Apa sampeyan pengin nggunakake Linux ing kantor, nanging VPN perusahaan sampeyan ora ngidini sampeyan? Banjur artikel iki bisa mbantu, sanajan iki ora mesthi. Aku pengin ngelingake sampeyan luwih dhisik yen aku ora ngerti masalah administrasi jaringan, mula bisa uga aku nindakake kabeh sing salah. Ing sisih liya, bisa uga aku bisa nulis pandhuan kanthi cara sing bisa dingerteni wong biasa, mula aku menehi saran supaya sampeyan nyoba.
Artikel kasebut ngemot akeh informasi sing ora perlu, nanging tanpa kawruh iki, aku ora bakal bisa ngatasi masalah sing ora dikarepke katon kanggo aku kanthi nyetel VPN. Aku sing sapa nyoba kanggo nggunakake pandhuan iki bakal duwe masalah sing aku ora duwe, lan aku ngarep-arep sing informasi tambahan iki bakal bantuan kanggo ngatasi masalah iki dhewe.
Umume prentah sing digunakake ing pandhuan iki kudu ditindakake liwat sudo, sing wis dibusak kanthi ringkes. Di eling-eling.
Umume alamat IP wis kabur banget, dadi yen sampeyan ndeleng alamat kaya 435.435.435.435, mesthine ana sawetara IP normal, khusus kanggo kasus sampeyan.
Aku duwe Ubuntu 18.04, nanging aku mikir kanthi owah-owahan cilik, pandhuan kasebut bisa ditrapake kanggo distribusi liyane. Nanging, ing teks iki Linux == Ubuntu.
Cisco Nyambung
Sing ana ing Windows utawa MacOS bisa nyambung menyang VPN perusahaan liwat Cisco Connect, sing kudu nemtokake alamat gateway lan, saben sampeyan nyambungake, ketik sandhi sing kalebu bagean tetep lan kode sing digawe dening Google Authenticator.
Ing cilik saka Linux, Aku ora bisa Cisco Connect mlaku, nanging aku ngatur kanggo google rekomendasi nggunakake openconnect, digawe khusus kanggo ngganti Cisco Connect.
Openconnect
Ing teori, Ubuntu duwe antarmuka grafis khusus kanggo openconnect, nanging ora bisa digunakake kanggo aku. Mungkin luwih apik.
Ing Ubuntu, openconnect diinstal saka manajer paket.
apt install openconnectSanalika sawise instalasi, sampeyan bisa nyoba nyambung menyang VPN
openconnect --user poxvuibr vpn.evilcorp.comvpn.evilcorp.com minangka alamat VPN fiktif
poxvuibr - jeneng panganggo fiktif
openconnect bakal njaluk sampeyan ngetik sandhi, sing, supaya aku ngelingake sampeyan, kalebu bagean tetep lan kode saka Google Authenticator, banjur bakal nyoba nyambung menyang vpn. Yen bisa, Sugeng, sampeyan bisa kanthi aman skip tengah, kang akèh pain, lan pindhah menyang titik bab openconnect mlaku ing latar mburi. Yen ora bisa, sampeyan bisa nerusake. Sanajan bisa digunakake nalika nyambungake, umpamane, saka Wi-Fi tamu ing kantor, mula bisa uga luwih awal kanggo bungah, sampeyan kudu nyoba mbaleni prosedur kasebut saka omah.
Sertifikat
Ana kemungkinan gedhe yen ora ana sing bakal diwiwiti, lan output openconnect bakal katon kaya iki:
POST https://vpn.evilcorp.com/
Connected to 777.777.777.777:443
SSL negotiation with vpn.evilcorp.com
Server certificate verify failed: signer not found
Certificate from VPN server "vpn.evilcorp.com" failed verification.
Reason: signer not found
To trust this server in future, perhaps add this to your command line:
--servercert sha256:4444444444444444444444444444444444444444444444444444444444444444
Enter 'yes' to accept, 'no' to abort; anything else to view: fgets (stdin): Operation now in progressIng tangan siji, iki ora nyenengake, amarga ora ana sambungan menyang VPN, nanging ing tangan liyane, carane ndandani masalah iki, ing asas, cetha.
