Kungani isethi engaphansi engemuva kwekhlayenti le-OpenVPN ingafinyeleleki?
I-OpenVPN ayikwazi ukuqagela ukuthi iyiphi ikhlayenti ephethe i-LAN ekude. Umugqa we-iroute efayeleni lekhlayenti, umzila wokubuya kanye nokudlulisela kwenza leyo sethi engaphansi ifinyeleleke.
Ama-ping aya ekhelini lethubhu leseva ayaphumelela, ithebula lemizila yekhlayenti ngokwayo ibonakala ilungile, futhi i-LAN engemuva kwaleyo khlayenti ayikafinyeleleki. Ithebula lokuhlela imizila lekhlayenti libonakala lilungile, iseva inomzila obheke ethubhini, futhi amaphakethe asanyamalala. Lesi yisibonakaliso esivamile sethubhu le-layer-3 elingazi ukuthi elinye lamakhlayenti alo liyisango futhi.
I-interface ye-tun ayinayo indawo elandelayo yekhlayenti ngayinye. I-kernel ibona i-interface eyodwa enabalingani abaningi, ngakho isinqumo sokuthi iyiphi ikhlayenti okufanele yamukele iphakethe le-LAN ekude kufanele sithathwe ngaphakathi kwenqubo ye-OpenVPN. Leso sinqumo silungiselelwa nge-iroute, futhi ngaphandle kwayo iphakethe alinandawo yokuya.
Iseva ihlela imizila ngokwekhlayenti, hhayi nge-interface
Lapho iseva idinga ukuthumela iphakethe ekhelini lethubhu lekhlayenti, impendulo icacile: ikheli lingelesikhathi saleyo khlayenti. Kepha lapho indawo ekuyiwa kuyo iyisethi yonke engaphansi engemuva kwaleyo khlayenti, ikheli alilona elomuntu owaziwa yiseva, futhi umzila we-kernel oya ethubhini uthi kuphela "ngale interface", awusho ukuthi imuphi umlingani.
OpenVPN ixazulula lokhu ngethebula lemizila yangaphakathi ehlanganisa isiqalo sendawo ekuyiwa kuyo nekhlayenti ethile. Lelo thebula lakhiwa ngemigqa ye-iroute, yingakho umzila ojwayelekile kusiseva awanele. Umzila we-kernel uletha iphakethe ku-interface yethubhu; ukuhlanganisa kwangaphakathi kunquma ukuthi iyiphi isikhathi esizolamukela. Yingakho futhi ukulungiswa kungaveli kokuphuma kwemizila ye-kernel.
Uma ukuhlanganisa kungekho, iphakethe lifika kuseva, lihambisana nomzila wethubhu futhi liyalahlwa ngoba akekho ikhlayenti elifuna leyo ndawo. Akukho okubhala iphutha elicacile, yingakho ukwehluleka kubonakala njengomgodi omnyama ongakhulumi kunokuba kube umjikelezo wokuhlela imizila.
Ukubhala umugqa we-iroute osho ikhlayenti
I-iroute ihlala efayeleni lokumisa elikhethekile lekhlayenti, hhayi ekumiseni okuyisisekelo kweseva. Khomba iseva kubhokisi ngokukhethwa kwe-client-config-dir, bese wenza ifayela elinegama eliyigama elijwayelekile lesitifiketi sekhlayenti bese ufaka isiqalo ngaphakathi.
Egatsheni eline-LAN engu-10.20.0.0/24 negama elijwayelekile lesitifiketi esingu-branch-router, ifayela ekuleyo ndlela linomugqa ofana ne-iroute 10.20.0.0 255.255.255.0. Ukumisa okuyisisekelo kudinga kuphela ukukhethwa kwebhokisi; isiqalo sihlala nekhlayenti.
