Iphothi yomthombo yeklayenti ngokuqhathaniswa nesilaleli seseva kugeleza kwe-VPN
Qhathanisa izinombolo ezimbili zephothi kumhubhe owodwa: isilaleli esingaguquki seseva nomthombo wesikhashana weklayenti, nokuthi ukuhunyushwa kwerutha kumi kanjani phakathi kwazo.
Izinombolo ezimbili zivela engxoxweni eyodwa, futhi akukho neyodwa ewrong. Ilogi yeseva ibonisa isilaleli esinikela isevisi, ikhompyutha ephathwayo ibonisa isokhethi esithumele idathagramu, futhi irutha ephakathi ingabhalwa kabusha eyesibili lapho iphuma. Ukuqhathanisa iziphetho zengxoxo kuwusizo kakhulu kunokuqhathanisa izinombolo ngokwazo. Ukuqhathanisa okungezansi kuhlukanisa isilaleli, isokhethi yeklayenti nomthombo ohunyushiwe, ngoba ziyaphendula imibuzo ehlukene.
Izinombolo ezimbili ezichaza iziphetho eziphikisanayo
Iphothi elilungisiwe leseva liyindawo lapho iklayenti lishaya khona. Linqunywa yinqubomgomo, liyavela kuphrofayela, futhi kufanele livuleke ohlangothini lweseva. Iphothi lomthombo weklayenti likhethwa endaweni, ngokuvamile kusuka kububanzi besikhashana, futhi likhona ukuze impendulo ibe nendawo yokuhlala. Lingashintsha ngakunye ukuxhumana kabusha, futhi akukho okukudizayini encike ekutheni lihlale lizinze.
Irutha ephakathi ingabhalwa kabusha lowo mthombo kumephu yayo 'NAT'. Yingakho inombolo ebonakala kuseva ivamise ukungabi nobudlelwane nenombolo ekhethwe yikhompyutha ephathwayo.
Kuphi lapho inombolo yomthombo ishintsha khona lapho iphuma
Thatha isibonelo se-IPv4 esiqanjiwe: iklayenti ngemuva kwerutha ehunyushayo, iseva enesilaleli esisodwa se-'UDP', nedathagramu elilodwa elidlula kuzo zombili. Ithebula lisho isiphetho ngasinye nokuthi kwenzekani kuso, esikhundleni sokuphinda kudlalwe iphakethe ezindaweni ezintathu zokubheka.
| Endpoint | What stays fixed | What changes on reconnect | Who owns it |
|---|---|---|---|
| Server listener | The service port and the address the profile names | Nothing; the listener does not follow the client | The server operator |
| Client socket | The destination it dials | The local source port, chosen per socket | The client, or its operating system |
| Translated source | Usually the public address of the router | The port, and sometimes the address after a network switch | The NAT device or the upstream carrier |
Indawo ekuyiwa kuyo ayiguquki kuwo wonke umugqa, futhi kushintsha kuphela ubunikazi bomthombo. Izidingo ze-UDP NAT zihlukanisa ikheli nephothi langaphakathi kumephu yangaphandle, futhi lowo uyiwona mehluko phakathi komugqa wesibili nowesithathu. Irutha ingagcina iphothi lomthombo weklayenti noma likhethe elinye; ukugcinwa akusiyo into okufanele uhlelo luyicabange.
Funda iziphetho ezintathu kusuka kubabungazi ngokwabo
Izinhlu ezingezansi zivela emishinini emithathu ehlukene futhi zihlangene zibonisa yonke ingxoxo. Gijimisa eyokuqala kuseva, eyesibili kuklayenti, eyesithathu noma kuphi lapho imephu ikhona. Umugqa owodwa welogi awubonisi zontathu.
ss -lunp 'sport = :1194'
ss -unp | grep 1194
conntrack -L -p udp | grep 1194Uhlu lokuqala lubonisa ukuthi iseva iboshelwe kuphothi lesevisi futhi libonisa ukuthi iyiphi inqubo engumnikazi walo. Eyesibili ibonisa isokhethi yasendaweni yeklayenti nendawo eyashaywa yilo. Eyesithathu ibonisa imephu eyakhiwe yirutha, futhi yiyona ndawo kuphela lapho kubonakala khona umthombo ohunyushiwe. Zifunde ngalolo hlelo futhi izinombolo ezimbili ziyeke ukubonakala ziphikisana.
Ukuxhumana kabusha kushintshani, futhi kushintshani
Amanye amarutha agcina iphothi lomthombo weklayenti lapho likhululekile, kanti amanye abeka elinye ngakunye. Zombili izimilo zivamile, futhi uhlelo olufuna okokuqala luzophuka kokwesibili. Ukushintsha kwemephu ngemuva kokuxhumana kabusha noma ukushintsha kwenethiwekhi akusona iphutha leseva: iklayenti livula isokhethi entsha, irutha linikeza elinakho, futhi iseva ibona umthombo omusha kusilaleli esifanayo. Iphutha kungaba ukulindela ukuthi iseva yamukele ithrafikhi eqondiswe kuphothi leklayenti engahleliwe.
Amaklayenti e-OpenVPN omphakathi athola le zimilo nge-nobind, evumela uhlelo lokusebenza ukuthi lukhethe iphothi lasendaweni; iphothi elikude lisavela kuphrofayela. Ukubopha ngokusobala isinqumo samabomu, hhayi imfuneko yephrothokholi. Iseva iyaqhubeka nokunikeza isiphetho esisodwa ngenkathi amaklayenti ekhetha ubunikazi bawo basendaweni.
Faka amalebula ezigaba ngokwehlukana kurekhodi
Ngaphakathi komhubhe kunengxoxo yesibili enezimbobo zayo. Isicelo se-HTTPS esithwalwa umhubhe sinendawo ekuyiwa kuyo i-TCP 443, kanti ukuxhumana okubethelwe kwangaphandle kusebenzisa i-UDP 1194, ngakho ukushintsha iphothi lomthombo wangaphandle akushintshi lutho kusevisi yangaphakathi.
Ngisho esigabeni sangaphandle, iphrothokholi ibalulekile. I-UDP 1194 ne-TCP 1194 ziyiziphetho ezihlukene, futhi isilaleli se-'TCP' ngeke sithole idathagramu le-UDP ngoba nje inombolo iyafana. Uma ubhala umqulu wokuthunyelwa, faka amalebula esilaleli seseva, isokhethi yeklayenti nomthombo ohunyushiwe njengezinto ezintathu ezihlukene, futhi ungeze ukuthutha kokunye ngakunye.
Bese uvumela inqubomgomo ilandele izindima. Iseva ivula ukuthutha okuhlosiwe kusilaleli sayo futhi isaqinisekisa osebenza nayo; isivikelo somlilo sekhayenti sivumela izimpendulo ekushintshaneni kwalo okuphumayo ngaphandle kokushicilela isevisi engenayo. Isihlungi esingenasimo sidinga indlela yokubuya ebhalwe ngokucacile, futhi yisizathu esingokoqobo sokuthi lo mehluko ubalulekile ngaphandle kwemidwebo emihle.