Yadda dokokin domain na Apple VPN On Demand ke kunna tunnel

Tunnel yana buɗewa lokacin da ka nemi sunan ciki ɗaya kuma yana zama a rufe lokacin da manhajar da ta biyo baya ke buƙatarsa haka. Wannan ba kuskure ba ne a manhajar; siffar dokar domain ce. Tsarin on-demand na Apple yana bayyana sharuɗɗan yin haɗi, kuma siffar domain na waɗannan sharuɗɗan tana tambayar mai warwarewar tsarin tambaya kafin ko fakiti ɗaya ya motsa. Tambayoyi biyu suna rikicewa kullum: yaushe tunnel ya kamata ya tashi, da abin da tunnel ke ɗauka bayan ya kasance. Na farko maɓalli ne, na biyu manufar hanya da mai warwarewa ce, kuma profile ɗaya yawanci yana saita duka biyun a cikin payload ɗaya, shi ya sa ingantacciyar dokar domain za ta iya barin ka a cikin hanyar sadarwar da ba daidai ba.

Maɓalli da zaɓin zirga-zirga suna a matakai daban-daban

Dokar on-demand tana zaune a cikin ƙamus ɗin on-demand na payload ɗin VPN: jerin dokoki mai tsari, kowace tana da aiki da saitin sharuɗɗan daidaitawa. Tsarin yana kimanta su lokacin da haɗin ya canza ko lokacin da wani abu ya yi ƙoƙarin isa hanyar sadarwa, kuma aikin yana yanke shawara ko an ɗaga tunnel, an kimanta shi, an cire shi ko an yi watsi da shi. Duk wannan yana faruwa a cikin layin sadarwa na dandali, kafin manhajarka ta sami socket.

Abin da ke biyo baya rukuni ne daban na maɓallai: saitunan IPv4 da IPv6 na tunnel, hanyoyin da aka haɗa da waɗanda aka cire, adiresoshin uwar garken DNS, kuma a iOS da iPadOS taswirar kowace manhaja da ke yanke shawarar waɗanne manhajoji za su iya amfani da tunnel. Profile na iya haɗa maɓalli mai faɗi da hanya mai ƙunci, ko maɓalli mai ƙunci da hanya ta asali. Karanta rabi ɗaya kawai sai rabin ɗayan ya yi kama da matsala.

Ina da profile na gwaji wanda ke haɗawa duk lokacin da aka nemi wani abu a ƙarƙashin domain na ciki amma yana tura /16 ɗaya kawai cikin tunnel. Yana yin daidai abin da payload ɗinsa ya ce, kuma shi ne irin profile ɗin da ke haifar da tikiti: mutane suna ɗauka cewa haɗaɗɗen tunnel yana nufin zirga-zirgarsu na ciki.

Abin da dokar domain ke tambayar mai warwarewa

Siffar domain ta dokar, wadda ake yawan kiranta connect-if-needed, ba ta duba payload ɗin fakiti ba kuma ba ta lura da URL. Lokacin da aka warware suna, tsarin yana kwatanta shi da domain ɗin da ke cikin dokar kuma, idan sun daidaita, yana tambaya ko ana iya warware wannan sunan ta uwar garken DNS da tunnel ke bayarwa. Idan mai warwarewar tunnel ya amsa, ana ɗaukar sunan na ciki kuma ana fara haɗin. Idan mai warwarewar gida ya amsa maimakon haka, ana ɗaukar sunan na waje kuma babu tunnel da zai bayyana. Bayanin turawa na Apple yana bayyana waɗannan a matsayin gano hanyar sadarwa sannan kimanta haɗi.

Sakamako biyu suna biyo baya. Dole profile ya ambaci uwar garken DNS a cikin tunnel; dokar domain ba tare da mai warwarewar tunnel ba tana da abin da za ta kwatanta, don haka kimantawa ba za ta iya samar da daidaiton da kake tsammani ba. Kuma binciken dole ya isa mai warwarewar tsarin. Manhaja ko burauza da ke gudanar da nata DNS mai ɓoye, ko extension da ke amsa a gida, ko haɗi zuwa adireshi na zahiri ba su taɓa samar da warwarewar sunan da dokar ke jira ba. Ɗaya daga cikin mafi tsayin rana da na yi ya ƙare lokacin da na gano cewa abokin ciniki da ke gaban tunnel yana amfani da DNS over HTTPS.

Ajiya ma tana cire maɓallin. Sunan da ke cikin ajiya za a iya amsa shi ba tare da binciken da zai fara tunnel ba, don haka dokar da ta yi aiki jiya tana gazawa bayan sake kunnawa, ko bayan tunnel ya daɗe yana aiki. A macOS sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder yana sake saita yanayin; a iOS kunna da kashe yanayin jirgi ko sake kunna na’urar yana ba ka farkon tsafta mai kama.

Iyakar daidaitawa: sunaye, manhajoji da cibiyoyin sadarwa

Daidaitawar domain nau’i ɗaya ne a cikin nau’i da yawa. Dokar na iya daidaitawa da nau’in interface (Wi-Fi, wayar hannu, Ethernet) da takamaiman SSID, kuma shigarwar kowace manhaja ko domain na Safari tana ɗaure tunnel ga aiki ɗaya. Wannan ɗaurewar tana bayyana abin da ya faru mai ban mamaki inda manhaja ɗaya kawai take da hali daban da kome: sauran manhajoji suna wajen iyakar tunnel, don haka suna ci gaba da amfani da hanyar gida ko da alamar tunnel ta ce an haɗa.

