Waxa ay jawaabta STUN daaha ka qaaddo marka VPN-ku ku shaqeeyo router-ka
Cinwaanka tunnel-ka router-ku ma aha cinwaanka gudaha ee browser-ka. Raac sida codsi kastu u maro oo u turjumo ka hor inta aadan akhrin waxa ay milicsade sheegto.
Marka tunnel-ku ku noolaado router-ka, mishiinka socodsiiya browser-ka ma laha wax interface tunnel ah. Weydii mishiinkaas cinwaannadiisa gudaha waxaadna helaysaa cinwaan LAN gaar ah iyo loopback, wax aan u egayn cinwaanka VPN. Si kastaba ha ahaatee, server STUN oo dhinaca kale jooga wali wuxuu sheegi karaa wax macno leh oo ku saabsan wadada, iyo waxa uu sheegayo waxay si buuxda ugu xiran tahay sida codsigaas gaar ah loo maray oo loo turjumay.
Tani waa qaybta u qalanta in la gaabiyo. „Browser-ku ma leh cinwaanka VPN“ waxay ka jawaabtaa su'aal ku saabsan interfaces, halka cinwaanka milicsan uu yahay jawaab ku saabsan wado maraysa turjumaad. Labada isku qasida waxay soo saartaa gabagabado kalsooni leh oo ku saabsan daahfurka oo aysan caddayntu taageerayn.
Laba qalab, laba qaybood oo interface
Hab ku saleysan router-ka tunnel-ku wuxuu ku dhammaadaa router-ka, macmiilka LAN-na wuxuu u diraa taraafikada caadiga ah gateway-ga caadiga ah. Liiska interface-ka macmiilku wuu gaaban yahay: hal cinwaan gaar ah, laga yaabee mid labaad oo shabakad kale ah, iyo loopback. Khatartu ma aha in mid ka mid ah uu si lama filaan ah u yahay cinwaanka tunnel-ka; khatartu waa in codsigu uu ka baxo wado aadan dooran.
Weydii macmiilka wadada ay qaadan lahayd meel gaar ah halkii aad weydiin lahayd interface-yada jira. Jawaabtu waxay magacawdaa gateway iyo cinwaanka isha ee kernel-ku isticmaali lahaa, taas oo horey uga war badan liis kasta oo cinwaanno ah.
ip route get 198.51.100.20
ip -6 route get 2001:db8::20
wg show wg0 allowed-ipsXadka dokumentiga waa meelo imtixaan wanaagsan maxaa yeelay weligood ma xalliyaan adeeg dhab ah. Isbarbardhig waxa macmiilku sheego iyo waxa router-ku sheego, oo qaado kala duwanaansho kasta caddayn ah in marin habaabinta siyaasadda, qaanuunka tunnel qaybsan ama wado labaad oo caadi ah uu samaynayo wax aadan xisaabtamin.
Waxa jawaabta Binding laga yaabo inay tidhaahdo
RFC 8489 waxay qeexdaa codsiga iyo jawaabta Binding, halkaas oo server-ku uu sheegto cinwaanka gaadiidka isha ee uu u arkay codsigaas. Waa hadal ku saabsan hal shanleyd mid ah hal daqiiqad, ma aha tirakoob interfaces-ka macmiilka. Sidaa darteed wax kasta oo xiiso leh waxay dhacaan inta u dhaxaysa macmiilka iyo barta ilaalinta.
Farqigaas waxaa buuxiya marin habaabin iyo turjumaad. Router-ka sameeya NAT isha taraafikada baxa wuxuu beddelaa isha gaarka ah ee macmiilka cinwaankiisa isaga oo ku yaal interface-ka baxa. Haddii interface-kaas uu yahay tunnel-ka, milicsaduhu wuxuu arkaa cinwaanka tunnel-ka. Haddii baakadka laga reebay tunnel-ka, milicsaduhu wuxuu arkaa waxa turjumaadda WAN soo saartay. Isla macmiil, isla milicsade, jawaab kale.
