Amakhasimende amabili e-OpenVPN kugateway eyodwa ye-Linux: hlukanisa inqubomgomo

Amademoni amabili e-OpenVPN angabika ithaneli eliphumelelayo womabili kuyilapho igateway ithumela ikhasimende ngalinye ngesisodwa. Akukho lutho ekuxhumaniseni izandla okunquma ukuthi ikhasimende lisebenzisa liphi ithaneli; i-kernel inquma, iphakethe ngephakethe, ngokudlula emithethweni yenqubomgomo bese kuba ithebula elishiwo umthetho ngamunye. Uma kubhekwa kanjalo, ukucushwa akuyekile ukuba mayelana nezinketho ze-OpenVPN futhi sekuba yimatriki yokuhambisa enabanikazi ababili.

I-kernel iyanquma, hhayi idemoni

Iphakethe elidluliswayo lifika kusixhumi esibonakalayo se-LAN futhi ikhodi yokuhambisa ihlola uhlu lwemithetho ngokulandelana kwesilinganiso. Umthetho wokuqala okufanayo kwawo isikhethi usho ithebula, futhi imizila yalelo thebula ikhetha idivayisi yokuphuma. Uma ithebula lingenawo umzila ofanayo, ukusesha kuqhubeka kumthetho olandelayo, futhi yile mininingwane eyenza ukucushwa okungaphelele kwehluleke buthule hhayi ngomsindo.

Inqubo yethaneli ayinalutho elingakusho kulolo hambo. Yakha isixhumi esibonakalayo futhi ingafaka imizila, kodwa ukuthi iphakethe lekhasimende elithile liyangena yini kuleso sixhumi kuncike ngokuphelele kuthebula elithunyelwe kulo. Ngakho amathaneli amabili anemizila efakiwe efanayo ayancintisana, futhi umbhali wokugcina uyawina kubo bonke. Yingakho ukucushwa kungabonakala kulingana kumafayela okucushwa kodwa kusathumele wonke amakhasimende ngademoni eyodwa.

Nikeza isimo ngasinye isethi yaso yezinsiza

Qala ngamagama, ngoba amagama asetshenziswa kabusha yiwo indlela izimo ezimbili ezigcina ngayo ukwabelana ngesimo ngengozi. Nikeza amadivayisi ethaneli ahlukile, amafayela okucushwa ahlukile, ubufakazi bokungena obuhlukile namayunithi okusebenza ahlukile. Bhala iphoyinti lokugcina langaphandle nekheli lethanele lesimo ngasinye kuthebula elifanayo nelamatriki enqubomgomo, ukuze ushintsho lwakamuva lube nendawo eyodwa yokubuka.

dev tun-office
route-nopull
pull-filter ignore "redirect-gateway"

dev tun-lab
route-nopull

route-nopull igcina imizila ephushwa iseva ingaphandle kwethebula lendawo, futhi yilokho kanye okufunayo uma amathebula enqubomgomo kufanele acace. Ukuthi iseva ethile iphusha kanjalo inketho ye-redirect-gateway, nokuthi inguqulo yekhasimende lakho isekela isimo sokuhlunga, kufanele kubhekwe encwadini yesandla esikhundleni sokuqagela.

Bhala imatriki: umthombo, ithebula, idivayisi

Eqenjini ngalinye lamakhasimende, engeza umthetho okhetha ithebula ngekheli lomthombo, bese ufaka umzila ohlosiwe kulelo thebula:

ip rule add from 10.8.1.0/24 lookup 100 priority 1000
ip rule add from 10.9.1.0/24 lookup 200 priority 1000
ip route add default dev tun-office table 100
ip route add default dev tun-lab table 200

Ithebula lidinga imizila yendawo ekuyiwa kuyo okufanele iqembu libe nayo, kanye nanoma yiziphi izihlengelo zendawo noma zokuphatha ezigcina igateway isebenziseka. Ithebula eliqukethe kuphela umzila ozenzakalelayo liyinqubomgomo yethaneli eliphelele yalelo qembu, okungenzeka ilungile ngqo, kodwa kufanele kube yisinqumo hhayi ukweqiwa.

Ukuthuthwa kwethaneli uqobo akukho eqenjini lamakhasimende

Amaphakethe abethelwe emademoni ngamunye avela ku-gateway uqobo, eqondiswe kumlingani wangaphandle. Umthetho ofana kuphela nesiqalo somthombo wekhasimende ushiya lawo maphakethe, yingakho imithetho eboshwe emthonjeni iphephile kunemithetho efana nakho konke. Umthetho ongenasikhethi ungabamba ukuthuthwa kwethaneli uqobo futhi ukubuyisele ngethaneli, bese ukuxhumana kwehluleka ngendlela ebukeka njengenkinga yomhlinzeki.

Gcina iseshini yokuphatha yendawo kanye nomzila wesendlalelo esingezansi ngokucacile ngaphandle kwamathebula enqubomgomo. Bhala lezo zihlengelo eceleni kwematriki; ziyingxenye yomklamo, hhayi ikhambi lesikhashana okufanele litholakale kabusha ngesikhathi sehlakalo.

Ukukhetha umzila akukuvumeli

Imvume yokudlulisela iyisinqumo sesibili esithathwa kamuva emzileni. Umthetho we-firewall owamukela amaphakethe aphuma ngethaneli lesibili awenzi ikhodi yokuhambisa ukuthi iyikhethe, futhi ithebula elilungile alinikezi imvume yokudlulisela. Kokubili kufanele kube khona, futhi ukuhlolwa okufakazela okukodwa kuphela kuzokuduhisa mayelana nokunye. Uma iqembu elilodwa lisebenza kanti elinye lingasebenzi, hlola lezo zinyathelo ezimbili ngokwehlukana esikhundleni sokubhala kabusha amathebula.

Ukuhunyushwa komthombo yisinqumo sesithathu, futhi kufanele kuboshwe eqenjini lomthombo kanye nedivayisi yethaneli eliwuthwalayo ngempela. Engeza iketanga elikhethekile lezimo ezimbili esikhundleni sokukhipha konke kuketanga le-postrouting, ngoba izinsizakalo ezingahlobene zingaba namafayela khona futhi ukukhipha konke kuzisusa buthule.

Kwenzekani uma ithaneli elilodwa liwa

Nquma ukuziphatha lapho kwehluleka kusengaphambili. Uma ithebula lethanele liphelelwa umzila walo, ukusesha kuwela kumthetho olandelayo, futhi ithrafikhi yeqembu iqhubeka ngethaneli elinye noma ngoxhumo olujwayelekile lwangenhla ngaphandle kwanoma yiluphi iphutha. Uma lokho kungamukeleki, engeza umthetho wokugcina onenombolo yokubaluleka ephansi obuyisela umphumela ongafinyeleleki kulo mthombo, ukuze ukulahleka kubonakale esikhundleni sokumunywa.

Thumela isicelo esisha eqenjini ngalinye lomthombo futhi bhala amaqiniso amane: ithebula elikhethiwe, idivayisi yokuphuma, umthombo ohunyushiwe, nokuthi ingabe impendulo ibuya ngayo kanye umzila ofanayo. Bese wehlisa ithaneli elilodwa futhi uphindele. Amadivayisi amabili e-TUN ohlwini lwezixhumi abonisa ukuthi womabili amademoni aqalile; awasho lutho ngokuthi imuphi owasetshenziswa yikhasimende elithile. Ukugijima kwesibili, lapho ithaneli elilodwa lingekho, yikho okubonisa ukuthi umthetho wakho wokubuyisela wenza lokho obukuhlosile.