Maɓallin kashewa yana toshe uwar garken VPN kafin kowane zirga-zirga ya wuce
Wane mataki maɓallin kashewa ke toshewa: neman ƙarshen wuri, hanyar waje, hanyar dawowa da tsofaffin keɓancewar abokan gaba — da ƙididdiga maimakon hasashe.
Maɓallan kashewa suna kasawa a alkibla da mutane ba sa tsammani: an gina su don toshe zirga-zirga yayin da ramin ke ƙasa, kuma fakitin da ke gina ramin su kansu zirga-zirga ne. Wannan shi ne dukan kuskuren. Tsarin ƙa’idoji da ke watsar da duk abin da ba ya fita ta ramin yana watsar da musafaha da zai tayar da shi, don haka abokin ciniki yana sake ƙoƙari a cikin madauki kuma kuskuren yana cikin matakin da aka fara dubawa. Kafin faɗaɗa bangon wuta, gano wanne daga matakai uku ake ƙi: neman suna, fakitin waje zuwa abokin gaba, ko amsar da ke dawowa.
Yadda ramin da nasa jigilar ke dogaro da juna
Karanta abokin ciniki na VPN a matsayin yanayin cibiyar sadarwa biyu da ke raba hanyar soket ɗaya. Kafin ramin ya kasance, abokin ciniki yana buɗe soket a kan adaftar zahiri kuma yana aika firam ɗin da aka ɓoye zuwa adireshi da tashar jiragen ruwa na abokin gaba. Bayan wannan musayar ta yi nasara ne kawai yake ƙirƙirar na’urar ramin kuma yana shigar da hanyoyi. Maɓallin kashewa manufa ce game da yanayi na biyu, an rubuta ta da yawa har ta shafi duka biyun.
Ƙa’idojin da suka dogara da mu’amala sune sifar da aka saba: karɓi abin da ke fita ta tun0 ko wg0, watsar da sauran hanyar fita. Wannan tsarin ba zai iya keɓance haɗin abokin ciniki da kansa zuwa uwar garke ba, don haka ingantaccen aiwatarwa yana ƙara wannan keɓancewar a fili, kai ma kana yin haka lokacin da kake rubuta ƙa’idoji da hannu. Ƙa’idojin kowace manhaja a Windows da macOS suna guje wa wani ɓangare na wannan ta hanyar daidaita tsari maimakon mu’amala, amma tsarin dole ne ya fita kafin ramin ya kasance.
Matakai uku, a cikin tsarin da suke faruwa
Mataki na farko shine warwarewa. Lokacin da bayanin martaba ke adana sunan mai masauki maimakon adireshin zahiri, abokin ciniki yana buƙatar amsar DNS kafin ya iya aika wani abu. Bayanin martaba da ke tura DNS zuwa mai warwarewar ramin yana haifar da matsi: ana iya isa mai warwarewar ta hanyar ramin da neman zai kamata ya kunna. Warwarewa a wajen ramin, ko liƙa ƙarshen wuri zuwa adireshi, yana kawar da wannan shakku.
Mataki na biyu shine fakitin waje, wanda dole ne ya jure hanyar farko sannan bangon wuta, a wannan tsari. wireguard-tools yana ɗaukar rabin hanyar don WireGuard ta hanyar yi wa nasa fakitin alama da ƙara ƙa’idar manufa don su tsallake hanyar da ya shigar yanzu; shafin jagorar wg-quick yana bayanin wannan ƙa’idar da teburin da take amfani da shi. Sake gina wannan hanyar da hannu, ko bar wani kayan aiki na biyu ya sake rubuta ƙa’idojin, kuma ana iya mayar da fakitin da aka yi wa alama cikin ramin da ya kamata su ƙirƙira.
Mataki na uku shine hanyar dawowa. Musafaha ba tare da amsa ba hujja ba ce ta watsi a waje; daidai yake da ƙa’idar shigowa ta uwar garke ko na’urar NAT da ta manta da taswirar. Raba waɗannan kafin ka taɓa abokin ciniki.
| What you see | Stage | Where to look |
|---|---|---|
| The client log repeats a resolve step and no packets appear on the wire | 1, name lookup | Resolver path while the tunnel is down |
| The send counter on the physical adapter stays flat | 2, routing | Peer route and policy rules |
| The send counter rises and a firewall drop counter rises | 2, firewall | Rule order, mark, and interface match |
| Packets leave and nothing comes back | 3, return path | Server input rules, NAT, listening port |
Abokan ciniki suna rubuta alamar da suka gano, ba matakin da ya gaza ba, don haka tebur yawanci ya fi log sauri.
Ƙididdiga suna yanke hukunci da sauri fiye da log
A Linux, nft list ruleset ko iptables -vnL OUTPUT yana buga ƙididdigar fakitin kowace ƙa’ida. Haɗa sau ɗaya, bar ya gaza, sannan sake karanta ƙididdigar. Ƙa’idar da ƙididdigarta ta motsa ita ce ƙa’idar da musafaha ya buga; idan babu abin da ya motsa a ko’ina, fakitin bai taɓa isa bangon wuta ba. Na ga tsarin ƙa’idoji ya watsar da nasa musafaha, kuma ƙididdiga ne kawai suka faɗi haka.
