Kwenzekani ngempela uma uqala i-VPN ku-Linux

Cindezela ukuxhuma futhi izinto ezintathu ziyashintsha kumshini we-Linux: kuvela i-interface, kufakwa imizila, futhi isixazululi siqala ukuphendula ngendlela ehlukile. Iningi lokwehluleka kokusetha livela ekutheni enye yalezi zintathu yenzeka ngaphandle kwezinye, noma izinhlelo ezimbili azivumelani ngokuthi ngubani umnikazi wazo. Ukuqonda ukulandelana kuchaza ukwehluleka ngokushesha kunokufunda umphumela wengqophamlando yeklayenti.

I-interface ivela ngaphambi kokuthi noma yini isebenze

Iklayenti yomhubhe ivula i-interface ebunjiwe futhi inikeza amaphakethe kuyo. Idivayisi ye-TUN ithwala amaphakethe e-IP, okuyikho okudingwa i-VPN enomzila; idivayisi ye-TAP ithwala ozimele be-Ethernet, okuyikho okudingwa umklamo webhuloho. Imojuli ye-kernel inikeza idivayisi, futhi iklayenti ingumnikazi wayo isikhathi sonke seseshini.

Ukuphakama kwe-interface akufani nomhubhe osebenzayo. Kungaba khona nekheli ngenkathi uzakwabo engafinyeleleki, futhi yingakho uhlu lwama-interface luwukuhlola kokuqala hhayi kokugcina. Idivayisi ezibika ukuthi iphakamile ichaza umbono we-kernel ngoxhumano olubunjiwe, hhayi ukuzimisela kukazakwabo ukuphendula.

Shiya imodi ye-interface enikeziwe injalo. Ukushintsha iphrofayili ye-TUN ibe yi-TAP akwenzi iseva enomzila ibe yebhuloho, futhi ngokuvamile kukhiqiza uxhumano olusungulwayo futhi olungadlulisi lutho.

Imizila ifakwa yilowo ophethe umhubhe

Imizila ingushintsho lwesibili, futhi ubunikazi bayo bubaluleke ngaphezu kokuqukethwe kwayo. Iphrofayili ye-NetworkManager, iyunithi ye-systemd neklayenti eqaliswe ngesandla zonke zingafaka imizila, futhi uma ezimbili zazo zenza lokho ngesikhathi esisodwa kwakheka ithebula okungekho muntu ongayichaza kamuva.

ip -br addr show
ip route show
ip -6 route show

Iphrofayili yomhubhe ogcwele ithatha indawo yomzila ozenzakalelayo; iphrofayili yomhubhe ohlukanisiwe yengeza imizila eqondile kakhulu futhi ishiye owenzakalelayo enjalo. Kokubili kuvamile, futhi okwesibili yikho okwenza ukususa umzila ozenzakalelayo kube ukuhlola kokuqala okubi kumshini owulawula kude. Ukuwususa futhi kuyindlela eshesha kakhulu yokulahlekelwa iseshini oyisebenzisayo ukulungisa inkinga.

Funda ithebula esikhundleni sokucabanga. Umzila oqondile kakhulu noma umthetho wenqubomgomo ungathumela ithrafikhi emhubheni ngenkathi umzila ozenzakalelayo usakhomba ku-interface yomzimba, lokho okubonakala kuphikisana kuze kube yilapho ufunda ithebula lonke. Le nhlanganisela ivamile kumhubhe ohlukanisiwe futhi iyadida noma ubani olindele ukuthi umugqa owodwa uchaze umklamo. Funa umzila ohambisana nendawo oya kuyo yangempela, hhayi lowo ohambisana nomdwebo.

