I-Always-on VPN ne-kill switch: iyiphi oyi-vulile ngempela?

I-Always-on ne-kill switch zihlala emigqeni emibili ukusuka kwelinye esikrinini esisodwa sezilungiselelo, ngakho abantu bazifunda njengamagama amabili esici esisodwa. Akunjalo. I-Always-on iyinqubomgomo yokuxhuma kabusha: qalisa ithaneli lapho kuqalwa khona, buyisela emuva ngemva kokuphahlazeka noma ukushintsha kwenethiwekhi, futhi uqhubeke uzama ngenkathi ihluleka. I-kill switch iyinqubomgomo yokuhamba: isho amaphakethe angakwazi ukushiya umshini ngenkathi ithaneli liphansi. Ungavula eyokuqala ngaphandle kweyesibili, futhi ezinkundleni eziningi umphumela wokuzenzakalela usavumela ukuhamba ukuba kuphume esikhaleni leso.

Isivivinyo 1: ingabe ukuvimba kuyiswishi yako yona?

Ku-Android 10 nangaphezulu, iphrofayela ye-VPN egciniwe ivula izilawuli ezimbili ezizimele ngemva kophawu lwegijima: Always-on VPN ne-Block connections without VPN. Eyesibili kuphela i-kill switch. Nge-always-on kuphela ithaneli liyabuya ngemva kokuphuka, futhi noma yiluphi uhlelo olusekuqaleni kwesicelo lungafinyelela kunethiwekhi nge-Wi-Fi noma idatha yeselula kuze kube lokho kwenzeka.

Amadivaysi aphethwe agcina ukwehlukaniswa okufanayo ku-API yenqubomgomo. I-setAlwaysOnVpnPackage() ithatha igama lephakheji kanye nefulegi lockdownEnabled; umphathi obeka iphakheji futhi ashiye ifulegi kuyi-false wakhe ithaneli elihlala njalo, hhayi idivaysi elivaliwe. Amagama ku-console awavamisile ukwenza lowo mehluko ubonakale.

Funda isimo kudivaysi, hhayi ku-console: adb shell settings get global always_on_vpn_app ne-adb shell settings get global always_on_vpn_lockdown. Uma eyokuqala ibuyisela i-null, awekho iphakheji eliphoqelelwe ezingeni lenkundla; uma eyesibili ibuyisela u-0, inkundla ayivimbi lutho. Umhlahlandlela we-VPN we-Android uzichaza njengamakhono ahlukene, hhayi imodi eyodwa.

Isivivinyo 2: ukuvimba kungokwaliphi ungqimba?

Amalebula ahlala kuklayenti futhi ukuvimba ngokuvamile kuhlala ku-firewall, yingakho igama elifanayo lisho okuhlukile enkundleni ngayinye. Imigqa engezansi yileyo okufanele iqinisekiswe ngaphambi kokuthemba noma iyiphi yayo.

I-Windows iyisibonelo esicace kakhulu selebula elingavimbi. Lapho i-Always On ichaza ukuqhubeka kwethaneli: ithaneli ledivaysi lokufakazela umshini kanye nethaneli lomsebenzisi le-akhawunti engene, kuhlelwe nge-XML yephrofayela noma nge-Add-VpnConnection. Akukho lutho kuleyo phrofayela olumisa iphakethe eliphumayo lapho ithaneli lingekho, futhi ukuhlunga okuphumayo akuvuliwe ngokuzenzakalela, ngakho ikhompyutha ephathekayo ku-Wi-Fi iyaqhubeka isebenza ngenkathi i-VPN iphansi.

I-WireGuard ihlukana ngendlela efanayo, kodwa ngokweklayenti. I-WireGuard for Windows inenketho ethi Block untunneled traffic yethaneli ngalinye efaka imithetho yokuhlunga; amathuluzi e-Linux awanayo iswishi efanayo. I-wg-quick yengeza umzila wokungena ngakunye kwe-AllowedIPs kanye nomthetho we-fwmark, futhi i-wg-quick down isusa kokubili, ngakho umzila wokuzenzakalela womzimba uthatha izintambo futhi ngaphandle kokuphosa iphakethe elilodwa.

Ezinkundleni ze-Apple, i-always-on iza njengesici sephrofayela yokuphatha yamadivaysi agadiwe futhi ivezwa njengemithetho ye-on-demand, hhayi ibhokisi lokumaka. Umbuzo okufanele uphendulwe kusukela ku-payload ukuthi ithaneli elihlulekile liyala ukuhamba noma licela nje okunye ukuxhumana. Isihloko semininingwane ngeke sikutshele.

