OpenVPN iyo HTTPS dekedda 443: yaa leh dhegeysanaha?
TCP iyo UDP 443 waa socket gaban oo kala duwan. Wadaagista hal TCP dhegeyste waxay u baahan tahay milkiile, iyo wadaagista dekedda OpenVPN waa heshiis cidhiidhi ah, ma aha khiyaano proxy.
Laba adeeg ayaa labaduba ka jawaabi kara dekedda 443 iyagoon waligood tartamin, sababtoo ah dhegeyste waxaa lagu go'aamiyaa gaadiidka, ciwaanka iyo dekedda wadajir, ma aha lambarka kaliya. Dhig server web iyo OpenVPN hal mishiin, oo su'aasha kaliya ee u qalanta jawaabta koowaad waa socket-ka ay process kastaa ka codsato kernel-ka. Qor liiskaas ka hor inta aadan wax ka beddelin qaabeynta, oo khaladaadka «ciwaanku horey ayaa loo isticmaalay» intooda badan iskood ayaa is sharaxa. Wax kasta oo liiska ka dambeeya waa doorasho u dhexeeya dhegeyste UDP, socket TCP la wadaago ama foodda hore ee u jiheeya borotokoolka.
Ka bilow socket-ka ay process kastaa codsato
bind wuu guulaystaa ama wuu guuldareystaa saddexdaas, sidaas darteed laba daemon waxay isku dhacaan oo kaliya marka saddexda qaybood isku bexaan. Taasi waa sababta website ku jira TCP 443 uu si aan xad lahayn ula wada noolaado dhegeyste OpenVPN ku jira UDP 443, iyo sababta u guurinta midkood ciwaan maxalli ah oo labaad oo isla host ah ay sidoo kale doodda dhamayso. Akhri dhegeystayaasha nool, ma aha faylasha ay ahayd inay abuuraan, sababtoo ah include duugoobay ama fayl unit la halmaamay ayaa ka cimri dheer wax ka beddelka aad xasuusato.
| Line in the listener list | What it establishes | What to do next |
|---|---|---|
| One udp row and one tcp row, each on 443 | Separate transport sockets, nothing contested | Point the VPN profile at udp and stop editing |
| A single tcp address and port listed by two processes | A real bind collision between two daemons | Move one service, or put a dispatcher in front of both |
| A proxy process owns the socket, no vpn process | The proxy accepts and has to hand off correctly | Check that its backend speaks the protocol it forwards |
Ku socodsii ss -lntup sida root oo akhri khad kasta oo xuso 443, oo ay ku jiraan gelitaanka IPv6. Dhegeyste v6 caadi ah wuxuu sidoo kale aqbalaa taraafikada v4, sidaas oo kale dhegeyste la halmaamay ayaa dekedda haysta ka dib markaad beddesho faylka aad u malaynayso inuu mas'uulka yahay. Haddii magaca process kaa yaabiyo, ku yaree wax soo saarka ss -lntup 'sport = :443' ka hor intaadan wax taaban.
U beddel tunnel-ka UDP marka shabakaddu ogolaato
Dhegeyste UDP wuxuu si buuxda uga gudbaa isku dhaca oo inta badan waa hagaajinta ugu gaaban, maadaama aan socket la wadaagin oo aan wax soo saar dheeraad ah gelin jidka. Laakiin ma aha bilaash. Qaar ka mid ah shabakadaha macmiilka waxay tuuraan UDP 443 iyagoon dirin reset, sidaas darteed tunnel-ku wuu joojiyaa inuu dhismo halkii uu ku guuldareysto bind, oo isticmaaluhu wuxuu soo sheegaa in VPN uu shidnaa iyadoon khalad la akhriyi karo. Dhegeyste UDP sidoo kale wuu ka badbaadaa dib u bilaabista lakabka web, taas oo muhiim u ah mishiin site-kiisa si joogto ah dib loo geeyo. Ka tijaabi shabakada ay isticmaalayaashu fadhiyaan, sababtoo ah shell ku jira server-ka wuxuu kaliya caddeeyaa in server-ku gaaro naftiisa.
Beddel gaadiidka qaabeynta server-ka iyo profile-ka macmiilka si wadajir ah. Profile weli codsanaya TCP wuxuu ku wareegi doonaa wareegyada dib u xidhka dhegeyste UDP kaliya, oo taasi waxay u ekaanaysaa cillad shabakadeed ilaa aad isbarbardhigto labada fayl.
