Amakheli amabili wesevisi kuklayenti eyodwa ye-OpenVPN: iroute ne-lo

Uhlelo luphendula ekhelini lwalo lwethaneli, futhi ikheli olibhalele lona alihambi ndawo. Akukho lutho olukhonondayo kulogi ye-OpenVPN, i-peer ibonakala ixhunyiwe, futhi i-hub ibala iklayenti elilodwa ncamashi. Igebe ukuthi ikheli lesibili kuklayenti lingamaqiniso amabili ahlukene: umethuli kufanele abe nalo, futhi i-hub kufanele yazi ukuthi iyiphi i-peer enalo. Phatha elinye ngaphandle kwelinye futhi ithrafikhi izofa e-hub noma ifike ngaphandle kwendlela yokuya ekhaya.

Igama liyingxenye yendawo, ubunikazi bukude

Ikheli lethaneli kuyaxoxiswana ngalo, ngakho zombili izinhlangothi ziyalifunda ngesikhathi sokuxhawula. Ikheli lesevisi elengeziwe akuxoxiswani ngalo nhlobo, yingakho ukulengeza kungashintshi lutho ku-hub ngokwalo. Iklayenti lingaba nekheli ngokushesha futhi iseva isazothumela leyo thrafikhi endleleni yayo ezenzakalelayo noma ilahle. Kufanele kwenziwe amarekhodi amabili, ezindaweni ezimbili ezihlukene.

Kuklayenti ikheli lingelomethuli, futhi i-loopback iyikhaya lemvelo lobunikazi besevisi okufanele bungaveli nhlobo kuxhumano lomzimba. Ku-hub ukuhlelwa kwe-peer kuya kwisimaphambili kuyisimemezelo esihlukile esifundwa yiseva kuphela. Awekho amarekhodi ashoyo elinye.

Gcina izigaba zombili zihlukene nasemibhalweni yakho. Amakheli esibonelweni ayizindinganiso zokubhala, futhi ukuwahlanganisa ne-LAN yangempela kuyindlela eshesha kakhulu yokwenza ukuhlelwa okusebenzayo kubonakale kuphukile.

Engeza ikheli kuklayenti ngokuhlala njalo

Beka ikheli lesevisi ku-loopback ngesimaphambili somethuli, ukuze umethuli alithathe njengokufakwayo kwendawo hhayi njengenethiwekhi encane okufanele kufinyelelwe kuyo. I-ip address add 10.66.0.10/32 dev lo yenza lokho kukheli elilodwa, futhi ukuphinda umyalo kukheli lesibili kufanekisa amasevisi amabili.

Kugijime lokho njengokuhlola kwesikhathi esisodwa, bese ukuhambisa kulokho okunokuhlelwa kwenethiwekhi yomethuli, ngoba ukwengezwa kwesikhathi sokusebenza kuyanyamalala lapho kuqalwa kabusha futhi amakhophi ayanda phakathi kokuxhumana kabusha. Iyunithi ye-systemd ehlelwe ngemva kwenethiwekhi ingenye indlela, futhi umphathi wenethiwekhi wokusabalalisa ungenye. Noma yini oyikhethayo, ikheli kufanele libe khona ngaphambi kokuthi uhlelo luxhumane, kungenjalo isevisi izokhula kusokhethi engalungile. Qinisekisa nge-ip address show dev lo ngemva kokuqalwa kabusha hhayi ngemva komyalo wesandla.

Ukuxhuma kuyisinqumo esihlukile ekukheleni. Uhlelo olulalela kukho konke ikheli lwamukela ithrafikhi ezindaweni ongakaze uzihlelele, ngakho luqondise ekhelini lesevisi elithile. Khona-ke inqubomgomo yokufakwayo yendawo inokuthile okuqondile okufanele icatshangelwe.

Yifuna efayeleni le-CCD eliyifunda ngempela i-hub

Kuseva, isimemezelo sobunikazi singena efayeleni leklayenti ngalinye elikhethwa igama elivamile eliqinisekisiwe, ngaphakathi kwedijithali eqanjwe nge-client-config-dir. Umugqa yi-iroute 10.66.0.10 255.255.255.255, owodwa ngekheli ngalinye, futhi utshela iseva ukuthi iyiphi i-peer okufanele yamukele ithrafikhi yaleyo ndawo.