Ing kene server ngirim sertifikat, sing bisa nemtokake manawa sambungan kasebut digawe menyang server perusahaan asli, lan ora menyang scammer ala, lan sertifikat iki ora dingerteni kanggo sistem kasebut. Lan mulane dheweke ora bisa mriksa apa server kasebut nyata utawa ora. Dadi, mung ing kasus, iku mandheg bisa digunakake.
Supaya openconnect bisa nyambung menyang server, sampeyan kudu ngandhani kanthi jelas sertifikat endi sing kudu teka saka server VPN nggunakake tombol —servercert
Lan sampeyan bisa ngerteni sertifikat sing dikirim server langsung saka apa sing dicithak openconnect. Mangkene saka potongan iki:
To trust this server in future, perhaps add this to your command line:
--servercert sha256:4444444444444444444444444444444444444444444444444444444444444444
Enter 'yes' to accept, 'no' to abort; anything else to view: fgets (stdin): Operation now in progressKanthi printah iki sampeyan bisa nyoba kanggo nyambung maneh
openconnect --servercert sha256:4444444444444444444444444444444444444444444444444444444444444444 --user poxvuibr vpn.evilcorp.comMbok saiki wis bisa, banjur sampeyan bisa nerusake kanggo mburi. Nanging kanthi pribadi, Ubunta nuduhake anjir ing wangun iki
POST https://vpn.evilcorp.com/
Connected to 777.777.777.777:443
SSL negotiation with vpn.evilcorp.com
Server certificate verify failed: signer not found
Connected to HTTPS on vpn.evilcorp.com
XML POST enabled
Please enter your username and password.
POST https://vpn.evilcorp.com/
Got CONNECT response: HTTP/1.1 200 OK
CSTP connected. DPD 300, Keepalive 30
Set up DTLS failed; using SSL instead
Connected as 192.168.333.222, using SSL
NOSSSSSHHHHHHHDDDDD
3
NOSSSSSHHHHHHHDDDDD
3
RTNETLINK answers: File exists
/etc/resolvconf/update.d/libc: Warning: /etc/resolv.conf is not a symbolic link to /run/resolvconf/resolv.conf/etc/resolv.conf
# Generated by NetworkManager
search gst.evilcorpguest.com
nameserver 127.0.0.53/run/resolvconf/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
# 127.0.0.53 is the systemd-resolved stub resolver.
# run "systemd-resolve --status" to see details about the actual nameservers.
nameserver 192.168.430.534
nameserver 127.0.0.53
search evilcorp.com gst.publicevilcorp.comhabr.com bakal mutusake masalah, nanging sampeyan ora bisa menyang kono. Alamat kaya jira.evilcorp.com ora dirampungake.
Apa sing kedadeyan ing kene ora jelas kanggo aku. Nanging eksperimen nuduhake yen sampeyan nambah baris kanggo /etc/resolv.conf
nameserver 192.168.430.534banjur alamat nang VPN bakal wiwiti magis mutusake masalah lan sampeyan bisa lumaku liwat wong-wong mau, sing, apa DNS nggoleki kanggo mutusake masalah alamat katon khusus ing /etc/resolv.conf, lan ora nang endi wae liya.
Sampeyan bisa verifikasi manawa ana sambungan menyang VPN lan bisa digunakake tanpa owah-owahan menyang /etc/resolv.conf; kanggo nindakake iki, mung ketik ing browser dudu jeneng simbolis sumber daya saka VPN, nanging alamat IP.
Akibaté, ana rong masalah
- Nalika nyambung menyang VPN, dns ora dijupuk
- kabeh lalu lintas dadi liwat VPN, kang ora ngidini akses menyang Internet
Aku bakal pitutur marang kowe apa sing kudu dilakoni saiki, nanging pisanan otomatisasi cilik.
Entri otomatis bagean tetep saka sandhi
Saiki, kemungkinan sampeyan wis ngetik sandhi paling ora kaping lima lan prosedur iki wis kesel sampeyan. Kaping pisanan, amarga sandhi dawa, lan kaloro, amarga nalika ngetik sampeyan kudu pas ing wektu sing tetep
Solusi pungkasan kanggo masalah kasebut ora kalebu ing artikel kasebut, nanging sampeyan bisa nggawe manawa bagean tetep saka tembung sandhi ora kudu dilebokake kaping pirang-pirang.