Isixazululi sishintsha izandla

I-DNS ingushintsho lwesithathu futhi yilowo okungenzeka kakhulu ukuthi ulawulwa endaweni ongayibonanga. Kudeskithophu, i-NetworkManager ingathumela izilungiselelo zesixazululi ngoxhumano ngalunye. Kusistimu esebenzisa i-systemd-resolved, izilungiselelo zisetshenziswa ngoxhumano ngalunye futhi /etc/resolv.conf kungase kube i-stub noma isixhumanisi somfanekiso hhayi ifayela okufanele ulihlele.

resolvectl status
readlink -f /etc/resolv.conf
cat /etc/resolv.conf

Uma ukuhlela ngesandla kwefayela lesixazululi kunyamalala ngemva kokuxhuma kabusha, lokho kuwuphawu lokuthola ingxenye eyigcinayo bese ushintsha iphrofayili esikhundleni salokho. Ukuhlela ifayela elikhiqiziwe wushintsho oluzosulwa ukuxhuma kabusha.

Amagama angasese ngokuvamile adinga isixazululi sangaphakathi nezizinda zokusesha ezinikezwe umqhubi. Ukushintsha ngesixazululi somphakathi kungaphula kanye leyo nsiza i-VPN ekhona ukuze ifinyelele kuyo, futhi uphawu lubonakala njengokwehluleka komzila hhayi kwe-DNS. Hlola igama nekheli ngokuhlukana, ngoba elilodwa ukusebenza kanti elinye ukwehluleka kukutshela ngqo lapho okufanele ubheke khona. Lokho kuqhathanisa okukodwa konga ihora lokulungisa imizila.

Umphathi oyedwa ngoxhumano ngalunye

Ifomethi yephrofayili inquma ukuthi iyiphi ihlelo elingayisebenzisa. Iphrofayili ye-OpenVPN idinga i-OpenVPN noma isengezo esihambisanayo, futhi ukulungiselelwa kwe-WireGuard kunefomethi yayo enokhiye bozakwabo neziqalo ezivunyelwe. Ibhokisi lokungenisa alihumushi elilodwa kwelinye, noma ngabe isandiso sefayela sibonisa ini.

Khetha umphathi oyedwa bese uwuyekela ukuthi ube ngumnikazi woxhumano. Ukuphakamisa umhubhe ofanayo ngamathuluzi amabili kwenza ithebula lemizila nokuziphatha kokuxhuma kabusha kungacaci, futhi eyesibili eqalayo ngokuvamile iyaphumelela ngezindlela okunzima ukuziphindaphinda.

Faka amaphakethe asekelwa ukusatshalaliswa kwakho futhi uthole iphrofayili kumqhubi. Yiphathise njengobufakazi bokungena, ngoba ngokuvamile iqukethe ukhiye oyimfihlo noma into elinganayo, futhi uyigcine lapho ezinye izimfihlo zakho zihlala khona. Iphrofayili eshiywe kufolda yokulanda ukhiye oshiywe etafuleni.

Yini okufanele uyihlole uma isiphakamile kodwa ingasebenzi

Uma i-interface isiphakamile futhi iklayenti ibika impumelelo, sebenza uye ngaphandle: ingabe ithebula lemizila likhetha umhubhe wendawo oya kuyo, ingabe isixazululi siyaphendula egameni langasese, futhi ingabe uhlangothi olukude lunendlela yokubuya. Ngakunye kunomyalo wakho nomnikazi wakho.

nmcli connection show --active
nmcli device status
wg show

Incwadi ye-nmcli ibhala imiyalo yesimo noxhumano uma udinga isethi ephelele. Okubalulekile lapha umehluko phakathi kwephrofayili esebenzayo nedivayisi ethwala ithrafikhi, ngoba zombili zingase zingavumelani.

Xhuma kabusha kanye ngomphathi ofanayo ngaphambi kokuthi uthi ukusetha kuphelile, futhi uhlole ukuthi i-DNS isasebenza ngemva kokunqamuka. Ukulungiselelwa okusebenza kuphela kuze kufike ushintsho lokuqala lwenethiwekhi akukapheli, kusebenza nje okwamanje.