VPN-ka Mac, shaandheynta content-ka ama Private Relay: kee ayaa firfircoon
Saddex lakab oo shabakadeed Mac waxay isku mid uga muuqdaan Settings. Ku kala sooc VPN, shaandheyn content iyo Private Relay iyadoo la eegayo wadada bixitaanka, siyaasadda socodka iyo baaxadda baaritaanka.
Mac-kaaga waxaa laga yaabaa inuu isla mar wado tunnel VPN, shaandheyn content iyo iCloud Private Relay, mana jiro mid ka mid ah oo ku dhawaaqaya kee ayaa qaabeynaya xiriir gaar ah. Baxnaamaha settings-ka way isku eg yihiin, calaamaduhuna way isku eg yihiin, oo ku dhawaad iibiye kastaa waxay sheegtaa badeecadiisa ammaanka shabakadda. Saddex xaqiiqo ayaa kala sooca: haddii taraafikadu ka baxdo meel fog oo aad magacaabi karto, haddii mishiin siyaasadeed uu go'aanno ogolow-ama-tuur ku qaato socodka shaqsi kasta, iyo haddii ilaalintu ku ekaato Safari. Saddexdan hagaaji oo su'aalaha VPN-kayga-ma-shaqeynayaa intooda badan iskood ayay uga jawaabaan.
Saddex shuruud oo qaybta gartaan
Shuruudda koowaad waa bixitaanka. Bixiye tunnel ah wuxuu baakadaha u dhiibaa albaab fog, sidaas darteed cinwaankaaga dadweynaha wuu is beddelaa, haddii borofaylku sidaas sheego, martigeliyayaasha albaabkaas gadaashiis waxay noqdaan kuwo la gaari karo. Haddii cinwaanku waligiis is beddelin oo aan subnetwork gaar ah furmin, ma eegto tunnel shaqeynaya, wax kasta oo bar menu-ga sheegto.
Shuruudda labaad waa go'aanka. Shaandheyn content waxay qiimeysaa socodka oo celisaa ogolow ama tuur. Waxay dhaqan gelin kartaa xannibaad qayb, qaanuun app kasta ama siyaasad uu shaqo-bixiye soo diray, waxayna diiwan gelin kartaa xukunka. Waxa ay keligeed aanay samayn karin waa in ay taraafikada siiso meel ay aaddo.
Shuruudda saddexaad waa baaxadda. Private Relay waxay ilaalisaa qayb qeexan oo baaritaanka ah ee ma aha qalab dhan, shaqadeeduna waa in ay kala soocdo ciddaad tahay iyo waxaad booqanayso, ee ma aha in ay ku dhigto shabakad kale.
Isku dhig saddexdan oo xuduudaha way adag tahay in la seego:
| Layer | Question it answers | Evidence to look for | What it does not do |
|---|---|---|---|
| VPN tunnel provider | Where does my traffic emerge, and which private networks can I reach? | Changed public address, a connected service, a default route through a utun interface | Enforce per-app content policy |
| Content filter | May this flow proceed, and who decided? | A filter extension in Network Extensions, drop verdicts, an MDM profile | Supply a different public exit |
| iCloud Private Relay | Can the local network see which sites Safari loads? | A relay egress address in Safari only, the relay toggle in iCloud settings | Cover other apps or grant access to a private subnet |
Shaandheynta content waa mishiin siyaasadeed, ma aha bixitaan
MacOS-ka shaandheyn waxay timaaddaa sida Network Extension oo lagu dhisay fasalka bixiyaha xogta shaandhaynta Apple, NEFilterDataProvider. Dejinta la maamulo, MDM ayaa riixda, waxaa loo rakibaa sidii kordhinta nidaamka oo hal mar lagu ansixiyaa System Settings > General > Login Items and Extensions. Wixii ka dambeeya waxay aragtaa socodka TCP, iyo qaar ka mid ah habaynta UDP, waxayna soo celisaa xukun mid kasta.
Qaabka guuldarrada ayaa dadka jahawareerinaya. Shaandheyn tuurta socod waxay abuurtaa waqti dhaqaaq, TLS gacan-qabsasho xanniban ama dib-u-dejin, taasoo si sax ah ugu eg tunnel kacay laakiin aan taraafikada dhaqaaqin karin. Cinwaanka dadweynaha waligiis isma beddelin, sababtoo ah ma jirin bixitaan beddeli lahaa.
Macaamiisha ganacsi waxay badanaa isku daraan labada door. Hal rakibiye ayaa keena bixiyaha tunnel iyo shaandheyn, shaandhaynta ayaa xannibta, tunnelkuna wuxuu sameeyaa wadada. Sidaas darteed magaca app-ka waxba kama sheegayo qaybta diidday xiriirka. Hubi liiska kordhinta, ka dib adeegga xiran, ka dib diiwaanka macmiilka, isla nidaamkaas.
Private Relay waxay daboolaa Safari, ma aha mishiinka oo dhan
Private Relay waxay u dirtaa baaritaanka ay daboolayso laba relay oo ay maamulaan dhinacyo kala duwan, sidaas darteed ma jiro hal hawl-wadeen oo haysta aqoonsigaaga iyo meelaha aad u socoto labadaba. Tani waa naqshad asturnaan, ma aha tunnel: ma jiro albaab la galo, ma jiro subnetwork gaar ah, mana jiro hab lagu dhejiyo cinwaan bixitaan waddan aad dooratay.