Don raba bai taɓa isa bangon wuta ba daga bai taɓa barin mai masaukin ba, lura da mu’amala da kanta. ip -s link show dev wlan0 yana ba da rahoton fakitin da aka aika, kuma tcpdump -ni wlan0 udp port 51820 yana nuna firam ɗin. Idan ya tsaya a kwance yayin da abokin ciniki ke sake ƙoƙari, kuskuren yana sama da netfilter: hanyar abokin gaba da ta ɓace, ƙa’idar manufa da ke nuni ga na’urar da ba ta wanzu ba tukuna, ko kuskuren soket da abokin ciniki ke haɗiye.
Gwada keɓancewa da adireshin takardu kamar 203.0.113.10, don kuskure ba zai iya bincika mai masaukin wani ba.
Tsohon keɓancewar ƙarshen wuri ana karantawa kamar karyewar uwar garke
Sigar da ta fi yaudara tana bayyana bayan adireshin abokin gaba ya canza: sabis na adireshi mai motsi ya matsar da shi, an sake gina mai masaukin, ko adireshin fitar cibiyar sadarwarka ya bambanta. Keɓancewar har yanzu tana ambaton tsohon adireshi, don haka fakitin zuwa sabon suna faɗawa cikin ƙa’idar watsi. Wannan tsarin aiki ya yi aiki jiya, kuma shi ya sa mutane suke fara bincikar uwar garke.
Sunan mai masauki a cikin ƙa’idar bangon wuta ba ya cece ka. A nftables ana warware sunan lokacin da ake loda tsarin ƙa’idojin, don haka yana liƙa duk adireshin da ya kasance a wannan lokacin kuma ya tsufa kamar na zahiri. Maganin dindindin shine sabunta keɓancewar lokacin da ƙarshen wuri ya canza kuma a kiyaye ta kunkuntar: adireshin abokin gaba ɗaya, tashar jigila ɗaya. Kewayon da ya isa ya jure canjin adireshi ya isa kuma ya bar zirga-zirgar da ba ta da alaƙa ta fita.
Lokacin da maɓallin kashewa ke aiki a kan mai masaukin uwar garke
Irin wannan dogaro yana nan a ɗaya gefen, kuma a can ya fi sauƙin mantawa. Idan injin da ke aiki a matsayin uwar garken VPN ɗinka yana gudanar da abokin ciniki na tebur tare da maɓallin kashewa, ko bayanin bangon wuta da aka kwafa daga kwamfutar tafi-da-gidanka, ƙa’idojinsa na watsi suna aiki kan sabis ɗin da ke ƙare ramukan. Ana watsar da amsoshin musafahar abokin ciniki, don haka kowane abokin ciniki ya kasa haɗawa yayin da uwar garke ke kama da lafiya kuma mu’amalarta ta rami tana zama ba a amfani da ita.
Wannan mai masaukin yana buƙatar karɓu uku kunkuntar kafin watsi: tashar saurare a kan mu’amalar zahiri, mu’amalar rami don zirga-zirgar da aka warware, da turawa daga ramin zuwa abin da abokan ciniki ya kamata su isa. Karanta saitin da aka shigar da nft list ruleset, iptables -S, ko pfctl -sr kafin ka canza wani abu, kuma ka tuna cewa tsarin ƙa’idojin da aka adana yana jurewa sake kunnawa, don haka kuskure a can yana jurewa tsarin da ya yi shi.
Tsarin dawo da ke riƙe injin a rufe
Yi aiki daga bayanin martaba zuwa waje. Karanta adireshin abokin gaba da tashar da abokin ciniki ke amfani da su, tabbatar cewa an warware sunan mai masauki ba tare da ramin ba, sannan ƙara keɓancewa ɗaya don wannan adireshi da tashar a kan adaftar zahiri kawai. Sake haɗawa kuma lura da ƙididdigar aikawa; cikakken musafaha shine alamar cewa an gyara mataki na biyu.
Bar sauran manufar watsi a wurinta yayin gwaji. Bincike marar lahani shine ƙoƙarin haɗi zuwa adireshin takardu marar alaƙa da tabbatar da cewa har yanzu yana ƙarewa, wanda ke nuna maɓallin kashewa yana aiki ba a kashe shi ba. Ƙarfafa keɓancewar da zarar ramin ya daidaita, kuma kada ka bar izinin dindindin na komai ga shirin abokin ciniki saboda yana da sauƙi.
Idan ramin ya tashi kuma manhajar har yanzu tana kasawa, sauran matakan ba wannan ba ne: DNS da aka raba, MTU da turawa ta kowace manhaja kowanne yana samar da rami mai haɗi tare da karyewar zirga-zirga, kuma kowanne yana da duba ta farko daban.