- Ukusetshenziswa kwemigudu ebethelwe kusetshenziswa izinqubo ze-SSL/TLS ukuqinisekisa ubumfihlo bedatha ephelele.
- Ukuguquguquka kokucushwa phakathi kwamamodi e-TUN okuqondisa umugqa wesi-3 kanye namamodi e-TAP okuhlanganisa umugqa wesi-2.
- Ukuphathwa kokuqinisekiswa okuqinile okusekelwe ku-Public Key Infrastructure (PKI) enezitifiketi zedijithali.
- Ukuthuthukiswa kokusebenza ngokusebenzisa i-UDP kanye nobuchwepheshe besimanje njenge-Data Channel Offload (DCO).
Namuhla, ukuvikela umkhondo wethu wedijithali nokugcina ubumfihlo cishe akunakwenzeka uma singalawuli. Enye yezindlela ezinhle kakhulu zokuvikela uxhumano lwethu ukusetha iseva yethu ye-VPN , esivumela ukuthi sakhe umhubhe ophephile phakathi kwamadivayisi ethu nenethiwekhi yethu yendawo, ngaphandle kokuthembela kubantu besithathu abangase bahlole idatha yethu. Uma unokungabaza ngokusebenza, ungahlaziya ukuthi i- VPN yangokwezifiso uma iqhathaniswa neyentengiso iyindlela engcono kakhulu yobumfihlo bakho.
Uma udidekile kancane ngamagama obuchwepheshe, ungakhathazeki, sizochaza yonke inqubo lapha. I-OpenVPN iyithuluzi eliyinhloko lalokhu ngoba ingumthombo ovulekile, iguquguquka kakhulu, futhi, yize kuthatha isikhathi ukujwayela ekuqaleni, inikeza ukulawula okuphelele kokuthi ubani ongena kunethiwekhi yakho nokuthi ulwazi olubethelwe luhamba kanjani.
Imiqondo Eyisisekelo Nokusebenza
Ngaphambi kokuthi singene emininingwaneni, kubalulekile ukuqonda ukuthi i-VPN (Virtual Private Network) empeleni iyisandiso senethiwekhi yakho yendawo (i-LAN) ngenethiwekhi yomphakathi njenge-inthanethi. Ukuze kufezwe lokhu, i-OpenVPN isebenzisa izixhumanisi ezibethelwe ngokusekelwe ezindinganisweni ze-SSL ne-TLS , ukuqinisekisa ukuthi noma yimuphi umdubuli noma umthungi ozama ukubamba ithrafikhi uzobona kuphela umsindo ongafundeki.
Iphuzu elibalulekile ukunquma ngemodi yokusebenza. Imodi ye -TUN (Tunnel) iyona evame kakhulu, njengoba ilingisa idivayisi ye-point-to-point Layer 3, efanelekela ukuqondisa ithrafikhi ye-IP. Ngakolunye uhlangothi, imodi ye -TAP (Bridge) ilingisa ikhadi le-Ethernet le-Layer 2, okuvumela amaklayenti ukuthi abonakale sengathi asebenzisa i-subnet efanayo ngokomzimba, okuwusizo kakhulu kumaphrothokholi angewona e-IP noma imidlalo emidala.
Okudingekayo kanye ne-Hardware
Ukuze lokhu kusebenze, udinga iseva. Lokhu kungaba yi-Windows 10 PC, iseva ye-Debian esebenzisa i-Linux, i-Raspberry Pi, noma ngisho ne-VPS efwini uma ukhetha ukungabi nehadiwe ekhaya. Ukuxhumeka kwe-inthanethi okuzinzile kubalulekile , futhi uma ufuna ukukufinyelela ungaphandle kwekhaya lakho, uzodinga ikheli le-IP lomphakathi. Uma umhlinzeki wakho wesevisi ye-inthanethi ekusekela i -CG-NAT , uzoba nezinkinga zokuvula amachweba, ngakho-ke ngincoma ukuthi uxhumane nabo ukuze ucele ikheli le-IP lomphakathi langempela.
Ukucushwa Kwezindawo Ze-Windows
Ukuze usethe iseva ku-Windows, isinyathelo sokuqala ukulanda isifaki esisemthethweni se-OpenVPN. Ngesikhathi senqubo yokufaka, kubalulekile ukuthi uthikhe ibhokisi le- EasyRSA 2 Certificate Management Scripts , njengoba lokhu kubalulekile ekudaleni okhiye bokuphepha. Uma isifakiwe, isofthiwe idala i-adapter ye-TAP ebonakalayo, ezophatha ikheli le-IP le-VPN.
Ingxenye enzima kakhulu ukudala izitifiketi. Sisebenzisa umyalo wesinyathelo njengomphathi, kumele sizulazulele kufolda ye-Easy-RSA bese siqhuba imiyalo efana ne -`init-config` bese sihlela ifayela le-`vars.bat` ukuze sifake ulwazi lwethu. Bese, sikhiqiza i-Certificate Authority (CA), ukhiye weseva, kanye namapharamitha e-Diffie-Hellman (dh), avumela iseva kanye neklayenti ukuthi bavumelane ngokhiye oyimfihlo ngaphandle kokuwushintshanisa ngaphambilini.
Ngokuphathelene nefayela lokucushwa (.ovpn), kufanele uchaze iphrothokholi (ngokuvamile i-UDP ngoba ishesha futhi imelana kakhulu nokuhlaselwa kwe-DoS), imbobo (ejwayelekile ingu-1194), kanye nezindlela eziya ezitifiketini ezidaliwe. Ungakhohlwa ukumisa ububanzi bekheli le-IP iseva ezolinika amaklayenti, isibonelo, ingxenye engu -10.8.0.0/24 , ukuze ugweme ukungqubuzana nenethiwekhi yakho yasekhaya.