Tsari yana da muhimmanci fiye da yadda mutane suke tsammani. Ana kimanta dokoki a jere kuma na farko da ya dace shi ne ke bayar da aikin, don haka babbar dokar haɗa-a-kowace-Wi-Fi da aka sanya sama da ƙaramar dokar domain za ta yi nasara a shiru kuma ta sa dokar domain ta kasa gwadawa. Kafin ka sake rubuta jerin domain, tabbatar cewa babu wata dokar da ta gabata da ta riga ta dace.

Shi ya sa always-on ba wai kawai tsauraran dokar on-demand ba ce. Tilasta always-on yanayi ne na turawa daban da nasa buƙatun kulawa da gudanarwa; yana riƙe tunnel a buɗe maimakon amsa ga suna. Idan abin da kake buƙata shine tunnel wanda ba ya faɗuwa har abada, dokar domain ita ce kayan aiki mara kyau.

Hanyoyin gazawa da ke kwaikwayon karyewar doka

Yawancin rahotannin cewa dokar domain ba ta aiki suna faɗuwa a ɗaya daga cikin wurare biyar, kuma na ƙarshe ne kawai rubutun dokar.

Ƙofofin captive sun cancanci nasu layin, domin Wi-Fi na otal da filin jirgin sama yana kama ainihin binciken da dokar ta dogara da shi. Har sai ƙofar ta shigar da na’urar, uwar garken DNS na tunnel ba za a iya isa ba, binciken ya kasa, kuma gazawar tana kama da domain da aka yi kuskuren rubuta. Tabbatarwa ita ce ɗayan shiru: dokar na iya tashi, tunnel na iya fara haɗawa, kuma haɗin ya mutu a kan takardar shaidar da ta ƙare ko kan tambayar da ta bayyana a wani allo.

IPv6 yana haifar da bambancin da ke da sauƙin kuskuren ganewar asali. Ana iya amsa sunan da ke da dukkan iyalan adireshi daga rikodin AAAA da farko, yayin da jerin hanyoyin tunnel ɗin ke ɗauke da IPv4 kawai. Burauza ɗaya tana yin nasara, wata tana kasa, kuma jerin domain ɗin ba shi da laifi kwata-kwata.

Gwada da ainihin buƙata, a wannan tsari

Karanta manufar kafin yin hasashe. A macOS sudo profiles show -type configuration yana buga profiles da aka shigar ciki har da payload ɗin VPN, scutil --nc list yana nuna yanayin sabis, kuma scutil --nc show <service> yana buga ƙamus ɗin on-demand da tsarin ke amfani da shi. A iPhone ko iPad da ake kulawa, wannan payload ɗin yana zuwa daga console ɗin gudanarwa ko rahoton MDM. Ana samun rajistan ayyukan sadarwa da log stream --predicate 'subsystem == "com.apple.networkextension"' a macOS, kuma ta console ɗin na’urar lokacin da wayar ke haɗe.

Sannan gwada da sunan mai masauki wanda ba a tambaya ba a baya a zaman. Zaɓi suna a yankin DNS na tunnel wanda ka san ana warware shi a ciki, nemi shi sau ɗaya, kuma ka lura ko tunnel ya bayyana. Gudanar da wannan binciken sau biyu: ƙoƙari na biyu yana amfani da hanyar ajiya, kuma bambanci tsakanin su yana gaya maka ko maɓallin shine warwarewa ko turawa.

Bayan tunnel ya tashi, tabbatar da matakan biyu daban. netstat -rn -f inet da netstat -rn -f inet6 suna nuna inda kowane prefix ya nufa, scutil --dns yana nuna tsarin masu warwarewa da wace interface ce ta mallaki kowane mai warwarewa, kuma nettop -m route yana nuna wace interface ce ta ɗauki bytes. Idan tunnel yana sama kuma mai warwarewar daidai ne amma albarkar har yanzu tana gazawa, daina gyara dokar; duba izini na gefen uwar garke da hanyar dawowa.

Lokacin da dokar ta wani ne

Idan tunnel ya sake bayyana bayan ka cire shi, yawanci dokar ta profile ce ba ta manhaja ba: tsarin da MDM ya tura, profile na sirri da ya ragu, ko profile da wani abokin ciniki ya shigar. sudo profiles show -type configuration tare da bincike kan maɓallan on-demand zai taƙaita shi, kuma hanyar cirewa ita ce profile, ba maɓallin da ke cikin sandar menu ba. Share shigarwar sabis ko manhajar yana barin dokar a baya, kuma shigarwa ta gaba tana gado ta kuma.

Gwaji ɗaya yana warware mallaka: cire haɗi, jira, sake neman sunan ciki. Idan tunnel ya dawo, maɓallin yana aiki kamar yadda aka tsara kuma tambayar da ba a warware ba ita ce wa ke kula da shi da ko wannan iyaka shine abin da kake so.

Kafin ka rubuta wannan a matsayin bug, bi waɗannan dubawa biyar: adiresoshin mai warwarewar tunnel suna cikin payload, sunan da ba a ajiye ba, babu wata dokar da ta gabata da ta riga ta dace, hanyar AAAA da jerin hanyoyi ke rufewa, da manhajar da ke cikin iyakar tunnel. Lokacin da duk biyar suka tabbata, dokar tana yin aikinta kuma kuskuren yana can gaba a kan hanya.