Ama-VPN amabili kumshini owodwa we-Linux: hlola ngalinye ngokwahlukile ngaphandle kokuxuba imiphumela

Izimpawu ezimbili zoxhumano eziluhlaza zibukeka njengokuqhathanisa futhi ngokuvamile ziyisigameko nje. Uma isicelo sokuhlola besingasebenzisa noma imuphi kule mihubhe emibili, umphumela uchaza okungenani owodwa wabo futhi kabi kakhulu awukho nakanye. Nika ukubona ngakunye umongo wenethiwekhi, indawo okuhloswe ngayo kanye nokulindelekile okubhalwe ngaphambi kokuba ukuhlola kuqale. Kumshini we-Linux ozilawulayo, izindawo zamagama zenethiwekhi ezinamagama yizona zindlela ezishibhe kakhulu zokuthenga lokwohlukanisa.

Izibani ezimbili eziluhlaza akukona ukuqhathanisa

Indawo yamagama ihlukanisa amathebula omzila, izixhumanisi kanye nesimo sesitaki senethiwekhi, ngakho isicelo esiqale ngaphakathi kwenye asikwazi ukuboleka umhubhe wenye buthule. Lokho engakuhlukanisi i-processor, isixhumanisi somzimba esiya phezulu noma idemon yokuxazulula amagama egijima kumsingathi. Kulesi sikhala sokugcina lapho iningi lalezi zivivinyo lihluleka khona ngaphandle kokuthi othile aqaphele. Uphenyo oluphuma endaweni yamagama bese lubuza isixazululi samagama somsithi lubuyisa impendulo engahlobene nhlobo nomhubhe ohlolwayo.

Le nqubo icabanga izindawo zamagama zokuhlola ezimbili esezilungisiwe futhi zigunyaziwe, ezinomxhoxho wangaphandle osebenzayo namaklayenti asekelwayo. Ayikhi lutho, ayibhalisi lutho futhi ayishintshi noma ikuphi ukulungiselelwa. Amamshini okufanisela ahlukile aseyisinqumo esithembekile uma iklayenti lidinga isikhathi sesikrini esigcwele noma lenqaba ukusebenza ngaphandle kwaso.

Qinisa okulindelekile ngaphambi kokugijima kokuqala

Nquma ngomongo ngamunye ukuthi impumelelo ibonakala kanjani: isixazululi samagama, igama lensizakalo, ikheli elilindelekile kanye nokuziphatha okudingekayo uma umhubhe uwa. Gcina lawo magugu ahleliwe kumaki wawo, ngoba irekhodi elixuba icebo nokubonile liyinganekwane enesigxivizo sesikhathi. Uhlu lokuhlola olungezansi yilona lwezi esidingayo irekhodi, futhi umugqa ngamunye kufanele ukwazi ukugcwaliswa ngaphambi koxhumano lokuqala.

Izintambo zesixazululi samagama zifanele zibe nomugqa wazo kulelo rekhodi, ngoba yilona nkambu okungenzeka kakhulu ukuthi uqambe amanga. Amafayela aboshelwe endaweni yamagama, njenge /etc/netns/vpn-a/resolv.conf avela emizileni yawo ejwayelekile uma umyalo ugijima ngaphakathi kwendawo yamagama, njengoba incwadi yereferensi ye-iproute2 mayelana nezindawo zamagama ichaza, kodwa ukulungiselelwa kokushintsha kwensizakalo yamagama nanoma isiphi isixazululi sendawo esiqalayo kusengadonsa uphenyo lubuyele kumsingathi.

