Meesha qayrka firewall-ka Android ay tahay inuu ku sii noolaado marka VPN-du shidan tahay
Keliya hal VpnService ayaa firfircoon noqon kara, sidaas darteed app-ka firewall-ka iyo app-ka VPN iskuma dul yaallaan. Socodsii hal codsi shaqo oo dhig qayr kasta meeshii taraafikadu dhab ahaan marayo.
Waxaad haysataa hal jumlad siyaasad: app-kan wuxuu gaari karaa adeegga shaqada, wax kalena ma gaaro. Su'aasha xigta waxay u egtahay doorasho badeeco, laakiin waa su'aal ku saabsan meesha, sababtoo ah qod kasta oo fulin kara wuxuu arkaa qayb kale oo taraafikada telefoonka ah. Gateway-gu wuxuu arkaa oo keliya waxa tunnel-ka soo gala. Filter-ka dhinaca telefoonka wuxuu arkaa oo keliya waxa loo ogol yahay inuu arko. Hal codsi labada dhex maris ayaa jawaabta caddeeya.
Ka bilow jumladda, ma aha badeecada
Ballaadhi shuruudda ka hor inta aadan wax dooran. Taasi waxay ka dhigan tahay xirmada iyo borofaylka uu ku socdo, sababtoo ah app-ka borofaylka shaqadu waa isticmaale kale marka la barbardhigo isla app-ka borofaylka shaqsiga. Waxay ka dhigan tahay halka loo socdo: host, port iyo protocol, ma aha magaca adeeg. Waxay ka dhigan tahay waddada DNS ee magacaas xallisa, iyo waxa ay tahay inuu dhaco marka tunnel-ku aanu diyaar ahayn.
Marka la qoro, siyaasadda tusaalaha waxay leedahay afar sadar: app-ka shaqadu wuxuu gaari karaa adeegga shaqada; app-ka shaqadu wax kale ma gaari karo; app-yada kale isma beddelaan; tunnel la'aan, app-ka shaqada waa la diidayaa halkii uu qaadan lahaa waddo toos ah. Sadar kastaa wuxuu leeyahay milkiile, mana wada aha milkiile keliya.
Tallaabo 1: waxa telefoonka laftiisu fulin karo
Firewall-ka Android ee aan root ahayn waa VpnService taraafikada gudaha u qabta, xitaa marka aanu tunnel fog ka dambeeynin. Android waxay ogolaataa hal adeeg VPN firfircoon borofayl kasta oo isticmaale, sidaas darteed app-ka labaad ee firewall-ku kama xirxirmo kan kowaad gadaashiisa. Wuu beddelaa, oo interface-kii app-ka kowaad filtrinayay wuu lumaa.
Taasi waa sababta rakibidda firewall-ka agtii macmiilka VPN ay marar yar soo saarto isku-dhafka dadku filayaan. Haddii firewall-ku bilaabo oo VPN-du go'o, wax isku dhacay ma jiro; labadu meelahooda way kala beddeleen. Beddelka interface-ku iskaashi maaha, calaamadduna waa tunnel-ka si joogto ah u dhaca mar kasta oo app-ka kale la furo.
Habab la taageeray ayaa haddana jira: filtrin lagu dhex daray macmiilka VPN ee aad hore u isticmaashay, kontaroolo platform oo la maamulo iyada oo loo marayo kontoroolka siyaasadda qalabka ama borofaylka shaqada, ama dhismaha uu soo-saare uu dokumenteeyay. Wax kasta oo kale waa tijaabo dib loo xaqiijinayo ka dib cusboonaysiin kasta oo app-ka ah.
Tallaabo 2: waxa gateway-gu fulin karo
Marka taraafikadu dhinaca fog lagu furmo, gateway-gu wuxuu xaddidi karaa baakadaha la gudbiyo ciwaanno, adeegyo ama aqoonsiyo VPN la xaqiijiyay oo la ogolaaday. Taasi waa fulin dhab ah wax kasta oo dhex mara, waana meesha saxda ah ee lagu xaddido gelitaanka subnet-yada gaarka ah.
