Umthetho we-VPN eyodwa ku-Android awuvimbeli iseva ye-SSH ebungazwayo

Umkhawulo we-VPN eyodwa ukhawulela izinsizakalo ze-VPN, hhayi ama-socket. Iseva ye-SSH ocingweni ihluleka ngenxa yesilaleli, ukufinyelela kozakwabo noma indlela yempendulo.

Le nkolelo ivamile ngokwanele ukuba ithathwe njengeqiniso: i-Android ivumela i-VPN eyodwa kuphela, ngakho iseva ye-SSH egijima ocingweni ayikwazi ukusebenza ngalowomhubhe. Ingxenye yokuqala iqinisile futhi isiphetho asilandi. Umkhawulo wepulatifomu umayelana nokuthi zingaki izinhlelo zokusebenza ezingabamba isikhala sesevisi ye-VPN, hhayi mayelana nokuthi mangaki ama-socket angaba khona noma ubani ovunyelwe ukuxhuma ocingweni. I-daemon ye-SSH ene-socket elalelayo iwuhlelo olujwayelekile olune-port ejwayelekile, futhi umhubhe ungenye yezindlela i-traffic yayo engahamba ngayo.

Umthetho we-VPN eyodwa uvimbela ini ngempela

VpnService ingcebo enendawo eyodwa. Lapho uhlelo lusungula umhubhe, luba yi-VPN yedivayisi, futhi uhlelo lwesibili oluzama ukusungula olunye lwenqatshwa kuze kube yilapho olokuqala lunyamalala. Lowo umthetho mayelana nobunikazi bomhubhe, futhi uchaza ukuthi kungani amaklayenti amabili e-VPN engeke asebenze ngesikhathi esisodwa.

Awusho lutho mayelana nama-socket alalelayo. Iseva ye-SSH ayibizi VpnService, ayibambi amaphakethe futhi ayincintisani ngalesosikhala. Ihlanganisa i-port futhi yamukele ukuxhumana, into efanayo ebiyokwenza ngaphandle kwe-VPN efakiwe. Ngakho inganekwane ihlanganisa umkhawulo kwabahlinzeki bomhubhe nomkhawulo ekuxhumaneni kwenethiwekhi, futhi lokhu okubili akuhlobene.

Isilaleli siyindawo okubhekwa kuyo, akusona ingxenye yomhubhe

Lapho umhubhe ukhona, ucingo lunekheli kuwo futhi idivayisi enguzakwabo inendlela eya kulelokheli. Ukuthi kukhona okuphendulayo kunqunywa yisilaleli. I-daemon eboshwe ku-loopback itholakala kuphela ocingweni uqobo; i-daemon eboshwe ekhelini elidala lomhubhe ingase igcine ukuboshwa kwayo ngemva kokuxhuma kabusha nakuba ikheli eyaboshwa kulo selishintshile.

Imithetho yokubopha iwukulungiselelwa okujwayelekile kwe-SSH: ikheli ne-port yokulalela, nokuthi ubani angangqinza. Ku-Android lezo zilungiselelo zisemisebenzweni yohlelo ngokwalo, futhi umnikazi wenqubo yohlelo kungenzeka angavunyelwa ukusebenzisa ama-port akhethekile, ngakho umkhuba wekhompyutha yedeskithophu wokubopha i-port 22 njenge-root awudluli ngaphandle koshintsho.

ListenAddress 10.90.0.4
Port 2222
AllowUsers alice

Ngemva kwalokho kunemvume endleleni uqobo. I-VPN yabathengi ethwala ngokukhululekile i-traffic yewebhu ephumayo akudingeki ivumele ukuxhumana okungena kumakhasimende ayo nhlobo; eziningi azikwenzi, ngoba lokho kungabeka ikhasimende elilodwa obala kwelinye. Uma uzakwabo engakwazi ukufinyelela ikheli lomhubhe wocingo noma kuphi, inkinga isemgomeni wesevisi hhayi ocingweni.

