Maxay natiijooyinka baaritaanka dekedaha u beddelaan ka dib bixidda VPN?
Bixidda beddel oo dekeddu si kale ayay uga jawaabi kartaa iyada oo aan adeeggu dhaqaaqin. Kala sooc fiirsashada waddada iyo liiska aad runtii u baahan tahay.
Ku socodsii isla baaritaanka dekedda khadka xafiiska iyo bixidda VPN, oo labada jawaabood waxay ku kala duwanaan karaan cinwaan aan cidna beddelin. Farqigaas wuxuu ka yimaadaa waddada iyo kaas oo martigeliyaha jawaabay, ma aha haddii adeeggu shaqeynayo. Saddex su'aalood ayaa kala sooca sharraxaadahaas: waxa baaritaanku runtii weydiiyay, martigeliyahay jawaabay, iyo waxa serverkaaga u gaar ah diiwaangeliyay. U mar sidaas oo kale oo qor jawaab kasta ka hor inta aadan u gudbin tan xigta.
Hagaaji baaritaanka ka hor inta aadan isbarbardhigin laba orod
Erayga xaaladda waxaa lala barbardhigi karaa eray kale oo xaalad ah kaliya marka labaduba ay ka soo baxeen isla tijaabo. Shan goobood ayaa taas xajinaya: cinwaanka isha ee dhinaca fog arkay, halka loo socdo ee la xalliyay, dekedda, nooca baaritaanka iyo waqtiga. Beddel mid kasta oo ka mid ah oo waxaad samaysay tijaabo labaad halkii aad laba jeer cabbiri lahayd tan koowaad.
Hubi isha wax kasta ka hor, sababtoo ah macmiilka VPN wuu shaqeyn karaa iyada oo gaadiidku weli ka baxayo interface-ka jirka. Weydii dhinaca fog waxa uu arko, ka dibna weydii kernel-ka interface-ka uu doortay:
curl -s https://ifconfig.me
ip route get 203.0.113.20Laba cinwaan oo ku yaal shabakado kala duwan waxay ka dhigan tahay in sharraxaaddu horey u gacanta ku jirto, baaritaanada hadhayna waxay kaliya xaqiijin doonaan. Markay iswaafaqaan, duub baaritaanka iyada oo calanka sababta daaran, si xaaladdu ula soo noqoto sharraxaad ku xiran halkii ay keligeed u istaagi lahayd sida eray qaawan. Nooca baaritaankana waxa uu ku jiraa diiwaankaas, sababtoo ah waxa uu qeexayaa waxa la weydiiyay, ma aha waxa soo noqday. Xaalad aan lahayn isha, habka iyo sumadda waqtiga lama barbardhigi karo waxna:
nmap -sT -p 443,8443 --reason 203.0.113.20Hayso soo-saarkaas diiwaanka agtiisa, ma aha buferka is-rogidda ee qofka xiga uusan arki karin. Laba baaritaan oo daacad ah oo iswaafaqsanayn waa dood kaliya marka aan cidna qorin shuruudaha. Marka shuruudaha la xajiyo, ama natiijooyinku way iswaafaqaan oo su'aashu way xidhantaa, ama way kala duwan yihiin oo farqigu waa xaqiiqo ku saabsan waddada.
Ogow martigeliyahay dhammaystiray gacan-qaadista
Gacan-qaadis dhammaatay waxay caddaynaysaa in martigeliyahay dhammaystiray, martigeliyahaasna ma aha inuu noqdo habka aad maskaxda ku haysato. Miisaaniyaha culeyska, boroksi qalloocan ama boroksi SYN ayaa ka jawaabi kara ka hor inta aan serverka dhabta ah ku lug yeelan, taas oo ah naqshad caadi ah, ma aha calaamad. Shahaado ansax ah oo loogu talagalay magaca la filayo sidoo kale ma yareyso tan, sababtoo ah shahaadadu waxay qeexdaa xiriirka adeegga oo wax kama sheegto mashiinka joojiyay xiriirka.
Tixraaca xaaladaha dekedda ee Nmap waxa uu tan u arkaa aasaas: xaaladdu waxay diiwaangelisaa waxa baaritaanku ka fiirsan kari lahaa halka laga diray, ma aha hantida dekedda. Akhri erayga xaaladda sidaas oo laba orod oo iswaafaqsanayn waxay bilaabaan inay u muuqdaan kuwo iswaafaqsan halkii ay ka ahaan lahaayeen kuwo is burinaya, iyada oo su'aashu ka dhaqaaqayso haddii dekeddu furan tahay una gudubtay cidda hor istaagtay.
Ka jawaab su'aasha labaad backend-ka halkii aad ka jawaabi lahayd dibadda. Frontend-ka aqbala xiriirada ka dibna aan gaarin upstream-kiisa waxa uu soo saaraa sawirka dibadda ee saxda ah ee adeeg caafimaad qaba oo leh barnaamij gaabis ah. Kaliya diiwaanka upstream-ka laftiisa ayaa kala sooca labada kiis:
tail -n 5 /var/log/nginx/access.log
ss -ltnp 'sport = :443'Sadarka log-ga waxa uu muujinayaa cinwaanka macmiilka ee barnaamijku runtii arkay, amarkana labaad waxa uu muujinayaa haddii habka haysta dekedda 443 uu yahay barnaamijkaaga ama wax hor yaalla. Haddii labaduba iswaafaqsanayn cinwaanka xiriirka galay, waxaad eegaysaa laba lugood oo isla codsi ah oo tikidhka waa inuu sidaas yidhaahdaa.
Hubi sharciyadaada ka hor inta aadan eedayn tunnel-ka
Siyaasadda ula kac ah ayaa ah sababta ugu badan ee dekeddu uga jawaabto hal shabakad oo aan ka jawaabin mid kale, waana sharraxaadda ugu xiisaha yar ee la heli karo. Sharciyada gelitaanku waxay u jiraan inay u oggolaadaan hal isha oo ay tuuraan inta kale, sidaas darteed beddelka bixidda waa isla dhacdada sharciyadaas loo qoray. Sidaas darteed xaalad ka duwan oo VPN ku timid ma muujiso in bixiyuhu baarayo gaadiidka. Waxay muujinaysaa in cinwaanka ishaagu hadda duwan yahay, taas oo ah sheegasho aad u yar.
Sharciyadaas waxaa lagu akhriyi karaa serverka, sidaas darteed akhri halkii aad ka mala-awaali lahayd bartamaha shabakadda. Liis sharciyada shaandhaynta ee xusaya mid kasta oo ka mid ah labada xadad cinwaan, ka dibna hubi haddii xiriirku uu gaaray daemon-ka:
nft list ruleset | grep -n -e 203.0.113 -e 198.51.100
journalctl -u sshd -n 50 | grep 203.0.113Natiijada labaad ee madhan waa mid xog leh, sababtoo ah waxba ma gaarin daemon-ka oo su'aashu waxay ka tirsan tahay shaandhe, koox ammaan ama waddada lafteeda. Ku dhicid waxay ka dhigan tahay in adeeggu arkay ishaada oo uu doortay jawaabtiisa, go'aankaasna badanaa waxa uu ku qoran yahay sharci aad akhriyi karto. Midkoodna natiijooyinka ma taageero sheeko ku saabsan bixiyaha, labadana way ka jaban yihiin in la hubiyo qabashada baakadaha.
Akhri gaadiidka, shahaadada iyo jawaabta si gooni ah
Saddex lakab ayaa soo saara saddex fiirsasho, baaritaan tijaabiya midkoodna ma soo sheegi karo labada kale. Ku hay sida sadarro gooni ah diiwaanka halkii aad ku laabi lahayd hal go'aan, sababtoo ah sadar kastaa si u gaar ah ayuu u guuldareystaa oo qaabka guuldareysta waxa uu kuu sheegaa halka aad marka xigta eegto.
| Observation | What it settles | What it leaves open |
|---|---|---|
| Connection completed | A host on the path accepted the handshake | Which host, and whether its upstream is reachable |
| Certificate valid for the name | The endpoint holds a credential for that name | Whether the process behind it is the one you meant |
| Expected response body | The application handled the request | Anything about other ports or other paths |
| Connection refused | A host replied and nothing was listening | Whether a filter sits ahead of the refused port |
| Timeout | No reply arrived before the deadline | Drop, blackhole route or an overloaded host |
Hal amar ayaa soo saara saddexda sadar ee ugu horreeya oo ka soo horjeeda adeeg aad maamusho. Soo-saarkiisa geli diiwaanka baaritaanka agtiisa, ma aha fariin chat:
curl -v --resolve office.example:443:203.0.113.20 https://office.example/Akhri soo-saarka sida ay isku xigaan: gacan-qaadistu waxay ka jawaabtaa su'aasha gaadiidka, mawduuca shahaadadu waxa uu ka jawaabaa su'aasha magaca, jidhka jawaabtuna waxa uu ka jawaabaa su'aasha barnaamijka. Marka sadarka gacan-qaadistu guulaysto oo sadarka jawaabtu uusan guuleysan, waxaad haysataa frontend leh upstream jaban, ma aha deked xiran. Taasi waa tikidh ka duwan tii aad furtay, waana mudan in si cad loo yidhaahdo.
Ku dhammee inaad tikidhka ku qorto afar xaqiiqo: cinwaanka isha, nooca baaritaanka, martigeliyaha jawaabay iyo waqtiga. Wax kasta oo isbarbardhig dambe u baahan yahay waxa uu ku nool yahay afartaas, qofka xiga ee kiiska qaatanana ma lahaan doono taariikhda terminal-kaaga. Haddii aadan buuxin karin afarta oo dhan, orodku ma dhammaanin.