Split tunneling na tushen manhaja da na tushen manufa: wanne za a zaba

Split tunneling na tushen manhaja da na tushen manufa ba saiti biyu ba ne don aiki ɗaya. Ɗaya yana tambaya wane tsari ne ke aika fakiti; ɗayan yana tambaya inda wannan fakiti ke zuwa. Dokar da aka gina don tambaya ta farko tana gazawa a shiru lokacin da zirga-zirgar ta zo daga tsarin taimako, kuma dokar da aka gina don ta biyu tana gazawa lokacin da sunan mai masauki ya warware zuwa adireshin da ba ka taɓa lissafa ba. Zaɓi abin da ya dace da buƙatar, sannan tabbatar da shi da fakiti biyu na gwaji: ɗaya dole ya yi amfani da rami ɗayan kuma ba dole ba.

Dokoki biyu suna aiki a matakai daban-daban

Ana aiwatar da dokar manhaja sama da matakin cibiyar sadarwa, a kan asalin da tsarin aiki ke bayarwa ga mai aikawa. A Android wannan shine UID da ke bayan fakiti, kuma sabis ɗin VPN yana yanke shawara ga kowane UID ko zirga-zirgar zai shiga ramin. Ba a tambayar komai game da manufa, don haka manhajar da aka zaɓa tana iya isa kowane abu kuma babu wata manhaja da za ta isa cibiyar sadarwar ciki.

Ana aiwatar da dokar manufa a kan fakitin kansa. Fuskar ramin tana da jerin prefixes, teburin tuƙi yana aika zirga-zirgar da ta dace cikinsa, kuma tsarin da ke aikawa ba shi da mahimmanci. Shi ya sa dokar manufa ke rufe sabis, firinta ko aikin batch da babu wanda ya tuna lissafa shi, kuma shi ya sa ba za a iya bayyana ta a matsayin wannan shirin kawai a dandamali wanda abokin cinikinsa ba ya taɓa kallon tsarin.

Dokokin manhaja sun dace da abokan cinikin wayar hannu da wakilai da ake sarrafawa

Android yana bayyana zaɓin kai tsaye: VpnService.Builder.addAllowedApplication() da addDisallowedApplication() suna ɗaukar sunayen fakiti kuma suna aiwatar da shawarar ga kowane UID, kamar yadda aka kwatanta a jagorar masu haɓaka VPN ta Android. iOS yana da makamancin haka ta hanyar dokokin VPN na kowace manhaja da aka danganta da masu gano bundle, yawanci ana bayar da su ta bayanan MDM maimakon rubuta da hannu.

Abokan cinikin tebur sune wurin rauni. Yawancin abokan cinikin VPN na Windows da macOS suna tuƙi bisa manufa kuma ba sa bayar da zaɓi ga kowane tsari kwata-kwata, domin direban ramin yana ganin fakiti, ba tsari ba. Idan shirin ku ya dogara da yin rami ga manhaja ɗaya a kwamfutar hannu, duba ainihin iyawar abokin ciniki kafin ku tsara kewaye da shi; watakila kuna zaɓa tsakanin jerin manufa da na'ura ta biyu.

Sakamakon da mutane ke mantawa: ba za ka iya kwaikwayon dokar manhaja da hanyoyi a waɗannan dandamali ba. Ƙara hanyar mai masauki ga uwar garken manhajar yana yin rami ga zirga-zirgar kowa zuwa wannan uwar garken, har da mai bincike da mai sabuntawa.

Dokokin manufa sun dace da jerin subnet da isa ga shafuka

WireGuard yana bayyana samfurin. AllowedIPs tuƙi ne da maɓallin sirri: fakitin ciki wanda manufarsa ta faɗi cikin jerin abokin tarayya ana ɓoye shi zuwa wannan abokin, kuma duk wani abu ya fita ba a ɓoye ba ta hanyar al'ada. Babu tsarin da za a ambata kuma babu rashin tabbas game da abin da aka haɗa.

OpenVPN yana isa wuri ɗaya ta hanyar teburin tuƙi da aka tura. route-nopull yana hana uwar garken yin umarni da hanyoyi, bayan haka route 10.20.0.0 255.255.0.0 vpn_gateway a gefen abokin ciniki yana rufe daidai prefix ɗin ofis. IPv6 magana ce daban a cikin kowane ɗayan waɗannan abokan ciniki, kuma manta da shi ita ce hanya mafi yawa don yin ɗigo a kusa da rabuwar IPv4 da ke kama da daidai.

