Ukulanda okukhulu ne-VPN: khetha indlela esicelweni

“Thumela ukulanda okukhulu eceleni kwe-VPN bese ugcina izimpendulo ezincane kuyo” kuzwakala njengenqubomgomo yokuqondisa, kodwa akunjalo. Umhambisi wezindaba unquma ngolwazi olutholakalayo ngalowo mzuzu: amakheli, izimbobo, iphrothokholi, izimpawu ze-firewall, ukugeleza okukhonjiwe. Ubukhulu bokugcina bompendulo abukho kulelo qoqo, ngoba abukafiki, futhi lapho umhambisi wezindaba engakala amabhayithi usevele ewathwala. Uma ufuna ukuqondisa ngokomsebenzi, isinqumo kufanele sifudukele endaweni eyazi umsebenzi, futhi uhlu lokuhlola olungezansi lukhombisa ukuthi umklamo wakho unayo leyo ndawo yini.

Kungani umhambisi wezindaba engakwazi ukukala impendulo

Ngesikhathi iphakethe lidinga indlela, umhambisi wezindaba ubone okungenani amaphakethe okuqala okugeleza. Angasho ukuthi ubani ukhuluma nobani, ngayiphi iphrothokholi, ngasiphi isimpawu, futhi kungaki amabhayithi asedlulile. Amabhayithi adlulile achaza okwedlule. Ubukhulu bompendulo yisici sompendulo ongakadalwanga, futhi ezimpendulweni ezihlukanisiwe noma ezisakazwayo kungenzeka kungaziwa ngaphambili.

Ngisho imethadatha yephrothokholi ngokwayo ibuthakathaka kunalokho okubonakala. I-HTTP ivumela izimpendulo ezingamenyezelwanga ubude bazo ngaphambi komzimba, futhi isenzo esisodwa somsebenzisi singakhiqiza izicelo eziningi ezindleko zazo ezihlangene ezingafani nanoma iyiphi inani lekhanda. Ukuthatha ikhanda njengobukhulu bomsebenzi kuyiphutha lokumodela ngaphambi kokuba kube iphutha lokuqondisa.

Ukuhlola 1: ingabe ikhona iphuzu lesinqumo elingakhetha indlela?

Shono ingxenye ezokwenza ukukhetha, bese usho ukuthi yini eyaziyo ngesikhathi sokukhetha. Isibuyekezi esilanda kusethi ebhalisiwe yamakhasimende sazi inhloso yaso ngaphambi kokuqala kokudluliswa. Insizakalo yokulanda ebheka imethadatha bese ivula isicelo yazi umsebenzi ngaphambi kokuba uxhumano lube khona. I-proxy esebenzisanayo ingasebenzisa inqubomgomo yezinga lesicelo noma igcine impendulo kunkinobambo ngaphandle kokuzenza umhambisi wezindaba.

Uma impendulo ithi “isango”, uhlu lokuhlola selwehlulekile. Isango lingahlukanisa ukugeleza okwaziwayo ngendawo okuya kuyo, isimpawu noma ingxenye yeklayenti bese likuthumela endleleni echaziwe kusukela kuphakethe lokuqala, okuvamisile ukwanele isibuyekezi esigunyaziwe futhi akwanele neze ubukhulu bompendulo ongaziwa.

Ukuhlola 2: imethadatha ikutshela ukuthini ngempela?

Ukuqondisa okwazi uhlelo lokusebenza kuhle njengamafildi eliwafundayo. Imithetho yobude bempendulo ku-incazelo ye-HTTP ivumela izimo lapho ubude bungatholakali ekuqaleni, futhi ukufaka ikhodi kokuqukethwe kwenza inani lamabhayithi adlulisiwe lihluke kubukhulu besethulo. Ngakho inqubomgomo eshintsha indlela lapho ikhanda liwela umkhawulo izoziphatha ngendlela engafanayo, futhi ikakhulukazi kukho kanye ukudluliswa okukhulu ebiyelwe ukukubamba.

