OpenVPN ka dambeeya stunnel: gudbi duubka, ma aha dekedda 1194
Laba dhageystayaal, saddex dekedood. Hubi halka gudbintu ku degto, halka duubku ku xirmaa, halka uu ku xirmaa, waxa tijaabo maxalli ah ay ka booday iyo labada aqoonsi.
Dhig duub TLS ah OpenVPN hortiisa oo rakibaaddu waxay heshaa dhageyste labaad, oo mid keliya oo iyaga ka mid ah waa in uu waligiis wajaho internetka. Marka tunnel-ku ka shaqeeyo isla mishiinka oo dibadda ka guuldareysto, gudbintu badanaa waxay u jeeddaa midka khaladka ah ee labada. Waxa is waafajinaya waa silsilad: qaanuunka dadweynaha wuxuu gaadhaa duubka, isku-xirka backend-ka duubku naftiisu wuxuu gaadhaa socket-ka VPN-ga dhabta ah. Afar bood ayaa silsiladdan qaada, mid kasta oo iyaga ka mid ahna wuxuu goor hore soo afjari karaa baaritaanka.
Laba socket, laba mulkiile, mid ka mid ah dadweyne
Duubku wuxuu dhammeeyaa TLS-ka isku-xirka dibadda wuxuuna u gudbiyaa qulqulka byte-ka la furfurey dhageyste OpenVPN TCP caadi ah. Kuwani waa socket gooni ah oo leh faylal habaynta gooni ah, sidaas darteed mid ka beddelashada wuxuu ka tagaa kan kale aan taabasho oo weli u eg caafimaad. Waxay kaloo ka dhigan tahay in labadu kala fogaadaan marka mid la beddelo iyada oo aan kan kale la beddelin.
Ka shaqaynta mishiinka laftiisa sidaas darteed wax badan kama caddayso wadada dadweynaha. Isku-xir toos ah oo dekedda asalka ah ayaa ka booda duubka, isku-xir duubka ciwaankiisa LAN ayaa ka booda tarjumaadda, oo kaliya habaynta buuxda ee dhinaca macmiilka ayaa tababarta waxa isticmaale dibadeed sameeyo. Magacyadana waa in si taxadar leh loo akhriyaa, sababtoo ah localhost waxay ka dhigan tahay host-ka socodsiiya qaybtaas gaar ah, ma aha host-ka aad si kadis ah ku qorayso. Farqigaas ku hay qoraalladaada, sababtoo ah tijaabo la diiwaangeliyay iyada oo aan la qorin boodka ay dabooshay waxay ku martiqaadaysaa in la isbarbardhigo laba shay oo kala duwan.
Halka gudbintu dhab ahaan ku degto
Silsiladda ayaa sahlan in lagu hayo afar bood halkii ay ka ahaan lahayd saddex lambar oo dekedood, sababtoo ah isla lambarka ayaa macne kala duwan ku yeelan kara gees kasta. Akhri shaxda saf saf: saf kastaa waa hal socket oo waa in uu aqbalaa isku-xir kadibna furo tan xigta. Marka saf u jeedo lammaanaha khaldan, calaamadda ku jirta tiirka ugu dambeeya ayaa ah waxa isticmaalahu soo sheegayo.
| Hop | Listens on | Must reach | Symptom when it points elsewhere |
|---|---|---|---|
| Client machine | A local plaintext port | The wrapper's public TLS address | Plain text offered to a TLS endpoint |
| Router forward | Public TCP 443 | The wrapper host on its translated port | Wrapper records no connection at all |
| Wrapper, server mode | Its accepted port, 8443 here | The native VPN socket on loopback | Handshake completes, then silence |
| Native VPN listener | Loopback TCP port | Its peer, over TCP only | A UDP socket behind a byte-stream relay |
Qaanuunka u jeeda dekedda VPN-ga asalka ah halkii uu ka jeedi lahaa duubka ayaa gebi ahaan ka booda dhammaynta TLS, taasina waa qaabka ugu caansan khaladkan: macmiilku wuxuu furaa gacan-qabsasho dhageyste filanaya qaabaynta OpenVPN, sidaas darteed isku-xirku wuu furmi karaa kadibna istaagi karaa. Xaqiiji dekedda la turjumay faylka habaynta duubka halkii aad ka xaqiijin lahayd xusuusta, sababtoo ah qofka xiga ee faylkaas wax ka beddela ayaa laga yaabaa in uu doortay lambar kale. Labada amarrood ee hoose waxay isku mar muujinayaan labada dhinac ee su'aashaas.
grep -nE '^[[:space:]]*(accept|connect)' /etc/stunnel/stunnel.conf
ss -lntp | grep -E ':443|:8443|:1194'Ciwaanka xidhitaanka ee ku diidaya
Sadarka accept ee ku xiran 127.0.0.1 wuxuu uun ka jawaabaa host-ka laftiisa, sidaas darteed gudbin ku timid ciwaanka LAN ma isku xiri karto macmiilkuna wuxuu arkaa diidmo u eg dhibaatada shaandhada baakadaha. Fiiri socket-ka ka hor inta aadan taaban darbiga dabka, sababtoo ah socket-ku waa jawaabta ka jaban. Ama ku xir duubka interface-ka uu gudbintu u jeedo, ama ku hay loopback oo ka dhig in gudbintu ku gaadho loopback iyada oo maraysa wax dhab ahaan shaqeeya. Kuwani waa laba naqshad, mid kastaa wuxuuna u baahan yahay qaanuunkiisa.
