Ƙarshen VPN ɗaya ta Squid: ƙunƙuntacciyar keɓewar CONNECT

Squid yana amsa buƙatar CONNECT da layin http_access na farko da ya yi daidai, kuma wannan layin na iya zama ƙi. Wannan gaskiya ɗaya tana bayanin dalilin da yasa keɓewar ƙarshen VPN yawanci ke kasawa a ƙoƙari na farko, domin buƙatar ba ta taɓa isa izinin da wani ya ƙara a ƙasa ba. Ƙunƙuntaccen gyara yana riƙe masu gadin tashoshi da suke akwai kuma yana koya musu ingantaccen tushe, manufa da tasha guda ɗaya. Duk sauran abin da ke kan wakili yana yin daidai kamar dā.

Yadda Squid ke yanke hukunci kan buƙatar CONNECT

Buƙatar CONNECT tana ambaton mai masauki da tasha, kuma Squid yana bin layukan http_access bisa tsari har ɗayansu ya yi daidai. Ƙin da ya yi daidai yana kawo ƙarshen kimantawa nan take kuma abokin ciniki yana samun 403 daga wakilin. Shi yasa matsayin ƙa’ida ya fi rubutunta muhimmanci. Matsar da layi ɗaya mataki ɗaya zuwa sama na iya canza sakamakon gaba ɗaya.

Masu gadi na al’ada suna ƙin duk abin da ke wajen Safe_ports kuma suna ƙin CONNECT a wajen SSL_ports. Waɗannan sunaye ACL ne da aka ayyana a cikin tsarin ka, don haka abin da ke cikinsu naka ne ba na yarjejeniya ba. Rarraba na iya ba da izinin kewayon tashoshi mai faɗi a matsayin Safe_ports yayin da yake taƙaita CONNECT daban. Karanta ainihin ƙimar kafin ka ɗauka cewa an toshe tasha bisa ƙira.

Tabbatar wakilin ne ɓangaren da ke ƙin buƙatar. 403 da Squid ya samar bai yi kama da faɗakarwar TLS daga uwar garken VPN ba, kuma haɗa biyun cikin matsala ɗaya yana ci farashin sa’a ta farko. Duba layin tarihin shiga na buƙatar, domin yana rubuta aikin da ƙa’idar da ta haife shi duka.

Gina daidaituwa guda ɗaya da aka haɗa maimakon ACL guda uku sako-sako

Gina keɓewar daga gaskiya uku: ingantaccen kewayon tushe, adireshin manufa guda ɗaya ingantacce, da tashar guda ɗaya da ƙarshen yake saurara. ACL guda biyu sako-sako da haɗaɗɗiyar daidaituwa guda ɗaya suna samar da manufa daban sosai, domin haɗin ne ake kimantawa. Ba da sunan haɗaɗɗiyar ACL bisa abin da take bayar da izini, ba bisa hanyar da take ɗauka ba.

Siffar da ke ƙasa tana amfani da kewayon takardu waɗanda dole a maye gurbinsu da ingantattun ƙimomi. Squid bai tanadi ɗaya daga cikin waɗannan sunaye ba, don haka naka ne ka zaɓa kuma naka ne ka riƙe su daidai. Wannan girke-girken ya taƙaita ga Squid 6 da 7, waɗanda tsarinsu da aka rubuta yana goyan bayan ƙungiyar all-of. Nassin yanzu yana nuna waɗannan umarnin a matsayin babu su a Squid 8, don haka ɗauki wannan a matsayin girke-girken da ke da alaƙa da siga ba hanyar ƙaura ba, kuma duba umarnin a nassin sigar ka kafin amfani da shi.

acl pvpn_src src 192.0.2.128/25
acl pvpn_dst dst 198.51.100.77/32
acl pvpn_port port 1194
acl pvpn_ok all-of CONNECT pvpn_port pvpn_dst pvpn_src

Ƙungiyar all-of tana daidaitawa ne kawai idan kowane memba ya yi daidai, wato ana duba tushe, manufa da tasha a layi ɗaya. Ƙungiyar ba ta ba da komai da kanta, kuma buƙatar da ta yi daidai da biyu kacal daga cikin gaskiyar uku ba za ta iya gamsar da ita ba. Wannan siffa tana riƙe keɓewar da ƙunci idan wani ya ƙara ƙofa ta biyu daga baya. Ko dai an ƙara sabuwar manufar da gangan, ko kuma buƙatar ta koma ga masu gadin asali.

