Ukukhipha i-VPN ku-LAN yasekhaya ku-Android: incwadi yokusebenza yesevisi eyodwa
Khipha kuphela isevisi yasekhaya oyivumile, hhayi zonke izindlela zangasese. Bhala inqubomgomo, sebenzisa i-VPN evunyelwe ukudlulwa, bese uhlola ukwehluleka kunethiwekhi yezivakashi.
Ufuna isevisi eyodwa yasekhaya ifinyeleleke kuyilapho i-VPN isasebenza kukho konke okunye. Isethingi ekhangayo ukukhishwa kwendlela yasendaweni okumboza wonke amakheli angasese, futhi lokho kuwukulawula okungalungile: kunethiwekhi elandelayo yehhotela noma yekhefi kungashintsha noma yini ephendulayo ibe yindlela yokudlula. Le ncwadi yokusebenza inciphisa ukukhishwa kusevisi eyodwa futhi ikufakazela ngaphansi kwezinguquko eziyiphulelayo.
Chaza ukukhishwa njengesevisi, hhayi njengesubneti
Qopha uhlelo lokusebenza, igama nokukheli okuyiwa kukho, iphrothokholi kanye nephothi, inethiwekhi lapho kuvunyelwe khona, kanye nokuhlolwa kobunikazi okwenziwa yisevisi ngokwayo. Ku-NAS enokufakazela ubuqiniso, isitifiketi noma i-akhawunti yikho okuqinisekisa ukuthi ufike emshinini ofanele. Ikheli ku-192.168.0.0/16 alifakazi lutho, ngoba wonke amarawutha asekhaya akhipha iziqalo ezifanayo.
Futhi nquma ukuthi eduze kusho ukuthini. Isevisi ku-VLAN enomzila ayikho kusubneti ucingo oluxhunywe ngqo kuyo, futhi i-Wi-Fi yezivakashi ingase yabelane ngesiqalo sangasese esifanayo nasekhaya kuyilapho ingumshini ohluke ngokuphelele. Ukukhishwa kufanele kuchaze isevisi nendawo, hhayi kuphela ibanga lamakheli.
Qinisekisa ukuthi ukulawula kwepulatifomu kuhambisana nesidingo
Isakhi sephrofayili se-Android IKEv2 sinikeza setLocalRoutesExcluded(true), futhi imibhalo yaso idinga i-VPN evunyelwe ukudlulwa: ukukhishwa kunengqondo kuphela lapho iklayenti lingavumela ithrafikhi ukuba idlule emhubheni. Imibhalo efanayo ixwayisa ukuthi inethiwekhi engaphansi inganikeza izindlela ezithinta ukukhishwa, yingakho lesi sethingi silandela inethiwekhi ojoyina kuyo, hhayi inethiwekhi oyethembayo.
Futhi akusiso isithembiso sokuthi zonke izimo zokuvala noma ukulungiselelwa okulawulwayo zizovumela umsebenzisi ukuba avule ukukhishwa okufanayo. Ukukhishwa kwendlela, ifulegi lokuvunyelwa ukudlulwa, kanye nenqubomgomo yokuvimba idivayisi kuyizinto zokulawula ezihlukene, futhi idivayisi elawulwayo ingase inqabele eyesithathu kuyilapho ivumela ezimbili zokuqala. Hlola iphrofayili efakiwe nenqubomgomo yokuphatha ngaphambi kokuklama eduze kwebhokisi lokumaka.
Incwadi yokusebenza: yakha futhi usebenzise ukukhishwa
Isinyathelo 1: dala iphrofayili ngendlela esekelwayo yokuthunyelwa, kungaba ukulungiselelwa okulawulwayo noma isakhi seklayenti. Isinyathelo 2: maka i-VPN njengevunyelwe ukudlulwa, ngoba ukukhishwa kwendlela yasendaweni akusebenzi ngaphandle kwakho. Isinyathelo 3: vula ukukhishwa kwendlela yasendaweni. Isinyathelo 4: gcina ukufakazela ubuqiniso kanye nokuhlolwa kwesitifiketi kwesevisi kuvuliwe; ukukhishwa kumayelana nomzila, hhayi ukwethemba. Isinyathelo 5: gcina futhi uxhume kabusha ukuze iphrofayili isebenze.
Ukuhlehlisa kuyindlela efanayo ngokuhlehla: sula ukukhishwa, bese usula ukuvunyelwa ukudlulwa, bese uxhuma kabusha. Ungalungisi umzila noma ihuku yomlilo wokuvikela ngqo kudivayisi. I-daemon yenethiwekhi ingumnikazi wale mithetho, futhi umthetho wokwenziwa ngesandla ungase weqe omunye umndeni wamakheli, ukuxhuma kabusha noma ukushintsha kwenethiwekhi. Uma ukulungiselelwa okufakiwe kungakwazi ukuveza inqubomgomo, gcina ukuvinjwa okuqinile kuze kube umnikazi ugunyaza omunye umklamo.
Hlola izimo ezine ezibalulekile
Sebenzisa izicelo ezingenangozi futhi ubhale umphumela olindelekile ngaphambi kokuqalisa isimo ngasinye. Imatriki engezansi iwukuhlolwa kokwamukela, hhayi isiphakamiso: uma noma isiphi isimo okufanele senqatshwe siphumelela, ukukhishwa kubanzi kunenqubomgomo.
| Case | Network | Destination | Expected |
|---|---|---|---|
| 1. Approved service | Home Wi-Fi | The NAS | Reachable and authenticated |
| 2. Other local device | Home Wi-Fi | A printer | Denied by VPN policy |
| 3. Same private prefix | Hotel or cafe Wi-Fi | 192.168.1.10 | Denied |
| 4. Transition | VPN drop, Wi-Fi to cellular | The NAS | No silent direct path |
Isimo 3 yiso esibamba ukudlulwa okubanzi kwesubneti yangasese, futhi isimo 4 sibamba iklayenti elisebenzise ukukhishwa kuphela ngesikhathi sokuxhuma. Qalisa isimo 4 lapho i-VPN inqanyuliwe futhi ucingo seludluliselwe kuselula, bese uxhuma kabusha futhi uqinisekise ukuthi ukukhishwa kubuya ngaphandle kokuvuselela. isithenjwa se-API yendlela yasendaweni sisho imfuneko yokuvunyelwa ukudlulwa eyenza isinyathelo 2 singenakugwenywa.
Qopha ukukhishwa futhi ukubuyekeze
Irekhodi eligcinwayo kufanele lichaze isevisi, indawo eyayifaneleka, umnikazi kanye nosuku. Igama elithi sendaweni lichaza ubudlelwano bomzila, hhayi izinga lokwethemba, futhi inethiwekhi elandelayo ucingo oluzojoyina kuyo ayiyona inethiwekhi lapho ukukhishwa kwagunyazwa khona.
Buyekeza irekhodi ngemva kokubuyekezwa kwe-OS, kokubuyekezwa kweklayenti noma kokuthutha. Phinda uqalise isimo 3 njalo lapho ukukhishwa kuvuselelwa, ngoba iphrofayili eyayikade ibeka umkhawulo wokudlula kusevisi eyodwa inganwetshwa ngoshintsho olulodwa lokwenziwa okuzenzakalelayo.