Android OpenVPN: engeza umzila wangasese ngaphandle kokwenza i-root kufoni
Engeza umzila owodwa kuphrofayela okulayishwa ngayo i-Android ngempela, bese uhlola ukuthi iseva uyawuvumela yini. Umhlahlandlela wokuhlela, ukuxhuma kabusha kanye nokuhlola okune.
Udinga enye inethiwekhi encane yangasese — ake sithi 10.60.0.0/24 — iphrofayela engayifaki okwamanje. Kumakhompyutha aphathekayo ubungeza umzila bese uqhubeka. Ku-Android i-VPN iwuhlelo lokusebenza, idivayisi ye-tun ingeyalolo hlelo, futhi awukho uhlu lwemizila ongaluhlela ngaphandle kwe-root. Umzila kufanele ube khona, kodwa ungena kuphrofayela elayishwa iklayenti, futhi usebenza kuphela uma uhlangothi olulandelayo luvuma. Nakhu ukuhlela, ukuxhuma kabusha, uhlangothi lweseva kanye nokuhlehlisa.
Ngaphambi kokuhlela: into umzila ongayenza nongakwazi ukuyenza
Umzila uphendula umbuzo owodwa: iyiphi i-interface okufanele ithwale ukuxhumana okuya kule ndawo. Awugunyazi lutho. Uma umnikazi wenethiwekhi engavumanga ukuthi le foni ingafinyelela kuleyo nethiwekhi encane, umzila olungile ukhiqiza isetho esibonakala silungile nokulahleka okuthule esangweni, futhi uzochitha ihora elilandelayo uhlela ifayela elingalungile.
Qala uthole leyo mvume, ngokubhala uma inethiwekhi inomnikezi. Bese ubhala lokho ongakwenzi: awunikezi ifoni ikheli ngaphakathi kwaleLo LAN, awushintshi isilaleli seseva, futhi awukhethi isayithi ngokwegama lomsingathi. Lezi yizinguquko ezine ezihlukene futhi eyokuqala kuphela ngeyakho.
| The route gives you | The route does not give you |
|---|---|
| A destination prefix associated with the tunnel | Permission to forward at the gateway |
| A path for the phone's own traffic | A return route on the target host |
| A scope for the client's virtual interface | A name in DNS, or HTTPS identity |
Hlela iphrofayela elayishwa ngayo iklayenti ngempela
Kuklayenti ehambisanayo eletha umbhalo wokukhetha ojwayelekile we-OpenVPN, isengezo siwumugqa owodwa:
route 10.60.0.0 255.255.255.0Yengeza emzimbeni wephrofayela, eduze kwezimiso zomzila ezinye, futhi ushiye i-endpoint, izitifiketi, ukuphathwa kokhiye nemigqa yokuqinisekisa yomsebenzi njengoba yayinjalo. Unganamatheli isibonelo esidala sonke ukuze uboleke umugqa owodwa: ukucindezela, izindlela zamafayela eziphelele nezilungiselelo ze-cipher eziphelelwe yisikhathi zihamba nakho futhi kuzokubiza isikhathi sokulungisa iphutha esihlukile.
Isinyathelo abantu abasigeji ubunikazi befayela. Uma uhlelo lwalethe iphrofayela, ikhophi eliyisebenzisayo ingeyohlelo, futhi ukuhlela okwangempela okulandwe akushintshi lutho. Sebenzisa umhleli osekelwa yiklayenti, noma uthele i-fayela elihleliwe kabusha ngendlela yokubuyekeza, futhi uqinisekise igama lephrofayela elisebenzayo uma kunamagama amaningi afanayo. Bhala ukuthi yikuphi okushintshile.
Uma iphrofayela isivele ine-route-nopull, awekho umzila ovela kuseva ofakwayo futhi yonke i-prefix edingwa ifoni kufanele ibalwe ngokugqamile. Lokho kungumklamo osemthethweni, kodwa kusho ukuthi umugqa oshiyiwe ubonakala njengokwenqatshwa yiseva.
Xhuma kabusha futhi uhlole kudivayisi
Qala unqamule, bese uxhuma kabusha kuphrofayela ethile oyihlelile esikhundleni sokuvumela uhlelo ukuthi libuyisele iseshini yokugcina. Vula ilogi yokuxhumana futhi uqinisekise ukuthi iklayenti lihlukanise umugqa omusha; isiqondiso somzila esinganakwa i-interface siwumphumela ojwayelekile wokuhlela ikhophi engalungile.