Ayo dadi ngomong bagean tetep saka sandi iku fixedPassword, lan bagean saka Google Authenticator 567 987. Kabeh sandi bisa liwati kanggo openconnect liwat input standar nggunakake argumen --passwd-on-stdin .
echo "fixedPassword567987" | openconnect --servercert sha256:4444444444444444444444444444444444444444444444444444444444444444 --user poxvuibr vpn.evilcorp.com --passwd-on-stdinSaiki sampeyan bisa terus bali menyang printah pungkasan lan ngganti mung bagean saka Google Authenticator ing kana.
VPN perusahaan ora ngidini sampeyan njelajah Internet.
Umumé, ora trep banget nalika sampeyan kudu nggunakake komputer kapisah kanggo pindhah menyang Habr. Ora bisa nyalin-tempel saka stackoverfow umume bisa nglumpukake karya, mula ana sing kudu ditindakake.
Kita kudu piye wae ngatur supaya yen sampeyan kudu ngakses sumber daya saka jaringan internal, Linux menyang VPN, lan nalika sampeyan kudu pindhah menyang Habr, iku menyang Internet.
openconnect, sawise mbukak lan nggawe sambungan karo vpn, nglakokaké script khusus, kang dumunung ing /usr/share/vpnc-scripts/vpnc-script. Sawetara variabel diterusake menyang skrip minangka input, lan ngatur VPN. Sayange, aku ora bisa ngerti carane mbagi arus lalu lintas antarane VPN perusahaan lan liyane saka Internet nggunakake script native.
Ketoke, sarana vpn-slice dikembangake utamane kanggo wong kaya aku, sing ngidini sampeyan ngirim lalu lintas liwat rong saluran tanpa nari nganggo rebana. Yaiku, sampeyan kudu nari, nanging sampeyan ora kudu dadi dukun.
Pemisahan lalu lintas nggunakake vpn-slice
Kaping pisanan, sampeyan kudu nginstal vpn-slice, sampeyan kudu ngerti dhewe. Yen ana pitakon ing komentar, aku bakal nulis kiriman sing kapisah babagan iki. Nanging iki program Python biasa, supaya ora ana kangelan. Aku nginstal nggunakake virtualenv.
Banjur sarana kasebut kudu diterapake, nggunakake saklar -script, nuduhake openconnect yen tinimbang skrip standar, sampeyan kudu nggunakake vpn-slice
echo "fixedPassword567987" | openconnect --servercert sha256:4444444444444444444444444444444444444444444444444444444444444444 --user poxvuibr --passwd-on-stdin
--script "./bin/vpn-slice 192.168.430.0/24 " vpn.evilcorp.com --script liwati string karo printah sing kudu disebut tinimbang script. ./bin/vpn-slice - path menyang vpn-slice file eksekusi 192.168.430.0/24 - topeng alamat kanggo pindhah menyang vpn. Ing kene, tegese yen alamat kasebut diwiwiti kanthi 192.168.430, mula sumber karo alamat iki kudu digoleki ing VPN.
Kahanan saiki kudu meh normal. meh. Saiki sampeyan bisa pindhah menyang Habr lan sampeyan bisa pindhah menyang sumber intra-perusahaan dening ip, nanging sampeyan ora bisa pindhah menyang sumber intra-perusahaan kanthi jeneng simbolis. Yen sampeyan nemtokake pertandhingan antarane jeneng simbolis lan alamat ing host, kabeh kudu bisa. Lan kerja nganti ip ganti. Linux saiki bisa ngakses Internet utawa intranet, gumantung saka IP. Nanging DNS non-perusahaan isih digunakake kanggo nemtokake alamat kasebut.
Masalah kasebut uga bisa diwujudake ing wangun iki - ing karya kabeh apik, nanging ing omah sampeyan mung bisa ngakses sumber daya perusahaan internal liwat IP. Iki amarga nalika sampeyan disambungake menyang Wi-Fi perusahaan, DNS perusahaan uga digunakake, lan alamat simbolis saka VPN ditanggulangi, senadyan kasunyatan sing isih mokal kanggo pindhah menyang alamat kasebut tanpa nggunakake VPN.