Isku dariddooda ayaa ah sida duub shaqeeya uu dibadda ka noqdo mid aan la gaadhi karin iyada oo fayl kastaa u eg yahay mid saxan. Hubinta hoose waa hal amarro, waxayna ka jawaabtaa su'aal aan dib u eegista qaanuunnada darbiga dabka ka jawaabi karin. Haddii natiijadu muujiso ciwaanka loopback iyada oo gudbintu u jeedo ciwaanka LAN, sixitaanku wuxuu ku jiraa sadarka accept ee kama jiro shaandhada baakadaha.
ss -lntp '( sport = :8443 )'Waxa tijaabada maxalliga ah dhab ahaan caddeysay
Guul la diiwaangeliyay iyada oo aan la qorin boodka ay dabooshay ma aha caddayn ku saabsan boodadka kale. Qor ciwaanka tijaabadu isticmaashay iyo habka ka jawaabay. Kadib ku celi dibadda shabakadda halkii aad ka celin lahayd telefoon ku jira isla Wi-Fi, sababtoo ah dhaqanka hiirta ayaa ku kala duwan router-yada iyo isku-xir aan waligiis LAN-ka ka bixin ayaa qancin kara macmiil iyada oo gudbintu gebi ahaan ku lug lahayn. Kaliya isku-daykaas labaad ayaa tababara wadada uu qof shisheeye qaato.
Marka isku-dayku guuldareysto, raac hal isku-xir labada log: sadarrada la aqbalay iyo la xiray ee duubka, kadib log-ga fadhiga daemon-ka VPN laftiisa. Soohdinta ugu horreysa ee aan waxba diiwaangelin waa halka isbeddelka xiga uu ku habboon yahay. Marka OpenVPN uu bilaabo isbarbardhigga ikhtiyaarrada lammaanaha, ku qiimee fariimahaas qaanuunnada hirgelintaas. Digniinta iskhilaafka link-mtu si otomaatig ah ma aha dilaa, ku dhejinta link-mtu 1500 ma caddayso in kala-baxu joogsaday, gorgortanka sirta wuxuu ka tirsan yahay habaynta gudaha OpenVPN ee ma aha gudbinta router-ka.
nc -vz 127.0.0.1 1194
journalctl -u stunnel -n 50 --no-pagerBaaritaannadaas waxay daboolaan socket-ka backend iyo log-ga duubka, taas oo kala soocda backend la diiday iyo gacan-qabsasho la diiday. Ku socodsii inta isku-day kaliya socdo ee ma aha kadib. Summada waqtiga isku-day kaliya ayaa isbarbardhigga lagu kalsoonaan karaa.
Laba aqoonsi, laba nidaam guuldarreyn
Shahaadada dibadda waxaa leh duubka halka aqoonsiga gudaha uu leeyahay OpenVPN, waxayna ka iman karaan hay'ado kala duwan. Daminta mid ka mid ah labada hubin si wadadu u ekaato mid caafimaad qabta waxay ku beddelaysaa ilaalin dhab ah natiijo muuqaal ah. Hay labada xaqiijin oo u kala saar si nidaam ah, sababtoo ah isku xigxiga fariimaha ayaa magacaabaya lakabka: dhibaatada shahaadada duubka waxay soo baxdaa ka hor inta aan la gorgortamin ikhtiyaar VPN ah, halka guuldarrada aqoonsiga gudaha ay soo baxdo kaliya marka qulqulka la dhiso.
buugga stunnel wuxuu si sax ah u qeexaa accept, connect iyo qaabka macmiilka, qaybahaasna waxay ka jawaabaan su'aasha socket-ka si ka degdeg badan qiyaas. Marka aadan weli karin inaad sheegto lakabka ka jawaabay, akhri shahaadada ay soo bandhigto dekedda dadweynaha amarka hoose. Shahaadada duubka oo ku jirta natiijada waxay ka dhigan tahay in gudbintu gaadhay duubka, aamusnaan ama khalad borotokoolna waxay ka dhigan tahay in aanay gaadhin. Farqigaas keliya ayaa waqti ka badbaadiya hubin kasta oo kale halkan.
openssl s_client -connect vpn.example:443 -servername vpn.example </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer