Umthetho we-firewall ye-Android kufanele ube kuphi uma i-VPN ivuliwe
I-VpnService eyodwa kuphela engasebenza, ngakho uhlelo lokusebenza lwe-firewall nohlelo lwe-VPN akuxhumekani phezulu. Landela isicelo sokusebenza esisodwa bese ubeka umthetho ngamunye lapho ithrafikhi idlula khona ngempela.
Unomusho owodwa wenqubomgomo: lolu hlelo lokusebenza lungafinyelela insiza yomsebenzi, futhi akukho okunye. Umbuzo olandelayo ubukeka njengokukhetha umkhiqizo, kodwa umbuzo wendawo, ngoba indawo ngayinye yokuphoqelela engaba khona ibona ingxenye ehlukile yethrafikhi yocingo. I-gateway ibona kuphela okungena kuthumbu. Isihlungi sohlangothi locingo sibona kuphela lokho esivunyelwe ukukubona. Ukudlulisa isicelo esisodwa kukho kokubili kwenza impendulo icace.
Qala ngomusho, hhayi ngomkhiqizo
Nweba imfuneko ngaphambi kokukhetha noma yini. Lokho kusho iphakethe nephrofayela elisebenza kuyo, ngoba uhlelo lokusebenza lwephrofayela yomsebenzi lungumsebenzisi ohlukile kunalolo hlelo olufanayo kuphrofayela yomuntu siqu. Kusho indawo ekuyiwa kuyo: host, port kanye ne-protocol, hhayi igama lensiza. Kusho indlela ye-DNS exazulula lelo gama, futhi kusho okufanele kwenzeke uma ithumbu lingekho.
Uma kubhaliwe, inqubomgomo yesibonelo inemigqa emine: uhlelo lomsebenzi lungafinyelela insiza yomsebenzi; uhlelo lomsebenzi alunakufinyelela okunye; ezinye izinhlelo azishintshi; ngaphandle kwethumbu, uhlelo lomsebenzi luyenqatshwa esikhundleni sokubuyela emuva endleleni eqondile. Umugqa ngamunye unomnini, futhi akubona bonke umnini oyedwa.
Isinyathelo 1: okungaphoqelelwa ucingo ngokwalo
I-firewall ye-Android engena-root iyi-VpnService ebamba ithrafikhi endaweni, ngisho noma ingekho ithumbu elikude ngemuva kwayo. I-Android ivumela insiza eyodwa ye-VPN esebenzayo ngephrofayela yomsebenzisi, ngakho uhlelo lwesibili lwe-firewall aluxhunyaniswa ngemuva kolokuqala. Luyayithatha indawo yayo, futhi i-interface obekuhluzwa ngayo uhlelo lokuqala iyanyamalala.
Yingakho ukufaka i-firewall eceleni komxhiki we-VPN akuvamisile ukukhiqiza inhlanganisela abantu abayilindele. Uma i-firewall iqala futhi i-VPN inqamuka, akukho okuhlanganisiwe; lezi ezimbili zishintshile izindawo. Ukushintshwa kwe-interface akukona ukubambisana, futhi uphawu wukuthi ithumbu liyawa njalo uma kuvulwa olunye uhlelo.
Izinhlelo ezisekelwayo zikhona: ukuhlunga okwakhelwe ngaphakathi kumxhiki we-VPN osuwusebenzisa, izilawuli zepulatifomu eziphethwe ngesilawuli senqubomgomo yedivayisi noma iphrofayela yomsebenzi, noma isakhiwo esichazwe umthengisi. Okunye konke ukuhlola okufanele kuqinisekiswe kabusha ngemva kokubuyekezwa kohlelo ngakunye.
Isinyathelo 2: okungaphoqelelwa yi-gateway
Lapho ithrafikhi isihlukaniswe ekupheleni okude, i-gateway ingakhawulela amaphakethe adluliswayo kumakheli, izinsiza noma izimpawu ze-VPN eziqinisekisiwe ezivunyiwe. Lokho wukuphoqelela kwangempela kukho konke okuphuma ngayo, futhi iyindawo efanele yokunciphisa ukufinyelela kuma-subnet angasese.
