Iseva noma iklayenti: iyiphi iyunithi ye-OpenVPN ku-Pi enendima ekabili

Amasuprocess amabili e-OpenVPN asebenza ku-Pi eyodwa ethatha ngesikhathi esisodwa abasebenzisi abazulazulayo futhi ifinyelela umhlinzeki ongaphezulu, futhi cishe awabelani nganoma yini ngaphandle kwengxenyekazi. Elinye lilalela imigudu engenayo kanti elinye lishaya ngaphandle. Ngayinye ifunda idayirekhthori yayo, futhi ngayinye inendlela yayo yokwehluleka. Ukuqalisa kabusha okungalungile iyona ndlela evame kakhulu yokuthi ukulungiswa kweklayenti kugcine kugxavuna isilaleli esikhundleni salokho.

Hlanganisa igama leyunithi nedayirekhthori eliyilayishayo

I-Upstream 2.6 ihlinzeka ngamayunithi amabili ethempulethi, [email protected] [email protected]. Ithempulethi yeseva iqala ku-/etc/openvpn/server futhi ilayishe i-%i.conf ukusuka lapho. Ithempulethi yeklayenti iqala ku-/etc/openvpn/client. Isenzakalo esibizwa nge-roaming singaba khona kuzo zombili izindawo ngesikhathi esisodwa, njengeseva nanjengeklayenti, ngamakonfigurashini amabili angenawo ukuxhumana nokuxhumana okungekho phakathi kwawo ngaphandle komucu.

Buza i-systemd esikhundleni sohlelo lwamafayela, ngoba abahlanganisi bamaphakheji banezela amafayela angeziwe angashintsha idayirekhthori yokusebenza noma ama-argumenti atholwa yi-binary.

systemctl list-units --type=service 'openvpn-*@*'
systemctl cat [email protected]
systemctl show -p WorkingDirectory -p ExecStart [email protected]

Umyalo wokuqala ubala iyunithi ngayinye eyakhiwe, kufaka phakathi lezo ehlulekile futhi zahlala zilayishiwe. Owesibili uprinta ifayela leyunithi kanye nanoma yikuphi ukubhalwa phezulu. Owesithathu iyona ndlela esheshayo yokubona amaqiniso amabili anquma umbuzo: idayirekhthori lapho inqubo iqala khona, kanye nendlela yokumisa eyanikezwa yona.

Nquma ngendlela yephakethe, hhayi ngegama le-interface

Isenzakalo seseva sinaso isokhethi elalelayo futhi samukela ukuxhumana. Ukuthuthwa kwaso okubethelwe kungukufaka kwasekhaya nokukhipha kwasekhaya ku-Pi, kanti ithrafikhi esiyidlulisela kubasebenzisi ilandela indlela yokudlulisa futhi ihlonipha elinye iqoqo lemithertho. Isenzakalo seklayenti asinaso isilaleli ngalowo mqondo: sixhumana nozakwabo, ngakho ukuthuthwa kwaso okubethelwe ukukhipha kwasekhaya okuya kwisendlalelo esingezansi.

Lowo mehluko ukutshela ukuthi umthertho uhambisana nani. Umthertho ohambisana ne-interface ngaphakathi kochungechunge lokudlulisa uvumela kuphela ithrafikhi osekuvele iyikhethile indlela; awukhethi indlela nhlobo. Lapho amaphakethe omsebenzisi ozulazulayo ephuma ngendlela engalungile, uchungechunge okufanele lucutshungulwe yi-forward, hhayi i-output.

Bheka amasokhethi ngaphambi kokuthi wenze ithiyori. Iseva eboshelwe ku-udp/1194 ibonisa isokhethi elalelayo. Iklayenti libonisa ukuxhumana nekheli lomhlinzeki futhi akukho lutho olulalelayo.

ss -lunp | grep openvpn
ss -unp state established '( dport = :1194 or sport = :1194 )'

Indlela ezenzakalelayo yesenzakalo esisodwa ingabamba izimpendulo zomunye

I-redirect-gateway eshukunyiswa yiklayenti elingaphezulu ifaka indlela ezenzakalelayo eqhudelana nayo yonke enye into emshinini, kufaka phakathi izimpendulo iseva ezithumela kubasebenzisi abazulazulayo. I-OpenVPN yenza okuhlukile kwekheli lozakwabo ukuze umgudu uhlale ufinyeleleka, kodwa lokho kuhlukile akusho lutho mayelana nefoni esenethiwekhi yehhotela.

Uphawu ngokuvamile alulingani. Ukuxhawula kuqedwa, iklayenti libika ukuthi lixhunyiwe, futhi ithrafikhi iyafa ngemva kwephakethe lokuqala lempendulo. Ukuhlelwa kwemithertho okususelwe emthonjeni, noma uphawu lwephakethe olubekwe esenzakalweni seseva nge---mark, kugcina imifudlana emibili ihlukene; akukho kukodwa okuyisiqoqo esiphelele semithertho ngokwakho, futhi kokubili kudinga izindlela ezivumelekile kuthebula ezikhethayo.

Hlola isinqumo sasekhaya esikhundleni sesimo somgudu, ngoba i-kernel ikhetha umthombo ne-interface ngaphambi kokuthi i-OpenVPN ibone iphakethe.

ip route get 203.0.113.44
ip rule show

Qalisa indima eyodwa kabusha futhi ubonise ukuthi enye yasinda

Ukulandelana kubalulekile lapho zombili izindima zincike esendlalelweni esifanayo esingezansi. Qalisa iklayenti kuqala kabusha uma indlela yaphezulu kufanele ibe khona ngaphambi kokuthi ithrafikhi yabasebenzisi idluliselwe, futhi uqalise iseva kuqala kabusha uma ushintsha kuphela isilaleli sayo noma ichibi layo. Noma kungaba yini, qinisekisa zombili iziyunithi ngemva kwalokho, ngoba ukuqalisa kabusha okwehlulekile kungashiya enye indima isebenza ngesimo esidala.

Bhala isimo sokuma ngaphambi koshintsho: ingabe ukulahlekelwa umgudu waphezulu kuvimbela abasebenzisi abazulazulayo, noma kubuyela emuva kuxhumano lwaphezulu lwe-Pi uqobo? I-DNS ne-IPv6 nakho kudinga impendulo ecacile, ngoba isixazululi esishukunyisiwe ngokuvamile siphila isikhathi eside kunendlela eyasenza saba usizo.

systemctl restart [email protected]
systemctl is-active [email protected]
journalctl -u [email protected] -n 20 --no-pager

Yamukela ushintsho kuphela lapho izinto ezintathu ziyiqiniso ngesikhathi esisodwa: ukuxhumana okusha okungenayo kuqedwa, uhlelo lokusebenza oludlulisiwe lufinyelela lapho ibheke khona ngomfula okuhloswe ngokuhleliwe, futhi zombili izinqubo zisabika umlingani wazo olindelekile. Uma okukodwa kokuthathu kwehluleka, ushintshe isenzakalo esingalungile noma indlela engalungile, futhi isinyathelo esilandelayo ukufunda iyunithi futhi hhayi ukuqalisa enye into kabusha.