Ingabe umzila ufanele ube kuphi ku-OpenVPN: kuklayenti noma kuseva?
Umzila ongenalutho kucongesto yeseva ushintsha iseva, hhayi iklayenti. Khetha ifayela leklayenti, i-push ehlanganisiwe noma i-push yeklayenti elilodwa, bese uhlola ukuthi kufike ini.
Ufaka i-route 10.60.0.0 255.255.255.0 kucongesto yeseva, uqala kabusha, uxhuma kabusha ikhompyutha ephathwayo, futhi i-subnet ayikwazi ukufinyeleleka kusukela kuleyo khompyutha. Umugqa wamukelwe, isevisi yaqala ngokuhlanzekile, futhi akukho okubonakala kungalungile kurekhodi. Okwenzekayo ukuthi umzila wafakwa emshinini owuhlelile: isango manje likholelwa ukuthi lingafinyelela leso siqalo, kuyilapho iklayenti lingatshelwanga lutho. Indawo iwumbuzo wonke, futhi kunezindawo ezine lapho umugqa ofanayo ungahlala khona.
Izindawo ezine nokuthi ngubani owamukela ngayinye
Umzila ungezwa ngecongesto yeklayenti uqobo, unikezwe kuklayenti ngayinye nge-push ehlanganisiwe, unikezwe kuklayenti elilodwa ngefayela elikhethekile leklayenti, noma ubhalwe kumongo womzila weseva uqobo.
Lezi zimo ezine zisebenzisa isakhiwo esicishe sifane futhi zinikeza imiphumela ehluke ngokuphelele. Ezintathu zokuqala zithinta lokho iklayenti elikuthumelayo emhubheni; eyesine ithinta indlela iseva efinyelela ngayo inethiwekhi, okuwusizo lapho iseva ngokwayo idinga indlela futhi kuyingozi lapho kudidaniswa nokwabiwa.
Nquma ukuthi iyiphi kwezine oyifunayo ngaphambi kokubhala umugqa, bese uqinisekisa umamukeli.
| Placement | Effect | Receiver |
|---|---|---|
| Client profile route | Installed by the client at connect | That client only |
Global push "route ..." | Sent to every client that accepts pushed options | All pulling clients |
| Client-specific push | Sent to the matching client context | One identity |
| Server config route, no push | Added to the server's own table | The gateway itself |
Kungani umzila weseva ongenalutho umangaza abantu
Icongesto yeseva iyindawo abaphathi abayibheka kuqala, futhi umyalo womzila lapho ufundeka njengesitatimende mayelana nenethiwekhi ye-VPN. Akunjalo. OpenVPN iwuthatha njengokufakwa komzila wendawo emshinini lapho i-daemon isebenza khona, okuyizinga elifanayo loshintsho ongalwenza nge-ip route bese ulikhohlwa.
Ukwabiwa kudinga ukuthi umzila u-pushwe, futhi i-push idinga ukuthi iklayenti ulidonse. Iklayenti eliqalwa nezinketho ezidonsiwe zivaliwe liziba ngokuphelele isithembiso. Hlola zombili iziphetho zalokho kubambisana kwesandla ngaphambi kokubhala kabusha ifayela leseva, ngoba irekhodi leseva ngeke likhononde: ngasohlangothini lwayo isithembiso sithunyelwe. Umzila owamukelwe futhi uqala ukusebenza ekuxhumekeni okulandelayo kuphela, hhayi nakanye kuseshini osekuyo kakade.
Uma usuzibona zombili njengemisebenzi ehlukene, ukwehluleka akuyona imfihlakalo: iseva ifinyelela isiqalo, iklayenti alikwazi, futhi zombili izitatimende ziyiqiniso ngesikhathi esisodwa.
Amafayela eklayenti ngalinye kanye nobuwena abuhambisana nabo
Ifayela elikhethekile leklayenti liqanjwa ngobuwena iseva eyakuqinisekisa, okungokwezenzakalo igama elivamile lesitifiketi. Igama lokuxhumana elinomusa kuklayenti yedeskithophu akulona lelo nani, futhi ukungafani kukhiqiza ifayela elingakaze lifundwe.
Hlola uhla lwamafayela iseva elusebenzisa ngempela, bese uqinisekisa ukuthi igama lefayela lihambisana ngqo nobuwena obuqinisekisiwe, kufaka phakathi izinhlamvu ezinkulu nezincane.
grep -n 'client-config-dir' /etc/openvpn/server/server.conf
ls -l /etc/openvpn/ccd/Ngaphakathi kwalelo fayela umzila usadinga uku-pushwa, ngoba umongo weklayenti ngalinye iqoqo lezinketho ezisetshenziswa kuseshini yalelo klayenti, hhayi ithebula lomzila wasekhaya. Umzila ongenalutho lapho unenkinga efanayo nomzila ongenalutho kufayela elihlanganisiwe.
Ifayela leklayenti uqobo kanye nethuluzi eliliphethe
Umzila obekwe kucongesto yeklayenti uyafakwa lapho lelo klayenti lixhuma futhi uyasuswa lapho linqamuka, okuwumjikelezo wempilo ofanele wendawo eqinile.
Uma umphathi wenethiwekhi ungumnikazi wephrofayela, angase angenise lezo zinketho kanye bese egcina ikhophi yakhe. Ukuhlela ifayela elilandiwe kamuva akushintshi lutho, okuyisizathu esivamile se-"umzila ukhona kodwa awusebenzi".
Hlola iphrofayela esebenzayo esikhundleni sefayela olilande, futhi uhlole izilungiselelo ezingenisiwe umphathi azibonisa. Bese uxhuma futhi ubuze isistimu ukuthi iyiphi indlela ikheli elithile eliyisebenzisayo, esikhundleni sokucabanga ukuthi umhubhe unqobile ngoba umzila wawukhona efayeleni lombhalo.
Qinisekisa kuklayenti, bese uhlola indlela yokubuya
Buza ithebula lomzila leklayenti uqobo mayelana nendawo ekuyiwa kuyo, hhayi leleseva. Ukusesha umsingathi oyedwa ngaphakathi kwesiqalo kwanele ukukhombisa isixhumanisi kanye negxathu elilandelayo elizosetshenziswa.
ip route get 10.60.0.10Uma ukusesha kukhomba kumhubhe, ukwabiwa kusebenzile futhi inkinga esele kwenye indawo. Uma kukhomba kusango elizenzakalelayo, umzila awufakwanga, wahlungwa yinketho yohlangothi lweklayenti, noma ungowephrofayela iklayenti elingayisebenzisi.
Ake sithi ukwabiwa kusebenzile futhi akukho okuphendulayo: khona-ke hlola ukudluliswa phambili kusango, indlela yokubuya yohlangothi olunye, kanye nanoma iyiphi i-firewall phakathi kwazo. Umzila ukhetha indlela, awunikezi ukufinyelela.