VPN ta UDP ba ta da murya a duba tashar? Me ya sa hakan ke faruwa
WireGuard da OpenVPN mai tsauri suna watsar da datagram ɗin da suka kasa tabbatarwa ba tare da amsawa ba. Shiru daga na'urar duba ɗabi'a ce da ake tsammani, ba tashar da aka rufe ba.
Kuna duba tashar VPN, ba ku sami amsa ba, kuma kuna yanke shawara cewa sabis ɗin ya ƙare ko kuma garkuwar wuta a rufe take. Tare da WireGuard, da kuma tashoshin sarrafawa na OpenVPN waɗanda ke ɗauke da nasu tabbatarwar, wannan shawarar ba ta biyo baya. Ana watsar da datagram marar ingantaccen kayan tabbatarwa ba tare da amsa ba, don haka shiru shine yadda sabis mai lafiya yake gani daga waje. Gwajin ba daidai ba ne kafin ramin ya kasance.
Shiru shine ka'ida, ba kuskure ba
UDP ba shi da kafa haɗi, don haka babu SYN kuma babu tabbaci da zai bai wa na'urar duba damar bambance tasha buɗaɗɗiya da wadda aka tace. Gwaji yana zuwa a matsayin datagram keɓaɓɓe, kuma sabis ɗin yana duba ko ya dace da ka'idar da yake tsammani. Idan bai dace ba, ana watsar da fakitin, kuma watsarwa ita ce ɗabi'ar da aka rubuta ba rashin aiki ba.
WireGuard yana tabbatar da saƙonnin handshake ɗinsa ta hanyar sirri kuma yana watsi da duk abin da ya kasa. OpenVPN tare da tls-auth ko tls-crypt yana yin haka ga tashar sarrafawa tasa. A duka biyun, wani nauyi na son rai ba ya taɓa isa matakin da ya shafi mai amfani, don haka babu abin da za a amsa da shi kuma babu kuskuren da za a mayar.
TCP da ya ba ku sake saiti daga rufaffiyar tasha. UDP yana barin ku cikin shakku, wanda masu duba ke warwarewa ta hanyar buga buɗaɗɗiya ko tace maimakon yin hasashe.
Abin da na'urar duba za ta iya yankewa da abin da ba za ta iya ba
Sakamakon dubawa yana da bayani gwargwadon nauyin da ya aika. Tsara abubuwan lura masu yiwuwa bisa abin da kowannensu ke goyan baya da gaske:
| Probe | Observed result | What it supports |
|---|---|---|
| Empty datagram | No reply | Nothing beyond the fact that UDP was used |
| Random payload | No reply | Consistent with an authenticated service |
| Valid handshake from a real client | A protocol reply | The service is alive and reachable |
| ICMP port unreachable | Unreachable message | The host answered, usually because nothing listens |
Karanta layi na uku a matsayin gwaji tabbatacce kaɗai a cikin jerin. Yana buƙatar ainihin bayanin martaba, ainihin maɓalli da madaidaicin wurin ƙarshe, wanda shine ainihin abin da na'urar duba ta gama-gari ba ta da shi.
Duba ƙarshen hanyar biyu
Don sabar da kuke gudanarwa, yi rikodin a kan mu'amala kafin ku yanke wata shawara, sannan ku tambayi sabis ɗin abin da ya gani. Duk umarnin biyu suna buƙatar root a kan ƙofar shiga:
tcpdump -ni any udp port 51820
tcpdump -ni any udp port 1194
wg showIdan babu fakitin da ya bayyana a kan mu'amala, hanyar ta watsar da shi kafin sabis ɗin ya ga wani abu, kuma tasha ta gaba ita ce turawa da tacewa. Idan fakiti sun iso amma babu handshake da ya cika, sabis ɗin ana iya isa gare shi kuma rashin daidaituwa yana cikin maɓallai, saitin wurin ƙarshe ko sigar ka'ida. Wannan kwatancen yana amsa tambayar da na'urar duba ba ta iya ba. Gudanar da shi yayin da ainihin abokin ciniki ke ƙoƙarin haɗawa, ba yayin da na'urar duba ke maimaita kanta ba.
Canza gwajin, ba kariya ba
Hanyar gajeruwa mai jaraba ita ce kashe kariyar tashar sarrafawa domin bincike ya sami amsa. Wannan yana musanya ainihin yanayin tsaro da kyakkyawan sakamakon dubawa, kuma hanya ce mara kyau. A maimakon haka yi amfani da ingantaccen bayanin martaba daga hanyar da aka amince da ita, kuma rubuta wurin ƙarshe da lokaci domin kwatancen ya kasance mai maimaitawa.
Gwajin mafi amfani shi ne na bambanci: bayanin martaba ɗaya a kan hanyar da ke aiki da kuma hanyar da ba ta aiki. Idan hanyar da ke aiki ta samar da handshake kuma hanyar da ta kasa ba ta samar da komai a kan mu'amala ba, kun gano wurin karyewa ba tare da raunana komai ba.
Don haka fakitin UDP marar amsa ba ya tabbatar da cewa sabar ba ta kan layi ba ko kuma tana da aminci. Yana tabbatar da cewa wannan gwajin, a wannan hanyar, a wannan lokacin, ba a karɓa shi ba.