Lankwasa masu gadin tashoshi ba tare da cire su ba

A matsayinsu na yanzu, layukan gadi biyu na al’ada suna kama da haka. Yawanci suna zama bayan tabbatarwa da kuma gaban layukan manufofin da ke ba da izinin komai.

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

Ƙara haɗaɗɗiyar daidaituwar da aka musanta ga kowanne, domin keɓewar da ta yi daidai ta tsira daga mai gadi da zai ƙi ta in ba haka ba. Sai kawai layukan gadi ke canzawa, kuma kowanne da ƙarin sharadi guda ɗaya kacal.

http_access deny CONNECT !SSL_ports !pvpn_ok
http_access deny !Safe_ports !pvpn_ok

Ana haɗa sharuɗɗan layin shiga guda ɗaya, don haka layin yanzu yana ƙin buƙatun da suka gaza duka biyun: binciken asali da keɓewar. Buƙatar ƙarshen da aka yarda da ita tana wucewa, kuma kowace wata buƙata tana riƙe tsohon halin tasha. Wannan ya fi ƙunci fiye da ƙara tashar cikin jerin SSL_ports na gama gari, wanda zai ba da izinin wannan tashar ga kowace manufa. Idan tashar tana cikin wannan jerin tuni, wannan ACL ba ta taƙaita komai kuma tsohon, mafi faɗin izini yana aiki ga sauran manufofi, don haka karanta jerin da ke aiki kafin ka ce keɓewar ta buɗe tashar. Hakanan ana iya juyawa, domin layuka biyu suna komawa ga siffarsu ta baya. Nassin kula da shiga yana rubuta tsari da masu gadin al’ada da wannan canji ya dogara da su.

Inda ba za a saka keɓewar ba

Sha’awa ita ce a saka izini sama da masu gadin sannan a gama. Wannan wuri kuma yana tsallake kariyar tabbatarwa da ta manufar gida waɗanda yawanci suke kusa da saman tsarin da ke aiki. Sakamakon ba ƙunƙuntacciyar keɓewa ba ne, rami ne da sharhi a kansa. Riƙe duk wani sabon izini a matakin da aka duba ɗaya da sauran manufofin abokin ciniki.

Duba abin da buƙatar har yanzu take buƙata bayan masu gadin tashoshi. Asusu da aka tabbatar, adireshin abokin ciniki da aka yarda da shi, da manufar manufa duk suna aiki har yanzu, kuma keɓewar ba ta canza ɗaya daga cikinsu. Idan wakilin ka ya riga ya bar asusun da aka yarda ya isa ga manufofi marasa takamaiman, mai gadin tasha bai taɓa zama ainihin iko ba.

Yi la’akari ko ƙarshen TCP ne kwata-kwata. Keɓewar CONNECT tana ɗaukar kwararar TCP, kuma bayanin OpenVPN da ke amfani da UDP ba zai zama isarsa ta hanyarsa ba. Canza bayanin zuwa TCP ne kawai idan uwar garken yana saurara haka kuma mai aiki ya yarda da bambancin halin.

Duba iyakar da mai nazari da ainihin buƙata

Yi nazarin tsarin kafin sake lodawa, kuma riƙe zama na biyu a buɗe yayin da kake yin haka. Kuskuren tsarin rubutu a lokacin sake lodawa na iya barin wakilin a tsohon tsari ko ya ƙi sabon gaba ɗaya. Mai nazari yana ba da rahoton layin da aka ƙi, wanda ya fi abin da kuskuren abokin ciniki zai gaya maka.

Sannan sake lodawa kuma aika ainihin CONNECT ɗaya ta wakilin daga ingantaccen tushe. Gudanar da mai nazari yana zuwa farko, domin sake lodawa da kuskuren rubutu ba ya koya maka komai game da manufar.

squid -k parse
squid -k reconfigure
curl -v -p -x http://proxy.lab.internal:3128 https://vpn.lab.internal:1194/ --max-time 5

Gwada al’amuran uku: ingantaccen tushe da asusu, tushen da ba a yarda da shi ba, da wata manufa a kan tasha ɗaya. Na uku shi ne ke tabbatar da keɓewar tana da ƙunci, domin yana gwada tashar ba tare da daidaituwar manufa ba. Karanta tarihin shiga na duka ukun maimakon dogaro da saƙon abokin ciniki. CONNECT mai nasara yana kafa kwararar TCP kuma ba wani abu ba, don haka musafaha VPN ya kasance gwaji daban.