Modifikasi otomatis file host
Yen vpn-slice dijaluk kanthi sopan, banjur sawise ngunggahake VPN, bisa pindhah menyang DNS, goleki alamat IP sumber daya sing dibutuhake kanthi jeneng simbolis lan ketik ing host. Sawise mateni VPN, alamat kasebut bakal dibusak saka host. Kanggo nindakake iki, sampeyan kudu ngirim jeneng simbolis menyang vpn-slice minangka argumen. Kaya iki.
echo "fixedPassword567987" | openconnect --servercert sha256:4444444444444444444444444444444444444444444444444444444444444444 --user poxvuibr --passwd-on-stdin
--script "./bin/vpn-slice 192.168.430.0/24 jira.vpn.evilcorp.com git.vpn.evilcorp.com " vpn.evilcorp.com Saiki kabeh kudu bisa digunakake ing kantor lan ing pantai.
Telusuri alamat kabeh subdomain ing DNS sing diwenehake dening VPN
Yen ana sawetara alamat ing jaringan, banjur pendekatan kanthi otomatis ngowahi file host bisa mlaku kanthi apik. Nanging yen ana akeh sumber daya ing jaringan, sampeyan kudu terus-terusan nambah garis kaya zoidberg.test.evilcorp.com kanggo script zoidberg jeneng salah siji bangku test.
Nanging saiki kita ngerti sethithik kenapa kabutuhan iki bisa diilangi.
Yen, sawise mundhakaken VPN, sampeyan katon ing /etc/hosts, sampeyan bisa ndeleng baris iki
192.168.430.534 dns0.tun0 # vpn-slice-tun0 OTOMATIS
Lan baris anyar ditambahake kanggo resolv.conf. Ing cendhak, vpn-slice piye wae nemtokake ngendi server dns kanggo vpn dumunung.
Saiki kita kudu nggawe manawa kanggo ngerteni alamat IP saka jeneng domain sing pungkasan ing evilcorp.com, Linux menyang DNS perusahaan, lan yen ana sing dibutuhake, banjur menyang standar.
Aku Googled kanggo sawetara wektu lan ketemu sing fungsi kuwi kasedhiya ing Ubuntu metu saka kothak. Iki tegese kemampuan kanggo nggunakake dnsmasq server DNS lokal kanggo mutusake masalah jeneng.
Yaiku, sampeyan bisa mesthekake yen Linux tansah pindhah menyang server DNS lokal kanggo alamat IP, sing siji, gumantung saka jeneng domain, bakal nggoleki IP ing server DNS eksternal sing cocog.
Kanggo ngatur kabeh related kanggo jaringan lan sambungan jaringan, Ubuntu nggunakake NetworkManager, lan antarmuka grafis kanggo milih, Contone, sambungan Wi-Fi mung ngarep mburi.
Kita kudu menek ing konfigurasi.
- Nggawe file ing /etc/NetworkManager/dnsmasq.d/evilcorp
alamat =/.evilcorp.com/192.168.430.534
Pay manungsa waé menyang titik ing ngarepe evilcorp. Iki menehi tandha dnsmasq yen kabeh subdomain saka evilcorp.com kudu digoleki ing dns perusahaan.
- Marang NetworkManager nggunakake dnsmasq kanggo resolusi jeneng
Konfigurasi network-manager dumunung ing /etc/NetworkManager/NetworkManager.conf Sampeyan kudu nambah ing kono:
[utama] dns=dnsmasq
- Wiwiti maneh NetworkManager
service network-manager restartSaiki, sawise nyambung menyang VPN nggunakake openconnect lan vpn-slice, ip bakal ditemtokake kanthi normal, sanajan sampeyan ora nambah alamat simbolis menyang argumen menyang vpnslice.
Cara ngakses layanan individu liwat VPN
Sawise aku bisa nyambung menyang VPN, aku seneng banget sajrone rong dina, banjur ternyata yen aku nyambung menyang VPN saka njaba jaringan kantor, banjur mail ora bisa. Gejala kasebut wis dikenal, ta?