Imininingwane emibili yephula lokhu ngokuthula. Igama lefayela kufanele lihambisane negama iseva elisebenzisa ngempela, elihluka lapho i-username-as-common-name isemdlalweni. Futhi i-iroute isebenza kuphela kumodi ye-TUN enedijithali yokuhlelwa kweklayenti ehleliwe, ngakho umugqa ofanayo awenzi lutho ekusetshenzisweni kwebhuloho. Engeza imigqa efayeleni elikhona esikhundleni sokulishintsha, ngoba lingase libe nekheli elimisiwe noma izinketho ze-push. Isichazamazwi se-OpenVPN 2.6 sibhala kokubili idijithali nomlayelo wobunikazi.

Ikhemeli ye-hub uqobo nayo idinga indlela eya kulezo zindawo, ukuze ithrafikhi ekhiqizwe endaweni ingene enqubweni yethaneli. I-route 10.66.0.10 255.255.255.255 ekuhlelweni kweva isimboza ithrafikhi ekhiqizwa yiseva uqobo, kuyilapho amanye amaklayenti edinga i-push "route 10.66.0.10 255.255.255.255" ukuze azifundele yona indawo.

Ukuhamba kwendlela nokugunyazwa kuhlala kuhlukene. Indlela eqhutshwayo itshela iklayenti lapho kufanele kuthunyelwe khona amaphakethe futhi ayinikezi lutho; isevisi kusamele yamukele umshayeli ngemibandela yayo.

Hlola inqubomgomo yokufakwayo nendlela yokuphendula

Iphakethe eliqondiswe egameni lifika kumethuli onalo njengokufakwayo kwendawo, ngakho umbuzo ukuthi ingabe udonga lomlilo lwendawo luyakuvumela lokho kumthombo kanye nembobo yokungena. Vumela imbobo yesevisi ethile kusukela kububanzi bomthombo we-VPN esikhundleni sokuvula ikheli lonke.

Izimpendulo zidinga indlela yokubuyela kumshayeli. Kumshayeli ongaphakathi kwechibi elijwayelekile lethaneli leyo ndlela isivele ikhona, ngoba idivayisi yethaneli iyayithwala. Umshayeli ongemuva kwenye inethiwekhi ehanjisiwe udinga futhi indlela yokubuya yaleyo nethiwekhi, futhi yilapho ukuhlelwa okungalingani kulahlekelwa khona amaphakethe.

Qaphela umlaleli wesibili embotsheni efanayo eboshelwe ekhelini elihlukile, ngoba ikhemeli ihambisa kusokhethi efanayo futhi imiphumela ibonakala ingenamthetho. Hlola nge-ss -lntp futhi uqinisekise ukuthi ikheli eliboshiwe iyigama lesevisi. I-NAT yomthombo ayidingeki lapha, futhi ukuyengeza kufihla ubunikazi bomshayeli okunyelwe kukho amalogi akho.

Hlola amakheli nobunikazi ngokwahlukana

Hlola ngezinyathelo ezimbili. Okokuqala qinisekisa ukuthi umethuli onalo angafinyelela isevisi egameni lakhe kusukela kuye uqobo, lokhu okwehlukanisa izinkinga zokuxhuma nodonga lomlilo ekuhambeni kwendlela. Bese uhlola kumshayeli we-VPN wangempela usebenzisa ukuqinisekisa kohlelo uqobo. Lapho okokuqala kudlula futhi okwesibili kwehluleka, ingxenye engekho iseceleni kwe-hub.

Hlola futhi izimo zokwehluleka eziqhubeka ngemva kokuxhumana: igama lihlala labiwe lapho ithaneli liphansi, futhi i-hub igcina indlela yayo lapho i-peer ingekho. Asikho into eyodwa eqinisekisa ukuthi isevisi iyafinyeleleka, yingakho ukuhlola kwezinyathelo ezimbili kunqoba i-ping eyodwa evela kukhompyutha ephathwayo.