Okungasekelwa imethadatha yohlelo lokusebenza yisinqumo ngomsebenzi: lo mkhondo womsebenzi uwukuvumelanisa okukhulu, lona kuyasebenzisana, lona ukubuyekezwa kwesofthiwe okuvela emthonjeni owaziwayo. Leyo inqubomgomo ebhalwe ngolimi lwenhloso, futhi izinzile ngokwanele ukuba ihlolwe. “Le mpendulo izoba nkulu kune-megabyte engamashumi amane” akuyona inqubomgomo enjalo.

Ukuhlola 3: ingabe ukugeleza sekukhona?

Ukuqondisa kungashintsha kokugeleza ngaphandle kokushintsha ubunikazi boxhumano, futhi lowo mehluko kufanele ugcinwe uqondile. Uxhumano lwe-TCP lukhonjwa ngamakheli nezimbobo zeziphetho zalo, futhi amaphakethe angathatha enye indlela uma ithebula lokuqondisa lishintsha ngaphansi kwawo. Okungeke kushintshe ngendlela engabonakali isimo sokuhunyushwa kwamakheli enethiwekhi: ukuhambisa ithrafikhi kwelinye iphuma kuvamise ukushintsha i-tuple yomthombo womphakathi, futhi uhlangothi olukude luzobona omunye umlingani ongenasimo esifanayo.

conntrack -L -p tcp --dport 443 | head -5
ip route get 203.0.113.10
ss -tn state established dst 203.0.113.10

Ngakho umthetho osebenzayo uwukuthi ukuhamba phakathi koxhumano usuka kwelinye iphuma uya kwelinye kuwubudlelwano obusha, hhayi ukufuduka. Uma umklamo udinga ukuthi uxhumano olufanayo luqhubeke, isinqumo kwakufanele sithathwe ngaphambi kwe-SYN yokuqala, futhi awukho umthetho wamaphakethe owengezwe kamuva ongayakha kabusha ngokuhlanzekile.

Ukuhlola 4: ingabe isidingo sangempela ukulibaziseka, hhayi iphuma?

Izicelo eziningi kakhulu zokuthi “thumela ithrafikhi yenqwaba kwenye indawo” empeleni izikhalazo zokuthi ukudluliswa okukhulu kwenza umsebenzi wokuxhumana uzizwe unensa. Leyo yinkinga yokuhlela, futhi inempendulo yokuhlela: umugqa onobulungiswa noma inqubomgomo yobubanzi bokudlulisela esekelwayo endleleni ekhona ivimbela ukugeleza kwenqwaba ukuthi kubulale umyalezo wengxoxo ngaphandle kokuhambisa noma yikuphi kwalokhu kokubili.

tc qdisc replace dev eth0 root cake bandwidth 100mbit

Ukubhekana nophawu ngale ndlela kushiya isinqumo sokuphuma lapho inqubomgomo yezokuphepha ikubeke khona, futhi kungabuyiselwa ngomyalo owodwa. Ukushintsha iphuma kuyo yonke ikilasi lethrafikhi ukushintsha kwenqubomgomo okunemiphumela kwezokuqinisekisa, ukuloga kanye nemithetho yokufinyelela, ngakho akufanele kube ithuluzi lokuqala esikhalazweni sokulibaziseka.

Uma isidingo ngempela kuyelinye iphuma le-inthanethi, kusho ngalawa mazwi bese ukusebenzisa emngceleni osekelwayo: uxhumano olusha olusuka kumkhondo womsebenzi ogunyaziwe, noma uhlelo lokusebenza oluvula isicelo salo ngokwalo ngokusebenzisa iphuma elikhethiwe. Bese urekhoda ukuthi yimiphi imisebenzi esebenzisa liphi iphuma, ukuze umuntu olandelayo angadingi ukukuqagela kuthebula lokuqondisa.

Gcina uhlu lokuhlola kurekhodi loshintsho: iphuzu lesinqumo, ifildi noma umsebenzi oyiqhubayo, ukuthi ukugeleza sekukhona yini, nokuthi uphawu olukaliwe kwakuwukulibaziseka noma iphuma. Imibuzo emine, futhi inqubomgomo ephendula yomine iyona ongayisebenzisa esikhundleni sokuyivikela.