Waddada blackhole iyo kill switch VPN: mid kastaa maxuu qabtaa
Waddada blackhole waxay tuurtaa taraafikada u dhigma oo waxay ku qasabtaa waddo xiran marka ay fashilanto. Isbarbar dhig baaxaddeeda iyo meelaha indhaha la' oo la xiriira kill switch ku saleysan shaandhaynta baakadaha.
Baakad waxay ka baxdaa laptop-ka, waligeed ma gaadho iridda VPN, oo ma jiro tiriyaha dab-damiska oo dhaqaaqa. Jadwalka waddooyinka ayaa horey u go'aamiyay masiirka baakadda: gelinta blackhole ayaa la mid ahayd oo kernel-ku wuu tuuray ka hor inta aanay jid kasta arag. Dhaqankaas waa faa'iido leh marka meel loo socdo ay tahay in ay ku fashilanto si xiran, laakiin waa fal waddo leh baaxad cidhiidhi ah. In loo arko kill switch buuxa waa halka naqshadaha khaldamaan.
Muxuu falka tuuristaa run ahaantii la mid yahay
Raadinta waddada waxay doorataa jadwal, ka dibna horgalaha ugu dheer ee u dhigma gudaha. Waddada blackhole waa gelin caadi ah oo falkeedu yahay tuuris, sidaas darteed waxay saameyn ku leedahay oo kaliya baakadaha dooran lahaa gelintaas ka dib go'aanka oo dhan. Beddel jadwalka qaanuun siyaasad ah, ama ku dar horgale gaar ah, tuuristuna ma khuseeyso.
Sidaas darteed baaxadda blackhole waa sax oo si fudud loo sheegi karaa: waxay daboolaan horgalaha, jadwalka dhexdiisa, qoyska ciwaankaas. Ma daboolaan meel ay jadwal kale ku guuleysan lahaa, mana daboolaan IPv6 sababtoo ah horgalaha IPv4 waa la tuuray.
ip route get waxay tusaa go'aanka ka hor inta aadan wax dhigasho, oo ay ku jiraan jadwalka iyo nooca waddada. Akhrinta natiijadaas ayaa ka dhaqso badan in laga qiyaaso codsi fashilmay qaanuunka ama horgalaha shaqeeyay.
Blackhole lama mid aha unreachable ama prohibit
Linux waxay bixisaa saddex nooc oo waddooyin u eg tuuris, oo waxay ku kala duwan yihiin waxa dirista uu arko. Blackhole waxay tuurtaa baakadda iyada oo aan jawaab lahayn, sidaas darteed macmiilku wuxuu arkaa waqti dhaaf. Waddada unreachable waxay soo celisaa fariin ICMP unreachable, sidaas darteed xiriirku si degdeg ah ayuu u fashilmaa khalad marti-geliye ama shabakad. Waddada prohibit waxay soo celisaa khalad mamnuucid maamuleed, taas oo u dhowaansho leh diidmo siyaasad oo ula kac ah.
Dooro dhaqanka aad rabto in barnaamijku arko. Tuuris aamusnaan ah ayaa ku habboon marka aadan rabin inaad siyaasadda muujiso, khalad degdeg ahna waa ka wanaagsan yahay marka isticmaalayaashu u baahan yihiin inay fahmaan sababta meel loo socdo aan la heli karin. Isku darka noocyada shabakadda waxay abuurtaa tigidhada taageero ee ku sifeeya isla siyaasadda sadex ciladood oo kala duwan.
Ha u qaadan in gelin kasta oo tuuris ah ay is beddeli karto markaad baadhayso xiriir. Qoraalka khaladka, waqtiga iyo qabashada baakadaha way kala duwan yihiin, nooca waddada ee jadwalka ayaa kuu sheegaya midka aad eegayso. buug-gacmeedka ip-route waxay taxaa noocyada iyo dhaqankooda khaladka.
