Profile-ka server-ku xiran wuxuu ku guuldareystaa ka dib proxy TLS: jiil kee?
Access Server 2.8 iyo 2.9 waxay u dhigaan profile-ka server-ku xiran siyaabo kala duwan. Go'aanso waddo kee ay proxy-gaagu jebinayso ka hor inta aadan beddelin hore.
Hal isticmaale wuu isku xidhi karaa mid kalena ma karo, isla portal-kaas, isla maalintaas. Labaduba waxay leeyihiin profile server-ku xiran, labaduba waxay ku jiraan isla build-ka Access Server, iyo farqiqa kaliya waa goorta profile-kooda la abuuray. Taasi waa qaabka mudan in la aqoonsado, sababtoo ah "server-ku xiran" waxay magacawdaa siyaasad ma aha isku xigxiga isku xirka. Access Server waxa uu soo saaray laba jiil oo shaygaas ah, proxy-ga rogan ee TLS waxa uu hor taagan yahay mid keliya oo ka mid ah waddooyinkooda. Saddex shuruud ah ayaa go'aamiya laanta aad ku jirto.
Laba jiil, laba isku xigxiga isku xir
Naqshadda hore, oo socota ilaa 2.8, faylka la soo dejisey waa pseudo-profile. OpenVPN Connect waxa uu u isticmaalaa in uu isku caddeeyo API-ga web-ka ee Access Server iyada oo loo marayo HTTPS, waxa uu helaa profile ku meel gaar ah oo isticmaalaha ku xiran iyo calaamad fadhi, oo markaas ka dib ayuu dhisaa VPN-ka. Laba gaadiid ayaa isku xigxiga u shaqeeya, midda koowaadna waa codsi web caadi ah.
Qaabka lagu soo bandhigay 2.9 ma sameeyo bilowgaas isku xir kasta. Waa profile asli ah oo ay isticmaali karaan OpenVPN macaamiisha waafaqsan, ma aha oo keliya OpenVPN Connect. Soo dejintiisa ama soo dejinta iyada oo loo marayo URL waxa ay weli ku lug yeelan kartaa HTTPS — taasi waa tallaabo daabacaad, ma aha soo qaadashada profile ku meel gaar ah isku xir kasta.
| Older server-locked (≤2.8) | Newer server-locked (2.9+) | |
|---|---|---|
| Before the tunnel | Web API call with credentials | Nothing; the profile is already local |
| Client requirement | OpenVPN Connect | Any compatible client |
| What a TLS web proxy can break | The bootstrap, before any VPN attempt | Download only, not the connection |
| Expected HTTP log on connect | A request from the client | Often nothing at all |
Casriyeyn ma qasabto in dib loo qoro profile-yada hore loo soo saaray, sidaas darteed nooca server-ka ee hadda jira waxa uu weli qaybin karaa shaygii hore. Build-ka server-ka waxa uu kuu sheegaa waxa suurtagal ah, ma aha waxa isticmaalahan soo dejiyay.
Saddex shuruud oo dooranaya laantaada
Shuruudda koowaad waa jiilka shayga. Weydii faylka, eeg sida loo soo saaray, oo qor nooca macmiilka soo dejiyay. Haddii aadan ka aqoonsan karin jiilka faylka, profile cusub oo loo soo saaray akoon tijaabo ayaa kuu sheegi doona waxa server-ku maanta soo saaro, taasina waa macluumaad ka duwan kan isticmaalaha guuldareystay haysto.
Shuruudda labaad waa waxa hore ee aad leedahay dhab ahaan dhammeeyo. Proxy-ga rogan ee HTTP ee lakabka toddobaad ee TLS-ka dejiya ma aha isla shayga la mid ah gudbinta TCP ee lakabka afaraad, gudbinta UDP-na sidaas oo kale ma aha. Habaynta caadiga ah ee Access Server ee dekedda 443 waxa ay keentaa in daemon-ka OpenVPN TCP uu aqoonsado taraafikada browser-ka oo uu u dhiibo adeegyada web-ka, sidaas darteed gelinta dhamaystire HTTPS oo aan xiriir la lahayn hore kama ilaaliso maaraynta borotokoolka daemon-kaas. Wadaagga lambarka 443 laba naqshad isku mid kama dhigto.
Shuruudda saddexaad waa halka guuldarradu ku dhacdo. Guuldarro ka hor VPN iyo guuldarro kanaalka kontoroolka waxa ay isku mid u muuqdaan macmiilka kaliya dhahaya "isku xidhaya", laakiin waxa ay caddayn uga tagaan meelo kala duwan. Haddii qaabka hore uu socdo, bilowgu waa musharax. Haddii qaabka cusubi uu socdo, log-ga gelitaanka web-ka oo madhan waa la filayaa oo waxba ma caddeeyo dhinac kasta.