Umhubhe owodwa ngesikhathi, omunye unqanyuliwe

Xhuma u-A ngomnini wakhe okhona ngenkathi u-B ehlezi phansi, bese uhlola inqubomgomo, imizila kanye nomzila okhethiwe kusukela kumongo wokuphatha. Imiyalo emithathu engezansi ifunda isimo; eyokugcina kuphela ethinta insizakalo yamagama, futhi akukho nowodwa kuyo othumela isicelo sohlelo lokusebenza.

sudo ip -n vpn-a -4 rule show
sudo ip -n vpn-a -4 route show table all
sudo ip -n vpn-a -4 route get 10.55.10.20
sudo ip netns exec vpn-a getent ahostsv4 svc-a.lab.internal

Uphenyo lomzila luphendula umbuzo ocatshangelwayo mayelana nendawo okuyiwa kuyo, ngakho alunakukhombisa ukuthi insizakalo yamukela ithrafikhi. Gcina lezi zinhlobo ezimbili zobufakazi kumakholomu ahlukene, ngoba umzila onempilo eceleni koxhumano olunqatshiwe umphumela wangempela futhi ojwayelekile. Bese uthumela isicelo esisodwa esingenabungozi esigunyaziwe ngohlelo lokusebenza lwangempela, esiqalwe kumongo ka-A njengomsebenzisi walo ojwayelekile ongenalungelo, nokuqinisekiswa kwesitifiketi nokuqinisekiswa kohlelo lokusebenza kungashintshiwe, futhi urekhode umphumela kanye nekheli lomthombo insizakalo elikubonile. Nqamula u-A ngomnini wakhe bese uphinda wonke umugqa wesisekelo ku-B, ubanga noma yikuphi ukushintshwa kokulungiselelwa okukwenzayo, ngaphandle kwalokho imigqa emibili yesisekelo ngeke isakwazi ukuqhathaniswa.

Zombili phezulu, bese kwehla okukodwa ngesikhathi

Isimo esizinzile siyingxenye elula. Ngemihubhe yomibili exhunyiwe, phinda uphenyo nesicelo sohlelo lokusebenza sakho konke ukuhlola, bese unqamula umhubhe owodwa futhi uhlole omunye. Xhuma kabusha ngokulandelana okuphambene uma ukulandelana koxhumano ngokwako kuwumbuzo.

sudo ip netns exec vpn-a tcpdump -ni any port 443 -c 5
sudo ip netns exec vpn-b getent ahostsv4 svc-b.lab.internal
sudo ip -n vpn-b -4 route get 10.55.20.20

Ukubamba kuxazulula izingxabano umphumela wohlelo lokusebenza ongakwazi ukuzixazulula: kukhombisa ukuthi isicelo saphuma ngesixhumanisi obusilindele noma ngento ehluke ngokuphelele. Ngakho konke ukushintsha rekhoda isenzo somnini, isigxivizo sesikhathi, umphumela womzila, umphumela wegama kanye nomphumela wohlelo lokusebenza. Bese uhlola imfuneko yokuvalwa okuphephile ngaphakathi kwendawo yamagama ethintekile, ngoba ukwehlukanisa akusona iswishi yokubulala. Indawo yamagama igcina imihubhe emibili ihlukene; ayivimbeli noma imuphi kuyo ukuthwala ithrafikhi uma iphrofayili yayo ithi ithrafikhi kufanele ime.

Irekhodi lingasho ini futhi lingakwazi ukusho ini

Ukuphumelela kufakazela lokho kubona kwalokhu kulungiselelwa, kulo msingathi, ngaleso sikhathi. Akusho lutho mayelana namaklayenti amabili ahlanganyela ithebula elilodwa lomzila wesikrini, futhi akusho lutho mayelana nokugeleza ngenkathi imihubhe yomibili ithwele umthwalo. Leyo yimibuzo ehlukene enezivivinyo ezihlukene, futhi ukuqhathanisa kuhle kufinyelela lapho umongo onanyathiselwe kumugqa ngamunye unjalo.

Gcina ukwehluleka kurekhodi eceleni kokuphumelela, kumakwe ukuthi imuphi umhubhe owawuphezulu ngaleso sikhathi. Ikhasi elihlanzekile elifihla isimo ngesikhathi sokulinganisa libi kunelibi elibonisa lona. Okwenza irekhodi likwazi ukusetshenziswa futhi kamuva umongo, hhayi amaphuzu.

Imihubhe emibili kumshini owodwa ingaqhathaniswa ngobuqotho, kodwa kuphela ngaphakathi kwezindawo eziningi zomongo njengoba wawulawula ngempela. Noma yini engaphezu kwalokho iyisifiso esinezimpawu eziluhlaza eceleni kwaso.