Manhajar VPN ko IKEv2 da ke cikin iPhone: yadda za a zaɓa
Manhajar VPN ta iPhone da abokin ciniki na IKEv2 da ke cikin na’urar suna magance matsaloli daban-daban. Da farko kwatanta tallafin ka’idoji, tabbatarwa, sarrafa na’ura da dawo da aiki.
A makon da ya gabata wani abokin aiki ya ba ni iPhone ɗinsa da shigarwar VPN biyu a Saiti: ɗaya manhajar mai bayarwa ta bar, ɗayan kuma daga bayanin IKEv2 da aka liƙa daga shafin tallafi. Waɗannan ba sigogin gasa ne na abu ɗaya ba. Manhajar mai bayarwa kwano ne da zai iya ɗaukar lambar ramin ta kansa, yayin da abokin ciniki na Apple da ke cikin na’ura abokin ciniki ne na IKEv2, wanda ake daidaita shi da hannu ko ta bayani. Ka’ida, yadda ake sarrafa shaidu, sarrafa na’ura da dawo da aiki su ne ke ƙayyade zaɓi.
Manhaja da abokin ciniki na asali suna a matakai daban-daban
Abokin ciniki na VPN da ke cikin Apple a aikace abokin ciniki ne na IKEv2. Fom ɗin hannu har yanzu yana lissafa tsohon L2TP a kan IPsec da zaɓuɓɓukan Cisco IPsec, amma babu filin jigilar mai bayarwa kuma babu inda za a liƙa tsarin OpenVPN ko WireGuard. Ko dai ka cika fom a Saiti > Gama gari > VPN & Sarrafa Na’ura ko ka shigo da bayani mai ɗauke da kayan VPN; saman shi ne adireshin uwar garke, shaida biyu, hanyar tabbatarwa da dokoki na zaɓi bisa buƙata.
Manhajar mai bayarwa tana aiki mataki ɗaya sama. Tana kawo mai bayar da ramin fakiti na Network Extension, don haka lambar ka’ida da dabarar turawa suna cikin manhaja kuma iOS yana wuce da fakiti kawai. Wasu manhajoji suna aiwatar da WireGuard ko OpenVPN, wasu jigilar ɓoyayyiyar tasu, kuma kaɗan suna shigar da bayanin IKEv2 kawai sannan suna tafiyar da abokin ciniki na asali a bayan allo mafi kyau. Wannan rukunin na ƙarshe ne ke sa zaɓin manhaja ko bayani ya zama na ƙarya wani lokaci.
Sakamakon a aikace: fayil ɗin .ovpn ko WireGuard ba ya maye gurbin waɗannan filayen, domin musafaha wata ka’ida ce.
Karanta kayan kafin kwatanta fasali
Lokacin da bayanin IKEv2 ne, maɓallan kayan suna bayyana kurakurai fiye da kowane kwatancen fasali. Mai nuni da saitunan IKEv2 na Apple yana rubuta kowace maɓalli; gajerun kaya suna kama da haka:
<key>VPNType</key><string>IKEv2</string>
<key>RemoteAddress</key><string>vpn.example.net</string>
<key>RemoteIdentifier</key><string>vpn.example.net</string>
<key>LocalIdentifier</key><string>[email protected]</string>
<key>AuthenticationMethod</key><string>Certificate</string>
<key>ServerCertificateIssuerCommonName</key><string>Example Issuing CA</string>Filaye uku ne ke ɗaukar yawancin nauyin bincike. RemoteIdentifier shine sunan da abokin ciniki yake tsammanin uwar garke za ta gabatar, don haka ƙofar da ke bayan NAT ko mai daidaita nauyi wanda takardar shaidarsa ke ambaton tafki maimakon adireshin yana kasawa ko da adireshin daidai ne. LocalIdentifier ita ce shaidar da uwar garke ke zaton kai ne, kuma da tabbatarwa ta takardar shaida dole ta dace da shaidar da aka haɗa da asusunka. ServerCertificateIssuerCommonName yana maƙale CA mai bayarwa, don haka bayani na iya kasawa ranar da aka sake bayar da takardar shaida, ba tare da wani saƙon kuskure ya ambaci takardun shaida ba.
Idan AuthenticationMethod daidai yake da SharedSecret, uwar garke tana yin tabbatarwar mai amfani ta EAP kuma sirrin da aka ba ka shaidar asusu ne a haƙiƙa. Wannan yana da muhimmanci lokacin da mai bayarwa ya aika takardu biyu, ɗaya don sunan mai amfani da kalmar sirri ɗaya kuma don takardar shaida, kuma ɗaya kawai ya dace da abin da ka shigo da shi.
Abin da manhaja za ta iya yi da abokin ciniki na asali ba zai iya ba
Zaɓin ka’ida shine fa’idar da ta fito fili. Idan uwar garnka tana magana da WireGuard ko OpenVPN, manhaja ita ce kawai abokin ciniki na iOS da zai iya amfani da shi, kuma gyara fom ɗin asali ba zai yi shawara da shi ba. Manhaja kuma za ta iya aiwatar da rami rabuwa bisa manufa ko manhaja, sarrafa DNS nata, toshewar irin kill switch, zaɓin uwar garke da sake haɗawa da aka daidaita da cibiyar sadarwarta.