Mail kita dumunung ing mail.publicevilcorp.com, tegese ora ana ing aturan ing dnsmasq lan alamat server mail digoleki liwat DNS umum.
Nah, kantor isih nggunakake DNS, sing ngemot alamat iki. Sing tak pikir. Ing kasunyatan, sawise nambah baris kanggo dnsmasq
alamat=/mail.publicevilcorp.com/192.168.430.534
kahanan ora owah babar pisan. ip tetep padha. Aku kudu mangkat kerja.
Lan mung mengko, nalika aku nyelidiki kahanan sing luwih jero lan ngerti masalah kasebut, ana wong sing pinter ngandhani carane ngatasi. Sampeyan perlu kanggo nyambung menyang server mail ora mung iku, nanging liwat VPN
Aku nggunakake vpn-slice kanggo pindhah liwat VPN kanggo alamat sing diwiwiti karo 192.168.430. Lan server mail ora mung alamat simbolis sing dudu subdomain saka evilcorp, nanging uga ora duwe alamat IP sing diwiwiti karo 192.168.430. Lan mesthi dheweke ora ngidini sapa wae saka jaringan umum teka marang dheweke.
Supaya Linux bisa liwat VPN lan server mail, sampeyan uga kudu nambah menyang vpn-slice. Contone, alamat pangirim yaiku 555.555.555.555.
echo "fixedPassword567987" | openconnect --servercert sha256:4444444444444444444444444444444444444444444444444444444444444444 --user poxvuibr --passwd-on-stdin
--script "./bin/vpn-slice 555.555.555.555 192.168.430.0/24" vpn.evilcorp.com Skrip kanggo ngunggahake VPN kanthi siji argumen
Kabeh iki, mesthi, ora trep banget. Ya, sampeyan bisa nyimpen teks menyang file lan nyalin-tempel menyang console tinimbang ngetik nganggo tangan, nanging isih ora nyenengake. Kanggo nggawe proses luwih gampang, sampeyan bisa mbungkus printah ing script sing bakal dumunung ing PATH. Banjur sampeyan mung kudu ngetik kode sing ditampa saka Google Authenticator
#!/bin/sh
echo "fixedPassword$1" | openconnect --servercert sha256:4444444444444444444444444444444444444444444444444444444444444444 --user poxvuibr --passwd-on-stdin
--script "./bin/vpn-slice 192.168.430.0/24 jira.vpn.evilcorp.com git.vpn.evilcorp.com " vpn.evilcorp.com Yen sampeyan sijine script ing connect~evilcorp~ sampeyan mung bisa nulis ing console
connect_evil_corp 567987Nanging saiki sampeyan isih kudu njaga console ing openconnect mbukak kanggo sawetara alasan
Mlaku openconnect ing latar mburi
Begjanipun, penulis openconnect njupuk care saka kita lan nambah tombol khusus kanggo program -background, kang ndadekake program bisa ing latar mburi sawise diluncurake. Yen sampeyan mbukak kaya iki, sampeyan bisa nutup konsol sawise diluncurake
#!/bin/sh
echo "fixedPassword$1" | openconnect --servercert sha256:4444444444444444444444444444444444444444444444444444444444444444
--user poxvuibr
--passwd-on-stdin
--background
--script "./bin/vpn-slice 192.168.430.0/24 jira.vpn.evilcorp.com git.vpn.evilcorp.com " vpn.evilcorp.com Saiki mung ora jelas menyang ngendi log kasebut. Umumé, kita ora butuh log, nanging sampeyan ora ngerti. openconnect bisa ngarahake menyang syslog, ing ngendi dheweke bakal tetep aman lan aman. sampeyan kudu nambah saklar –syslog menyang printah
#!/bin/sh
echo "fixedPassword$1" | openconnect --servercert sha256:4444444444444444444444444444444444444444444444444444444444444444
--user poxvuibr
--passwd-on-stdin
--background
--syslog
--script "./bin/vpn-slice 192.168.430.0/24 jira.vpn.evilcorp.com git.vpn.evilcorp.com " vpn.evilcorp.com Dadi, ternyata openconnect bisa digunakake ing endi wae ing latar mburi lan ora ngganggu sapa wae, nanging ora jelas carane mungkasi. Yaiku, sampeyan bisa, mesthi, nyaring output ps nggunakake grep lan goleki proses sing jenenge ngemot openconnect, nanging iki pancen angel. Thanks kanggo penulis sing uga mikir babagan iki. Openconnect nduweni tombol -pid-file, sing sampeyan bisa nglatih openconnect kanggo nulis pengenal proses menyang file.
