Amasango amabili, i-VPN eyodwa: kungani i-OpenVPN ikhetha umgwaqo ongaphezulu ongalungile

Imigwaqo emibili ephezulu, ithuneli elilodwa, futhi ithrafikhi iphuma ngomgwaqo ongawukhethanga. Amanethiwekhi amancane azimele ayafinyeleleka, ilogi ibika uxhumano oluyimpumelelo, futhi uthunge lwemitha lulona oluyithwelayo. Akukho lutho kokuphuma kwe-OpenVPN okukhuluma ngesango, ngoba iklayenti ayikaze ikhethe elilodwa. Yavula isokhethi iya ekhelini elikude futhi yashiya i-kernel inquma ukuthi kufinyelelwa kanjani kulelo kheli.

Ikheli lethuneli akulona iphuzu lokugcina

Kukhona izindlela ezimbili ezihlukene kusekhoni ngayinye. Indlela yangaphandle ithwala ukuthuthwa okubethelwe iye ekhelini lomphakathi leseva. Indlela yangaphakathi ithwala konke okusunduzwa iseva ethunelini, futhi imithetho yomzila yelinye ayinamthelela kwelinye.

Ingxenye ye-remote kuphrofayili isho indawo yangaphandle, ngakho yilolo kheli okufanele ligcinwe. Futhi iyona nani elishintshayo lapho igama le-host lixazululwa ngendlela ehlukile noma iphrofayili ibala ama-remote amaningi.

Thola ikheli iklayenti elishaye kulo ngempela

Funda isokhethi esisebenzayo esikhundleni sefayela lokuhlela. Ithebula lesokhethi likhombisa i-peer inqubo exhumane nayo ngempela, futhi yilona nani okufanele ukuhluka kuhambisane nalo. Iphrofayili ingahlelwa kabusha ngemva kokuqala kwesekhoni, futhi isokhethi iwubufakazi obulodwa balokho okushayiwe:

ss -tunp | grep -i openvpn
journalctl -u openvpn-client@work --no-pager | grep -i "Peer Connection Initiated"

Umugqa welogi usho ikheli le-peer kanye nechweba ngesikhathi soxhumano. Uma ungahambisani nephrofayili, kukhona into phambi kweklayenti ebhala kabusha indawo ngaphambi kokuqala koxhumano.

Hlola nomndeni wamakheli. Iphrofayili eneziteki ezimbili ingaxhumana nge-IPv6 kuyilapho ukuhluka kwakho kuhlanganisa i-IPv4 kuphela, bese ithrafikhi ilandela umthetho ohlukile kunalowo owubhalile. Kuyafana nge-proxy ephendula egameni lephuzu lokugcina. Zombili izimo zikhiqiza ithuneli elisebenzayo kuyilapho umzila wakho ungenzi lutho.

Gcina iphuzu lokugcina futhi ufunde ukulandelana kwenqubomgomo

Umzila we-host uqondile ukudlula noma yimuphi umzila ozenzakalelayo. Ngakho i-/32 yekheli le-peer iyawina ethebuleni eliyo. Indlela ejwayelekile isho ngokusobala isango nedivayisi:

ip route add 203.0.113.40/32 via 192.168.10.1 dev eth0

Lowo mzila usiza kuphela uma ukusesha kufinyelela kulelo thebula. Imithetho yenqubomgomo ihlolwa ngokulandelana futhi ukufana kokuqala kuyanquma, ngakho umthetho othumela konke kwithebula lesibili udlula umzila wakho we-host ku-main. Funda imithetho ngaphambi kokucabanga ukuthi umzila unegunya:

ip rule show
ip route get 203.0.113.40

Buza umyalo wesibili ngekheli lomthombo elifanayo noma uphawu olusetshenziswa iklayenti lapho inqubomgomo incike kukho. Ibika umzila i-kernel engawukhetha, okuwubufakazi mayelana nokusesha hhayi ubufakazi bokuthi isokhethi esisebenzayo isebenzisa lowo mgwaqo.

Lapho iphuzu lokugcina lihamba

Igama le-host elixazuluka kumakheli amaningi lenza i-/32 ehlala njalo ingavumeleki ngokushesha lapho impendulo ishintsha. Iphrofayili enemigqa eminingi ye-remote inenkinga efanayo, ngoba iklayenti ingahlala kunoma yimuphi kuyo. Vuselela umzila kusukela kumakhemu omjikelezo wempilo weklayenti ngokwalo esikhundleni sokuwengeza ngesandla. Iskripthi se-up esifunda i-peer okuxoxiswene ngayo futhi sifaka umzila we-host sigcina ukuhluka kuhambisana neqiniso, futhi iskripthi se-down esihambisanayo siyisusa.

Bhala ukuvuselela endaweni efanayo nayo yonke eminye imisindo yokuhlela yomzila we-host. Umzila okhona kuphela kuze kufike ukuqalisa kabusha okulandelayo uwukuhlola, hhayi ukulungisa.

Gcina inqubomgomo yangaphakathi ihlukile

Ukuhambisa indlela yangaphandle akunikezi ukufinyelela kunethiwekhi encane eyimfihlo entsha futhi akushintshi ukuthi yiziphi izindawo iseva ezisunduzayo ethunelini. Umzila wesendlalelo esiphansi ukhetha ucingo; imizila esunduziwe ikhetha okungena ethunelini. Ukugcina lezi zinqumo ezimbili zihlukene yikho okwenza ukwehlukana kubikezeleke.

Uma inhloso kuwukugcina ukuthuthwa okubethelwe kude nomgwaqo wemitha, shiya umzila ozenzakalelayo futhi wengeze ukuhluka kwe-host okukodwa. Ukushintsha umzila ozenzakalelayo womshini wonke ukuze kuhambiswe uxhumano olulodwa lwe-VPN kuphula yonke enye inhlelo kule host.

Qinisekisa umphumela ngokubona okubili okuzimele: ikheli lasekhaya nedivayisi yesokhethi, kanye nomzila okuxazululwa kuwo indawo eyimfihlo. Uma kokubili kuhambisana nenhloso yakho, ukwehlukana kungokoqobo. Incwadi ye-OpenVPN 2.6 ihlanganisa izinketho ze-remote nokubopha kwasekhaya ezinquma ukuthi iklayenti ishaya kuluphi ikheli.