Shuruudaha dekedaha VPN: saddex sadar oo la qoro ka hor isbarbardhigga
Ogow su’aasha dekedda aad runtii haysato: meesha baxa, daabacaadda soo-galka ama gaadiidka tunnel-ka laftiisa. Ka dib weydii bixiyaha taas oo kaliya.
Liisladka dekedaha ee adeegyada VPN waxaa lagu koobiyaa bogagga isbarbardhigga iyada oo aan la hayn faahfaahinta go’aamisa haddii ay muhiim yihiin: yaa bilaaba xiriirka. Qaanuunka oggolaanaya TCP 443 baxa wax kama sheegto haddii martigeliyaha kale uu gaari karo dhageystaha ku yaal mishiinkaaga. Qor saddex shuruudood oo gooni ah ka hor inta aadan isbarbar-dhiggan hal qorshe, oo calaamadee kuwa hawshaadu runtii u baahan tahay. Inta badan isbarbardhigga waxay noqdaan hal su’aal gaaban marka xaashidaas jirto.
Kala sooc shuruudda ka hor inta aadan akhrin liis kasta oo dekedo
Saddex sadar ayaa daboolaya ku dhowaad kiis kasta: gaarista meel ka baxsan tunnel-ka, daabacaadda wax si dadka kale ay ugu xirmaan gudaha, iyo qaadista tunnel-ka laftiisa. Sadar kastaa wuu guuldareystaa sabab ka duwan, iyo siyaasadda bixiyaha ee buuxisa mid waxay ka tagi kartaa labada kale aan la taaban. In hawshaada lagu meeleeyo sadarka saxda ah waxay qaadataa shan daqiiqo oo waxay badbaadisaa dood dambe.
| Line | Who starts it | What can block it | Question for the provider |
|---|---|---|---|
| Outbound destination | Your application | Egress filter on the exit node | Is this protocol and port allowed to that destination? |
| Inbound publishing | A remote peer | No mapping, no public address, short lifetime | Which protocol, which external port, and how long does the mapping last? |
| Tunnel transport | Your client to the gateway | The access network drops that protocol | Does the client offer a fallback the local network permits? |
Hadallada suuqgeynta waxay si ula kac ah u kala fidiyaan saddexda sadar. Oggolaanshaha P2P wuxuu qeexayaa siyaasadda meesha, cinwaan gaar ah wuxuu qeexayaa cinwaan, iyo sheegashada in aanay jirin xaddidaad dekedo badanaa waxay ka dhigan tahay in qorshuhu aanu taxin. Mid ka mid ah jumladahaas kama jawaabo kuwa kale.
Dooro hal qulqul oo gaar ah oo u qor jumlad ahaan: bilaabaha, gaadiidka, dekedda, qoyska cinwaanka, jihada. Macmiilka kaydka habeenkii ee u soo gudbiya martigeliyaha fog waa baxa kaliya. Adeegaha ciyaarta ee miiskaaga oo asxaabtu ku biiraan waa soo-galka. Labadaba hal tunnel dhex marista waxay ka dhigan tahay in xaashidu u baahan tahay labada sadar, ma aha tanaasul dhexdooda ah.
Helitaanka baxa wuxuu ku guuldareystaa siyaasadda meesha, ma aha tunnel-ka
Taraafikada baxa ee dhex marta albaabka turjuma wuxuu abuuraa xaalad. Baakadda ugu horreysa ee ka timaadda cinwaan iyo deked gudaha waxay dhistaa gelitaan turjumaad, jawaabahuna way la jaanqaadaan, taas oo ah dabeecadda khariidaynta lagu qeexay RFC 3022. Habkaas ayaa sabab u ah in tabka browser-ka uu badanaa shaqeeyo isagoon lahayn wax codsi deked ah.
Laba shay ayaa wali jebiya. Nodka baxa wuxuu shaandheyn karaa meelo ama lambarrada dekedaha uu u arko kuwa la xadgudbi karo, iyo barnaamijka wuxuu dhageysan karaa deked aan siyaasadda baxa waligeed filayn. Weydii lammaanaha meesha halkii aad ka weydiin lahayd xeerarka soo-galka, oo filo jawaabo kala duwan TCP iyo UDP.
Cabbir ka hor inta aadan doodin. Ku wad kuwan mishiinka dabada tunnel-ka u noqon doona, hal mar tunnel-ka oo damisan iyo hal mar oo furan:
ss -lntup | sort
nc -vz -w 3 203.0.113.10 443
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 5 https://example.com
Isla amarrada, isla meesha, laba xaaladood oo tunnel, waxay siinayaan hawlwadeenka isbarbardhig ka hor iyo ka dib uu ku dhaqaaqi karo. Ku beddel cinwaanka dukumentiga martigeliyaha aad runtii u baahan tahay; waxa muhiimka ah waa in isbarbardhiggu soo noqnoqdo, ma aha in lambar uun uu u muuqdo mid cajiib ah.
