I-VPN relay iyeka ukwamukela i-SSH: imikhawulo yezincazelo zamafayela

I-handshake ye-WireGuard isaqedwa, i-peer isabonisa i-endpoint yakamuva, kodwa isikhathi esisha se-SSH esidlula ku-relay engemuva kwayo silenga ngaphandle kwebanner. Leyo nhlanganisela isuka emhubheni iqonde kunqubo eyamukela i-socket. I-relay efana ne-socat ihlezi endleleni yohlelo lokusebenza ngesabelomali sayo sezincazelo, izingane zayo kanye nemikhawulo yayo ezuzwe njengefa. Uhambo olungezansi luqala kuklayenti futhi lumiswe engxenyeni yokuqala engakwazi ukuvula enye i-socket.

Landela indlela ngaphambi kokushintsha inombolo

Landela isicelo esisodwa esihlulekile esikhundleni sokucabanga ngomhubhe wonke. Iklayenti libhala emhubheni, i-VPN daemon ihlukanisa ukubethela futhi iqondise, kanti i-relay yamukela ngaphesheya. Isinyathelo ngasinye sisebenzisa izincazelo, futhi esivame ukuqeda yisona sokugcina.

Qala ngesicelo ongakwazi ukusiphindaphinda bese ukala isikhathi saso. Uma i-handshake ye-TCP iqedwa kodwa ibanner yohlelo lokusebenza ingafiki, i-relay ithathe i-socket yabe isikhonza kwingane noma emlenzeni wayo ongenhla. Uma i-handshake uqobo ingaqedi, imbangela iwukuhamba kwendlela, i-firewall noma isimo somlaleli, hhayi uphahla lwezincazelo. Bhala ukuthi yiluphi lwezinhlobo ezimbili obone, ngoba zikhomba ezinqubweni ezihlukene.

Bala nezigxumo eziphinda umsebenzi. Umsindo ohlukanisayo unikeza yonke i-socket eyamukelwe kwingane egcina ikhophi yayo, ngakho isamba sangempela yisici somuthi wonke, hhayi somzali kuphela.

Funda umkhawulo i-relay ewuzuze njengefa

Umkhawulo oyedwa obalulekile ungowenqubo esebenzayo, futhi wabekwa yilokho okwaqala leyo nqubo. Ukuthayipha ulimit -n ku-shell kuchaza i-shell. Buza umphathi wensizakalo ukuthi wasebenzisa ini, bese uqinisekisa ku-PID.

systemctl show -p MainPID -p LimitNOFILE vpn-relay.service
cat /proc/$(systemctl show -p MainPID --value vpn-relay.service)/limits

Ifayela le-limits liprinta uphahla oluthambile noluqinile njengoba inqubo ibona. Inani elithambile eliphansi ngaphansi kwenani eliqinile elicwebile lisho ukuthi i-daemon ivunyelwe ukuphakamisa uphahla lwayo, futhi ezinye zenzeka lokho ekuqaleni; amanani athambile alinganayo aphansi asho ukuthi ifayela le-unit liwumthombo.

Ama-drop-in alayishwa ngokulandelana kwesichazamazwi futhi amafayela akamuva ayawina, ngakho i-systemctl cat vpn-relay.service iwumbono ogunyaziwe walokho okusebenzayo. Ukuhlela ifayela umphathi angakaze alifunde yisizathu esivame kakhulu sokuthi inombolo ephakanyisiwe ingabi nawo umphumela.

Hlukanisa ukusebenza ngesikhathi esifanayo okuqinile nesimo esigciniwe

Izinqubo ezimbili zingafinyelela uphahla olufanayo ngezizathu ezingahlobene, futhi amakhambi ayahluka. Isidingo esilandela izikhathi ezisebenzayo ngesikhathi esifanayo siwumbuzo wamandla okusebenza. Ukukhula okuqhubeka ngemva kokuphela komsebenzi ukuvuza noma iqoqo lezikhathi okungekho owazivala.

Kala ngesikhathi sokungenzi lutho, ekuphakameni kwakho okujwayelekile futhi uphinde ngemva kwemizuzu embalwa ukuthi umthwalo umile. Ukubala okufakiwe okuvuliwe nge-ls /proc/PID/fd | wc -l uma kuqhathaniswa nomkhawulo othambile kukutshela igebe, futhi ukubala okuphansi ngokukodwa noma ngokubili kunoquphahla ukuvimba okuqinile hhayi indlela enensayo.

Uma ukubala kunqaba ukwehla, bheka izimo ze-socket esikhundleni sezamba. Izincazelo ezihlezi ku-CLOSE_WAIT zisho ukuthi i-peer yavala kanti uhlangothi lwakho aluzange lwavala, okuyiphutha emjikelezweni wokuphila kohlelo lokusebenza umkhawulo omkhulu owubambezela nje. Khawulela imodeli yezingane futhi: i-relay ehlukanisayo ngaphandle komkhawulo ezinganeni ezisebenza ngesikhathi esifanayo iqeda izincazelo, izikhala zenqubo kanye nenkumbulo kanyekanye.

Qinisekisa inani elisha kunqubo ephilayo

Ngemva kokuhlela i-unit, layisha kabusha umphathi bese uqala kabusha insizakalo, ngoba ukulayisha kabusha kukodwa akukaze kushintshe imikhawulo inqubo esebenzayo esevele iyizuze njengefa. Qinisekisa kunqubo esebenza ngempela ithrafikhi.

systemctl daemon-reload
systemctl restart vpn-relay.service
awk '/Max open files/ {print}' /proc/$(systemctl show -p MainPID --value vpn-relay.service)/limits
ss -tnp state established '( sport = :2222 )' | wc -l

Umuthetho we-awk ubuyisela ipheya elisha; uma usabonisa elidala, i-drop-in oyihlelile akuyona elethwa. Ukubala kwe-ss ukuhlola kwakho umthwalo, ngakho vula inani lezikhathi ozilindele bese ubona likhuphuka. Ukubala okuqhubeka nokukhula ngemva kokuba lezo zikhathi zivaliwe kusho ukuthi umkhawulo awuzange ube yinkinga yonke.

Isixwayiso esisodwa sihamba nakho konke ukwenyuka okukhulu. Izinhlelo ezisebenzisa i-select() ukubuza azikwazi ukubheka izincazelo ezingaphezu kwe-FD_SETSIZE, okuyi-1024 kuma-build ajwayelekile, ngakho uphahla oluphakanyiswe ngaphezu kwalokho lungakhiqiza ukwehluleka okubonakala kungahlobene. Incwadi yokubhekisa yokusebenza ye-systemd iphethe isixwayiso esifanayo kumasevisi ewasebenzisayo.

Gcina ukuqala kabusha kude nokutholakala komhubhe

Ukuqala kabusha i-relay kuwisa izikhathi zayo ezisebenzayo, futhi lowo ngumcimbi ohlukile ekuweni kwe-VPN. Hlela ushintsho ukuze umhubhe uhlale ungenhla ngenkathi i-relay izungeza, futhi uxwayise noma ubani isikhathi sakhe eside esidlula kulo.

Ukubuyisela emuva yifayela le-unit eledlule kanye nokunye ukuqala kabusha, futhi lelo fayela lihlala endaweni yalo kuze kube inani elisha lisebenza usuku olulodwa lomsebenzi. Bese uvala umjikelezo ngesicelo esahluleka ekuqaleni: isikhathi esisodwa esisha se-SSH nge-relay, ukudluliswa okukodwa okude ngokwanele ukuba kubaluleke, kanye nokubala kwezincazelo okubuyela ezingeni lako lokungenzi lutho.