Indlela ye-blackhole ne-kill switch ye-VPN: yini eyenza ngayinye
Indlela ye-blackhole ilahla ithrafikhi ehambisanayo futhi iphoqelela indlela evaliwe lapho yehluleka. Qhathanisa ububanzi bayo nezindawo ezingabonakali ne-kill switch esekelwe ekuhlungeni amaphakethe.
Iphakethe lishiya ikhompyutha ephathwayo, alifiki neze esangweni le-VPN, futhi asikho isibali se-firewall esinyakazayo. Ithebula lemizila selivele linqume isiphetho sephakethe: ukufakwa kwe-blackhole kwahambisana nalo futhi i-kernel yalilahla ngaphambi kokuba noma iyiphi i-interface ilibone. Lokho kuziphatha kuwusizo lapho indawo okufunekayo kufanele yehluleke ngendlela evaliwe, kodwa kuyisenzo sokuhlela umzila esinobubanzi obuncane. Ukulithatha njenge-kill switch ephelele yilapho imiklamo iphambana khona.
Yini isenzo sokulahla esihambisana nayo ngempela
Ukusesha umzila kukhetha ithebula, bese isijobelelo eside kakhulu esihambisanayo kulo. Umzila we-blackhole ukuwukufakwa okuvamile okwesenzo salo ukulahla, ngakho uthinta kuphela amaphakethe ebezizokhetha lokho kufakwa ngemuva kwesinqumo sonke. Shintsha ithebula ngomthetho wenqubomgomo, noma engeza isijobelelo esithile kakhulu, futhi ukulahla akusasebenzi.
Yingakho ububanzi be-blackhole bunembile futhi kulula ukubusho: buhlanganisa isijobelelo, ethebuleni, salolo mkhakha wamakheli. Abuhlanganisi indawo okufunekayo ezoyinqoba elinye ithebula, futhi abuhlanganisi i-IPv6 ngenxa nje yokuthi isijobelelo se-IPv4 silahliwe.
ip route get ibonisa isinqumo ngaphambi kokuthi usebenzise noma yini, kufaka phakathi ithebula nohlobo lomzila. Ukufunda lokho kokuphuma kushesha kunokuqagela kusuka esicelweni esihlulekile ukuthi yimuphi umthetho noma isijobelelo esisebenzile.
I-blackhole ayifani ne-unreachable noma i-prohibit
I-Linux inikeza izinhlobo ezintathu zomzila ezifana nokulahla, futhi ziyahluka kulokho umthumeli akubonayo. I-blackhole ilahla iphakethe ngaphandle kwempendulo, ngakho iklayenti libona ukuphela kwesikhathi. Umzila we-unreachable ubuyisela umyalezo we-ICMP unreachable, ngakho ukuxhumana kwehluleka ngokushesha ngephutha lomsingathi noma lenethiwekhi. Umzila we-prohibit ubuyisela iphutha lokuvinjelwa kokuphatha, okuseduze nokwenqatshwa kwenqubomgomo ngamabomu.
Khetha indlela yokuziphatha ofuna uhlelo luyibone. Ukulahla buthule kufanele lapho ungafuni ukuveza inqubomgomo, futhi iphutha elisheshayo lingcono lapho abasebenzisi kudingeka baqonde ukuthi kungani indawo okufunekayo ingatholakali. Ukuhlanganisa izinhlobo kuyo yonke inethiwekhi kukhiqiza amathikithi okusekela achaza inqubomgomo eyodwa njengamaphutha amathathu ahlukene.
Ungacabangi ukuthi konke ukufakwa kokulahla kuyashintshana lapho uhlola ukuxhumana. Umbhalo wephutha, isikhathi nokubanjwa kwamaphakethe kuyahluka, futhi uhlobo lomzila ethebuleni lukutshela ukuthi yikuphi okubhekile. incwadi ye-ip-route ibala izinhlobo nokuziphatha kwazo lapho kwenzeka iphutha.
