Indlela imithetho yesizinda ye-Apple VPN On Demand evula ngayo umhubhe
Umthetho wesizinda unquma kuphela ukuthi umhubhe uvuleka nini. Indlela uhlolo lwe-DNS lwe-connect-if-needed olusebenza ngayo, kungani imizila isakhetha ithrafikhi nokuthi ingahlolwa kanjani iphrofayela.
Umhubhe uvuleka lapho ucela igama elilodwa langaphakathi futhi uhlala uvaliwe lapho uhlelo lokusebenza olulandelayo luwudinga ngokulinganayo. Lokho akulona iphutha kuhlelo lokusebenza; kuwukuma komthetho wesizinda. Ukulungiselelwa kwe-on-demand kwe-Apple kuchaza izimo zokusungula uxhumano, futhi isimo sesizinda salezo zimo sibuza umxazululi wohlelo umbuzo ngaphambi kokuba ngisho iphakethe elilodwa linyakaze. Imibuzo emibili ihlale ihlanganiswa: ukuthi umhubhe kufanele ukhuphuke nini, nokuthi umhubhe uthwala ini lapho usuvele ukhona. Owokuqala uyisigqugquzeli, owesibili umgomo wemizila nomxazululi, futhi iphrofayela eyodwa ivamise ukusetha kokubili ku-payload eyodwa, yingakho umthetho wesizinda olungile usengakushiya kwinethiwekhi engalungile.
Isigqugquzeli nokukhethwa kwethrafikhi kusezendlalelo ezihlukile
Umthetho we-on-demand uhlala kusichazamazwi se-on-demand se-payload ye-VPN: uhlu lwemithetho oluhleliwe, ngamunye unesenzo kanye nesethi yezimo zokufanisa. Uhlelo luyahlola lapho uxhumano lushintsha noma lapho okuthile kuzama ukufinyelela inethiwekhi, futhi isenzo sinquma ukuthi umhubhe uyakhushulwa, uyahlolwa, unqanyulwa noma awunakwa. Konke lokhu kwenzeka kusendlalelo senethiwekhi yepulatifomu, ngaphambi kokuba uhlelo lwakho luthole isokhethi.
Okulandelayo iqembu elihlukile lokhiye: izilungiselelo ze-IPv4 ne-IPv6 zomhubhe, imizila yawo efakiwe nekhishiwe, amakheli abaseva be-DNS, futhi ku-iOS ne-iPadOS ukumephwa ngohlelo lokusebenza okunquma ukuthi yiziphi izinhlelo ezingawusebenzisa umhubhe. Iphrofayela ingahlanganisa isigqugquzeli esibanzi nomzila omncane, noma isigqugquzeli esincane nomzila ozenzakalelayo. Funda ingxenye eyodwa kuphela, enye izobonakala iyiphutha.
Nginophrofayela yaselabhu exhumanisa noma nini lapho kucelwa okuthile ngaphansi kwesizinda sangaphakathi kodwa ihambisa kuphela i-/16 eyodwa kumhubhe. Yenza ngqo lokho okusho i-payload yayo, futhi iwuhlobo lwephrofayela oludala amathikithi: abantu bacabanga ukuthi umhubhe oxhunyiwe usho ukuthi ithrafikhi yabo ingaphakathi kuwo.
Umthetho wesizinda ubuza ini kumxazululi
Isimo sesizinda somthetho, esivame ukubizwa nge-connect-if-needed, asihloli ama-payload amaphakethe futhi asibheki ama-URL. Lapho igama lixazululwa, uhlelo luliqhathanisa nezizinda ezisemthethweni futhi, uma kufana, libuza ukuthi lelo gama lingaxazululwa yini ngamaseva e-DNS anikezwa umhubhe. Uma umxazululi womhubhe ephendula, igama libalwa njengelangaphakathi futhi uxhumano luyaqala. Uma umxazululi wendawo ephendula esikhundleni salokho, igama lithathwa njengelangaphandle futhi awukho umhubhe ovelayo. Uhlolojikelele lokusatshiswa kwe-Apple kuchaza lokhu njengokutholwa kwenethiwekhi okulandelwa ukuhlolwa koxhumano.
