Tashar OpenVPN ɗaya, ayyuka uku: me ya sa tashoshin ciki suke da muhimmanci

Zama ɗaya na SSH, manhajar yanar gizo ɗaya da neman suna ɗaya na iya raba haɗin VPN guda ɗaya ba tare da yin rigima kan tashoshi ba. Abokin ciniki yana gina kwarara ɗaya da aka ɓoye zuwa ƙofar, kuma kowace tattaunawar manhaja tana tafiya a cikinta. A waje, sai jigilar tunnel ɗin da tasharsa kawai ake gani. A ciki, kowace sabis tana riƙe da tasharta kuma har yanzu tana buƙatar izininta.

Abin da kwararar waje take ɗauka, da abin da take ɓoyewa

Abokin ciniki yana naɗe kowane fakiti cikin jigilar tunnel ɗin kafin ya bar na'urar. Wannan kwararar waje tana da tashar manufa ɗaya, wadda aka ƙayyade lokacin da aka saita VPN ɗin. A cikin naɗin, kowane ainihin fakiti yana riƙe da adireshi da tashar sabis ɗin da yake nufa. Ƙofar tana cire naɗin kuma tana bin hanyar kan kuwwar ciki, don haka manufar tana ganin wani abokin ciniki na yau da kullum da ya zo daga hanyar sadarwa.

Don haka rikodin da aka yi a fuskar WAN yana nuna tattaunawa ɗaya, ba uku ba. Tashoshin ciki suna bayyana ne kawai bayan an cire naɗin. Shi ya sa buɗewar wuta ɗaya za ta iya ɗaukar SSH, HTTPS da DNS a lokaci ɗaya.

# WAN side: one outer tuple, whatever the inner services are
tcpdump -ni wan0 'udp port 443'
# tunnel side: the inner tuples appear after decapsulation
tcpdump -ni tun0

Takardun TUN/TAP suna magana kan miƙa da ake yi inda naɗaɗɗiyar na'urar TUN ke miƙa fakiti IP tsakanin kernel da tsari a sararin mai amfani. Wannan miƙa ita ce take sa kan kuwwar ciki a bayyane ga lambar bin hanya da ta wuta na ƙofar. Har ila yau tana bayyana me ya sa tashar waje ba ta faɗin kome game da waɗanne ayyuka aka yarda da su.

Tura NAT na mai saurare ne, ba na manhajoji ba

Ƙofar da aka yi wa hosting da kanta a bayan NAT na IPv4 tana buƙatar fassara ɗaya mai shigowa: an tsara adireshin jama'a da tashar zuwa mai saurare na VPN. Babu wata doka da ake buƙata ga SSH, HTTPS ko DNS don kawai masu amfani da tunnel suna isa gare su. Wallafa waɗannan tashoshi zai fallasa ayyukan da tunnel ɗin ke kariya tukuna. Dokar tura tana bayyana isar mai saurare, ba izini ga wani abu a ciki ba.

Akasin haka ma gaskiya ne. Buɗe tashar tunnel ɗin ba ya fallasa wani abu dabam, don haka sabis ɗin da ake iya samu ta hanyar tunnel ɗin kawai yana riƙe da saman jama'arsa a rufe. Wannan rabuwa ita ce yawanci dalilin ajiye sabis ɗin a asirce tun farko.

Manufar ciki ita ce inda ake yanke shawarar shiga da gaske

Ɓoyewa yana kariya ga hanyar; ba ya ba da izini ga manufa. Hanyoyin abokin ciniki suna zaɓar waɗanne prefixes suka shiga tunnel ɗin, manufar tura ta ƙofar tana yanke shawara ko fakiti za su iya barinta, kuma katangar wuta ta manufa tare da shiga suna yanke shawara ko sabis ɗin zai amsa. DNS ita ce mafi bayyanan misali: ɗaukar tambayoyi ba ya sa mai warwarewa ya karɓe su daga rukunin abokan cinikinka. Kowane Layer na iya cewa a'a da kansa.

Gwada kowace sabis ɗin daban ta hanyar tunnel ɗin. Neman da ya yi nasara ba ya faɗin kome game da tashar yanar gizo, kuma buƙatar yanar gizo da ta yi nasara ba ta faɗin kome game da SSH.

dig @10.40.0.53 app.corp.example
nc -vz 10.40.0.10 8443
ssh -p 2222 [email protected]

Lokacin da tunnel ɗin yana aiki kuma komai ya gaza, fara karanta teburin hanya na abokin ciniki. Lokacin da sabis ɗaya ya gaza yayin da sauran suke aiki, kuskuren yana wurin wannan manufar. Waɗannan abubuwan lura guda biyu suna nuni ga masu daban-daban, kuma haɗa su yana ɓata lokaci.

WireGuard yana ja da layi ɗaya

WireGuard yana kiran mai sauraronsa na waje da ListenPort, kuma manhajar ciki har yanzu tana amfani da duk tashar sabis da take buƙata. AllowedIPs saitin prefixes ne da aka bin hanyarsu, ba jerin tashoshin sabis da aka yarda da su ba. Karanta shi a matsayin jerin izini na tashoshi yana samar da dokoki da ba su dace da abin da tunnel ɗin ke yi ba. Sunan ya bambanta; rarrabuwar layi kuwa ba ta bambanta ba.

Yarda da sabis ɗin a manufar shigar ciki ta gida lokacin da yake aiki a kan ƙarshen wurin kansa, ko a manufar turawa lokacin da yake bayan wannan ƙarshen wurin. Bambancin ne ke yanke shawarar wace ƙungiyar doka ce ke ganin fakitin.

Babban siffa ita ce jigilar waje ɗaya tare da tattaunawa na ciki da yawa. Kayan da suke buƙatar musanya na waje da yawa, ko wata yarjejeniyar IP dabam, suna tunatarwa cewa tsarin tashar jama'a ɗaya yana bayyana wannan ƙira ba kowane VPN ba.