Tura tashar jiragen ruwa da shiga VPN: inda fakitin yake zuwa da gaske

Zane-zane biyu, aikace-aikacen HTTPS ɗaya, kuma fakitin yana bin hanyar dabam a kowanne. Tura tashar jiragen ruwa yana canza inda ake isar da fakitin kuma yana barin sauran a matsayinsa. VPN yana ɗaukar wannan fakitin a cikin wani fakitin da farko, don haka mai sauraron aikace-aikacen yana ganin wata tushe dabam da ƙaramin mafi girman kaya. Ƙulla da mutane suke muhawara a kai tana nan a duka lokuta biyu, domin aikace-aikacen har yanzu HTTPS ne; abin da ya bambanta shi ne wanene zai iya buɗe haɗi da abin da cibiyar sadarwa ta tsakiyar za ta iya lurawa. Wannan bambanci yana warware yawancin tambayoyin aiki.

Dokar DNAT tana sake rubuta makoma kuma tana tsayawa a nan

A kan ƙofar Linux, wallafa sabis yana nufin doka a cikin sarkar PREROUTING ta teburin nat, ko makamancin haka a nftables. Dokar tana dacewa da adireshin jama'a da tashar, sannan tana sake rubuta makoma zuwa adireshin sirri na aikace-aikacen. Adireshin tushe, tashar tushe da kaya sun kasance ba a taɓa su ba, kuma conntrack yana rubuta taswirar don a sake rubuta amsoshi yayin fita. Halin shine tsarin fassarar adireshi na gargajiya da aka bayyana a cikin RFC 3022.

sudo iptables -t nat -A PREROUTING -d 203.0.113.10 -p tcp --dport 443 \
  -j DNAT --to-destination 10.20.30.40:443
sudo iptables -t nat -L PREROUTING -n -v
sudo conntrack -L -p tcp --dport 443

Mai sauraron aikace-aikacen ba ya taɓa sanin cewa haɗin ya zo ta hanyar fassara. Yana ganin ainihin adireshin tushen abokin ciniki, wanda ke da amfani ga tarihin shiga da iyakokin sauri, kuma yana amsa ga adireshin sirri domin conntrack yana juya taswirar. Babu abin da ke cikin wannan hanyar da yake buɗewa ko sake ɓoyewa: TLS har yanzu yana gudana tsakanin abokin ciniki da takardar shaidar aikace-aikacen kansa.

Dokar kuma tana ƙayyade hanyoyin gazawa da za ku haɗu da su daga baya. Idan ƙofar tana tura amma uwar garken aikace-aikacen ba ta da wata hanyar komawa ga abokin ciniki, amsoshi suna fita da tushen da bai dace ba kuma musafaha yana tsayawa. Idan wata doka ta biyu ta dace da farko, tsari ne ke yanke sakamako, kuma iptables -t nat -L -n -v yana nuna ƙididdigar da ke tabbatar da wace doka ta karɓi fakitin.

Ramin yana naɗe fakitin kafin mai sauraro ya gan shi

VPN ba ya wallafa aikace-aikacen kwata-kwata. Abokin ciniki yana gina fakitin waje da aka yi wa adireshin jama'a na ƙofar, yana ɓoye fakitin ciki a cikinsa, kuma ƙofar tana buɗewa kuma tana tura fakitin ciki zuwa makomar sirri. Da WireGuard jigilar waje UDP ce, yawanci a kan tasha mai tsayi; da OpenVPN a kan TCP 443 fakitin waje yana kama da TLS ga duk abin da ke lura da hanyar.

A cikin ramin fakitin ciki yana riƙe da adireshi na sirri: adireshin ramin abokin ciniki, a ce 10.8.0.6, da aikace-aikacen a 10.20.30.40. Saboda haka mai sauraro yana ganin tushe daga tafkin ramin, kuma kowane abokin ciniki yana raba wannan ƙofar a matsayin tsallaken gaba. Tarihin shiga bayan VPN yakan nuna ƙofar maimakon mai amfani saboda wannan dalili, sai idan ƙofar tana kiyaye ainihin tushen.