Imiphumela emibili iyalandela. Iphrofayela kufanele isho amaseva e-DNS ngaphakathi komhubhe; umthetho wesizinda ongenaye umxazululi womhubhe awunakho ukuqhathanisa, ngakho ukuhlolwa akukwazi ukunikeza ukufana okulindele. Futhi ukubheka kufanele kufinyelele kumxazululi wohlelo. Uhlelo lokusebenza noma isiphequluli esisebenzisa i-DNS yaso ebethelwe, isandiso esiphendula endaweni, noma uxhumano ekhelini elingokoqobo akukaze kukhiqize ukuxazululwa kwegama okwakulindelwe umthetho. Omunye wemini yezindebe emide engake ngayichitha waphela lapho ngithola ukuthi iklayenti elingaphambi komhubhe lalisebenzisa i-DNS over HTTPS.
Ukugcina kususa futhi isigqugquzeli. Igama eselikugcino lingaphendulwa ngaphandle kohlolo obeluzoqala umhubhe, ngakho umthetho owawusebenza izolo wehluleka ngemuva kokuqalisa kabusha, noma ngemuva kokuba umhubhe ube phezulu isikhashana. Ku-macOS sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder isetha kabusha isimo; ku-iOS ukushintsha imodi yendiza noma ukuqalisa kabusha idivayisi kukunikeza isiqalo esihlanzekile esifanayo.
Ubukhulu bokufanisa: amagama, izinhlelo nezinethiwekhi
Ukufanisa isizinda kuwuhlobo olulodwa phakathi kweziningi. Umthetho ungafanisa futhi nohlobo lwesixhumanisi (Wi-Fi, umakhalekhikhini, i-Ethernet) ne-SSID ethile, futhi amanqenqema ngohlelo noma ngesizinda se-Safari abopha umhubhe kuhlelo olulodwa lokusebenza. Lokho kubopha kuchaza isipiliyoni esiyinqaba lapho uhlelo olulodwa kuphela lwenza okwehlukile kunakho konke okunye: ezinye izinhlelo zingaphandle kobukhulu bomhubhe, ngakho ziyaqhubeka zisebenzisa indlela yendawo ngisho lapho isithonjana somhubhe sithi kuxhunyiwe.
Ukulandelana kubaluleke kakhulu kunalokho abantu abakulindele. Imithetho ihlolwa ngokulandelana futhi eyokuqala efanisayo inikeza isenzo, ngakho umthetho obanzi wokuxhuma kunoma iyiphi i-Wi-Fi obekwe ngaphezu komthetho wesizinda omncane uyanqoba buthule futhi wenza umthetho wesizinda ungahlolwa. Ngaphambi kokubhala kabusha uhlu lwezizinda, qinisekisa ukuthi awukho umthetho wangaphambilini osewufanile.
Yingakho i-always-on ingeyona nje umthetho we-on-demand oqinile. Ukuphoqelelwa kwe-always-on kuyimodi yokusatshiswa ehlukile enezidingo zayo zokuqapha nokuphatha; igcina umhubhe uvulekile esikhundleni sokuphendula igama. Uma okudingayo kungumhubhe ongawi neze, umthetho wesizinda uyithuluzi elingalungile.
Izimo zokwehluleka ezilingisa umthetho ophukile
Imibiko eminingi yokuthi umthetho wesizinda awusebenzi iwela kwenye yezindawo ezinhlanu, futhi eyokugcina yazo kuphela iwumbhalo womthetho.
| What you see | Layer | First check |
|---|---|---|
| Tunnel comes up, internal site still fails | route or resolver after connect | netstat -rn, scutil --dns |
| Tunnel never comes up for that name | trigger path | fresh lookup, cache flush, private DNS |
| Tunnel comes up for every app | scope, or an earlier rule | rule order, per-app mapping |
| Tunnel drops and will not return on the same Wi-Fi | interface or SSID match, admission | captive portal, SSID string, auth prompt |
| Tunnel returns after you disconnect it | profile ownership | profiles show |
Amasango e-captive afanele umugqa wawo, ngoba i-Wi-Fi yamahhotela neyezikhumulo zezindiza ibamba kanye lokho kubheka umthetho othembele kukho. Kuze kube isango livumela idivayisi, iseva ye-DNS yomhubhe ayifinyeleleki, uhlolo luyahluleka, futhi ukwehluleka kubonakala njengesizinda esibhalwe ngokungalungile. Ukuqinisekiswa kungenye imeko ethule: umthetho ungase usebenze, umhubhe ungase uqale ukuxhuma, futhi uxhumano lufe esitifiketini esiphelelwe yisikhathi noma embuzweni ovela kwesinye isibonisi.
