Amashubhu amabili e-OpenVPN kusibungu esisodwa se-Linux: ubani ongumnikazi womzila?

Amaphrofayili amabili axhunyiwe, futhi elinye lawo lithwala buthule ithrafikhi ehloselwe elinye. Isibungu se-Linux singasebenzisa womabili OpenVPN amaklayenti ngesikhathi esisodwa ngaphandle kobunzima. Engakwazi ukukwenza ukunquma esikhundleni sakho ukuthi iyiphi inqubo ingafuna isiqalo sini. Leso sinqumo kufanele sithathwe ngaphambi kokuba ishubhu lesibili likhuphuke, hhayi ngemva kokuba insiza iyeke ukuphendula.

Qala emsebenzini okufanele uwenzwe isixhumanisi sesibili

Ihhovisi elifinyeleleka ngephrofayili elilodwa kanye nelabhu elifinyeleleka ngelinye zidinga amashubhu womabili akhuphukile futhi akekho noyedwa ofuna konke. Uhlelo olulodwa oluqinile okufanele luphume ngephrofayili yesibili ludinga umthetho wenqubomgomo, hhayi umzila wesibili ozenzakalelayo. Isixhumanisi esilindile sidinga ishubhu elilodwa kuphela elisebenza ngesikhathi esisodwa, ngakho isipele akufanele siqale nomshini.

Lezi zimo ezintathu ezihlukene, futhi ziyadideka ngoba zontathu ziqala ngendlela efanayo: iphrofayili yesibili noxhumano oluyimpumelelo. Bhala phansi ukuhleleka okuhlosiwe kuqala, bese ulungiselela kukho. Umshwana owodwa mayelana nenhloso wonga ihora lokuthwebula amaphakethe.

systemctl list-units --type=service 'openvpn-client@*'
ip -4 route show default

Umyalo wokuqala ubala izimo ezisebenzayo, kuhlanganise nalezo eziqalwe ngesandla ngaphandle komphathi. Owesibili uprinta isicelo samanje somzila ozenzakalelayo, futhi leso yisimo okuzodingeka usichaze kamuva.

Amachibi ahlanganayo aphuka ngaphambi komzila

Amaseva amabili azokwabela ngokujabula amakheli avela ku-10.8.0.0/24 efanayo. Iklayenti bese libamba izixhumanisi ezimbili ngaphakathi kwesiqalo esisodwa ngaphandle kokuthile okusho ukuthi iyiphi indawo eyakwini, futhi ukuziphatha okuvelayo kubonakala njengokonakala komzila kodwa empeleni ukona kokubalwa kwezinombolo. Ukubala kabusha ichibi kubiza ukuhlela okukodwa kokumiswa; isu ngalinye lomzila elilandelayo libiza impelasonto. Hlola ichibi ngaphambi kokwengeza umzila walo.

Bheka ne-LAN yasekhaya. I-LAN yasekhaya enenombolo engu-192.168.1.0/24 evezwa yishubhu elilodwa nayo ikhiqiza ukungaqondakali okufanayo, futhi uphawu igama lesibungu elixazululwayo kuyilapho uxhumano lungaqedi neze. Lokho kubonakala njengokonakala kokuxazulula amagama kuze kube yilapho uprinta imizila.

ip -4 addr show
ip route show table all | grep -E '10\.|192\.168\.'

Qhathanisa kokubili okuphumayo nokubili ukumiswa kweseva ngaphambi kokuthinta iklayenti. Uma iziqalo zihlangana, yima futhi ubale kabusha, ngoba noma ngabe zingaki izikhathi zokuqalisa kabusha ngeke zihlukanise.

