Me ya sa sakamakon binciken port ke canzawa bayan ficewar VPN?
Canza ficewar kuma port na iya amsa daban ba tare da sabis ɗin ya motsa ba. Raba lura da hanya daga lissafin da kuke buƙata da gaske.
Gudanar da wannan binciken port ɗin daga layin ofis da kuma daga ficewar VPN, kuma amsoshin biyu na iya samun sabani game da adireshin da babu wanda ya canza. Wannan tazara ta fito daga hanya da kuma wanda ya amsa, ba daga ko sabis ɗin yana aiki ko a kashe ba. Tambayoyi uku sun raba waɗannan bayanin: abin da na’urar bincike ta tambaya da gaske, wace mashin ta amsa, da abin da sabar ku ta rubuta. Bi su a cikin wannan tsari kuma rubuta kowace amsa kafin ku wuce ta gaba.
Gyara na’urar bincike kafin kwatanta gudu biyu
Kalmar yanayi ba za a iya kwatanta ta da wata kalmar yanayi ba sai idan dukansu sun fito daga gwaji ɗaya. Filaye biyar sun tabbatar da hakan: adireshin tushe da gefen nesa ya gani, manufar da aka warware, port ɗin, nau’in bincike, da lokacin. Canza ɗaya daga cikinsu kuma kun yi gwaji na biyu maimakon auna na farko sau biyu.
Duba tushen kafin kome, domin abokin ciniki na VPN na iya aiki yayin da zirga-zirga ke fita ta hanyar injin jiki. Tambayi gefen nesa abin da yake gani, sannan tambayi kernel wace hanya ya zaɓa:
curl -s https://ifconfig.me
ip route get 203.0.113.20Adireshi biyu a cibiyoyin sadarwa daban-daban suna nufin bayanin yana hannunka tuni, kuma sauran waɗannan gwaje-gwajen za su tabbatar da shi kawai. Idan sun yi daidai, ɗauki na’urar bincike tare da tutar dalili a kunne, don yanayin ya dawo a haɗe da bayani maimakon ya tsaya shi kaɗai a matsayin kalma tsirara. Nau’in bincike ma yana cikin wannan rikodin, domin yana bayyana abin da aka tambaya ba abin da ya dawo ba. Yanayi ba tare da tushe, ba tare da hanya ba kuma ba tare da tambarin lokaci ba ba za a iya kwatanta shi da komai ba:
nmap -sT -p 443,8443 --reason 203.0.113.20Ajiye wannan fitarwa kusa da rikodin maimakon a cikin buffer na gungurawa da mutum na gaba ba zai iya gani ba. Bincike biyu na gaskiya da suka sabawa juna ba su zama jayayya ba sai idan babu wanda ya rubuta sharuɗɗan. Da sharuɗɗan sun tabbata, ko sakamakon ya yi daidai kuma tambayar ta rufe, ko kuma sun bambanta kuma bambancin gaskiya ne game da hanya.
Gano wace mashin ce ta kammala musafaha
Musafahar da aka kammala tana tabbatar da cewa wata mashin ce ta kammala ta, kuma wannan mashin ɗin ba lallai ba ne ya zama tsarin da kuke tunani. Mai daidaita kaya, wakili mai juyawa ko wakilin SYN na iya amsawa kafin sabar ta gaske ya shiga, wanda tsari ne na yau da kullum ba alama ba. Ingantaccen takardar shaida ga sunan da ake tsammani shi ma ba ya taƙaita wannan, domin takardar shaida tana bayyana dangantakar sabis kuma ba ta ce komai game da wace na’ura ce ta ƙare haɗin ba.
Tushen Nmap na yanayin port yana ɗaukar wannan a matsayin asali: yanayi yana rubuta abin da na’urar bincike za ta iya lura da shi daga inda aka aika ta, ba dukiyar port ba. Karanta kalmar yanayi haka kuma gudu biyu da suka sabawa sun fara bayyana daidaitacce maimakon masu cin karo, yayin da tambayar ta ƙaura daga ko port ɗin a buɗe yake zuwa wanene ya tsaya a gabansa.
