I-subneti engezansi ne-VPN yedeskithophu: khipha ukudlula, hhayi izinhlelo
Ukweqa kwesinhlelo ngasinye kuhlukanisa kuphela umphumela wasekhaya. Amadivayisi angemuva kwesiteshi somsebenzi adinga inqubomgomo yawo yokungena, yokudlulisela neyendlela yokubuya.
Umshini owodwa, imisebenzi emibili, i-firewall eyodwa: uxhumano lwe-Wi-Fi oluya phezulu, i-subneti encane ye-Ethernet ngemuva kwayo, neklayenti le-VPN ledeskithophu elicabanga ukuthi konke okuphuma kumshini kungokwasekhaya. Izinhlelo eziqaliswe endaweni ziphuma ngendlela yokuphuma yasekhaya. Amadivayisi angemuva kwesiteshi somsebenzi afika ephothini le-Ethernet futhi adinga isinqumo sokudlulisela. Okukhiphiwe okubhalelwe indlela yokuqala akukaze kubone eyesibili, yingakho isiphequluli sidlula ithuneli kodwa amadivayisi awadluli.
Izindlela ezimbili zamaphakethe, inqubomgomo eyodwa
| Origin | Path | Decision owner |
|---|---|---|
| Application on the workstation | OUTPUT then egress | The VPN app's routing policy |
| Device behind the workstation | PREROUTING then FORWARD | The workstation's own forwarding policy |
Umugqa wokuqala yilokho okuchazwa yimihlahlandlela eminingi ye-split-tunneling. Eyesibili iwukuhlelwa komzila ohleli ngengozi kumshini ofanayo. Ukuhlanganisa kokubili kube umfanekiso wengqondo eyodwa iyiphutha; babelana ngekerneli, hhayi ngenqubomgomo. Dweba zombili izindlela ngaphambi kokuhlela noma yimuphi umthetho, futhi ukwakheka okusele kuvela ekutheni iyiphi indlela engekho.
Ithebula libuye lichaze ukuthi kungani umshini owodwa ungaphasa isivivinyo esisodwa kodwa uhluleke kwesinye. Isiphequluli esiteshini somsebenzi sifakazela indlela yasekhaya; ikhompyutha ephathekayo exhunywe ephothini le-Ethernet ifakazela indlela yokudlulisela. Qinisekisa ushintsho ngakho kokubili, kungenjalo eyesibili ihlala ingahloliwe noma ngabe isiphequluli silayishwa kabusha kangaki.
Okukhiphiwe kwesinhlelo kuhlukanisa ini ngempela
Ukukhipha kwesinhlelo ngasinye ngokuvamile kusebenza ngokuthi kumakwe amaphakethe avela kunqubo noma kumsebenzisi, bese kuthunyelwa ithrafikhi emakiwe ngaphandle kwethuneli. Lokho kuwukwakheka kokuphuma kwasekhaya. Iphakethe elivela kudivayisi engezansi alinayo inqubo yasekhaya, ngakho alikaze lifane nesikhethi, noma ngabe isikhethi siyini.
Noma ngabe isikhethi siyini, izinhlu ezimbili azilona uhlu olulodwa, futhi yilokho okubalulekile. Umhlahlandlela we-Mullvad we-Linux uchaza izimpawu ezisetshenziswa i-firewall yawo nenqubomgomo yokuhamba kwezindiza, futhi izibonelo zawo ziqondise ekukhishweni kwasekhaya; azilona incazelo esekelwayo yomzila ongezansi. Ukuzikopisha kuveza umshini okholelwa ukuthi unokukhiphiwe kuyilapho udlulisela konke ethuneli.
Bhala isivumelwano sokudlula
Qamba ndawonye isiqalo somthombo ongezansi kanye ne-interface yokungena, bese ukhawulela leso siqalo ekungeneni. Ngaphandle komkhawulo, noma yiliphi idivayisi elifinyelela iphothi lingafuna ikheli elikhiphiwe bese liphuma ngokweqa. Kuthatha njengemibuzo emibili: ingabe lawa ma-host angawasebenzisa la maxhumano aphezulu, futhi angafinyelela isiteshi somsebenzi noma izigaba eziyimfihlo zethuneli? Lezi yizimvume ezengeziwe, hhayi imiphumela yohlangothi yokukhetha uxhumano.