Nikeza iphrofayili ngayinye iyunithi yayo futhi isiqalo ngasinye umnikazi

Iphrofayili ngayinye ithola igama layo lesimo kanye nefayela layo lokumiswa, ngakho isimo esibizwa ngokuthi office silayisha i-office.conf kuyilapho leso esibizwa ngokuthi lab silayisha i-lab.conf. Qinisekisa lokho kuhlangana ngomphathi wensizakalo esikhundleni sokwethemba uhlu lwemikhombandlela, ngoba i-drop-in ingashintsha ukuthi iyiphi ifayela elayishwayo. Ukuhlangana okungalungile kusho ukuthi ulungisa iphrofayili engasebenzi.

Bese unquma ukuthi ubani ofaka imizila. Lapho amaseva eqhuba amasethi angahambisani, kungenjalo nqaba ukughutshwa futhi ubale iziqalo ngokwakho, noma vumela iphrofayili eyodwa igcine okuzenzakalelayo futhi uqondise enye ngemithetho yenqubomgomo. Izinqubo ezimbili ezifaka zombili okuzenzakalelayo zigcina ngomnqobi buthule futhi ngaphandle kombhalo obhaliwe wesinqumo.

systemctl cat [email protected]
grep -E 'route-nopull|pull-filter|redirect-gateway' /etc/openvpn/client/lab.conf

Eyokuqala ibonisa iyunithi kanye nanoma yikuphi ukubhala ngaphezulu okushintsha izimpikiswano zayo. Eyesibili ibonisa ukuthi iphrofayili iyayamukela yini imizila eqhutshwayo, futhi leso isiswishi esinquma konke okulandelayo.

Izibonakaliso zigcina izimpendulo kusixhumanisi ezivela kuso

Lapho ishubhu ngalinye likhonza imithombo ehlukene, impendulo ingaphuma ngoxhumano olungalungile futhi uxhumano lufe ngemva kwephakethe lokuqala. Iphethini eqhubekayo iwukuthi umake amaphakethe angenayo ngokwesixhumanisi sokufaka, ubuyisele leso sibonakaliso empendulweni, futhi unikeze isibonakaliso ngasinye ithebula elinegedi layo elizenzakalelayo.

Ukwahluzwa kukamzila obuyela emuva okuxekethile ngokuvamile kufanele kukhululeke ezixhumanisini ezithintekile, ngoba impendulo ifika ngokusemthethweni ngoxhumano ithebula eliyinhloko ebingeke likhethe. Gcina izibonakaliso ziwumfihlo ukuze zingalokothi zibambe ithrafikhi ebethelelwe yamashubhu ngokwawo, okungathumela ishubhu ngaphakathi kwalo.

ip rule show
ip route show table 101
sysctl net.ipv4.conf.all.rp_filter

Funda imithetho ekhona ngaphambi kokwengeza omunye. Ukubalwa kabusha kwezinto ezibalulekile kanye namathebula akhohliwe yisizathu esivamile sokuthi inqubomgomo yezibonakaliso ibonakale ingenamphumela nakancane.

Fakazela ukuhlukaniswa ngokumisa isixhumanisi esisodwa

Njengoba womabili amashubhu ekhuphukile, rekhoda ikheli lesixhumanisi ngasinye, umzila oya esibungwini esisodwa ngemva kweshubhu ngalinye, nendlela indawo engahlobene eyithathayo. Buza ingqikithi ngokusesha esikhundleni sokufunda ithebula elilodwa, ngoba ithebula elilodwa alikaze likhombise isinqumo sokugcina.

Bese umisa isimo esisodwa futhi ubuke isixhumanisi saso nemizila yaso inyamalala kuyilapho enye iqhubeka. Ukuphuka kokusindile kusho ukuthi zombili zisabelana ngegama ledivayisi, umzila noma umthetho we-firewall ongahlukaniswanga muntu.

Buyisela iphrofayili emisiwe futhi uphindele izivivinyo ezifanayo. Lapho ishubhu lisinda kuphela ekuqaleni kokuqala ngemva kokuqalisa kabusha, ubuka ukukhubazeka komjikelezo wokuphila hhayi ukuklanywa komzila.