Farashin shine software da ba ka duba ba, wanda ke gudana da haƙƙin faɗaɗa cibiyar sadarwa. Inganci ya bambanta fiye da yadda katunan shago ke nunawa: manhaja ɗaya tana sake haɗawa da tsafta yayin da wata tana zubar da ɗan daƙiƙa bayan canjin cibiyar sadarwa, kuma kill switch da ke cikin manhajar fasalin wannan manhaja ne, ba na iOS ba. A kan na’ura da ake sarrafawa, duba jerin da aka amince da shi da farko.
Abin da bayanin IKEv2 da ke cikin ke yi daidai
Ƙananan sassa masu motsi shine dukan hujja. Abokin ciniki na IKEv2 da tarin IPsec ɗinsa suna zuwa da tsarin aiki, don haka babu faɗaɗa da zai iya faɗuwa, babu tsari ga kowace manhaja da za a riƙe da rai, kuma babu zagayen sabuntawa na ɓangare na uku tsakaninka da rami mai aiki. Hakanan ana iya kulle bayani: a kan na’ura da ake sa ido, mai amfani ba zai iya cire abin da gudanarwa ya shigar ba, kuma Always On VPN, wanda ke sake haɗawa a kowace cibiyar sadarwa ba tare da maɓallin mai amfani ba, yana wanzu ne kawai a cikin wannan sifa ta sa ido da gudanarwa ta bayani.
Abin da hanyar cikin ba ta bayar shine sassauci. Babu VPN ga kowace manhaja ba tare da manhajoji da ake sarrafawa ba, babu kill switch ga mai amfani, kuma babu jigilar da za ta yi kama da HTTPS a cibiyar sadarwar da ke toshe IPsec. A cibiyoyin sadarwar otal da ke zubar da UDP 500 da 4500, IKEv2 na ciki ba shi da hanyar ajiya.
Tebur na yanke shawara da ke warware yawancin lokuta
A aikace tambayar ka’ida tana yanke shawarar yawancin lokuta kafin fasali su zama masu muhimmanci.
| What you were given | Device situation | What to use |
|---|---|---|
| An .ovpn or WireGuard config | Personal phone | Provider app; the native form cannot load it |
| IKEv2 host plus CA name | Personal or managed | Profile, or the app's own IKEv2 mode |
| IKEv2 with username and secret | Personal phone | Either; the profile is simpler if you never switch servers |
| A management-installed profile | Supervised, MDM | Native client; do not add a second app entry |
| A per-app tunnelling requirement | Personal phone | App, or accept a full tunnel; iOS cannot split by app without management |
| IPsec blocked on your main network | Any | App with a transport that survives the block |
Layuka biyu sun cancanci wani kallo na biyu. Buƙatar kowace manhaja a wayar mutum ita ce yanayin da mutane ke karantawa ba daidai ba: saitin yana cikin iOS amma gudanarwa ce ke tafiyar da shi, don haka na’urar da ba a sarrafa ba ba za ta bayar da ita ba. Cibiyar sadarwar da aka toshe ba dalilin rashin amincewa da IKEv2 ba ce; ita ce dalilin da ya sa manhajar mai bayarwa take wanzuwa.
Tabbatar da zaɓi da gwaji ɗaya
Gwada hanyoyin kasawa, ba maɓallin haɗawa ba. Haɗa sau ɗaya, tabbatar alamar VPN ta bayyana, sannan buɗe shafin da ke mayar da adireshinka na jama’a ka kwatanta da na baya. Sauya daga Wi-Fi zuwa bayanan wayar hannu ba tare da taɓa VPN ba ka lura da sake haɗawa, sannan ka ratsa wayar ta yanayin jirgin sama. Sake farawa ka ga ko ramin ya dawo da kansa: bayani mai OnDemandEnabled ya kamata, yayin da manhajoji da yawa dole a fara buɗe su.
Idan bai dawo ba, raba kuskuren bisa ko akwai rami kwata-kwata. Rashin alamar VPN yana nufin ramin bai taɓa tashi ba: ko dai musafaha ya kasa a RemoteIdentifier, CA da aka maƙale ko shaida, ko kuma ba a taɓa gwada haɗin ba domin dokar bisa buƙata ba ta dace ba kuma babu manhaja da ta fara shi. Alama da zirga-zirgar da ke kasawa tana nufin turawa, DNS ko manufar gefen uwar garke, kuma sake shigar da abokin ciniki bai taɓa ɗaya cikin waɗannan ba.
Jerin gajere don barin na’urar a bayyane ga mutum na gaba:
- shigarwar VPN ɗaya, ba biyu ba;
- an saka sunan bayani ko manhajar da sunan uwar garken da take haɗawa da ita;
- an rubuta darajar shaidar inda za ka same ta.
Fara da layin ka’ida a tebur, kuma tsaya a nan idan ya amsa tambayar.