Daabacaadda soo-galka waxay u baahan tahay khariidayn, cinwaan iyo cimri
Wax ka baxsan ma bilaabi karaan xiriir dhageystahaaga haddii aanay wax ku yaal dhinaca dadweynaha ogaan halka loo gudbiyo. Kaydka dekedda joogtada ah ee hawlwadeenka haysto, khariidaynta macmiilku ka codsado UPnP, NAT-PMP ama PCP, iyo cinwaan dadweyne oo la maro waa saddex badeecooyin kala duwan oo leh saddex xad oo kala duwan.
Weydii shan su’aalood mid kasta oo ka mid ah: waa worse protokool, waa dekedda dibadda, dekedda dibaddu ma ka duwanaan kartaa tan gudaha, qoyskeeda cinwaan kee ayay daboolaa, iyo inta ay khariidayntu ku sii socoto dib-u-xirka ka dib. Kaydka ku xiran fadhi firfircoon wuu baaba’aa marka fadhigaas dhammaado, wax kasta oo bogga qorshuhu yiraahdo.
Marka hore xaqiiji qaybta gudaha, sababtoo ah dhageyste dhintay iyo waddo soo-gal ah oo xanniban ayaa dibadda isku mid u muuqda:
ss -lntup | grep -E ':(8080|51820)\b'
python3 -m http.server 8080 --bind 0.0.0.0
curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080
Marka codsiga gudaha uu soo celiyo 200 oo codsi ka yimid shabakad aad maamusho aysan weli dhaqso u dhammaan, farqigu wuxuu ku yaal dhinaca dadweynaha. Taasi waa daqiiqadda aad hawlwadeenka u sheegto protokoolka iyo dekedda dibadda halkii aad barnaamijka magaciisa ku sharrax lahayd.
Gaadiidka tunnel-ka laftiisa waa su’aal gooni ah
Dekedaha qaadaha waa qaybta ugu yar ee dhibaatada iyo tan ugu fudud in la raadiyo. Qiimaha caadiga ah way kala duwan yihiin protokool ahaan, iyo waxa macmiilku ka wada hadli karo ayaa ka muhiimsan sharraxaad kasta oo qorshe.
| Client | Outer transport | Default port | When it helps |
|---|---|---|---|
| OpenVPN | UDP | 1194 | Default mode; needs outbound UDP to pass |
| OpenVPN | TCP | 443 | UDP is dropped and TCP 443 is not |
| WireGuard | UDP | 51820 | Short handshake; there is no TCP mode |
| IKEv2/IPsec | UDP | 500 and 4500 | Mobile clients; 4500 carries NAT traversal |
Shabakad tuurta UDP baxa waxay aqbali doontaa tunnel TCP 443 oo diidi doontaa UDP, sidaas darteed habka beddelka ah wuxuu ku habboon yahay xaashida shuruudaha. Beddelka qaadaha ma raro dekedda barnaamijka gudaha tunnel-ka mana ballaadhiyo siyaasadda meesha; kuwaasi waxay ku sii jiraan sadarkooda.
Kala-baxidda waxay mudan tahay hal tijaabo inta aad halkaas joogto, sababtoo ah tunnel isku xira oo ka dib ku hakada wareejinta waaweyn badanaa wuxuu leeyahay MTU khaldan ma aha deked xiran:
ping -M do -s 1400 203.0.113.10 ping -M do -s 1372 203.0.113.10
Windows-ka tijaabadaas la mid ah waa ping -f -l 1400 203.0.113.10. Deji MTU-da tunnel-ka ka hooseeya cabbirka ugu weyn ee gudba, ka dib mar kale tijaabi wareejinta fashilantay.
Xaqiiji saddexda sadar ka hor inta aadan bixin lacagta qorshe
Dhig saddexda sadar hal bog oo buuxi unug kasta natiijo la cabbiray halkii ballan. Amarradan waxay soo saaraan qaybta gudaha ee boggaas qiyaastii hal daqiiqo gudahood:
ss -lntup | sort
nc -vz -w 3 203.0.113.10 443
python3 -m http.server 8080 --bind 0.0.0.0
curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080
ping -M do -s 1400 203.0.113.10
Akhri wax soo saarka sida liiska hubinta. Baxa wuu shaqeeyaa marka meeshu ka jawaabto tunnel-ka oo furan. Soo-galku wuxuu shaqeeyaa kaliya marka martigeliyaha ka baxsan shabakadaada uu gaaro dhageystaha dekedda dibadda. Qaaduhu wuu shaqeeyaa marka istaahilka gacanta lagu dhammeeyo protokool ay shabakaddaada gelitaanku ogolaato.
Laba caado ayaa xaashida daacad ka dhigta. Qor taariikhda iyo nooca macmiilka agagaarka natiijo kasta, sababtoo ah siyaasadaha bixiyeyaasha iyo qiimaha caadiga ah ee macmiilka labaduba way dhaqaaqaan. Ka dib weydiiso khariidaynta ugu cidhiidhiga ah ee u adeegta qulqulka, sababtoo ah codsiga in wax walba la furo badanaa wuxuu kasbadaa diidmo ama iib dheeraad ah halkii jawaab farsamo.