Sidee bay ula barbar dhigtaa kill switch
Kill switch waa shaandhaynta baakadaha: qaanuun dab-damis ah oo tuura taraafikada baxa ee ka bixi lahaa bannaanka tunnel-ka. Waddada blackhole waa go'aan gudbin oo la qaatay horey stack-ka. Labaduba waxay joojin karaan taraafikada, laakiin waxay arkaan waxyaabo kala duwan oo waxay seegaan kiisaska kala duwan.
| Mechanism | What it blocks | What it misses | How failure looks |
|---|---|---|---|
| Blackhole route | Destinations matching the prefix and table | Other tables, other address families, traffic with a different route | Silent timeout |
| Firewall kill switch | Egress not bound to the tunnel interface | Rules that are too broad can break the endpoint or DHCP | Dropped packets with counters |
| WireGuard AllowedIPs | Destinations not routed into the interface | Traffic that never enters the interface at all | No tunnel route, direct egress |
Daboolka ayaa ah halka isbarbardhiggu muhiim yahay. Dab-damisku wuxuu u dhigmaan milkiilaha, dekedda ama jidka, oo wuxuu xannibaa barnaamij isagoo meesha ugu dambeysa la heli karo; waddo ma awooddo. Taa lidkeeda, waddo waxay u diri kartaa horgale dhan tuuris iyada oo aan shaandheyn baakad ah la rakibin, taas oo faa'iido u leh nidaam yar.
AllowedIPs ee WireGuard waa waddooyin fure-cryptographic ah, ma aha dab-damis. Waxay go'aamisaa horgalaha meelaha loo socdo ee laga aqbalo jidka, profile-ka taxaya kaliya subnet-ka tunnel-ka waxay u dhaafaa meelaha kale waddada caadiga ah ee default-ka. Sidaas darteed profile-yada tunnel buuxa waxay isticmaalaan 0.0.0.0/0 iyo sidaas darteed wg-quick waxay sidoo kale rakibaa qaanuunada dab-damiska marka ay awooddo.
Ka ilaali barta ugu dambeysa ee tunnel-ka tuurista
Cinwaanka dibadda ee barta ugu dambeysa waa in uu ahaado mid la heli karo iyada oo loo marayo jidka jirka. Tuuris sidoo kale qabata cinwaankaas waxay hor istaagtaa gacan-qabsiga in uu baxo, tunnel-kuna waligiis ma kaco, taas oo u eg fashil VPN halkii ay ahaan lahayd siyaasad waddo. Hubi waddada barta ugu dambeysa ka hor iyo ka dib isbeddelka.
Helitaanka maamulka waxay ka mid tahay isla dib-u-eegista. Haddii waddada kaliya ee router-ka ama macmiilka ay tahay tunnel-ka, tuuris aad u ballaaran ayaa kaa xiri kara mashiinka kuu ogolaan lahaa inaad ka saarto. Hayso waddo band-ka dibadda ah oo diiwaan gashan, console, ama dib-u-noqosho waqti leh.
IPv6 waxay u baahan tahay gelin u gaar ah iyo dib-u-eegis u gaar ah. Naqshad tuurta IPv4 blackhole oo ka tagta IPv6 waddada default-ka waxay daadiyaa taraafikada siyaasaddu dooneysay inay joojiso, khaladkuna kuma muuqdo imtixaan IPv4 kaliya.
Ku dhaqangeliso marxalado iyada oo la adeegsanayo timer iyo dib-u-noqosho
Codso waddada iyada oo la tirtiro si otomaatig ah oo gaaban si khaladku uusan uga badbaadin dib-u-kicinta. Amarraha hoose waxay isticmaalaan xad diiwaangelin; ku beddel horgalaha naqshaddaadu runtii tuurto:
sudo ip route replace blackhole 10.0.0.0/8
ip route get 10.1.2.3
sudo systemd-run --on-active=60 /sbin/ip route del blackhole 10.0.0.0/8Amarka labaad waa in uu soo sheegaa waddada blackhole iyo jadwalka ay ka timid. Tan saddexaad waxay qorsheynaysaa tirtirka hal daqiiqad gudahood, taas oo waqti ku filan si loo xaqiijiyo siyaasadda oo gaaban si looga soo kabsado khalad marti-geliye fog. Marka dhaqanka la xaqiijiyo, ka dhig gelinta mid joogto ah iyada oo loo marayo isla maamulka qaabeynta ee leh waddooyinka kale.
Xir isbeddelka adigoo diiwaangelinaya horgalaha, jadwalka, qoyska ciwaanka iyo habka dib-u-noqoshada. Tuuris waa ka-reebis ula kac ah naqshadda waddooyinka, oo injineerka xiga waa inuu ogaadaa taraafikada loo jeediyay inuu joojiyo ka hor inta uusan go'aamin haddii ay weli halkaas ku habboon tahay.