I-IPv6 idala uhlobo okulula ukuluxilonga ngokungalungile. Igama elinezinhlobo ezimbili zamakheli lingaphendulwa kuqala kusuka kurekhodi ye-AAAA, kuyilapho uhlu lwemizila yomhubhe luthwala i-IPv4 kuphela. Isiphequluli esisodwa siyaphumelela, esinye siyahluleka, futhi uhlu lwezizinda alunacala neze.
Hlola ngesicelo sangempela, ngalokhu kulandelana
Funda umgomo ngaphambi kokuqagela. Ku-macOS sudo profiles show -type configuration iphrinta amaphrofayela afakiwe kuhlanganise ne-payload ye-VPN, scutil --nc list ikhombisa isimo sesevisi, futhi scutil --nc show <service> iphrinta isichazamazwi se-on-demand esisetshenziswa uhlelo. Ku-iPhone noma iPad ephethwe, i-payload efanayo ivela kukhonsoli yokuphatha noma kumbiko we-MDM. Amalogi enethiwekhi ayatholakala nge-log stream --predicate 'subsystem == "com.apple.networkextension"' ku-macOS, nangokhonsoli yedivayisi lapho ucingo luxhunyiwe.
Bese uhlola ngegama lomsingathi elingakaze libuzwe ngaphambilini kulesi seshini. Khetha igama esizindeni se-DNS somhubhe owaziyo ukuthi lixazululwa ngaphakathi, libuze kanye, bese ubheka ukuthi umhubhe uyavela yini. Sebenzisa lokho kubheka kabili: umzamo wesibili ujwayeza indlela yokugcina, futhi umehluko phakathi kwakho kokubili ukutshela ukuthi isigqugquzeli ukuxazululwa noma ukuhambisa imizila.
Lapho umhubhe usukhuphukile, qinisekisa izendlalelo ezimbili ngokwehlukana. netstat -rn -f inet ne-netstat -rn -f inet6 zikhombisa ukuthi isiqalo ngasinye sikhomba kuphi, scutil --dns ikhombisa ukulandelana kwabaxazululi nokuthi isiphi isixhumanisi siphethe umxazululi munye, futhi nettop -m route ikhombisa ukuthi isiphi isixhumanisi sathwala amabhayithi. Uma umhubhe uphezu futhi umxazululi ulungile kodwa insiza isahluleka, yeka ukuhlela umthetho; hlola ugunyaziso ohlangothini lweseva nomzila wokubuya.
Lapho umthetho ungokomunye umuntu
Uma umhubhe uvela futhi ngemuva kokuba uwunqamule, umthetho uvamise ukuba ngowephrofayela hhayi wohlelo lokusebenza: ukulungiselelwa okusundululwe nge-MDM, iphrofayela yomuntu siqu esele, noma iphrofayela efakwe elinye iklayenti. I-sudo profiles show -type configuration kanye nokusesha okhiye be-on-demand kuzokunciphisa, futhi indlela yokususa iyiphrofayela, hhayi iswishi kubha yemenyu. Ukususa umnqenqema wesevisi noma uhlelo lokusebenza kushiya umthetho, futhi ukufakwa okulandelayo kuwuthola njengefa futhi.
Uhlolo olulodwa lunquma ubunikazi: nqamula, linda, cela igama langaphakathi futhi. Uma umhubhe ubuya, isigqugquzeli sisebenza ngendlela eyakhelwe ngayo futhi umbuzo ovulekile ukuthi ngubani owuphathayo nokuthi lowo mkhakha uyilokho okukufunayo.
Ngaphambi kokubika lokhu njengephutha, dlula kulezo zivivinyo ezinhlanu: amakheli omxazululi womhubhe akhona ku-payload, igama elingagcinwanga, awukho umthetho wangaphambilini osewufanile, umzila we-AAAA ombozwa uhlu lwemizila, futhi uhlelo lokusebenza lungaphakathi kobukhulu bomhubhe. Lapho kuzo zonke ezinhlanu kuma, umthetho wenza umsebenzi wawo futhi iphutha lisekude phambili emzileni.