I-split tunneling esekelwe ku-app noma esekelwe endaweni: yikuphi okufanele ukukhetha

I-split tunneling esekelwe ku-app nesekelwe endaweni akuzona izilungiselelo ezimbili zomsebenzi owodwa. Okunye kubuza ukuthi iyiphi inqubo ethumela iphakethe; okunye kubuza ukuthi lelo phakethe liyaphi. Umbuso owakhelwe umbuzo wokuqala uyahluleka buthule lapho ithrafikhi ivela kunqubo esizayo, futhi umbuso owakhelwe owesibili uyahluleka lapho igama lomsingathi lihumushwa libe ikheli ongakaze ulifake ohlwini. Khetha into ehambisana nesidingo, bese ukuqinisekisa ngamaphakethe amabili okuhlola: elilodwa kufanele lisebenzise umhubhe futhi elinye akufanele.

Imibuso emibili isebenza ezingqimbeni ezihlukene

Umbuso we-app uphoqelelwa ngaphezu kwengqimba yenethiwekhi, ngokumelene nobunikazi uhlelo lokusebenza olukunikeza umthumeli. Ku-Android lokho yi-UID engemuva kwephakethe, futhi insizakalo ye-VPN inquma nge-UID ngayinye ukuthi ithrafikhi iyangena emhubheni. Akukho okubuzwayo mayelana nendawo, ngakho uhlelo olukhethiwe lungafinyelela noma yini futhi alukho olunye uhlelo olungafinyelela inethiwekhi yangaphakathi.

Umbuso wendawo uphoqelelwa kulo iphakethe ngokwalo. Isixhumi somhubhe sinomqoqo wama-prefix, ithebula lomzila luthumela ithrafikhi ehambisanayo kuso, futhi inqubo ethumelayo ayibalulekile. Yingakho umbuso wendawo uhlanganisa insizakalo, iphrinta noma umsebenzi weqoqo okungekho owayekhumbula ukuwufaka ohlwini, futhi yingakho ungeke uchazwe njengalolu hlelo kuphela endaweni yokusebenza iklayenti layo elingakaze libheke inqubo.

Imibuso ye-app ifanele amaklayenti eselula nama-ejenti aphethwe

I-Android iveza ukukhetha ngokuqondile: VpnService.Builder.addAllowedApplication() ne-addDisallowedApplication() zithatha amagama ephakethe futhi ziphoqelela isinqumo nge-UID ngayinye, njengoba kuchazwe kumhlahlandlela wonjiniyela we-VPN we-Android. I-iOS inokulingana ngemibuso ye-VPN yohlelo ngalunye esekelwe kuzihlonzi ze-bundle, ngokuvamile ezisakazwa ngephrofayela ye-MDM esikhundleni sokuthayipha ngesandla.

Amaklayenti ekhompyutha yesihlalo yiwo abuthaka. Iningi lamaklayenti e-VPN e-Windows ne-macOS lihamba ngomzila ngokwendawo futhi alinikezi isikhethi senqubo nhlobo, ngoba umshayeli womhubhe ubona amaphakethe, hhashi izinqubo. Uma uhlelo lwakho luncika ekutheni umhubhe wohlelo olulodwa kukhompyutha ephathwayo, hlola amandla angempela eklayenti ngaphambi kokuklama ngakho; kungenzeka ukuthi ukhetha phakathi kohlu lwezindawo nomshini wesibili.

Umphumela abantu abawugcini: kulezo zinkundla awukwazi ukulingisa umbuso we-app ngemizila. Ukwengeza umzila womsingathi wesiphakeli sohlelo kudlulisa ithrafikhi yabo bonke emhubheni iye kuleso siphakeli, kuhlanganise isiphequlili nesibuyekezi.

Imibuso yendawo ifanele uhlu lwama-subnet nokufinyeleleka kweziza

I-WireGuard yenza imodeli icace. I-AllowedIPs wumzila wokhiye wokubhala: iphakethe langaphakathi elinendawo ewela ohlwini lozakwabo libhalwa ngokufihla liye kulo ozakwabo, futhi konke okunye kuphuma kungafihliwe ngomzila ojwayelekile. Akukho nqubo okufanele ibizwe futhi akukho kungacaci mayelana nalokho okufakiwe.

I-OpenVPN ifinyelela endaweni efanayo ngokusebenzisa ithebula lomzila elicindezelwe. I-route-nopull ivimbela isiphakeli ekunqumeni imizila, emva kwalokho i-route 10.20.0.0 255.255.0.0 vpn_gateway yohlangothi lweklayenti ihlanganisa ngqo isiqalo sehhovisi. I-IPv6 isitatimende esihlukile kulo lonke lamaklayenti, futhi ukuyikhohlwa iyona ndlela evamile yokuvuza eduze kokwehlukaniswa kwe-IPv4 okubonakala kulungile.