Marka shaygu duqsan yahay: bilowgu marka hore guuldareystaa
Akhri khaladka dhabta ah ee macmiilka halkii aad ka akhrin lahayd xaaladdiisa ugu dambeysa. Meelaha xiisaha leh waa khaladka HTTPS, aqoonsiga server-ka ee macmiilku filayay, halka codsigu u kicitimay, iyo haddii xaqiijinta shahaadada dhammaatay. Kadib isbarbar dhig log-yada adeegga web-ka iyo proxy-ga dhinaca server-ka.
In browser-ku gaaro bogga gelitaanka ma aha caddayn in xaqiijinta API ee macmiilkan ay guulaystay. Waa codsiyo kala duwan, oo leh filasho shahaado kala duwan iyo inta badan magacyo martigeliye kala duwan. Haddii portal-ka si sax ah loo adeego oo macmiilku wali guuldareysto, khilaafku waxa uu ku jiraa waddada bilowga, ma aha furaha sirta isticmaalaha.
Ha ka dhigin isbarbardhigga mid gudba adigoo daminaya xaqiijinta TLS ama dabacsanaya siyaasadda xaqiijinta. Taasi waxa ay u beddelaa ismaandhaaf qaabeynta la ogaan karo waddo shaqeysa laakiin aan la xaqiijin, waana isla isbeddelkaas kan tijaabo ku meel gaar ah u beddela dalool joogto ah. Dukumeentiga Access Server ee profile-yada isku xirka waxa uu qeexaa labada jiil iyo socodka profile-ka ku meel gaarka ah, waana tixraaca la hubiyo ka hor inta aadan u malayn in proxy-ga uu dembi leh yahay.
Marka shaygu cusub yahay: akhri kanaalka kontoroolka
Profile qaab 2.9 ah, macmiilku si toos ah ayuu u aadaa barta ugu dambeysa ee VPN-ka asalka ah. Baadh batalada ku jira profile-ka, gaadiidka la isticmaalayo, iyo khaladka kanaalka kontoroolka. Haddii macmiilku waligiis soo saarin codsi HTTP, taasi waxay waafaqsan tahay naqshadda mana aha calaamad.
Halkan sidoo kale su'aasha proxy-ga ayaa beddelata qaabka. Dejinta HTTPS ma jebin karto qulqulka kaliya TCP ee uusan waligiis arkin, laakiin waxa ay weli jebin kartaa soo dejinta daabacda profile-ka, gudbinta kaliya TCP-na UDP ma qaadan doonto. Hubi gaadiidka uu profile-ku codsado ka hor inta aadan go'aansan in hore uusan khuseyn.
Gudbinta TLS ee hal qulqul waa habayn cidhiidhi ah. Ma bixiso gudbin UDP, mana soo saarto habdhaqanka gudbinta adeegyada ee daemon-ka laftiisa ee 443. Haddii hore ee aad leedahay mid ka mid ah sameeyo, sheeg kee, sababtoo ah daawadu way kala duwan tahay.
Dawooyinka sida cidhiidhiga ah u hadha
Hubinta ugu yar ee faragelinta waa in la abuuro profile cusub oo la taageeray akoon tijaabo oo lagu xidho barta ugu dambeysa ee asalka ah ee loogu talagalay iyada oo leh isla shuruudaha xaqiijinta. Haddii taasi shaqeyso oo profile-kii hore ee la hayay uusan shaqeyn, hal tallaabo ayaad ku kala soocday shayga server-ka iyo proxy-ga.
Qaybinta profile-ka isticmaalaha ku xiran waxa ay gabi ahaanba meesha ka saartaa ku tiirsanaanta bilowga hore, sababtoo ah ma jiro isweydaarsi profile ku meel gaar ah oo dhici kara. Waa in loo soo saaraa isticmaalaha loogu talagalay, waligiis laga soo koobi karin maamule, waxana uu beddelaa waxa macmiilku loo fasaxay, markaa u qaado go'aan siyaasadeed ee ma aha xal wareeg ah.
Kadib hagaaji habaynta daabacaadda si ay waddo kastaa oo loo baahan yahay u jirto: waddada web-ka ee soo dejinta iyo isticmaalka portal-ka, iyo waddada asalka ah ee VPN ee gaadiidka ay profile-yadu filayaan. Ku hay shaqada proxy-ga hal lakab. Tunnel isticmaalaha ku xiran oo shaqeeya waxa uu caddeeyaa in waddadaas shaqeyso; ma caddeeyo in habayn kasta oo proxy ay taageerto jiil kasta, guuldarrada bilowga horena ma xukunto qaabka cusub.
- Aqoonsado jiilka shayga ka hor inta aadan taaban proxy-ga.
- Go'aanso haddii guuldarradu dhacdo ka hor tunnel-ka ama gudihiisa.
- Xaqiiji waxa hore ee aad leedahay dhammeeyo: HTTP, qulqulka TCP, ama UDP.
- Tijaabi profile dhawaan la soo saaray oo ka soo horjeeda barta ugu dambeysa ee asalka ah iyada oo siyaasaddu aan isbeddelin.