Isivivinyo 3: linganisa isikhala, hhayi isithonjana

Ukushintsha okune kubalulekile, futhi kwehluleka ngezindlela ezihlukene: ukuqalisa ngaphambi kokuba noma ubani angene, ukulala nokuvuka, ukushintsha kusuka ku-Wi-Fi kuya kudatha yeselula, kanye nokuphahlazeka kweklayenti okushiya isixhumi sethaneli silihlelelwe ingxenye. Ukuxhuma kabusha okuhlanzekile kokunye kwayo akufakazeli lutho mayelana nezinye ezintathu.

Isivivinyo esishibhile kakhulu simisa ithaneli ngamabomu bese sizama ukuphuma. Ngenkathi ithaneli liphansi, i-curl -m 5 -sS -o /dev/null -w '%{http_code}' https://example.com ebuyisela i-200 isho ukuthi inqubomgomo i-fail-open; ukuphelelwa yisikhathi noma ukuxhumana okunqatshiwe kusho ukuthi kukhona okusavimbayo. I-ip route get 1.1.1.1 isho isixhumi esingathwala iphakethe, okujwayele ukunikeza ulwazi oluningi kunesithonjana se-tray, futhi i-systemctl status wg-quick@wg0 ibonisa ukuthi isixhumi sasuswa ngokuhlanzekile yini.

Gijimisa isivivinyo esifanayo efasiteleni lesibili ngenkathi inethiwekhi ishintsha, hhayi kuphela ngemva kokuba izinze. Isikhala phakathi kokuphuka nomzamo omusha siyona ingxenye ebalulekile, futhi ukuxazululwa kwamagama kuyindlela esheshayo yokuqaphela ukuthi ukuhamba kuphunyukile: uma isixazululi sendawo siphendula ngenkathi ithaneli liphansi, ukuvimba akuphelele.

Isivivinyo 4: nxephezela okukhethekile ngaphambi kokukhiya

Okukhethekile okubili kuyisakhiwo. Iklayenti kufanele lifinyelele iseva ye-VPN uqobo, ngakho iqoqo lemithetho elahla konke livimbela nokuxhuma kabusha obekuzobuyisela ukuvikelwa. I-captive portal nayo ayifinyeleleki ngethaneli elingakanyiwe, ngakho idivaysi elikhiyiwe ku-Wi-Fi yehhotela lidinga indlela ebhaliwe yokuvula iphothali, hhayi eyokuzenzela.

Isimo esincane kakhulu, indawo yokugcina ivunyelwe futhi konke okunye kulahliwe:

table inet vpnlock {
  chain output {
    type filter hook output priority 0; policy drop;
    oifname "lo" accept
    ip daddr 203.0.113.10 udp dport 51820 accept
    oifname "wg0" accept
  }
}

Thatha lowo mugqa wendawo yokugcina njengokuguquguqukayo, hhayi okungaguquki. Abahlinzeki bashintsha amakheli, futhi okukhethekile okugugile yisizathu esijwayelekile sokuthi i-kill switch esebenzayo ibe idivaysi engakwazi ukuxhuma kabusha. Amaphrinta endawo, ukwabelana kwe-NAS kanye nezinsizakalo zokuthuthukisa zingezinye zohlu olubhaliwe olufanayo, uma kungenjalo zitholakala ngetikithi losizo elilodwa ngemva kwelinye.

Isivivinyo 5: bhala lokho okufakazele ngempela

Gcina ithebula elamakholomu amane futhi uligcwalise ngokuhlola: isimo, ukuziphatha okulindelekile, ukuziphatha okubonwe, ubufakazi. Imigqa iwukushintsha okuvela esivivinyweni 3 kanye nokwehluleka okukodwa ngamabomu. Umugqa ongakwazi ukuwugcwalisa ngokuphuma komyalo umugqa ongakuhlolwanga, futhi idivaysi edlula umugqa wokuxhuma kabusha kodwa ehluleka kumugqa wokuqalisa ijwayelekile ngokwanele ukuba kufanele imizuzu eyishumi eyengeziwe.

Ngaphambi kokusho ukuthi kuphelile:

• Qinisekisa ukuthi isilungiselelo sokuvimba sihlukile kwesokuxhuma kabusha, futhi ufunde inani laso kudivaysi.
• Yazi ukuthi yiluphi ungqimba olusebenzisa ukuvimba - inketho yeklayenti, inqubomgomo yedivaysi noma i-firewall - nokuthi lolo ngqimba luhlelwa kuphi.
• Gcina umyalo owodwa wokuhlola ofakazela ukuvimba, futhi uwugijimise ngesikhathi sokushintsha, hhayi ngemva kwako.
• Bhala uhlu lokukhethekile, kufaka indawo yokugcina, futhi uphawule ukuthi ubani okuvuselelayo.
• Kuhadiwe ephethwe, shiya inqubomgomo ephoqelelwe njengoba injalo; ukususa ukuvimba kushintsha imfuneko esikhundleni sokulungisa ithaneli.