Indlela yempendulo iyindawo lapho ngokuvamile iphuka khona

Ake sithi uzakwabo ufinyelela ikheli lomhubhe wocingo futhi i-SYN ifika. Manje impendulo kufanele iphume ngayo leyo ndlela, futhi leso yisinqumo somzila ngaphakathi kocingo. Uma impendulo iphuma nge-Wi-Fi ngoba yiloyo nethiwekhi ezenzakalelayo, uzakwabo ubona ukuxhumana okungaqedi, okubonakala kufana ncamashi nodonga lomlilo.

I-Android yenza lokhu kube nzima kunedeskithophu ngoba inethiwekhi ezenzakalelayo ikhethwa ngenqubo ngayinye futhi ingashintshwa umgomo wohlelo lwe-VPN. Iklayenti le-VPN lingahambisa umzila wohlu kuphela lwezinhlelo ezivunyelwe, ngakho uhlelo lweseva olungaphandle kwalolo hlu luqhubeka lusebenzisa inethiwekhi yenyama ngezimpendulo zalo ngenkathi uzakwabo ezilindele ngomhubhe.

Uhlelo lungabopha nama-socket alo kunethiwekhi ethile, okudlula okwezenzakalelayo. Uma ufunda umbiko othi isevisi iyafinyeleleka kusuka kwelinye ikheli hhayi kwelinye, ngokuvamile yilona mshini osemuva.

Ukudlula i-VPN akulungisi isevisi engenayo

Isixazululo esidumile, ukukhipha uhlelo lwe-SSH ku-VPN ukuze i-traffic yalo iyeke ukuqondiswa kabusha, iwukulungiswa kwenkinga ephambene. Kusiza lapho ukuthutha kweklayenti le-SSH eliphumayo kuhlala kuphuka ngenxa yomhubhe. Kuseva ebungazwayo kungase kukhiphe izimpendulo ngaphandle komhubhe osetshenziswa uzakwabo, okuguqula ukwehluleka okwengxenye kube ukwehluleka okuphelele.

Kufanayo nasekuvuleni i-port yomphakathi ku-router. Uma imfuneko iwukuthi idivayisi eyodwa egunyaziwe ifinyelele ucingo nge-VPN, ukubeka i-SSH obala ku-inthanethi kuwumodeli wengozi ohlukile hhayi ukulungisa.

Nquma kuqala ikheli lesevisi: ikheli le-LAN locingo, ikheli lalo lomhubhe, noma indawo yokugcina edluliselwe ngamabomu. Ngayinye inenkontileka yayo yokufinyeleleka nokubekwa obala, futhi ukuzihlanganisa yikho okwenza inkinga encane yokufinyelela ibe umgodi unaphakade.

Hlola uhlangothi olulodwa ngesikhathi

Bhala amaqiniso amane ngaphambi kokushintsha ukulungiselelwa: ikheli uzakwabo axhuma kulo, isimo sesilaleli ocingweni, umongo wohlelo nomsebenzisi onalo, kanye nendlela ebonwe ohlangothini ngalunye. Umbiko othi i-VPN inqamula i-SSH awunakho nekuyodwa kwalokhu futhi awukwazi ukwehlukanisa inkinga yokuthutha kweklayenti neseva engafinyeleleki.

adb shell ip -br addr
adb shell ip route get 10.90.0.9
nc -vz 10.90.0.4 2222

Gijimisa ukuhlolwa kwe-port kusuka kuzakwabo, hhayi ocingweni, futhi ufunde okukhiphayo okuningiliziwe kweklayenti le-SSH ukuze ubone ukuthi kwehluleka ngaphambi noma ngemva kokuxhawana kwe-TCP. I-socket engaxhumi neze nokungena okunqatshiwe kuyizigaba ezahlukene ezinabaphethe abahlukene.

Gcina ukuqinisekiswa kokhiye wesilawuli nemikhawulo ye-akhawunti kungashintshiwe ngenkathi ulungisa amaphutha. Ukukhawulela isilaleli nabasebenzisi abavunyelwe yikho okwenza iseva efinyelelekayo yamukeleke; ukuxegisa lokho ukuze ukuxhumana kusebenze kushintsha inkinga eyodwa nembi kakhulu. Incwadi yesithenjwa yeseva ye-OpenSSH ihlanganisa izilawuli zokulalela nokufinyelela uma ukusetshenziswa kwakho kwe-Android kulandela wona magama okulungiselelwa.

Izihloko ezihlobene