Igama elijwayelekile liyingxenye ebuthakathaka. Isitifiketi esikhishwe nge-subject ehlukile, noma ukusetshenziswa okuqinisekisa abasebenzisi ngegama lomsebenzisi kuyilapho ifayela liqanjwe ngesitifiketi, kukhiqiza ifayela elingasoze lifundwe. Hlola igama iseva elilibika ngempela lesikhathi, futhi cabanga ngokukhethwa okwenza ikhlayenti elingafani nehluleke esikhundleni sokuxhuma buthule ngaphandle kwemizila yalo. Ukuqamba kabusha ifayela ukuze lihambisane nesitifiketi ukulungisa kwemizuzu emihlanu okuvimbela ubusuku obude kakhulu.
Ikhlayenti elilodwa lingaba neziqalo eziningi. Engeza umugqa we-iroute owodwa kunethiwekhi ngayinye, futhi gcina uhlu eduze kwezinye izilungiselelo zaleyo khlayenti ukuze ukuhlanganisa kuhlale kungabhekwa.
Ukwakha umzila wokubuya kuzinhlangothi zombili
Ukuletha amaphakethe e-LAN ekude uyingxenye yomsebenzi. Ikhlayenti kumele futhi ithumele ukuhamba kwezimoto kwaleyo LAN ethubhini, okuvame ukwenziwa ngokusunduza umzila kukhlayenti: umugqa ofana ne-push "route 10.8.0.0 255.255.255.0" utshela ikhlayenti ngayinye indlela yokufinyelela inethiwekhi ohlangothini lweseva. Egatsheni, umzila olinganayo ukhomba ethubhini kukho konke okufanele kufinyelele ohlangothini lweseva.
Inhlangothi yokubuya idinga umnikazi ohlangothini olukude. Lapho, othile kumele azi indlela yokubuya: umzila omile kurutha we-LAN okhomba iqoqo le-VPN kuseva, noma ukuhumusha amakheli kuseva ngaphambi kokuba ukuhamba kwezimoto kungene e-LAN. Umzila omile ugcina amakheli oqobo ebonakala kumalogo nasemikhubeni yokufinyelela kodwa udinga ukubambisana komnikazi we-LAN; ukuhumusha kuzimela kodwa kufihla ukuthi ngubani ngempela oxhumile.
Ukudlulisela kumele kuvunyelwe kusiseva. Ngaphandle kwakho i-kernel yamukela iphakethe elisuka ethubhini futhi yenqaba ukulidlulisela ku-interface ye-LAN, lokho okubonakala kukhlayenti kufana ncamashi ne-iroute engekho.
Ukuhlola ukufinyeleleka ngama-probe afanele
Hlola ngezingqimba esikhundleni soku-ping ekugcineni okukude nokuqagela. Kusuka kuseva, hlola ukuthi ukuhlanganisa kwangaphakathi kwesiqalo kukhona nokuthi umzila we-kernel ukhomba ethubhini. Kusuka kukhlayenti, qinisekisa ukuthi umzila osunduziwe ufakiwe nokuthi indlela yalo ezenzakalelayo eya ekhelini le-LAN iwumgodi wethubhu.
Bese ubheka amaphakethe. Ukubamba ku-interface yethubhu kukhombisa ukuthi iseva iyathumela ngasokukhlayenti yini, futhi ukubamba ku-interface ye-LAN kukhombisa ukuthi iyadlulisa yini. Uma okokuqala kukhombisa amaphakethe kanti okwesibili akukhombisi lutho, inkinga ukudlulisela noma isihlungi; uma kokubili kungakhombisi lutho, ukusesha kwehlulekile kusenesikhathi.
Amaseva amabili axhunywe ngethubhu aphinda umthetho ofanayo ezinhlangothini zombili: ngalinye lidinga i-iroute yeqoqo lelinye, futhi ngalinye lidinga umzila nokudlulisela okwenza indlela ilingane. Ukuhlela imizila nenqubomgomo kuyizinto ezihlukene lapha. Ukuhlela imizila kunquma ukuthi iphakethe lingaya kuphi, kuyilapho umthetho we-FORWARD unquma ukuthi kuvunyelwe yini, ngakho ikhlayenti elinemigqa emibili ye-iroute lingafinyelela iziqalo zombili ngaphandle uma isihlungi sisho okunye.