Iqhathaniswa kanjani ne-kill switch
I-kill switch iwukuhlunga amaphakethe: umthetho we-firewall olahla ithrafikhi ephumayo ebingaphuma ngaphandle komhubhe. Umzila we-blackhole yisinqumo sokudlulisela esithathwa ngaphambili ku-stack. Kokubili kungamisa ithrafikhi, kodwa kubona izinto ezahlukene futhi kweqe izimo ezahlukene.
| Mechanism | What it blocks | What it misses | How failure looks |
|---|---|---|---|
| Blackhole route | Destinations matching the prefix and table | Other tables, other address families, traffic with a different route | Silent timeout |
| Firewall kill switch | Egress not bound to the tunnel interface | Rules that are too broad can break the endpoint or DHCP | Dropped packets with counters |
| WireGuard AllowedIPs | Destinations not routed into the interface | Traffic that never enters the interface at all | No tunnel route, direct egress |
Ububanzi yilapho ukuqhathanisa kubalulekile khona. I-firewall ingahambisana nomnikazi, imbobo noma i-interface futhi ivimbe uhlelo ngesikhathi iphuzu lokugcina lisefinyeleleka; umzila awukwazi lokho. Ngokuphambene, umzila ungathumela isijobelelo sonke ekulahleni ngaphandle kokulayisha noma isihlungi samaphakethe, okusiza ohlelweni oluncane.
I-AllowedIPs ye-WireGuard iwukuhlela ngokhiye we-cryptographic, hhayi i-firewall. Inquma ukuthi yiziphi izijobelelo zendawo okufunekayo ezamukelwa ku-interface, futhi iphrofayela ebala kuphela isubneti yomhubhe ishiya ezinye izindawo emzileni ojwayelekile wokuzenzakalela. Yingakho amaphrofayela omhubhe ophelele esebenzisa i-0.0.0.0/0 nokuthi kungani i-wg-quick ibuye ifake imithetho ye-firewall lapho ikwazi.
Gcina iphuzu lokugcina lomhubhe lingaphandle kokulahla
Ikheli langaphandle lephuzu lokugcina kufanele lihlale lifinyeleleka ngokusebenzisa i-interface yomzimba. Ukulahla okubamba nalelo kheli kuvimbela ukuxhawulana ukuthi kuphume, futhi umhubhe awukhe wenyuka, okubonakala njengokwehluleka kwe-VPN hhayi inqubomgomo yokuhlela umzila. Hlola umzila oya ephuzwini lokugcina ngaphambi nangemuva koshintsho.
Ukufinyelela kokuphatha kukulo mhlahlandlela ofanayo. Uma indlela eyodwa kuphela eya kumzila noma kuklayenti ingumhubhe, ukulahla okubanzi kakhulu kungakuvalela ngaphandle emshinini obekungakuvumela ukuthi uwususe. Gcina umzila obhaliwe ongaphandle kwebhendi, ikhonsoli noma ukubuyiselwa okunesikhathi.
I-IPv6 idinga ukufakwa kwayo nokuhlolwa kwayo. Umklamo olahla i-IPv4 ku-blackhole kuyilapho ushiya i-IPv6 emzileni wokuzenzakalela udlulisa ngqo leyo thrafikhi inqubomgomo ebilindele ukuyimisa, futhi iphutha alibonakali ekuhlolweni kwe-IPv4 kuphela.
Yethula ngezigaba ngokuthi kusetshenziswe isikhathi nokubuyiselwa
Sebenzisa umzila ngokususwa okuzenzakalelayo okufushane ukuze iphutha lingahlali ngemuva kokuqalisa kabusha. Imiyalo engezansi isebenzisa ibanga ledokhumenti; libuyisele ngesijobelelo umklamo wakho owulahlayo ngempela:
sudo ip route replace blackhole 10.0.0.0/8
ip route get 10.1.2.3
sudo systemd-run --on-active=60 /sbin/ip route del blackhole 10.0.0.0/8Umyalo wesibili kufanele ubike umzila we-blackhole nokuthi ithebula elivela kulo. Owesithathu uhlela ukususwa kungemva komzuzu owodwa, okuyisikhathi esanele sokuqinisekisa inqubomgomo futhi kufushane ngokwanele ukululama ephutheni kumsingathi okude. Lapho ukuziphatha sekuqinisekisiwe, yenza ukufakwa kube okungapheli ngokusebenzisa ukuphathwa kokumiswa okufanayo okuphethe eminye imizila.
Vala ushintsho ngokurekhoda isijobelelo, ithebula, umkhakha wamakheli nendlela yokubuyiselwa. Ukulahla kuwukuhluka ngamabomu emklamweni wokuhlela umzila, futhi unjiniyela olandelayo udinga ukwazi ukuthi iyiphi ithrafikhi obekufanele uyimise ngaphambi kokunquma ukuthi isakufanele yini lapho.