Iseva ye-VPN ku-Android: i-root ayenzi ifoni ifinyeleleke
Izinkinga ezintathu ezihlukene zinquma ukuthi ifoni ingakhonza amaklayenti e-VPN: indlela engenayo, imodeli yamalungelo kanye nokudlulisela. I-root ithinta eya phakathi kuphela.
I-root ishintsha ukuthi iyiphi imisebenzi yenethiwekhi inqubo evunyelwe ukuyizama. Ayiniki ifoni ikheli elifinyeleleka emphakathini, ayigcini imephu engenayo kumhlinzeki, futhi ayigcini i-daemon iphila ngemva kokuqala kabusha. Uma unquma ukuthi ifoni ye-Android ingasebenza njengesiseva se-VPN, hlukanisa imibuzo emithathu: ingabe iklayenti elihlosiwe lingafinyelela isilaleli nhlobo, iyiphi imodeli yamalungelo edingwa ukusetshenziswa kwesiseva, futhi yini okufanele idluliselwe lapho umhubhe usumile.
Ubani futhi kuphi okufanele afinyelele ifoni
Iklayenti elikwi-LAN efanayo evunyelwe kanye neklayenti elikusebenzisa idatha yeselula zihlola izinethiwekhi ezimbili ezihlukene. Qala ngokunquma okuhloswe, ngoba izimpendulo azidluliseli. Ku-Wi-Fi, ithrafikhi engenayo engaceliwe ngokuvamile idinga imephu kurotha ephezulu kanye nendlela yomphakathi esebenzisekayo ngale kwayo. Kuselula, i-NAT yezinga lomhlinzeki isho ukuthi i-IPv4 engenayo ayitholakali kaningi, noma ngabe ifoni ivumela ini.
Yilowo mphumela wokugcina ongasathintwa yi-root. I-firewall yasendaweni yefoni ne-NAT yomhlinzeki yizinhlelo ezihlukene, futhi ukushintsha eyokuqala akunamphumela kweyesibili. Ikheli le-interface eliyimfihlo, isithonjana sedatha yeselula noma isokhethi elalelayo akubona ubufakazi bokufinyeleleka. Uma indlela yomhlinzeki inikeza i-IPv6 ehamba ngokomhlaba wonke, usadinga inqubomgomo yesilaleli ne-firewall eyenzelwe yona; ukuba nekheli akufani nokwamukela ukuxhumana.
| Client path | What actually decides reachability |
|---|---|
| Same LAN | The phone's listener and its local firewall |
| Wi-Fi, from the internet | A mapping on the upstream router plus a usable public path beyond it |
| Cellular IPv4 | The carrier's NAT, which the handset does not control |
| Cellular IPv6 | Address, listener and firewall policy together |
Ukukhonza nokudlulisela kuyimpumelelo ezimbili ezihlukene
Ukuxhawula kwe-VPN okuqediwe kufakazela ukuthi umhubhe ukhona. Akufakazeli ukuthi iklayenti lingafinyelela i-LAN engemuva kwefoni, futhi akufakazeli ukuthi ifoni ingasebenza njengokuphuma kwe-inthanethi. Lezo yizilungiselelo ezihlukene ezakhiwe phezu kohlelo lwamakheli angaphakathi, imizila, ukuziphatha kokubuya kanye nenqubomgomo yokudlulisela encane yomsebenzi oyifunayo ngempela.
Indlela yokwehluleka iqaguleka: ukuxhawula kuphumelela, iklayenti likhombisa ukuxhumana, futhi akukho okulayishwayo. Ngaphambi kokulungisa iklayenti, nquma ukuthi yiluphi indima kwezimbili oyakhayo. Ukufinyelela kude kudivayisi kwinethiwekhi yefoni nokuphuma kwe-inthanethi ngomhubhe ogcwele kudinga imithetho ehlukene yokudlulisela, futhi ukunikeza kokubili lapho ubufuna okukodwa kwandisa ukuchayeka ngaphandle kokwengeza ikhono obulicele.