Hlola indawo ngekheli, hhayi ngegama. Ukuhlola kwe-TCP emkhakheni owodwa wensiza owaziwayo kunikeza ulwazi olungaphezu kwe-ping, ngoba amahost amaningi aphendula ku-ICMP kuyilapho umkhakha wensiza uhlungiwe. Uma ikheli liphendula kodwa igama lingaphenduli, umbuzo wakho ungowokuxazulula hhayi wowomzila, futhi isigaba esilandelayo asisiseyakho.
Nalapha kukhona ukuhlola okubili kobubanzi. I-VPN ngohlelo ngalunye kusho ukuthi umzila wekheli ungaba khona kuyilapho uhlelo oluhlola ngalo lungaphandle kwesethi efakiwe, ngakho hlola ngohlelo olungaphakathi ngempela. Futhi i-prefix ye-IPv4 ayisho lutho ngendlela ye-IPv6; uma insiza iyi-dual-stack, engeza umzila we-IPv6 ohambisanayo noma ulindele ukuthi iklayenti likhethe indlela obungalihlosile.
Umphumela owodwa ongemuhle kufanele waziwe kusenesikhathi: uma umzila we-full-tunnel usuvele uhlanganisa 0.0.0.0/0, i-prefix ayikho shile futhi ukuyengeza futhi akushintshi lutho. Ukumboza kabili akulungisi ukwenqatshwa kohlangothi lweseva noma impendulo engekho.
Qedela indlela kuseva
Izinto ezintathu kufanele zibe yiqiniso ngaphandle kwefoni. Isango lidinga umzila oya endaweni kanye nemvume yokudlulisela umthombo wefoni ngakulo. Indawo kufanele yamukele lowo mthombo futhi ibuyisele izimpendulo ngesango, uma kungenjalo umklamo udinga ukuhunyushwa ngamabomu ekuphumeni. Ukukhetha kwe-route encwadini ye-OpenVPN kuhlanganisa isiqondiso sohlangothi lweklayenti; ukudlulisela kanye nomzila wokubuya kuyizilungiselelo ezihlukene emishinini ehlukene.
Uma indawo ingemuva komunye umklayenti we-VPN hhayi ngqo emuva kwesango, iseva idinga i-iroute yenethiwekhi encane yalowo mlingani. Leso siqondiso singesesva futhi sichaza ukuthi iyiphi iklayenti ephethe i-prefix; ifoni ayikwazi ukuyinikeza kusuka kuphrofayela yayo, futhi akukho nani lokuhlela kohlangothi lweklayenti okungayithatha indawo.
Hlola indlela yokubuya ngokugqamile. Impendulo ephuma ngomzila ozenzakalelayo esikhundleni somhubhe ikhiqiza uphawu olujwayelekile oluvulekile ngesigamu: ukuxhumana kusungulwa ohlangothini olulodwa futhi akukho lutho olubuyayo. Ukuhunyushwa komthombo esangweni kuwukulungisa okusemthethweni uma indawo ingakwazi ukuhamba ibuyela emuva, kodwa kuyisinqumo senqubomgomo enemiphumela yaso.
Ukuhlehlisa nokwamukela
Gcina iphrofayela yangaphambili ngaphambi kokuyihlela. Uma ushintsho lwenza izinto zibe zimbi kakhulu, buyisela leyo khophi ngendlela efanayo yokuthela kabusha, xhuma kabusha, futhi uqinisekise ukuthi ukuziphatha kwakudala kubuyile — lokho kuqinisekisa ukuthi ushintshe lokho obucabanga ukuthi uyakushintsha. Ukuhlehlisa okungabuyisi isimo sakudala kusho ukuthi uhlelo luphethe ikhophi yesithathu ongakayitholi.
Amukela ushintsho uma izinto ezine zimi, zihlolwe ngalokhu kulandelana ngemva kokuxhuma kabusha okusha: indawo iphendula emkhakheni wayo wensiza, igama langasese liyaxazululeka uma kulindelekile, i-HTTPS isaqinisekisa igama lomsingathi elihlosiwe, futhi konke kusasebenza ngemva kokuqalisa kabusha noma ukusuka ku-Wi-Fi kuye kunethiwekhi yeselula. Ukuhlola kokugcina yikho okubamba umzila okhona kuphela kuze kube yilapho i-Android isungula kabusha umhubhe.
- Qinisekisa ukuthi umnikazi wenethiwekhi uvumela indawo ngaphambi kokuhlela noma yini.
- Beka umzila kuphrofayela elayishwa yiklayenti, bese uthela kabusha futhi uxhume kabusha.
- Qinisekisa ngomkhakha wensiza, ngaphakathi kobubanzi bohlelo ngalunye, komndeni wekheli olungile.
- Lungisa ukudlulisela, umzila wokubuya kanye ne-iroute kuseva, hhayi efoni.
- Gcina ikhophi yokuhlehlisa, futhi uphinde uhlole ngemva kokuqalisa kabusha.