Hlola ukubuyiswa kweseva ye-VPN ngemuva kokuqalisa kabusha: yini okufanele uyihlole kuqala

Qalisa kabusha iseva kungekho muntu ongenile, bese uxhuma kusuka kunethiwekhi ongayilawuliyo. Lolu vivinyo olulodwa luphendula ukuthi ukubuyiswa kungokoqobo yini, ngoba umhubhe osebenza kuphela ngemuva kokuba othile eqalise umyalo ngesandla awukona ukubuyiswa, kuwukulungiswa. Iningi lezihlolo liyeka kusenesikhathi: i-daemon ibonakala isebenza, i-interface iyakhuphuka, nekhasi alilayishi. Igebe cishe njalo lisenkwazini yokuqhubeka kwezingxenye ezizungeze umhubhe, hhayi kumyalo womhubhe uqobo.

Abanikazi abane, izivivinyo ezine ezihlukene

Ngaphambi kokuqalisa kabusha, shono ukuthi yini okufanele ibuyise umhubhe. Uvivinyo olwenzayo kanye nokulungisa okusebenzisayo kuncike kuleyo mpendulo, futhi kunezinto ezingabanikazi ezine ezijwayelekile: i-unit ye-systemd yesevisi ye-VPN, i-unit yesibonelo se-wg-quick ye-interface ye-WireGuard, i-runtime yekhontheyna, noma iphrofayela yomphathi wenethiwekhi. Uma ungakwazi ukusho umnikazi, ma uqede futhi uwuthole, ngoba uvivinyo lokuqalisa kabusha ngaphandle kwendlela yokuqalisa elindelekile lukutshela kuphela ukuthi kukhona okwenzekile.

Umninikazi ngamunye ugcina ukucushwa kwakhe kwenye indawo. Iseva ye-OpenVPN elawulwa yi-systemd ifunda ukucushwa kwayo ekubuyeni, ngakho-ke okusefayelini ngesikhathi se-boot yikho okusebenzayo. I-interface ye-wg-quick ithola amakheli, imizila kanye ne-DNS kulelo fayela, okusho ukuthi i-interface eyakhiwe ngesandla kusuka ku-shell futhi engakaze inikwe amandla njenge-unit ngeke ibuye. Ikhontheyna ibuyisa indawo yayo yokungena kodwa hhayi izinguquko ze-firewall zomphetheli, ngaphandle uma lezo zihlala ngaphandle kwekhontheyna.

Kuqala isisekelo, ngaphandle kwalokho umphumela awunamqondo

Qopha isimo esisebenzayo ngesikhathi sisebenza: amakheli emhubheni, imizila yesubnethi yeklayenti, imithetho ye-NAT noma yokudlulisela, isokhethi elalelayo, kanye ne-sysctl yokudlulisela. ip addr show wg0, ip route, nft list ruleset noma iptables-save, ss -lunp kanye no-sysctl net.ipv4.ip_forward kwanele kumaphetheli amaningi.

Qopha ukuthi isevisi icushwe kanjani ukuze iqale, hhayi nje ukuthi iyasebenza. systemctl is-enabled wg-quick@wg0 no-systemctl is-active wg-quick@wg0 baphendula imibuzo ehlukene, futhi isimo esinikwe amandla yiso esibalulekile ngesikhathi se-boot, njengoba kuchazwe ku-systemctl(1). Mayelana ne-OpenVPN, hlola ukuthi umphetheli usebenzisa yiphi ithempulethi, ngoba openvpn@server no-openvpn-server@server bangamayunithi ahlukene anezimiso ezingezona ezifanayo.

Yenza ukuqalisa kabusha bese ufunda ukwehluleka kokuqala

Qalisa kabusha ngamabomu, esikhathini osikhethile, i-console noma indlela yangaphandle ivuliwe. Buka ukulandelana kwezehlakalo hhayi isimo sokugcina: umphetheli uyafinyeleleka, i-unit inikwe amandla, i-interface ikhona, imizila ifakiwe, imithetho ye-firewall ikhona, isilaleli siboshiwe, iklayenti lamukelwe. Isinyathelo sokuqala esingenzeki yisitholakele; konke okulandela leso kungumsindo.

Isevisi ingase isebenze kuyilapho umhubhe ungasebenziseki, futhi lokhu kuwukuphumelela okungamanga okuvamile. Ukuqalisa kungase kuqede ngaphambi kokuba inethiwekhi ibe ku-inthanethi uma i-unit ilindele kuphela i-network.target esikhundleni se-network-online.target. Amafayela okubhekiselwa kuwo njengezitifiketi, okhiye noma i-CRL angase angafundeki ngaleso sikhathi ngoba ukufakwa noma indlela yezimfihlo ayikakalungi. Azikho zombili lezi zinkinga ezivela ku-systemctl status kuze kube yilapho ufunda ijenele le-unit.

Vivinya ngaphandle komphetheli. Iklayenti elikwi-LAN efanayo lingase liphumelele emzileni okungekho klayenti elikude elingase liwusebenzise, futhi isikhathi se-SSH kumshini asifakazeli lutho ngomhubhe. Xhuma, xazulula igama langaphakathi, finyelela insiza yangasese, bese uphinda uxhume kanye ukuze uqinisekise ukuthi isimo sokuhoxiswa nokhiye kusasebenza.

Imibandela emithathu enquma ukulungisa kwakho

Uma umhubhe ubuya kodwa amaklayenti engafinyeleli lutho, ukwehluleka kukumzila noma ekuqhubekeni kwe-NAT. Uma amaklayenti engakwazi ngisho ukuqeda ukuxhawulisana, ukwehluleka kuse-interface noma ezintweni zokuqinisekisa. Uma isevisi ingaqali neze, ukwehluleka kusefayelini ye-unit noma ekuthembekeni kwayo. Lawa magatsha amathathu aholela ekulungiseni okuhlukene, yingakho ukuqalisa kabusha ngamehlo ahluthiwe ngaphandle kwesisekelo kuthatha isikhathi esingaphezu kwalokho okusindisayo.

Yenza ukulungisa lapho isethingi ingumnikazi khona. Faka ukudlulisela ku-sysctl drop-in, faka imithetho ye-NAT kwisethi yemithetho elayishwa ngesikhathi se-boot, nika i-unit amandla esikhundleni sokuyiqalisa, futhi gcina izimfihlo endleleni ekhona ngaphambi kokuba i-unit iqale. Ukwengeza ubuthongo ku-unit kufihla ukuthembela esikhundleni sokukusho.

Qopha umphumela ku-runbook

Bhala ukuthi yini ebuyile yodwa, yini obekufanele uyiqalise, nokuthi igebe lahlala isikhathi esingakanani. Faka imiyalo eqondile oyisebenzisile ukuqinisekisa, ukuze umuntu olandelayo aphinde uvivinyo esikhundleni sokuzakhela olunye olusha. Uma isinyathelo sithile besidinga umyalo wesandla, lowo myalo ungowokucushwa, hhayi we-runbook njengesinyathelo esihlala njalo.

Bese uhlela uvivinyo olulandelayo ngemuva koshintsho olulandelayo kusitaki senethiwekhi somphetheli, hhayi ngosuku lwekhalenda ezinyangeni eziyisithupha. Isimo sokwehluleka osivikelayo umyalo wesikhashana owawubonakala unjengowaphakade, futhi leyo ivela ngesikhathi lapho othile ehlela imithetho ye-firewall noma ehambisa isevisi ku-unit entsha.