#!/bin/sh
echo "fixedPassword$1" | openconnect --servercert sha256:4444444444444444444444444444444444444444444444444444444444444444
--user poxvuibr
--passwd-on-stdin
--background
--syslog
--script "./bin/vpn-slice 192.168.430.0/24 jira.vpn.evilcorp.com git.vpn.evilcorp.com " vpn.evilcorp.com
--pid-file ~/vpn-pidSaiki sampeyan bisa mateni proses kanthi printah
kill $(cat ~/vpn-pid)Yen ora ana proses, mateni bakal ngipat-ipati, nanging ora bakal mbuwang kesalahan. Yen file kasebut ora ana, mula ora ana sing bakal kelakon, supaya sampeyan bisa mateni proses kasebut kanthi aman ing baris pertama skrip.
kill $(cat ~/vpn-pid)
#!/bin/sh
echo "fixedPassword$1" | openconnect --servercert sha256:4444444444444444444444444444444444444444444444444444444444444444
--user poxvuibr
--passwd-on-stdin
--background
--syslog
--script "./bin/vpn-slice 192.168.430.0/24 jira.vpn.evilcorp.com git.vpn.evilcorp.com " vpn.evilcorp.com
--pid-file ~/vpn-pidSaiki sampeyan bisa nguripake komputer, mbukak console lan mbukak printah, maringaken kode saka Google Authenticator. Konsol banjur bisa dipaku mudhun.
Tanpa VPN-irisan. Tinimbang afterword
Ternyata angel banget kanggo ngerti carane urip tanpa VPN-iris. Aku kudu maca lan google akeh. Untunge, sawise mbuwang akeh wektu karo masalah, manual teknis lan malah wong openconnect maca kaya novel sing nyenengake.
Akibaté, aku ngerteni manawa vpn-slice, kaya skrip asli, ngowahi tabel rute kanggo misahake jaringan.
Tabel routing
Cukup, iki minangka tabel ing kolom pisanan sing ngemot alamat sing pengin dilewati Linux, lan ing kolom kapindho sing kudu diterusake adaptor jaringan ing alamat iki. Ing kasunyatan, ana liyane speaker, nanging iki ora ngganti inti.
Kanggo ndeleng tabel routing, sampeyan kudu mbukak printah rute ip
default via 192.168.1.1 dev wlp3s0 proto dhcp metric 600
192.168.430.0/24 dev tun0 scope link
192.168.1.0/24 dev wlp3s0 proto kernel scope link src 192.168.1.534 metric 600
192.168.430.534 dev tun0 scope link Kene, saben baris tanggung jawab kanggo ngendi sampeyan kudu pindhah kanggo ngirim pesen kanggo sawetara alamat. Kapisan yaiku katrangan saka ngendi alamat kudu diwiwiti. Kanggo mangerteni carane nemtokake manawa 192.168.0.0/16 tegese alamat kudu diwiwiti karo 192.168, sampeyan kudu google apa topeng alamat IP. Sawise dev ana jeneng adaptor sing ngirim pesen.
Kanggo VPN, Linux nggawe adaptor virtual - tun0. Baris kasebut njamin lalu lintas kanggo kabeh alamat sing diwiwiti kanthi 192.168
192.168.0.0/16 dev tun0 scope link Sampeyan uga bisa ndeleng kahanan saiki saka tabel nuntun nggunakake printah rute -n (Alamat IP kanthi pinter anonim) Printah iki ngasilake asil ing wangun sing beda lan umume ora digunakake, nanging output kasebut asring ditemokake ing manual ing Internet lan sampeyan kudu bisa maca.