Engakutholi ubunikazi bohlelo locingo obunamathiselwe kupakethe ngalinye le-IP elijwayelekile. Izinhlelo eziningana ezabelana ngekheli elilodwa lethumbu ziyisihloko esisodwa kuyi-gateway, ngaphandle uma isakhiwo sizihlinzeka ngamakheli ahlukene noma ubunikazi obuqinisekisiwe obuhlukene. Ngakho umthetho womsebenzisi ngamunye ku-gateway awuwona umthetho wohlelo ngakunye ocingweni, noma ngabe ikhonsoli yokuphatha iwubiza kanjani.
Isinyathelo 3: bhala okungafinyeleli neze
Uhlelo olukhishwe ku-VPN oluxhumana nedivayisi eseduze alufinyeleli kuyi-gateway, ngakho i-firewall yokuphuma ayikwazi ukwenqaba iphakethe engakaze ilithole. Kuyafana nendlela eqondile engahlosiwe ngesikhathi sokuphazamiseka kanye nokuchayeka kokungena kunethiwekhi yokufinyelela yendawo. Lokho kuyimikhawulo yendawo ngokwencazelo.
Okuphambene nakho kuyiqiniso: umthetho wendawo ovumela ukuxhumana awuniki ukufinyelela nge-ACL yenethiwekhi yangasese ye-gateway. Isicelo esisodwa singaba ngaphansi kwemikhawulo yomibili, futhi ukwanelisa eyodwa akusho lutho ngomunye.
Isinyathelo 4: nikeza umthetho ngamunye indlela
Beka isinqumo etafuleni ngaphambi kokulungisa noma yini, ngoba izigaba ezingenalutho yizindawo lapho izakhiwo zehluleka khona.
| Path | Who can enforce it | Blind spot |
|---|---|---|
| Work app to the work service, tunnel up | Gateway ACL on address and service, plus a local block on other paths | The gateway cannot see which app sent the packet |
| Work app to other destinations, tunnel up | Local app-aware filter, or the gateway if those destinations are addressed there | The local filter must be the active VpnService |
| Work app with no tunnel | Local deny, so the app cannot take a direct path | Requires the filter to survive the tunnel going away |
| Nearby LAN device | Local policy only | The gateway never sees it |
Isimo esisebenzayo yimikhawulo emibili enemisebenzi emibili. Umkhawulo wendawo owazi uhlelo ulawula ukuziphatha kocingo, kuhlanganise nokubuyela emuva okuqondile, futhi umkhawulo we-gateway ulawula izinsiza ezikude. Uhlangothi lwe-gateway lungavumela insiza yomsebenzi futhi lunqabe yonke enye i-subnet yangasese, kuyilapho inqubomgomo yohlangothi locingo inquma yona mayelana nendlela eqondile uhlelo olungayithatha.
Isinyathelo 5: gcina ukuthutha kuphila, bese uqinisekisa
Noma iyiphi inqubomgomo yendawo oyikhethayo kufanele ivumele ukuthutha okusungula futhi okugcina i-VPN. Ukuvimba lokho kuthutha kushiya ucingo lungenawo ithumbu futhi lungenayo inqubomgomo, okungaphoqeleli lutho ngokuhambisanayo futhi kunzima ukukuxilonga ngoba uhlelo alunayo inethiwekhi.
Bese uqinisekisa umugqa ngamunye womusho wokuqala esikhundleni sombono jikelele: uhlelo lomsebenzi lufinyelela insiza yomsebenzi, lolo hlelo luyenqatshwa kwenye indawo, uhlelo okungewona owomsebenzi luziphatha njengakuqala, futhi uma ithumbu limisiwe uhlelo lomsebenzi alubuyeli ekuxhumaneni okuqondile. Hlola indlela ye-DNS ngokwehlukile, ngoba i-DNS yangasese noma isixazululi esibethelwe kungadlula isihlungi esihlola amakheli kuphela.
Uma esinye salezi zinyathelo singenakweneliseka ocingweni, imfuneko ingumbuzo wesakhiwo hhayi isilungiselelo se-firewall. Ukuhlukanisa inqubomgomo phakathi kwedivayisi oyilawulayo ne-gateway oyilawulayo ngokuvamile yimpendulo eqotho, futhi idokhumenti ye-Android VPN connectivity iyindawo yokuqinisekisa ukuthi ipulatifomu izovumela futhi ayiyikuvumela ini ensizeni eyodwa.