U daa process-ka VPN inuu yeesho TCP 443 oo inta kale gudbi
Community OpenVPN qaabka server TCP wuxuu akhriyaa baaytka ugu horreeya ee xidhiidhka soo galaya oo wax kasta oo aan borotokoolkiisa ahayn u gudbiyaa backend HTTPS, oo port-share tilmaamuhu taas ayuu u jiraa. Backend-ku waa server web caadi ah oo TLS shidan, oo lagu magacaabo host iyo deked tilmaamahaas, ma aha URL.
port-share 10.0.0.5 8080
Mishiin uu site-ku leeyahay ciwaan gaar ah oo labaad, khadkaas wuxuu taraafikada aan VPN ahayn u diraa 10.0.0.5:8080, sidaas darteed host-ka mala-awaalka ah ee HTTPS waa inuu halkaas ku xidhnaadaa oo dab-damiska waa inuu oggolaadaa boodboodka maxalliga ah. Server-ka web waa inuu TLS isagu dhammeeyaa, sababtoo ah baaytka soo gaaraya waa gacan-qabashada asalka ah ee browser-ka oo wax dhexdhexaad ah ma aysan furin. U jeedi tilmaamaha dhegeyste HTTP caadi ah oo browser-ku wuxuu heli doonaa khalad hab aan ansax ahayn, taas oo loo akhriyaa sida site jaban halkii backend meel khaldan la dhigay. Tilmaamuhu wuxuu kaliya ku jiraa qaabka server TCP, oo dhegeyste UDP ma leh qulqul la baadho.
Maadaama process-ka VPN uu aqbalo xidhiidh kasta, application-ka web wuxuu arkaa codsiga la gudbiyay oo ka yimid mid ka mid ah ciwaannada host-ka laftiisa halkii uu ka iman lahaa booqde. Wax kasta oo u baahan ciwaanka dhabta ah ee macmiilka waxay ku xiran yihiin taageerada borotokoolka PROXY ee backend-ka ama foodda hore ee ku daraysa. U guurinta backend-ka ciwaan maxalli ah oo kale ma soo celiso ciwaanka booqde; waxay kaliya beddelaa ciwaanka host-ka ee site-ku diiwaangeliyo. Ku qor xaddidaaddaas qoraallada geynta ka hor inta aysan warbixin falanqayn su'aasha soo bandhigin.
Proxy rogan waa qalab khaldan; router lakabka afaraad ma aha
HTTP proxy rogan wuxuu dhammeeyaa TLS si uu u akhriyo codsiyada, taas oo macnaheedu yahay inuusan u gudbi karin qulqulka OpenVPN isagoon taaban. Router lakabka afaraad ee u gudbiya SNI ama baaritaanka baakadda koowaad wuxuu hor istaagi karaa labadaba, haddii uusan dhammeeyn jalsada uu VPN-ku ku tiirsan yahay. Labada qalab waxay isku mid u eg yihiin jaantus ahaan oo si gebi ahaan kale ayay u dhaqmaan socket-ka.
Access Server ganacsi wuxuu la yimaadaa dejinta wadaagista dekeddiisa, oo kuwani si mid-ka-mid ah uma habboona tilmaamaha bulshada. Aqoonso badeecada iyo nooca ka hor inta aadan la qabsan hagaha loo qoray kan kale. Dejinta la koobiyeeyay oo si aamusan la iska indhatiray ayaa ka xun dejinta la'aan, sababtoo ah liiska dhegeystayaasha weli wuu u muuqdaa mid lagu kalsoonaan karo intaas ka dib.
Tijaabi website-ka iyo tunnel-ka laba waddo oo kala duwan
Soo rar site-ka oo xidh tunnel-ka, ka dib mar kale akhri liiska dhegeystayaasha si aad u aragto process-ka hadda leh 443. Bogga soo rarma waxba kama caddeeyo VPN, tunnel-ka xidhma waxba kama caddeeyo site-ka, in kastoo labaduba isticmaalaan isla lambar. Saddexda amar ee hoose waxay hubiyaan socket-ka la wadaago, waddada web iyo adeegga VPN isla nidaamkaas.
ss -lntup 'sport = :443' curl -sI https://vpn.example.com/ | head -n 1 journalctl -u openvpn-server@server -n 20
Isbarbardhig ciwaanka macmiilka ee log-ga gelitaanka backend-ka iyo kan log-ga VPN isla daqiiqadda. Haddii site-ku diiwaangeliyo booqde kasta sida host-ka laftiisa, gudbintu way shaqaysaa oo maaraynta ciwaanku ma shaqayso. Haddii labada log aamusan yihiin, foodda hore waligeed ma wareejin xidhiidhka. Si kastaba ha ahaatee, liiska dhegeystayaasha ayaa go'aamiya yaa aqbala socket-ka, waana taas xaqiiqda la xaqiijinayo ka hor inta aadan beddelin fayl kale.
Kaga tag khariidadda dhegeystayaashaas qaabeynta agteeda si qofka xiga ee taabta 443 uu u ogaado process-ka aqbala iyo halka borotokoolka kale uu tagay. Xaqiiji lahaanshaha ka dib isbeddelka halkii aad ku kalsoonaan lahayd waxa wax ka beddelku ujeeddadiisu ahayd.