Ikhophi yokulondoloza yeseva ye-VPN: nquma ukuthi yini okufanele ikwazi ukubuyiselwa

Ukukopisha ifayela lokumisa akulona ikhophi yokulondoloza, futhi ikhophi yokulondoloza okungekho muntu ongayibuyisela akulona uhlelo. Ingqoqo kufanele ibe nobunikazi besevisi, inqubomgomo eyizungezile kanye nesimo esitshela ukuthi yimaphi amadivayisi asavunyelwe. Kufanele futhi ivikelwe, ngoba ezimweni eziningi zokufakwa ingqoqo inikeza ngqo lokho okunikezwa yi-VPN. Ukunquma ukuthi yini okufanele ikwazi ukubuyiselwa kuza kuqala; uhlu lwamafayela lulandela leso sinqumo.

Qala emgomweni wokwakha kabusha

Bhala ukuthi iseva eyakhiwe kabusha kufanele yenzani ngaphambi kokubala ifayela elilodwa: ukuqeda imigudu efanayo, ukwethula ubunikazi obufanayo kanye nokwenqaba amadivayisi akhishwe njengamanje. Lowo musho ukhipha iningi lamakhophi angenalwazi, ngoba indawo yokumisa ayivamisile ukuba nohlu lokukhishwa noma ukuncika kobunikazi bangaphandle. Iveza futhi izingxenye ezihlala ngaphandle komsingathi, njengamarekhodi e-DNS, imithetho ye-firewall yamafu kanye nendawo okugunyaza kuyo isango. Uhlelo oluzishaya indiva lukhiqiza iseva ebuyisiwe ebonakala iphilile kodwa engamukeli muntu.

Hlunga izinto ngezitsha ezintathu: ubunikazi, ukumiswa kanye nesimo. Ubunikazi izikhiye, izitifiketi kanye nesiphathimandla esizisayinayo. Ukumiswa izilungiselelo ze-daemon, amachibi, imizila kanye nenqubomgomo ye-firewall, kanti isimo iqoqo labalingani, ama-akhawunti kanye nokukhishwa okushintsha nsuku zonke.

Ubunikazi ingxenye ongakwazi ukuyikhiqiza kabusha

Izikhiye zangasese azikwazi ukwakhiwa kabusha kusuka enkumbulweni, futhi izitifiketi ezincike kuzo ziphelelwa yisikhathi ngohlelo olulithola njengefa esikhundleni sokulukhetha. Londoloza ikhophi yokhiye weseva, izinto zokuhlinzeka amaklayenti kanye nesiphathimandla sezitifiketi, bese uphawula ukuthi yikuphi kuzo okufanele kuhlale ngaphandle kwenethiwekhi. Ukhiye wesiphathimandla ohlala kuphela esangweni elisebenzayo ukude nokwephulwa okukodwa nokusethwa kabusha kobunikazi obugcwele kwiklayenti ngalinye. Rekhoda lokho okugcinwa ngamabomu kwenye indawo ukuze kungabikho muntu okukopisha engqoqweni enokuvikela okuphansi.

Ukukhishwa kufanele kube nomugqa wakho ohlelweni. Ukubuyisela ukumiswa kwasezolo kungabuyisa ubunikazi obukususile namuhla, lokhu okuguqula ukubuyisela kube yisigameko sokuphepha. Gcina isimo samanje sokukhishwa endaweni engaxhomekekile esithombeni ozobuyela kuso, futhi usihlole ngemva kokubuyisela kokunye.

Thatha isimo ngomzuzu owodwa

Ikhophi ethathwe ngesikhathi isevisi ibhala ikhiqiza uhlu olungahambelani, futhi idatha yobunikazi engahambelani imbi kune khophi ehlanzekile endala. Sebenzisa indlela yokukhipha esekelwe kusitore ngasinye, bese urekhoda isikhathi sesithombe, ngoba yonke imibuzo yakamuva mayelana nokubuyisela incike kukho.

wg showconf wg0 > /srv/backup/wg0.runtime.conf
sqlite3 /var/lib/vpn/admin.db ".backup '/srv/backup/admin.db'"
cp -a /etc/wireguard /srv/backup/etc-wireguard
sha256sum /srv/backup/*.conf > /srv/backup/MANIFEST

Umyalo wokuqala uphrinta isixhumi esisebenzayo sibuyele njengokumiswa, okuyindlela eshesha kakhulu yokubamba abalingani abengezwe ngesandla esikhundleni sethuluzi lokuphatha; lokhu incwadi ye-wg(8) iyakubhala. Umugqa we-sqlite uyisibonelo sedathabhendi yokuphatha: umyalo wekhophi ukhiqiza ikhophi evumelanayo ngesikhathi umbhali eqhubeka. Ikhophi yendawo igcina izimvume, okubalulekile ngoba lawo mafayela okhiye afundwa kuphela yi-root. Imanifest iyona ekuvumela ukuhlukanisa ingqoqo ephelele kweyinqunyiwe.

Yenza ukubuyisela kube nokwenzeka, bese ukuzama

Bethelela ingqoqo futhi ugcine ukhiye wokubuyisela kwenye indawo hhayi emshinini eyavela kuwo. Ikhophi yokulondoloza okukho kuphela kwisiseva esihlulekile umusho wayo wokufihla iyikhophi okungekho muntu ozoyivula. Khawulela ukutholwa kubantu asebekwazi ukuphatha isango, futhi urekhode ukutholwa ngakunye. Hlola ukubuyisela kunethiwekhi ehlukanisiwe, ngoba ubunikazi obukotshiwe obakhiwe eduze kokukhiqiza budala amaseva amabili aphendula ngokhiye ofanayo womlingani.

Bhala okukhishiwe ngokunakekela okufanayo nokuqukethwe. Imithetho ye-firewall yamafu, amarekhodi e-DNS kanye nendawo yangaphandle kungase kudingeke isinyathelo sayo sokubuyisela. Ikhophi yamafayela ephumelelayo akubona ubufakazi bokuthi isevisi iyabuya; ubufakazi kuphela obalwayo yindawo yokugcina eyakhiwe kabusha edlula ukuhlolwa kokwamukela okufanayo nokwasekuqaleni.