Sunan mai masauki ba hanya ba ne. Idan bayanin ya ba da filin yanki, ɗauke shi a matsayin sunan da abokin ciniki zai warware sau ɗaya, ba a matsayin kewayon adireshi na dindindin ba; cibiyoyin sadarwar isar da abun ciki da masu daidaita nauyi za su ba da adireshi daban gobe.

Inda duka samfuran biyu ke karyewa: masu taimako, sabis na gama gari, masu warwarewa

Tsare-tsaren taimako suna karya dokokin manhaja ta hanyar da ke kama da kuskuren uwar garken. Mai sabunta burauza, mai ba da rahoton hatsari, sabis ɗin daidaitawa da ke gudana a matsayin SYSTEM da WebView da aka saka a wani fakiti duk asali ne daban-daban, don haka yin rami ga burauzar na iya barin ainihin buƙatar a wajen ramin. Akasin haka yana da ruɗani daidai: manhajar da aka ware da ke kiran ɗakin karatu na gama gari a cikin tsarin da aka yi masa rami, har yanzu zirga-zirgarta tana cikin ramin.

Dokokin manufa suna karyewa a kan sabis na gama gari da kuma sunaye. Rarraba fayiloli, firintoci, DNS na ciki da uwar garken lasisi duk suna rayuwa a adireshi, don haka ramin manhaja ɗaya yana ba burauza damar shiga yayin da faifan da aka tsara ya mutu. Wannan bambancin ɗaukar nauyi ba kuskure ba ne a kowane samfuri, amma shi ne dalilin da ya sa ramin manhaja ɗaya yakan haifar da VPN yana aiki kuma rabon ya tafi.

Masu warwarewa suna tsallakawa duka biyu. Idan abokin ciniki ya saita sabar DNS na ciki amma tsarin aiki yana amfani da DNS ta HTTPS zuwa mai warware na jama'a, amsar tana zuwa daga wajen ramin kuma dokar manufa ba za ta taɓa dacewa ba. Duba wane mai warware ne ya amsa da gaske kafin ka yanke hukuncin cewa dokar ba daidai ba ce, kuma tabbatar a gefen abokin ciniki ko ya sanya mai warware na ramin kwata-kwata. Rabuwar da ta bar DNS a wajen ramin tana da kyau a teburin tuƙi kuma har yanzu tana gazawa ga kowane sunan ciki.

Jagorar aiki: zaɓi, yi amfani, tabbatar

Fara daga buƙatar, ba daga menu ba. Idan manufar ita ce kawai wannan manhaja za ta iya amfani da ramin, kuna buƙatar dokokin manhaja da dandamali da ke tallafa musu. Idan manufar ita ce waɗannan cibiyoyin sadarwar ana isa gare su ta ramin, kuna buƙatar prefixes. Idan amsar ita ce duka biyu, aiwatar da su a matsayin sarrafawa biyu daban kuma rubuta wanne ne ke da alhakin wace gazawa.

Yi amfani da mafi ƙunƙuntar siffar da za ka iya bayyanawa, sannan tabbatar ta hanyar tambayar teburin tuƙi maimakon alamar matsayin abokin ciniki:

ip route get 10.20.30.40
ip -6 route get 2001:db8:10::40
wg show wg0 allowed-ips
Get-NetRoute -DestinationPrefix 10.20.0.0/16
Find-NetRoute -RemoteIPAddress 10.20.30.40

Layi biyu na farko suna ambaton fuskar da ainihin manufa za ta yi amfani da ita; wg show yana buga jerin prefixes da aka saita; a Windows, Find-NetRoute yana amsa tambayar da stack zai amsa lokacin aika fakitin. Idan fuskar ita ce ramin, dokar ta dace.

Sannan gwada fakiti na biyu wanda ya kamata a ware, daga wata manhaja, zuwa wannan manufar. Rubuta a cikin tikiti sigar abokin ciniki, nau'in doka, jerin prefixes ko fakiti da sakamakon biyu da aka gani. Wannan biyun sakamakon ne ke gaya wa injiniya na gaba ko an saita manufar ba daidai ba ko kuma zirga-zirgar ba ta taɓa kasancewa nata ba.