Vumela ukudlulisela, bese ukuhlunga. Isango le-Linux lidinga ukudlulisela okuvunyiwe, imithetho evumela ithrafikhi ehlosiwe kuzo zombili izinhlangothi, kanye nomzila wokubuya ophezulu noma ukuhunyushwa komthombo okukhawulelwe ngamabomu. I-NAT iyodwa ayikhethi uxhumano oluphezulu futhi ayiniki indlela yokudlula esihlungwini; ibhala kabusha ikheli kuphela ngemuva kwalezo zinqumo.
Ukuhlukanisa kokudlula kumele kwenzeke ngaphambi kwesinqumo somzila wokudlulisela, okusho isigaba se-prerouting hhayi i-output. Umthetho obekwe ngemuva kwesinqumo usengashintsha iphakethe, kodwa awukwazi ukushintsha lapho iphakethe selithunyelwe khona.
Izimpawu zezomsebenzisi onazo
Amanani ezimpawu, izinombolo zamathebula kanye nokubaluleka kwamaketanga kuyingxenye yenqubomgomo yohlelo lwe-VPN, hhayi izinto ezingaguquki zaphakade. Inethiwekhi ehlala isikhathi eside encike ekufakweni komthetho ethebuleni elakhiwa kabusha olunye uhlelo izophuka ekubuyekezweni okulandelayo, ngokuvamile ngesikhathi sokuxhumana kabusha hhayi ngesikhathi esifanele.
Ukungeza iketanga lesisekelo lesibili ngesinqumo se-accept akusho ukuthi kuzodlula i-drop yeketanga elizayo. Amaketanga esisekelo anamahokhi nokubaluleka, futhi isinqumo sokuqala ngokulandelana siyawina; i-accept kwelinye iketanga ayikhanseki i-drop okufinyelelwa kuyo elinye iketanga kuqala. Bheka isethi ephelele yemitherho nokulandelana kwenqubomgomo yokuhamba, hhayi isibali esisodwa esikhuphukile. Isibali sifakazela ukuthi umthetho wagijima, asikaze sifakazele ukuthi isinqumo sawo yisona esasetshenziswa.
Hlanganisa, noma susa i-subneti
Izinhlelo ezimbili ziyahluka ekutheni ukweqa kungokabani. Ukuhlelwa okuhlanganisiwe kugcina umshini owodwa nenqubomgomo eyodwa, ngezindleko zokuncika emjikerweni wokuphila wamathebula ohlelo lwe-VPN naseqoqweni lezimpawu umbhali walo angazishintsha. Umzila oqondisiwe wenethiwekhi engezansi ususa lokho kuncika ngokuphelele: i-subneti inokuxhumana kwayo okuphezulu, futhi isiteshi somsebenzi sihlala siyiklayenti elingenawo umsebenzi wokudlulisela.
Khetha eyesibili lapho inethiwekhi engezansi kufanele iqhubeke isebenza phakathi kwezibuyekezo ze-VPN, noma lapho kungekho muntu ongahlola inqubomgomo ehlanganisiwe ngemuva kokukhishwa ngakunye. Khetha eyokuqala kuphela lapho ukuhlanganiswa kubhaliwe futhi kunomuntu okunakekelayo.
Qinisekisa umngcele ezimweni ezine: kuxhunyiwe, kuyaxhumana kabusha, kuvinjelwe ngamabomu futhi kumisiwe. Hlola ukuxazululwa kwamagama kanye nemindeni emibili yamakheli kukho ngakunye, ngoba ukweqa okuvuza i-DNS akusona isikhiphiwe obekusihlele. Isivivinyo kufanele sifakazele umngcele onembile, hhayi nje ukuthi ikhasi elilodwa lilayishiwe.