Ngendi alamat IP kanggo rute kudu diwiwiti bisa dingerteni saka kombinasi kolom Tujuan lan Genmask. Bagean alamat IP sing cocog karo nomer 255 ing Genmask dianggep, nanging sing ana 0 ora. Yaiku, kombinasi Destination 192.168.0.0 lan Genmask 255.255.255.0 tegese yen alamat kasebut diwiwiti kanthi 192.168.0, mula panyuwunan kasebut bakal ngliwati rute kasebut. Lan yen Destination 192.168.0.0 nanging Genmask 255.255.0.0, banjur njaluk alamat sing diwiwiti karo 192.168 bakal ngliwati rute iki
Kanggo ngerteni apa sing ditindakake vpn-slice, aku mutusake kanggo ndeleng status tabel sadurunge lan sawise.
Sadurunge nguripake VPN kaya iki
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 222.222.222.1 0.0.0.0 UG 600 0 0 wlp3s0
222.222.222.0 0.0.0.0 255.255.255.0 U 600 0 0 wlp3s0
333.333.333.333 222.222.222.1 255.255.255.255 UGH 0 0 0 wlp3s0Sawise nelpon openconnect tanpa vpn-slice dadi kaya iki
route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 tun0
0.0.0.0 222.222.222.1 0.0.0.0 UG 600 0 0 wlp3s0
222.222.222.0 0.0.0.0 255.255.255.0 U 600 0 0 wlp3s0
333.333.333.333 222.222.222.1 255.255.255.255 UGH 0 0 0 wlp3s0
192.168.430.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
192.168.430.534 0.0.0.0 255.255.255.255 UH 0 0 0 tun0Lan sawise nelpon openconnect ing kombinasi karo vpn-slice kaya iki
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 222.222.222.1 0.0.0.0 UG 600 0 0 wlp3s0
222.222.222.0 0.0.0.0 255.255.255.0 U 600 0 0 wlp3s0
333.333.333.333 222.222.222.1 255.255.255.255 UGH 0 0 0 wlp3s0
192.168.430.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
192.168.430.534 0.0.0.0 255.255.255.255 UH 0 0 0 tun0Bisa dideleng yen sampeyan ora nggunakake vpn-slice, banjur openconnect kanthi tegas nulis yen kabeh alamat, kajaba sing dituduhake khusus, kudu diakses liwat vpn.
Teng mriki:
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 tun0Ing kana, ing jejere, dalan liyane langsung dituduhake, sing kudu digunakake yen alamat sing dicoba Linux ora cocog karo topeng saka meja.
0.0.0.0 222.222.222.1 0.0.0.0 UG 600 0 0 wlp3s0Wis ditulis ing kene yen ing kasus iki sampeyan kudu nggunakake adaptor Wi-Fi standar.
Aku pracaya yen path VPN digunakake amarga iku sing pisanan ing tabel nuntun.
Lan miturut teori, yen sampeyan mbusak path standar iki saka meja nuntun, banjur magepokan karo dnsmasq openconnect kudu njamin operasi normal.
Aku nyoba
route del defaultLan kabeh bisa.
Nuntun panjalukan menyang server mail tanpa vpn-slice
Nanging aku uga duwe server mail kanthi alamat 555.555.555.555, sing uga kudu diakses liwat VPN. Rute kasebut uga kudu ditambahake kanthi manual.
ip route add 555.555.555.555 via dev tun0Lan saiki kabeh apik. Supaya sampeyan bisa nindakake tanpa vpn-slice, nanging sampeyan kudu ngerti apa sing lagi dilakoni. Aku saiki mikir babagan nambah baris pungkasan saka script openconnect native mbusak rute gawan lan nambah rute kanggo mailer sawise nyambung menyang vpn, mung supaya ana kurang bagean obah ing mancal.
Mbokmenawa, tembung mburi iki cukup kanggo wong sing ngerti carane nyiyapake VPN. Nanging nalika aku nyoba kanggo ngerti apa lan carane nindakake, Aku maca cukup akèh kuwi Panuntun sing bisa kanggo penulis, nanging sakperangan alesan ora bisa kanggo kula, lan aku mutusaké kanggo nambah kene kabeh bêsik sing aku ketemu. Aku bakal seneng banget babagan sing kaya ngono.
Source: www.habr.com