Izinhlobo ezintathu zokushintshwa kwe-OpenVPN ku-pfSense, izindlela ezintathu

„OpenVPN failover“ ku-pfSense ihlanganisa okungenani izindlela ezintathu ezingahlobene, futhi ngayinye idinga indlela ehlukile. Ukugcina ithumbu liphila ngaphesheya kwesixhumanisi se-inthanethi esiyisipele, ukuxhuma kabusha kuseva enye nokuqondisa ithrafikhi ye-LAN kwelinye ithumbu esevele limisiwe akuwona amavariyenti wesici esisodwa. Khetha ukwehluleka ozivikela kukho ngaphambi kokwakha iqembu lesango. Iqembu elilungisa okukodwa kuzo akwenzi lutho kwezinye ezimbili.

Qamba ukwehluleka ngaphambi kokwakha iqembu

Bhala umusho ofuna ukuthi ube yiqiniso ngesikhathi sokuphazamiseka. „Ithumbu lixhuma kabusha nge-WAN yokulondoloza“ kanye no-„igatsha lisafinyelela kuhlelo lokusebenza ngelinye ithumbu“ imisho ehlukile. Owokuqala kuphela okumayelana nokuthuthwa.

Bese uyihlanganisa nendlela eyodwa. Ukulahleka kwe-WAN yasendaweni kuyinkinga yokukhethwa kwesixhumi, iphoyinti lokugcina elikude elifile kuyinkinga yohlu lokuxhumana, futhi indlela engasetshenziswa ngaphakathi kwethumbu elimisiwe kuyinkinga yokuhlelwa kwendlela nenqubomgomo.

I-WAN yasendaweni: hambisa ukuthuthwa

Kumklami we-OpenVPN we-pfSense, uhlelo lwama-WAN amaningi olusekelwayo lukhetha iqembu lesango elifanele njengesixhumi umklami abopha kuso. Yikho okwenza uxhumano lwangaphandle luphume ngosixhumanisi sokulondoloza lapho eyinhloko yehluleka. Kukodwa akushintshi ukuthi ithrafikhi yangaphakathi ihlelwa kanjani.

Uhlangothi lweseva lwalo mklamo luhlukile. Iseva ye-OpenVPN okumele ifinyeleleke ngekheli eziningi zomphakathi idinga isilaleli kanye nenqubomgomo yokungena yokufakwa ngakunye kwalokho, hhayi nje umklami okwazi ukushaya ngamaxhumanisi amabili. Ukufakwa okukodwa komphakathi okusebenzayo akubona ubufakazi bokuthi okwesibili kuhleliwe.

Umthetho wokuhlela ngokwenqubomgomo wamaphakethe e-LAN adluliswayo awuwona isethingi ehambisa uxhumano lokuthutha lwe-VPN olwakhiwe endaweni. Lezi zinto ezimbili zokusesha ezihlukile, futhi ukushintsha okukodwa akushintshi okunye.

Iphoyinti lokugcina elikude: enye iseva

I-remote ehlukile isici sohlu lokuxhumana. Umklami uzama ukufakwa okulandelayo lapho okwamanje kungaphenduli, okusiza lapho ikhasi elithile liwile hhayi lapho i-uplink yakho iwile. Ukwehluleka kokubili kubonakala kufana edeskini lomsebenzisi futhi kudinga izilungiso ezihlukile.

Umuntu ngamunye ofakayo kumele abe umshintshi wangempela: ukuqinisekiswa okuhambisanayo, inqubomgomo yomklami ehambisanayo kanye nokufinyelela emithonjeni efanayo yangasese. Igama lesibili lesikhathi eliphenduka libe yingqalasizinda efanayo ephukile akusona isipele. Iseva engenawo umzila odingakalayo nayo ayisiyo, kungakhathaliseki ukuthi ukuxhawulana kwayo kubukeka kuphilile kangakanani.

Le ndlela futhi ayenzi amathumbu amabili adlulisele ngasikhathi sinye. Ishintsha uxhumano olulodwa ngolunye, ngokulandelana, futhi igebe phakathi kwabo libonakala kukho konke obekusebenza.

Indlela yethumbu: khetha enye indlela yokuphuma

Lapho amathumbu amabili esemi kakade futhi ithrafikhi kufanele isebenzise elinempilo eyengeziwe, indlela iwukuxhumiwe kwe-VPN elabiwe elinegalari yalo, kanye nomthetho ocacile wenqubomgomo othumela ithrafikhi efanele lapho. Iqembu lamagalari phezu kwalezo zixhumi ezabiwe lingaveza ukubaluleka nokuqashwa.

Lowo mklamo umayelana nokukhetha, hhayi ukubuyisela. Ukuhambisa ukuxhumana okusha ukuya ethumbu lesibili akusho lutho ngezikhathi ezisemisiwe kakade kwelokuqala, futhi akusho lutho mayelana nokuthi uhlangothi olukude luzokwamukela ikheli elisha lomthombo. Ukukubheka njengendlela yokubuyisela iyindlela yokubeka okulindelwe phezulu kakhulu.

Uma imfuneko iwukuthi izikhathi ezikhona zisinde, shono lokho ngokusobala. Iningi lemisebenzi alihambisi ukugeleza okuphilayo phakathi kwamathumbu, futhi ukuklama sengathi liyakwenza kuveza ukushintsha okubonakala kulungile kumdwebo futhi empeleni kudonsa yonke imixhanyango evulekile.

Abahloli, i-NAT kanye nomthetho we-fail-closed

Umhloli kufanele ahlole into okumele ithumbu liyilethe. Ithagethi ephendula isuka kumlingani wethumbu kodwa hhayi isuka kunethiwekhi yohlelo lokusebenza ngale kwayo izobika inempilo kuyilapho abasebenzisi bengaboni lutho. Ithagethi yokuxilonga engafinyeleleki izobika ifile kuyilapho indlela ilungile. Khetha ikheli ngamabomu futhi uqinisekise ukuthi lifinyeleleka kuphela ngethumbu elihlosiwe.

Hlola i-NAT ephumayo kuzo zombili izindlela zokuphuma. Ukuhumusha okusebenza kokokuqala akuchazi ikheli lomthombo lesipele, futhi inethiwekhi yangasese ekude idinga umzila wokubuyela ohambisana nomthombo oyiwethulayo. Ukuhumusha okulungile emzileni owodwa kungaba kungalungile ngokuthula kwomunye.

Bese unquma ukuthi kwenzekani kuthrafikhi engamelanga isebenzise i-WAN. I-pfSense inokuziphatha okuchaziwe kwemithetho egalari elikhethiwe layo liwile, futhi umthetho obanzi wokuvumela ozayo kamuva noma umzila ozenzakalelayo kungase kubhubhise inhloso yakho. Bhala umphumela ovimbelile njengemfuneko, bese uwuqinisekisa ngokwehlisa umzila.

Hlola ukulahleka nokubuyiselwa ngokwehlukana, ngethrafikhi ogunyaziwe ukuyikhiqiza, futhi ubuke izinto ezintathu ngasikhathi sinye: i-WAN ethwala uxhumano lwangaphandle, ithumbu elithwala isicelo sohlelo lokusebenza kanye nomzila othathwa yimpendulo. Ipheya lezikhombisi zegalari eziluhlaza akusona esisodwa salezo zintathu. Umhlahlandlela we-Netgate wama-WAN amaningi uchaza ukubophela kokuthuthwa kanye nezinye izindlela zomklami ezithunyelwe ngaphandle okuncika kuzo lokhu.