Saddex kiis oo isku eg oo aanay ahayn
Farqiga faa'iidada leh ma aha mid dadweyne iyo mid gaar ah, laakiin waa goobta fulinta ee baakadka maareysay. Ka shaqee kiisaska iyadoo shaxda router-ka la furan yahay, maxaa yeelay hal browser ayaa soo saari kara saddexdaba iyadoo ku xiran qaanuun aad illowday inaad qortay.
| Where the request leaves | What rewrites the source | What the reflector reports |
|---|---|---|
| Tunnel interface on the router | Router NAT towards the tunnel address | The tunnel address as seen on that path |
| WAN interface, excluded by policy | Ordinary WAN translation | The public WAN address |
| Private reflector reached through the tunnel route | Router NAT towards the tunnel address | An internal identifier valid only inside that path |
Kaliya kiiska labaad ayaa jebiya shardiga ah in taraafikada qaar waligood si toos ah uga baxin, kaliya kiiska koowaad iyo saddexaadna waxay muujiyaan aqoonsi dhinaca tunnel-ka. Midkoodna saddexda saf ma aha sheegasho ku saabsan habdhaqanka bixiye gaar ah: haddii milicsade gaar ah la gaari karo waxay ku xiran tahay marin habaabin, cinwaannada IP ee la oggolaaday dhinaca kale iyo siyaasadda firewall-ka labada dhinac.
Haysashada akoonka bixiye isku mid ah ma caddeyso wax ka mid ah kuwan. Waxaa kale oo mudan in la xusuusto in codsiga la maray uu hayn karo isha LAN ee macmiilka haddii aan waxba turjumin, sidaa darteed goobta isha waa in la raaco halkii laga malayn lahaa jaantuska topolojiga.
Ururintu ma aha xulasho
WebRTC waxay ururisaa cinwaanno mushahar ah in la tijaabiyo, musharihuna muuqda liiska ogaanshaha laga yaabee inuusan waligii xambaarin warbaahin. Akhrinta liiska sida „kan waa waxa dhinaca kale bartay“ waxay buunbuunisaa caddaynta. Lammaanaha la doortay waa kan runtii xambaaray fadhi, wuxuuna ku yaal goob kale.
Hubinta bixista HTTPS waxay ka jawaabtaa su'aal kale: cinwaanka isha ee server web uu u arkay codsigaas. Waa ishubin faa'iido leh sababtoo ah waxay isticmaashaa borotokool kale iyo inta badan meel kale oo aan ahayn milicsadaha UDP, kala duwanaanshaha labada waxay inta badan tilmaamaysaa qaanuun marin habaabin ee ma aha khalad.
Go'aanso siyaasadda, ka dibna akhri jawaabta
Qor ujeeddada ka hor imtixaanka: taraafikada kee ay tahay inuu isticmaalo tunnel-ka, kee si toos ah u bixi kara, qoysaska cinwaanka kee ay ku jiraan xadka, iyo waxa dhacaya marka tunnel-ku xiran yahay. La'aanteed saldhiggaas furasho kastu waa mugdi, maxaa yeelay ma kala sooci kartid daadan iyo wado aad si ula kac ah u oggolaatay.
Kadibna mid mid u weydii su'aal kasta. Wado kee ay qaadanaysaa meeshan. Cinwaan kee ay sheegaysaa milicsadahan. Lammaane mushahar kee ay dooratay fadhiga. Jawaabaha dhigo siyaasadda agteeda oo taariikh u dhig, maxaa yeelay cusboonaysiinta firmware waxay beddeli kartaa habdhaqanka caadiga ah si aamusan u burinaya gabagabadii sanadkii hore.
Router-ku wali waa goob fulin xoog leh, maxaa yeelay wuxuu arkaa taraafikada aan macmiilku ka gudbi karin isaga oo dib u habaynaya naftiisa. Ma aha ballan ah in goob kasta oo borotokool codsi kasta aanay waxba daaha ka qaadin, mana aha beddelka qorista wadooyinka aad dooratay inaad oggolaato.