Dekedda isha macmiilka iyo dhageystaha serverka ee socodka VPN
Isbarbar dhig labada lambar ee dekedda hal tunnel: dhageystaha joogtada ah ee serverka iyo isha ku meel gaadhka ah ee macmiilka, iyo sida tarjumaadda routerku u dhexeyso.
Labo lambar ayaa ka muuqda isla wada hadalka, mana jiro mid khaldan. Diiwaanka serverku wuxuu muujinayaa dhageystaha bixiya adeegga, laptopku wuxuu muujinayaa socketka soo diray datagramka, routerka dhexda ku yaalna wuxuu dib u qori karaa kan labaad marka baxaya. In la isbarbar dhigo darafyada wada hadalka ayaa ka faa'iido badan in la isbarbar dhigo lambarrada. Isbarbardhigga hoose wuxuu kala saaraa dhageystaha, socketka macmiilka iyo isha la tarjumay, sababtoo ah waxay ka jawaabaan su'aalo kala duwan.
Labo lambar oo qeexaya darafyo iska soo horjeeda
Dekedda serverka ee la habeeyay waa meesha uu macmiilku wacdo. Siyaasad ayaa go'aamisa, waxay ka muuqataa profile-ka waana inay furan tahay dhinaca serverka. Dekedda isha macmiilka waxaa lagu doortaa gudaha, badanaa laga bilaabo xadka ku meel gaadhka ah, waxayna u jirtaa in jawaabtu meel ay ku degto hesho. Way is beddeli kartaa isku xirnaasho kasta, waxna kuma xidhna design-ka inay joogto noqoto.
Routerka dhexda ku yaal wuxuu ishaas dib ugu qori karaa khariidadda 'NAT' ee u gaar ah. Taasi waa sababta lambarka serverka lagu arko inta badan aanu xiriir la lahayn kan laptopku doortay.
Halka lambarka ishu isku beddelo marka baxaya
Qaado tusaale IPv4 la male-awaalay: macmiil ka dambeeya router tarjumaad sameeya, server leh hal dhageyste 'UDP', iyo hal datagram oo labadaba dhex mara. Shaxdu waxay magacaabtaa daraf kasta iyo waxa ku dhaca, halkii ay dib u ciyaari lahayd baakadda saddex meelood oo kormeer.
| Endpoint | What stays fixed | What changes on reconnect | Who owns it |
|---|---|---|---|
| Server listener | The service port and the address the profile names | Nothing; the listener does not follow the client | The server operator |
| Client socket | The destination it dials | The local source port, chosen per socket | The client, or its operating system |
| Translated source | Usually the public address of the router | The port, and sometimes the address after a network switch | The NAT device or the upstream carrier |
Ujeeddadu waa mid joogto ah saf kasta, waxaana is beddela oo kaliya aqoonsiga isha. Shuruudaha UDP NAT waxay kala saaraan cinwaanka iyo dekedda gudaha iyo khariidadda dibadda, taas oo si sax ah u tahay farqiga u dhexeeya safka labaad iyo saddexaad. Routerku wuxuu hayn karaa dekedda isha macmiilka ama wuxuu dooran karaa mid kale; haynta maaha wax ay codsigu qaadan karo.
Akhri saddexda daraf oo ka soo qaado martigeliyayaasha laftooda
Liisaska hoose waxay ka yimaadeen saddex mishiin oo kala duwan oo si wadajir ah u muujinaya wada hadalka oo dhan. Ku socodsii kan ugu horreeya serverka, kan labaad macmiilka, kan saddexaadna meel kasta oo khariidadda ay ka jirto. Hal saf oo log ah waligiis ma muujiyo saddexda oo dhan.
ss -lunp 'sport = :1194'
ss -unp | grep 1194
conntrack -L -p udp | grep 1194Liiska koowaad wuxuu caddeeyaa in serverku ku xiran yahay dekedda adeegga wuxuuna muujinayaa process-kee leh. Kan labaad wuxuu muujinayaa socketka gudaha ee macmiilka iyo halka uu wacday. Kan saddexaad wuxuu muujinayaa khariidadda uu routerku abuuray, waana meesha kaliya ee isha la tarjumay ka muuqato. Akhri iyaga sidan, labada lambar waxay joojinayaan inay iskhilaafsan u muuqdaan.
Waxa isku xirnaasho cusub beddesho iyo waxa aanay beddelin
Routerrada qaar waxay hayaan dekedda isha macmiilka marka ay bannaan tahay, qaarna waxay qoondeeyaan mid kale mar kasta. Labada dabeecadba waa caadi, codsiguna doonaya kan koowaad wuxuu ku dumin doonaa kan labaad. Isbeddelka khariidadda ka dib isku xirnaasho cusub ama isbeddel shabakadeed maaha cilad server: macmiilku wuxuu furaa socket cusub, routerku wuxuu bixiyaa waxa uu hayo, serverkuna wuxuu ku arkaa isha cusub isla dhageystahaas. Cilad waxay noqon lahayd in la filayo in serverku aqbalo taraafik ku wajahan deked macmiil caadi ah.
Macmiillada OpenVPN ee bulshada waxay dabeecaddan ku helaan nobind dhexdiisa, taas oo u oggolaanaysa nidaamka hawlgalka inuu doorto dekedda gudaha; dekedda fog wali waxay ka timaadaa profile-ka. Si cad u xidhiddu waa go'aan miyir leh, maaha shuruud borotokool. Serverku wuxuu sii wadaa inuu bixiyo hal daraf halka macmiilladu doortaan aqoonsigooda gudaha.
Calaamadee lakabyada si gooni ah diiwaanka
Tunnelka gudihiisa waxaa jira wada hadal labaad oo leh dekedo u gaar ah. Codsiga HTTPS ee tunnelku qaado wuxuu u jeedaa TCP 443, halka xidhiidhka sirta ah ee dibaddu isticmaalo UDP 1194, sidaas darteed beddelka dekedda isha dibadda wax kama beddelo adeegga gudaha.
Xitaa lakabka dibadda, borotokoolku waa muhiim. UDP 1194 iyo TCP 1194 waa darafyo kala duwan, dhageyste 'TCP' waligiis ma heli doono datagram UDP sababtoo ah lambarku wuu is waafajiyaa. Markaad diiwaangeliso daabacaad, calaamadee dhageystaha serverka, socketka macmiilka iyo isha la tarjumay sidii saddex shay oo kala duwan, oo ku dar gaadiidka mid kasta.
Ka dib ha u hoggaansamo siyaasaddu doorarka. Serverku wuxuu ku furaa gaadiidka loogu talagalay dhageystahiisa oo wali wuxuu xaqiijiyaa lammaanaha; firewallka macmiilku wuxuu oggolaadaa jawaabaha isweydaarsigiisa baxaya isaga oo aan daabicin adeeg soo galaya. Shaandhada aan xaaladda lahayn waxay u baahan tahay jihada soo noqodka oo si cad loo qoray, taasna waa sababta wax ku oolka ah ee farqigani uga muhiim yahay shaxanka nadiifka ah.