Ba Pi mai nisa SOCKS proxy ta hanyar SSH client ɗinka

Kana ɗauka cewa SOCKS proxy dole ne ya gudana a inda hanyar sadarwa ta riga ta kasance. OpenSSH na iya ajiye mai sauraro a wani wuri daban gaba ɗaya. Tura ta dinamik ta nisa tana buɗe tashar SOCKS a kan uwar garke mai nisa kuma tana fara kowace haɗa daga SSH client ɗinka na gida, wanda ke ɗauke da hanyar VPN da aka amince da ita ta kwamfutar tafi-da-gidanka. Pi na samun proxy mai iyaka; ba ya gado raminka ko damar ka.

Mai sauraro da gefen da haɗin ke farawa na iya bambanta

ssh -D 1080 na yau da kullum yana gudanar da mai sauraro a kan na'urarka kuma yana aika haɗa daga can. Tura ta dinamik ta nisa tana juya hakan: mai sauraro na bayyana a uwar garke mai nisa, kuma kowace haɗa da ya karɓa ana buɗe ta daga gefen gida. littafin jagora na OpenSSH client yana rubuta -R ba tare da wata manufa tabbatacciya ba a matsayin daidai wannan tsarin SOCKS4/5.

Umarni da aka goyi bayan daga kwamfutar tafi-da-gidanka yana kama da wannan, tare da asusu, uwar garke da tasha a matsayin masu riƙe wuri:

ssh -NT -S none -o ExitOnForwardFailure=yes \
  -o PermitRemoteOpen=app.corp.example:443 \
  -R 1080 [email protected]

Cikakkun bayanai uku suna yin aiki mai amfani a can. -S none yana nisantar da zama daga wani babban mai kula da aka raba, ExitOnForwardFailure yana kasa da sauri maimakon ya bar ka da zama mai rabin buɗe, kuma PermitRemoteOpen yana iyakance abin da mai sauraro mai nisa zai iya kaiwa. Yi amfani da asusun Pi da aka ba da izini kuma ka tabbatar da maɓallin uwar garke kafin ka ƙara kowane ɗaya daga cikin waɗannan.

Abin da mai sauraro mai nisa ke bayyanawa da gaske

Duba manufar tura ta uwar garke kafin ka dogara da mai sauraro. Tare da GatewayPorts no tura ta nisa tana kasancewa a ɗaure da loopback, kuma wannan shine bayyanar da kake so. Uwar garke da aka saita don tilasta tura ta wildcard tana wallafa tasha ɗaya a kowace fuska, wanda ke mai da proxy na sirri wani abu da hanyar sadarwar gida za ta iya kaiwa.

Loopback kuma ba iyaka ba ce ga kowane mai amfani. Wata hanya a kan Pi na iya haɗawa da 127.0.0.1:1080 idan ta san tashar, don haka asusun gida na Pi da duk abin da ke gudana a kansa suna cikin tsarin hanyar shigarka. Wannan dalili ne na ajiye jerin manufofi a ɗaure, ba dalili ba ne na tsallake duba manufar.

Ka ajiye manufar da aka yarda da ita takamaimai ga aikace-aikacen da kake ƙoƙarin kaiwa. Maye gurbinta da tura mara iyaka don wani shiri marar alaƙa ya yi aiki yana faɗaɗa hanyar nesa da matsalar da ka fara da ita. Jerin manufofi kuma yana rubuta abin da zaman ya kasance domin, wanda ke taimaka wa duk wanda zai duba shi daga baya. Rubuta shi kusa da asusun da ka yi amfani da shi.

Aika aikace-aikace ɗaya ta cikin proxy

Client a kan Pi da ya fahimci proxy zai iya yin buƙatar. Fifikon socks5h yana ba da sunan manufa ga proxy, don haka bincike da haɗin duka suna faruwa a gefen kwamfutar tafi-da-gidanka, kuma ya dace da manufar da aka ambata a PermitRemoteOpen:

curl --proxy socks5h://127.0.0.1:1080 \
  --noproxy '' https://app.corp.example/

Ka riƙe tabbatar da takardar shaidar na yau da kullum da tabbatar da aikace-aikacen da kansa. Proxy yana canza inda ake yin haɗin TCP; ba ya mai da sabis marar tabbaci lafiya, kuma ba ya mai da ƙarshen da aka sa hannu da kansa abin aminci.

Kwamfutar tafi-da-gidanka har yanzu tana buƙatar hanyarta da isa ga mai warwarewa zuwa uwar garken SSH da aikace-aikacen duka. Dole ne manufar VPN da aka amince da ita ta zaɓi zirga-zirgar SSH client ɗinta, kuma keɓewar split-tunnel na iya aika wannan zirga-zirgar ta wata hanya dabam da wadda ka gwada.

Tabbatar da hanyar sannan ka rufe ta

Tabbatar cewa mai sauraro yana nan a inda kake tsammani kuma manufar da aka yi niyya ce kaɗai ke amsawa:

$ ss -ltnp | grep 1080
LISTEN 0 128 127.0.0.1:1080 0.0.0.0:*
$ curl -sS -o /dev/null -w '%{http_code}\n' \
    --proxy socks5h://127.0.0.1:1080 https://app.corp.example/

ExitOnForwardFailure na iya tabbatar da cewa an kafa tura, kuma har yanzu ba zai iya tabbatar da cewa shiga aikace-aikacen ya yi nasara a ƙasa ba. Gwada aikace-aikacen, ba tasha kaɗai ba. Mai sauraro da ya karɓa sannan ya kasa kowace buƙata yawanci yana nufin sunan manufa ko hanyar kwamfutar tafi-da-gidanka ba daidai ba ne, ba wai ramin ya kasa ba.

Wannan tsari yana ɗaukar TCP kaɗai. UDP, ICMP da shirye-shiryen da suka yi watsi da saitunan proxy suna kasancewa a waje da shi, kuma tura tana ƙarewa a daidai lokacin da zaman SSH ya ƙare. Dakatar da wannan zaman idan ka gama kuma ka cire saitin proxy da ka ƙara wa aikace-aikacen.

Don shiga na dindindin, yi amfani da rijistar da aka goyi bayan ta mai hanyar sadarwa ko ƙofar da ake sarrafawa maimakon haka. Proxy na baya shine kayan aiki mara kyau don guje wa iyakokin na'ura ko albarkatu na VPN; idan aka yi amfani da shi cikin waɗannan, kawai hanyar aikace-aikace ɗaya ce da aka ba da izini tare da iyakoki bayyananne.