Baaxaddeeda si ula kac ah ayay cidhiidhi tahay: waxay daboolaa baaritaanka Safari oo ay la socdaan weydiimaha DNS iyo raridda HTTP aan ammaan ahayn. Fadhi terminal, macmiil iimayl, app sheekaysi iyo bilaabe peli ayaa ka baxsan. Haddii hubinta Terminal-ka ay wali muujiso cinwaanka shabakadda gelitaankaada halka Safari uu muujinayo cinwaan relay, taas waa natiijada la filayay, ma aha rakibid jabtay.
Helitaanku waa shuruud. Waxay u baahan tahay qorshe iCloud+, lagama bixiyo gobol kasta, shabakad la maamulana waxay xannibi kartaa gelitaanka relay, markaas Safari wuxuu ku laabtaa xiriir toos ah. Guudmarka Apple ee Private Relay waa tixraaca baaxadda hadda. Marka borofayl VPN xiran yahay oo uu qaadayo taraafikadaas, relay laguma dul dhigo; wadada borofaylku ayaa go'aamiya.
Akhri caddaynta nidaamka saxda ah
Ku bilow xaaladda adeegga, sababtoo ah waa calaamadda ugu jaban. scutil --nc list waxay daabacdaa adeegyada VPN ee la habbeeyay iyo in mid kastaa xiran yahay. Borofaylku wuu sannadoo fadhiyi karaa isagoo aan waligiis xirmin, dadkuna caadi ahaan tunnel ayay u tiriyaan.
Ka dib eeg interface-yada iyo wadooyinka. ifconfig waxay muujisaa interface-yada utun, laakiin jiritaankooda keligii wax badan ma caddeeyo, maadaama macOS u isticmaalo utun ujeeddooyin badan oo ka baxsan VPN. Waxa muhiimka ah waa in wadada caadiga ah ay gasho mid ka mid ah, taasoo route -n get default soo sheegto.
Xallinta magacyada scutil --dns waxay taxdaa xalliyayaasha nidaamku dhab ahaan isticmaali doono, oo halkaas waxaa ka muuqda bixiye DNS proxy. Isbarbardhigga dig +short example.com iyo dig +short example.com @1.1.1.1 wuxuu kala soocaa xalliyaha jawaabta iyo xalliyaha la dhexgalayo.
Dhaqdhaqaaqa kordhinta waxay gaadhaa diiwaanka midaysan: log show --predicate 'subsystem == "com.apple.networkextension"' --last 5m. Waxaad raadinaysaa kordhin kee bilaabmay iyo in shaandheyn ay soo sheegtay xukun ku saabsan socodka aad danaynayso, ma aha sadar la xafido.
Cidhiidhi calamadaha ka hor inta aanad wax damin
Marka hore kala saar guuldarrada. Magac aan la xallin, xiriir isla markiiba la diiday, iyo xiriir hungada ilaa waqtiga dhaqaaqa — kuwani waa saddex indho-indheyn kala duwan oo leh saddex mas'uul oo kala duwan. Xallintu waxay tilmaamaysaa xalliye ama DNS proxy. Diidmo degdeg ah waxay tilmaamaysaa qaanuun shaandheyn. Aamusnaantu badanaa waxay tilmaamaysaa wadada, ama tunnel kacay laakiin aan gudbin.
Mac la maamulo, ka soo qaad in shaandhayntu ay tahay tan ururka. Damiintiisa si loo tijaabiyo VPN waxay meesha ka saaraysaa qaybta aad rabtay inaad fiirsato, MDM-na badanaa wuu soo celiyaa hubinta xigta. Weydii maamulaha magaca siyaasadda ka hor inta aanad wax beddelin, oo ku tijaabi app-ka gaarka ah ee guuldarraystay ee ma aha nidaamka oo dhan.
Dabin kale: daminta Private Relay si loo tijaabiyo VPN waxba kama sheegto taraafikada shisheeye, sababtoo ah relay waligiis ma daboolin taraafikadaas. Lakab kastaa waa in lagu tijaabiyaa app-ka uu dhab ahaan xukumo.
Mar liiskan oo joogso shayga ugu horreeya ee guuldarraysta:
scutil --nc listma muujisaa adeegga aad filayso inuu xiran yahay?- Cinwaanka dadweynaha laga arko Terminal ma ka duwan yahay cinwaanka ay bixisay shabakadda gelitaankaada?
- Ma jiraa kordhin shaandheyn oo rakiban, oo ma diiwan gelisay xukun socodka guuldarraysta?
- Guuldarraddu ma ku eg tahay Safari oo keliya? Haddii sidaas tahay, hubi baaxadda relay ka hor inta aanad tunnelka eedayn.
Haddii afarta oo dhan gudbaan oo app-ku wali guuldarraysto, dhibaatadu waxay ka sarraysaa lakabka shabakadda: habaynta proxy, kalsoonida shahaadada, ama liis ogolaansho heer app.