Igama lomsingathi akulona umzila. Uma iphrofayela inikeza inkambu yesizinda, yithathe njengegama iklayenti elilixazulula kanye, hhashi njengobubanzi bekheli obuhlala njalo; amanethiwekhi okusabalalisa okuqukethwe nezilinganisi zomthwalo zizonikeza amakheli ahlukile kusasa.

Lapho zombili izimodeli ziphuka khona: abasizi, izinsizakalo ezabiwe, abaxazululi

Izinqubo ezisizayo ziphula imibuso ye-app ngendlela ebukeka njengokuhluleka kwesiphakeli. Isibuyekezi sesiphequlili, umbiki wokuphahlazeka, insizakalo yokuvumelanisa egijima njenge-SYSTEM kanye ne-WebView efakwe kwelinye iphakethe konke kungobunikazi obuhlukene, ngakho ukwenza umhubhe wesiphequlili kungase kushiye isicelo sangempela ngaphandle komhubhe. Okuphambene nakho kuyadida ngokufanayo: uhlelo olukhishiwe olubiza ilabhulali eyabiwe ngaphakathi kwenqubo enziwe umhubhe lusenethrafikhi yalo emhubheni.

Imibuso yendawo iyaphuka ezinsizakalweni ezabiwe nasemagameni. Ukwabelana ngamafayela, amaphrinta, i-DNS yangaphakathi nesiphakeli selayisense konke kuhlala emakhelini, ngakho umhubhe wohlelo olulodwa unikeza isiphequlili ukufinyelela kuyilapho idrayivu elethwe ngemephu ihlala ifile. Lowo mehluko wokuhlanganisa akulona iphutha kunoma iyiphi imodeli, kodwa yiwo isizathu esenza umhubhe wohlelo olulodwa uvame ukukhiqiza isimo sokuthi i-VPN ivuliwe futhi ukwabelana akusekho.

Abaxazululi banqamula kokubili. Uma iklayenti libeka amaseva e-DNS angaphakathi kodwa uhlelo lokusebenza lisebenzisa i-DNS nge-HTTPS iya kumxazululi womphakathi, impendulo ivela ngaphandle komhubhe futhi umbuso wendawo kungenzeka ungahlangani nakanye. Hlola ukuthi yimuphi umxazululi ophendule ngempela ngaphambi kokuphetha ngokuthi umbuso awulungile, futhi qinisekisa ohlangothini lweklayenti ukuthi ngabe lifake umxazululi womhubhe nhlobo. Ukwehlukaniswa okushiya i-DNS ngaphandle komhubhe kubukeka kuphelele ethebuleni lomzila futhi kusahluleka kulo lonke igama langaphakathi.

Inqubo: khetha, sebenzisa, qinisekisa

Qala esidingweni, hhashi kumenyu. Uma umgomo uwukuthi uhlelo kuphela olungasebenzisa umhubhe, udinga imibuso ye-app kanye nendlela yokusebenza eyisekelayo. Uma umgomo uwukuthi lezi zinethiwekhi zifinyeleleka ngomhubhe, udinga ama-prefix. Uma impendulo ingukuthi kokubili, zisebenzise njengezilawuli ezimbili ezihlukene futhi ubhale ukuthi yikuphi okuphethe ukuhluleka kukuphi.

Sebenzisa isimo esincane kakhulu ongasichaza, bese uqinisekisa ngokubuza ithebula lomzila esikhundleni sesithonjana sesimo seklayenti:

ip route get 10.20.30.40
ip -6 route get 2001:db8:10::40
wg show wg0 allowed-ips
Get-NetRoute -DestinationPrefix 10.20.0.0/16
Find-NetRoute -RemoteIPAddress 10.20.30.40

Imigqa emibili yokuqala isho isixhumi esizosetshenziswa indawo yangempela; i-wg show iphrinta uhlu lwama-prefix olulungisiwe; ku-Windows, i-Find-NetRoute iphendula umbuzo ofanayo ozophendulwa isitaki lapho iphakethe lithunyelwa. Uma isixhumi kuwumhubhe, umbuso uhlangene.

Bese uhlola iphakethe lesibili okufanele likhishwe, livela kolunye uhlelo, liya endaweni efanayo. Bhala ethikithini inguqulo yeklayenti, uhlobo lombuso, uhlu lwama-prefix noma lwamaphakethe kanye nemiphumela emibili ebonakele. Yileyondlela yemiphumela etshela unjiniyela olandelayo ukuthi inqubomgomo ilungiswe kabi noma ithrafikhi yayingeyona eyayo nakanye.