Waxa aanu helin waa aqoonsiga app-ka telefoonka ee ku lifaaqan baakad kasta oo IP caadi ah. App-yo badan oo wadaaga hal ciwaan tunnel waxay gateway-ga u yihiin hal maado, haddii aanu nashqaddu siin ciwaanno gaar ah ama aqoonsiyo la xaqiijiyay oo gaar ah. Sidaas darteed qayrka isticmaale kasta ee gateway-ga ma aha qayrka app kasta ee telefoonka, sida kasta oo kontoroolka maamulka ugu magacaabo.
Tallaabo 3: liis garo waxa marnaba imanaya
App laga saaray VPN oo la xiriira qalab u dhow marnaba ma gaaro gateway-ga, sidaas darteed firewall-ka bixitaanku ma diidi karo baakad uusan marnaba helin. Sidoo kale waa waddada tooska ah ee aan la qorsheyn inta lagu jiro xannibaadda iyo soo-gaadhista gelitaanka shabakadda gudaha ee gelitaanka. Kuwaasi waa xuduudo gudaha ah marka la qeexo.
Arrinta lidkeeduna sidoo kale waa run: qayr gudaha ah oo ogolaada xiriir kama bixiyo gelitaan iyada oo loo marayo ACL-ga shabakadda gaarka ah ee gateway-ga. Hal codsi waxa uu ku xiran karaa labada xuduud, oo mid ka mid ah buuxinta wax kama sheegto tan kale.
Tallaabo 4: qayr kasta u qoondee waddo
Dhig go'aanka shax ku dhex jira ka hor inta aadan wax habaynin, sababtoo ah unugyada madhan waa meesha nashqaduhu ku guuldareystaan.
| Path | Who can enforce it | Blind spot |
|---|---|---|
| Work app to the work service, tunnel up | Gateway ACL on address and service, plus a local block on other paths | The gateway cannot see which app sent the packet |
| Work app to other destinations, tunnel up | Local app-aware filter, or the gateway if those destinations are addressed there | The local filter must be the active VpnService |
| Work app with no tunnel | Local deny, so the app cannot take a direct path | Requires the filter to survive the tunnel going away |
| Nearby LAN device | Local policy only | The gateway never sees it |
Qaabka shaqeeya waa laba xuduud oo leh laba shaqo. Xuduud gudaha ah oo app-ka garanaya ayaa maamula hab-dhaqanka telefoonka, oo ay ku jirto fallback tooska ah, xuduudka gateway-na wuxuu maamulaa khayraadka fog. Dhinaca gateway-ga wuxuu ogolaan karaa adeegga shaqada oo uu diidi karaa subnet kasta oo gaar ah, halka siyaasadda dhinaca telefoonka ay keligeed go'aansato waddada tooska ah ee app-ku si kale u qaadan lahaa.
Tallaabo 5: gaadiidka nool, kadib xaqiiji
Siyaasad kasta oo gudaha ah oo aad dooratid waa inay ogolaataa gaadiidka VPN-da dhisa oo joogteeya. Xannibaadda gaadiidkaas waxay telefoonka kaga tagtaa tunnel la'aan iyo siyaasad la'aan, taas oo aan wax si isku mid ah u fulineyn oo ay adag tahay in la ogaado sababtoo ah app-ku shabakad ma hayo.
Kadib xaqiiji sadar kasta oo jumladda asalka ah halkii aad ka eegi lahayd aragtida guud: app-ka shaqadu wuxuu gaaraa adeegga shaqada, isla app-ka waxaa laga diidayaa meel kale oo loo socdo, app aan shaqo ahayn wuxuu u dhaqmaa sidii hore, oo marka tunnel-ku joojmo app-ka shaqadu kuma laabto xiriir toos ah. Waddada DNS si gooni ah u hubi, sababtoo ah DNS gaar ah ama resolver sir ah ayaa ka gudbi kara filter-ka kaliya ciwaannada eega.
Haddii mid ka mid ah tillaabooyinkaas aan telefoonka lagu buuxin karin, shuruuddu waa su'aal dhisme ah ee ma aha deegaan firewall. Siyaasadda u kala qaybin qalabka aad maamusho iyo gateway-ga aad maamusho ayaa badanaa jawaabta daacad ah, oo dokumentiga isku xirka VPN ee Android waa meesha aad ku xaqiijiso waxa platform-du u ogolaanayso hal adeeg iyo waxa aanay u ogolaanayn.