Amsa tambaya ta biyu a backend maimakon daga waje. Frontend da ke karɓar haɗi sannan ya kasa isa ga upstream ɗinsa yana haifar da ainihin hoton waje na sabis mai lafiya tare da aikace-aikace mai jinkiri. Rikodin upstream ɗin kansa ne kawai ke raba shari’o’in biyu:
tail -n 5 /var/log/nginx/access.log
ss -ltnp 'sport = :443'Layin log ɗin yana nuna adireshin abokin ciniki da aikace-aikacen ya gani da gaske, kuma umarni na biyu yana nuna ko tsarin da ke riƙe da port 443 aikace-aikacenku ne ko wani abu a gabansa. Idan waɗannan biyun sun sabawa game da wane adireshi ya haɗa, kana kallon ƙafa biyu na buƙata ɗaya kuma tikiti ya kamata ya faɗi haka.
Duba dokokinka kafin ka zargi rami
Manufar da aka yi da gangan ita ce dalilin da ya fi yawa da port ke amsawa a wata cibiyar sadarwa ba wata ba, kuma ita ce bayani mafi ƙarancin sha’awa da ake da shi. Dokokin shiga suna wanzu don ba da izini ga tushe ɗaya da watsar da sauran, don haka canjin ficewa shine ainihin abin da aka rubuta su dominsa. Saboda haka yanayi daban ta hanyar VPN baya nuna cewa mai ba da sabis yana duba zirga-zirga. Yana nuna cewa adireshin tushenka ya bambanta yanzu, wanda shine ƙaramin da’awa.
Ana iya karanta waɗannan dokoki a sabar, don haka karanta su maimakon yin hasashe game da tsakiyar cibiyar sadarwa. Lissafa dokokin tacewa da suka ambaci ɗaya daga cikin jerin adireshi biyu, sannan duba ko haɗin ya isa ga daemon kwata-kwata:
nft list ruleset | grep -n -e 203.0.113 -e 198.51.100
journalctl -u sshd -n 50 | grep 203.0.113Sakamako na biyu mara komai yana da bayanai, domin babu abin da ya isa ga daemon kuma tambayar ta shafi tacewa, ƙungiyar tsaro ko hanyar kanta. Bugawa yana nufin sabis ɗin ya ga tushenka kuma ya zaɓi amsarsa, kuma yawanci ana rubuta wannan shawarar a cikin doka da za ka iya karantawa. Babu ɗaya daga cikin sakamakon da ke goyan bayan labari game da mai ba da sabis, kuma duka biyun sun fi arha a duba su fiye da kama fakiti.
Karanta sufuri, takardar shaida da amsa daban
Yadudduka uku suna haifar da lura uku, kuma na’urar bincike da ke gwada ɗaya daga cikinsu ba za ta iya ba da rahoto kan sauran biyun ba. Ajiye su a matsayin layuka daban a cikin rikodin maimakon ninka su cikin hukunci ɗaya, domin kowace layi tana kasawa ta hanyarta kuma yanayin kasawa yana gaya maka inda za ka duba na gaba.
| Observation | What it settles | What it leaves open |
|---|---|---|
| Connection completed | A host on the path accepted the handshake | Which host, and whether its upstream is reachable |
| Certificate valid for the name | The endpoint holds a credential for that name | Whether the process behind it is the one you meant |
| Expected response body | The application handled the request | Anything about other ports or other paths |
| Connection refused | A host replied and nothing was listening | Whether a filter sits ahead of the refused port |
| Timeout | No reply arrived before the deadline | Drop, blackhole route or an overloaded host |
Umarni ɗaya yana haifar da layuka uku na farko a kan sabis da kake sarrafawa. Sanya fitarwarsa cikin rikodin kusa da binciken ba a cikin saƙon hira ba:
curl -v --resolve office.example:443:203.0.113.20 https://office.example/Karanta fitarwar a tsari: musafaha tana amsa tambayar sufuri, batun takardar shaida yana amsa tambayar suna, kuma jikin amsa yana amsa tambayar aikace-aikace. Lokacin da layin musafaha ya yi nasara kuma layin amsa bai yi ba, kana da frontend mai karyewar upstream maimakon port da aka toshe. Wannan wani tikiti ne daban da wanda ka buɗe, kuma ya cancanci faɗi haka a sarari.
Kammala ta hanyar rubuta gaskiya huɗu cikin tikiti: adireshin tushe, nau’in bincike, mashin da ya amsa, da lokacin. Duk abin da kwatancen gaba zai buƙata yana rayuwa cikin waɗannan huɗu, kuma wanda ya karɓi shari’ar na gaba ba zai sami tarihin tasharka ba. Idan ba za ka iya cika duka huɗun ba, gudun bai ƙare ba.