OpenVPN iyada oo loo marayo proxy HTTP: marka hore akhri jawaabta CONNECT
Proxy CONNECT wuxuu gudbiyaa bytes, sidaas darteed labada darafba waxay u baahan yihiin TCP. Akhri 407, 403 iyo 503 ka hor inta aadan eedayn shahaadada, oo hayso xaqiijinta serverka oo shidan.
U jihee macmiil VPN proxy HTTP shirkadeed, oo xaqiiqada ugu horreysa ee faa’iido leh waa in proxy-gu aanu ku hadlin borotokoolka VPN. Wuxuu furaa xiriir TCP caadi ah ciwaanka aad sheegtay ka dibna dhinac u leexdaa, isagoo u oggolaanaya macmiilka iyo serverka inay is-weydaarsigooda ku sameeyaan qulqulkaas. Wax kasta oo macmiilku u baahan yahay, laga bilaabo nooca gaadiidka ilaa dhageystaha serverka, waa inuu la jaanqaado habayntaas. Laba is-waafaqi la’aan ayaa sharraxaya inta badan guul-darrooyinka: profile UDP oo u jeedda proxy CONNECT, iyo jawaab proxy oo si khaldan loo qaatay khalad VPN.
Waxa proxy-gu qaado, iyo waxa aanu qaadin
Proxy-gu waa uun tallaabo gaadiid. Ma noqdo proxy-gaaga browser-ka, ma kaydiyo bogagga aad ku booqato tunnel-ka, mana arko taraafikada gudaha haddii aan qof si ula kac ah u habayn baaritaan. Tunnel-ka uu furo waa mid aan isaga ku caddayn marka loo eego naqshadda.
Taasi waxay kaloo macnaheedu tahay in proxy-gu aanu hagaajin karin server aan lahayn dhageyste u dhigma. Fasaxa gaaritaanka meel iyo adeeg ka dhageysta meeshaas waa laba xaqiiqo oo kala duwan, oo kaliya tan hore ayaa leh maamulaha proxy-ga.
Qaaduhu waa inuu TCP yahay labada daraf
Proxy CONNECT caadi ah wuxuu kaliya gudbiyaa qulqulka bytes , sidaas darteed macmiilku waa inuu isticmaalo gaadiid qulqul. Qayb macmiil oo kiiskaas ah waxay u egtahay sidan:
proto tcp-client
remote vpn.example.net 1194
http-proxy proxy.corp.example 3128Dhinaca serverka wuxuu u baahan yahay dhageyste TCP dhab ah dekedda lagu sheegay safka remote. Beddelka proto udp oo loo beddelo proto tcp-client profile gudihiisa waxay abuurtaa macmiil filanaya qulqul; ma abuurto qulqulka dhinaca kale. Haddii isla serverkaas uu sidoo kale ka jawaabo UDP dekeddaas, taasi waa dhageyste kale, ma aha qaab labaad oo isla midka ah.
Meesha ay jirto instance TCP gooni ah, qalabka tunnel-keeda, barkada ciwaannada iyo dariiqa waa kheyraad u gaar ah. Koobiyaynta habayn shaqaynaysa iyo beddelka erayga gaadiidka waxay kheyraadkaas uga tagtaa tilmaamaya instance-kii asalka ahaa, taasoo soo saarta xiriir xaqiijiya oo markaas aan waxba marin.
Akhri jawaabta proxy-ga ka hor natiijada VPN
Is-weydaarsiga ugu horreeya ee macmiilku waa safka codsiga oo magacaabaya martigeliyaha iyo dekedda meesha loo socdo. Jawaabta safkaas waxay kuu sheegaysaa haddii qulqul bytes uu jiro, oo waxay timaaddaa ka hor inta aan la hubin shahaado ama aqoonsi kasta:
CONNECT vpn.example.net:1194 HTTP/1.1
Host: vpn.example.net:1194| Proxy reply | What it means | Where to look next |
|---|---|---|
407 Proxy Authentication Required | The proxy wants its own credentials | The client's proxy auth options, not the VPN account |
403 Forbidden | The destination or method is not permitted | The proxy's access policy for that host and port |
503 Service Unavailable | The proxy could not complete the upstream connection | The proxy's own logs and the server's listener |
Jawaab fasalka 200 ah oo CONNECT loo diray waxay ka dhigan tahay in qulqulku jiro. Ma sheegto wax ku saabsan haddii shahaadada gateway-ga la aamini karo, haddii furaha la wadaago uu qabanayo, ama haddii akoonka isticmaalahu uu ansax yahay. Hubintaas waxay dhacdaa ka dib, qulqulka gudihiisa, oo waxay ku guul-darraystaan fariimaha macmiilka laftiisa halkii ay ahaan lahaayeen safka xaaladda HTTP. Akhri diiwaanka macmiilka dhacdada OpenVPN ugu horreysa ee ka dib gacan-qabsiga proxy-ga, ma aha safka ugu dambeeya ka hor inta daaqaddu xidhmin.
Aqoonsiga proxy-ga iyo aqoonsiga VPN-ga inta badan waa aqoonsiyo kala duwan oo ay hayaan kooxo kala duwan. 407 ma aha furaha sirta ah ee khaldan ee akoonka VPN, shahaado la diidayna ma aha dhibaatada fasaxa proxy-ga.
Waxa CONNECT aanu muujin
Tunnel CONNECT cad ma aha dhexgal. Proxy-gu wuxuu gudbiyaa bytes oo ma joojiyo fadhiga TLS ee VPN, sidaas darteed xaqiijinta shahaadada serverka ee macmiilku waxay sii ahaanaysaa mid macno leh oo waa inay sii shidnaataa. Daminta xaqiijinta si loo dhaafo proxy waxay xallinaysaa dhibaato ka duwan tan aad haysato.
Waxaa jira habaynno gooni ah oo ay urur si ula kac ah u joojiyo oo u baaro TLS. Kuwaas waxay u baahan yihiin habaynta kalsoonida iyo go’aanka siyaasadda ee u gaar ah, oo ma aha waxa safka http-proxy caadi ah uu codsado.
Qiimaha TCP gudaha TCP
Qaadista tunnel-ka TCP waxay hayaa qulqulka dibadda oo nidaamsan oo dib-u-dirid leh, taraafikada gudahana badanaa waa TCP. Labada hababka soo-kabashada iskuma xidhna, sidaas darteed hal qayb lumay waxay joojin kartaa wax kasta oo wadaaga qulqulkaas dibadda ilaa dib loo diro. Taasi waa is-dhaafsi dhab ah oo loo sameeyay is-waafaqnaanta, ma aha casriyeyn bilaash ah.
Isticmaal wadada proxy-ga marka shabakaddu aysan kuu reebin beddel, oo dooro waddo toos ah oo UDP ah halka siyaasaddu u oggolaato. Si kasta ha ahaatee, isbeddel ka dib xaqiiji in isla proxy-ga, meesha loo socdo iyo profile-ku gaaraan marxaladda xigta; browser-ka bog ku raraya ciwaankaas wuxuu isticmaalaa borotokool kale oo wax kama caddeeyo tunnel-ka.