Ukusetshenziswa ku-GNU/Linux (Debian)
Ku-Linux, inqubo ilula kakhulu sisebenzisa i-terminal. Sifaka iphakheji nge apt install openvpn futhi sisebenzisa I-Easy-RSA 3 ngokuphathwa kwe-PKI. Lapha singakhetha ukuphepha okuphezulu sisebenzisa Amajika e-Elliptical (EC) nge-algorithm ye-secp521r1 kanye nama-signature e-SHA512, okunciphisa umthwalo wokucubungula futhi kwandisa ukuqina kokubethela.
Uma izitifiketi zeseva nezeklayenti sezikhiqizwe, sidala ifayela server.confKunconywa ukwengeza isiqondiso tls-crypt Ukuze sivikele isiteshi sokulawula futhi sivimbele ukuhlaselwa kokunqatshelwa kwenkonzo, kumelwe sikwenze kube lula ukuze amakhasimende akwazi ukufinyelela kwamanye amadivayisi endlini. Ukudlulisela phambili i-IP (ip_forward) ku-kernel ye-Linux, okuvumela iseva ukuthi isebenze njengebhuloho eliya kunethiwekhi yendawo. Ukuze uqinise ukuvikelwa, ungafunda Indlela yokusetha i-Fail2Ban ukuze uvikele iseva yakho ye-Linux.
Izindlela Ezisheshayo Nezixazululo Zebhizinisi
Uma ungafuni ukuhlushwa yi-console, kunezikripthi zokufaka okuzenzakalelayo (njenge-edumile openvpn-install.sh) ezilungiselela konke ngemizuzwana embalwa ku-VPS. Kukhona futhi Iseva Yokufinyelela ye-OpenVPN, inguqulo ene-interface yewebhu enembile kakhulu evumela ukuthi uphathe abasebenzisi futhi ulande amaphrofayili amakhasimende ngaphandle kokuthinta umugqa owodwa wekhodi.
Kulabo abafuna ukusebenza okudlulele, isici esisha se-Data Channel Offload (DCO) esihlanganiswe kuma-kernel e-Linux yesimanje sihambisa ukubethela ku-core yesistimu, siphinde kabili isivinini sokudlulisa futhi sinciphise kakhulu ukusetshenziswa kwe-CPU. Uma lokhu kubonakala kuyinkimbinkimbi kakhulu, kunezinye izindlela ezifana nokusetha i-VPN nge-WireGuard ku-Raspberry Pi , okuyinto yesimanje futhi esheshayo, yize i-OpenVPN ihlala iyinkosi maqondana nokuhambisana nokwenza ngokwezifiso.
Ukuxhumana Nokufinyelela Okukude
Ukuze uvumele umhlaba wangaphandle ukuthi uthole iseva yakho, udinga ukufinyelela izilungiselelo ze-router yakho bese ulungiselela ukudluliselwa kwe-port ye-UDP port 1194 ekhelini le-IP elingaguquki leseva yakho. Uma ikheli lakho le-IP lomphakathi lishintsha njalo, kungcono ukusetha isevisi ye-Dynamic DNS (DDNS) njenge-No-IP noma i-DynDNS. Lokhu kuzokuvumela ukuthi uxhume usebenzisa igama (isb., myhome.ddns.net) esikhundleni sekheli le-IP lezinombolo.
Ngasohlangothini lweklayenti, kungakhathaliseki ukuthi ku-Windows, Android, noma iOS, udinga ukungenisa ifayela le -.ovpn kanye nezitifiketi ezihambisanayo kuphela. Kubalulekile ukuqinisekisa ukuthi i-cipher iyafana kuzo zombili izinhlangothi, isibonelo, i-AES-256-GCM , ukuze ugweme amaphutha okuxhawulana noma ukwehluleka kokuqinisekisa ngesikhathi sokumiswa kwemigudu.
Ukuxazulula Okujwayelekile
Kuvamile ukuthi into ethile ihambe kabi okokuqala. Uma iklayenti libambeke esimweni sokulinda, kungenzeka kakhulu ukuthi i -Windows firewall noma i-router ivimba i-port. Ukuze wenze lokhu kube ngcono, ungahlola izilungiselelo ze-firewall ezithuthukisiwe kumaseva . Uma ubona imiyalezo ethi "TLS Error", qinisekisa ukuthi ifayela le-ta.key liyafana kokubili kuseva nakuklayenti. Okokugcina, uma uxhumano lumisiwe kodwa ungakwazi ukufinyelela inethiwekhi yendawo, hlola ukuthi udale umzila ongaguquki ku-router yakho okhomba ikheli le-IP leseva ye-VPN.
Ukusetha iseva ye-OpenVPN yendawo kuguqula noma iyiphi ikhompyutha elula ibe yindawo yobumfihlo, kusiza ukufinyelela okukude okuphephile kumafayela, amakhamera e-IP, noma amaphrinta ngaphandle kokuwabeka ngqo kwi-inthanethi. Kungakhathaliseki ukuthi ukhetha ukucushwa okuningiliziwe ngesandla ukuze ulawule ngokuphelele, usebenzisa izikripthi ezenzakalelayo ku-VPS, noma uyisebenzisa kuma-router ahambisanayo, isihluthulelo sisekuphathweni kwesitifiketi okufanele kanye nokudluliselwa kwephothi okunembile ku-firewall.