Naɗewa yana cin sararin kan layi, kuma wannan shine kawai bambancin matakin inji wanda yake da sakamakon da za a iya aunawa. Kan layin IP na waje da UDP da kan layin WireGuard kansa suna cin MTU na hanyar, don haka manyan fakiti dole a raba su ko tulin TCP na ciki ya takaita MSS ɗinsa. Canja wurin da ke aiki a kan hanyar da aka tura zai iya tsayawa a kan ramin lokacin da na'urar tsakiyar ta watsar da ICMP da zai nuna ƙaramin MTU.

ip route get 10.20.30.40
ping -M do -s 1400 10.20.30.40
sudo iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
  -j TCPMSS --clamp-mss-to-pmtu

Ana yanke shawarar fallasa a ƙofar shiga, ba da sirri ba

Dukansu zane-zane suna ƙarewa a mai sauraron TLS ɗaya, don haka dukansu suna gado takardar shaidar ɗaya, nau'ikan yarjejeniya ɗaya da shigar aikace-aikacen ɗaya. Abin da ke canzawa shi ne wanda aka ba izinin fara musafaha. Da turawa ta jama'a, kowace uwar garke da za ta isa 203.0.113.10:443 tana samun musafahar TCP da TLS ClientHello kafin a tuntuɓi izinin aikace-aikacenku kwata-kwata. Da shiga ta rami kawai, ana iya isa mai sauraro ne kawai daga adireshin da ƙofar ke turawa cikin ramin, kuma SYN na baƙo yana mutuwa a manufofin ƙofar.

Wannan bambanci game da isarsu ne, ba game da sirri ba. Sabis ɗin HTTPS da aka tura ba rubutu ne a fili ba, kuma VPN ba ya kawar da buƙatar tabbatar da aikace-aikacen: karɓar cikin rami yana amsa ko na'ura za ta iya aika fakiti cikin wannan cibiyar sadarwa, yayin da aikace-aikacen fayil yana amsa ko mai amfani zai iya karanta takarda. Haɗa su biyun shine yadda ƙungiyoyi suke ƙarewa da VPN da ke ba da dukan LAN da aikace-aikace mai kalmar sirri ɗaya da aka raba.

Bincika mai sauraro da manufofin daban, domin kowane ɗayansu na iya zama fiye da yadda kuke tsammani:

sudo ss -ltnp 'sport = :443'
sudo nft list ruleset
openssl s_client -connect 203.0.113.10:443 -servername files.example.com </dev/null

Idan ss ya nuna mai sauraron yana daure da 0.0.0.0, ana iya isa aikace-aikacen daga duk inda turawa da manufofin wuta suka yarda, kuma turawa ɗaya ce daga cikin hanyoyin shiga. Daure da adireshin sirri, ko takaita kewayon tushe a cikin wutar, yanke shawara ne dabam daga zabar VPN, kuma ita ce shawarar da ke rage fallasa da gaske.

Auna hanyar, ba alamar ba

Lokacin da wani ya ce turawa tana da sauri, kwatancen gaskiya yana riƙe da duk sauran a daidai: abokin ciniki ɗaya, cibiyar sadarwar shiga ɗaya, fayil ɗaya, saitin TLS ɗaya, uwar garken aikace-aikace ɗaya. Gudanar da canja wurin sau biyu ga kowace hanya kuma rubuta jimillar lokaci, adadin gazawa da amsawa, ba fitar gwajin sauri marar alaƙa ba.

curl -sS -o /dev/null -w '%{time_connect} %{time_appconnect} %{time_total}\n' \
  https://files.example.com/report.pdf
mtr -rwc 20 203.0.113.10
mtr -rwc 20 10.20.30.40

Waɗannan lambobi suna raba kafa haɗi daga lokacin canja wuri, wanda ke da muhimmanci domin hanyoyin biyu yawanci sun bambanta a jinkirin tafiya-da-dawowa da MTU maimakon a kuɗin sirri. Aikin TLS yana faruwa a ƙarshen duka zane-zanen, kuma rami yana ƙara ɗaukar ciki, wata hanya dabam da wata ƙila mafi cunkoson ƙofa. Idan hanyar ramin ta fi tsayi ko ƙofarta tana da nauyi, bambancin na hanyar ne ba na kalmar sirri ba.

Zaɓi manufar shiga da sabis ɗin yake buƙata da gaske, sannan yanke shawara ko bambancin da aka auna ya cancanci canza ta. Turawa ta jama'a ta dace da sabis ɗin da aka yi don buɗaɗɗen intanet, tare da takaita tushe, TLS da aka sabunta da sa ido a gabansa. Shiga ta rami kawai ya dace da kayan aiki na ciki wanda masu amfani da shi sun riga sun yi rajista, matuƙar turawar ƙofar da izinin aikace-aikacen duka sun fi dukan LAN kunkuntar.

Kafin ka ce an gama zanen, tabbatar da abubuwa huɗu: wane adireshi mai sauraron yake daure da shi, wace doka ko hanya ce ke karɓar fakitin, shin hanyar komawa tana aiki daga ainihin adireshin abokin ciniki, kuma shin manyan kaya suna tsira daga MTU. Kowanne daga cikinsu yana da umarni a sama, kuma babu wanda kalmar aminci ko ginshiƙin bandwidth ke amsawa.