Imodeli yamalungelo iwukuzikhethela, hhayi i-root noma lutho
I-daemon ejwayelekile ye-OpenVPN esebenzisa idivayisi ye-TUN ye-kernel idinga amakhono afanele, ukufinyelela kunodi yedivayisi kanye nokubambisana kwenqubomgomo yezokuphepha ye-Android. I-root akuyona inkululeko ephelele ku-SELinux; inqubo enamalungelo isabekwa imingcele inqubomgomo yesikhulumi. Yingakho ibhinari esebenza kahle kuseva ye-Linux ingahluleka efonini ngaphandle kwephutha elicacile mayelana nezimvume.
Ukwenzeka kwegesi endaweni yomsebenzisi kungaba nemodeli yamalungelo ehluke ngokuphelele, ngakho isitatimende esijwayelekile sokuthi zonke iziseva ze-VPN ku-Android zidinga i-root sibanzi kakhulu. I-root ikuthengela ikhono lokuzama imisebenzi eminingi, hhayi isiqinisekiso sokuthi izovunyelwa noma umphumela uzofinyeleleka.
Ukubhaliswa kwesevisi ye-VPN yakwa-Android uqobo kungenye indlela ehlukile. Kunikeza uhlelo lokusebenza isixhumanisi sekhayenti esilawulwayo esinomjikelezo wempilo ocacisiwe; akusona isifaki sesiseva esijwayelekile, futhi ukuqalisa i-daemon kusuka kutheminali akukuniki ukuphatha okuhlala kukhona, inqubomgomo yohlelo lokusebenza ngalunye noma indlela yokululama eyayo.
Uma ufuna iphuzu lokuphuma, shintsha isakhiwo
Lapho inhloso kumane kuwukuphuma kwe-inthanethi kude ngokusebenzisa ifoni hhayi ukuhambisana nephrofayela ye-OpenVPN ekhona, inodi yokuphuma esekelwayo kunethiwekhi yokunweba iwumklamo ofaneleka kangcono. I-Tailscale ibhala indima yenodi yokuphuma ye-Android kanye nezinyathelo zayo zokubhalisa, zokuphathwa kanye nokukhetha iklayenti.
Ukushintshana kungokoqobo futhi kufanele kushiwo ngokucacile: wamukela enye iphrothokholi, enye imodeli yokwethemba kanye nokuncika kuleyo akhawunti nesevisi yokuxhumanisa. Akwenzi iklayenti le-OpenVPN elingashintshiwe lijoyine inethiwekhi yokunweba, futhi akukuniki isilaleli se-OpenVPN ekhelini lomphakathi.
Okusadinga ukusetshenziswa
Noma iyiphi indlela oyikhethayo, izisekelo zokusebenza zinquma ukuthi izohlala iviki yini. Gcina imininingwane yokungena yeseva iyimfihlo, khipha ubunikazi bamaklayenti ahlukene, futhi uhlele ukuhoxiswa ngaphambi kokuba ukudinga. Nquma ukuthi izibuyekezo zifika kanjani, yini egcina isevisi isebenza ngemuva kanye nokuthi ilulama kanjani ngemva kokuqala kabusha noma ushintsho lwenethiwekhi.
Gwema izindlela ezimfushane ezibonakala zilula: ibhinari yasendulo engaguquki, amagama e-interface abhalwe ngqo kanye neskripthi sokuqala esisula inqubomgomo ye-firewall ekhona. Bese wamukela umphumela kuphela lapho uhlolwa ngokucacile: iklayenti elikude eligunyaziwe lifinyelela insiza ehlosiwe, izindawo ezinqatshelwe zihlala zingatholakali, futhi idivayisi iziphindisela yona ngemva komcimbi womjikelezo wempilo osekelwayo. Ukufinyelela kwe-root kungenye yezinto ezingaba khona kulo mphumela, futhi akuvamisile ukuba yikho okunqumayo.