, indlela engekho ethebuleni 51820 iwela kuxhumano oluphezulu olujwayelekile futhi i-akhawunti ikhipha ngokuthula ukuxhumana okwakufanele kubanjwe inqubomgomo. Nakho, ukwehluleka okufanayo kuba isikhathi sokuphela, okungukuthi ukuvimbela hhayi indlela yokubuyela.

Gcina umthetho ojwayelekile wekheli lendawo ngaphambi kwalezi, futhi unqume ngokuqwashile ukuthi izihluzo ze-LAN noma zokuphatha ziza ngaphambi kwethebula elikhethiwe. Indlela ezenzakalelayo etholakala lapho ayibuzi i-main kamuva ngendlela ye-LAN eqondile kakhulu, okumangaza labo abalindele ukuthi ukufanisa isiqalo eside kakhulu kuyasebenza phakathi kwamathebula. Bhala uhlu lwezihluzo okuhlosiwe kwinothi yoshintsho ngenkathi isizathu sisasha.

Lokho ukuhlelwa kwendlela nge-UID okushiyayo: i-DNS

I-daemon yesixazululi ivula amasokhethi ayo aphezulu ngaphansi kwe-UID yayo, ngakho ukukhetha u-1500 akuhambisi leyo mibuzo ethebuleni 51820. Ukuhlanganiswa kwe-DNS yisinqumo esihlukile: khombisa i-akhawunti esixazululini esifinyeleleka ngethuneli, noma wamukele ukuthi ukuxazululwa kwamagama kulandela indlela yomsingathi kuyilapho ukuxhumana kungalandeli.

Umbuzo we-loopback oya ku-stub yendawo akubona ubufakazi bokuthi umbuzo ophezulu wasebenzisa indlela yesiphequluli, futhi nokulayisha ikhasi okuphumelelayo kusuka kunqolobane akubona ubufakazi.

I-IPv6 idinga umusho wayo ekwakhiweni

Imithetho engenhla ihlanganisa i-IPv4 kuphela. Uma imfuneko kuyithuneli ye-IPv4 ngaphandle kwe-IPv6 eqondile kusuka kule akhawunti, engeza umthetho wokugcina obuyekezwe njenge-ip -6 rule add priority 12101 uidrange 1500-1500 unreachable, bese uhlola imithetho ye-IPv6 yangaphambili kanye nezihluzo ze-loopback ofuna ukuzigcina.

Ukuvimbela i-IPv6 eqondile akukona ukushaya ithuneli kwezingqimba ezimbili; kuwumngcele. Ukukubiza ngokuthi ukushaya ithuneli kuzodida umuntu olandelayo ofunda inqubomgomo, futhi ukudideka kuzovela njengethikithi losizo mayelana nesayithi ye-IPv6 ephukile.

Qinisekisa nge-akhawunti yangempela, bese uthatha umjikelezo wokuphila

Qhathanisa ukusesha: i-ip -4 route get 198.51.100.25 uid 1500 ngokumelene nendawo efanayo nge-UID evamile. Bese wenza isicelo esivunyelwe ngaphansi kwe-akhawunti ezinikezelwe futhi uhlole ikheli lomthombo elibonwa uhlangothi olukude. Ikheli lomthombo elithandwayo akulona i-source NAT, futhi ngeke lidlule uhlelo olubopha okunye. Uma kokubili ukusesha kubuyisa indlela efanayo, umthetho awukwenzi lokho ocabanga ukuthi ukwenza.

Gcina ithebula, imithetho kanye nobude bokuphila kwendlela yethuneli ngaphansi komnikazi oyedwa, hlola ukuxhuma kabusha nokulahleka kwethuneli, futhi lapho uhoxisa inqubomgomo susa kuphela okufakiwe kwayo okuqondile. I-namespace isatholakala uma izixhumanisi ezihlukile nesimo esihlukile kuyikho okudinga ngempela.