Ukuqondisa uhlelo olulodwa nge-VPN ngaphandle kwemishini yonke

Iklayenti le-VPN liyaxhuma, isiphequluli siyasebenza, futhi umyalo owodwa owukhathalele ngempela usaphuma ngoxhumano lwasekhaya. Noma okuhlukile kuyenzeka: ithumbu lithatha umzila ozenzakalelayo futhi iseva yamafayela yasendaweni inyamalala kudesktopi. Ngihlangabezane nalokhu nge-ejenti yokwakha okwakudingeka ifinyelele isibuko se-artifact sangaphakathi ngenkathi ingxenye esele yomsingathi ihlala ku-LAN yasehhovisi, futhi iklayenti lanikeza izinketho ezimbili nje, ithrafikhi yonke noma lutho. Isicelo sifana nhlangothi zombili, lolu hlelo hhayi umshini wonke, futhi iningi lamaklayenti alinayo ibhokisi lokumaka yalokhu, ngoba ithebula lemizila alikaze lazi ukuthi uhlelo luyini.

Kungani ithebula lemizila lingakwazi ukubona uhlelo lwakho

Lapho inqubo ithumela iphakethe, isitaki sibheka ikheli lendawo ekuyiwa kuyo kuthebula lemizila. Akukho igama lefayela elisebenzayo noma imbobo engena kulokho kubheka. Amagama wesizinda ahluleka ngesizathu esifanayo: ithumbu lihambisa ithrafikhi iye ekhelini, futhi lapho igama lixazululwa laba ikheli, ukuhlela umzila ukuphela kwento esetshenziswayo okusele ku-kernel. Yingakho "i-VPN yale sayithi kuphela" ekugcineni isho i-proxy, futhi "i-VPN yalolu hlelo kuphela" isho enye yezindlela ezimbalwa.

Akukho kulokhu okuwumzila ngenqubo. Ngakunye kudlulisela isinqumo ongqimbeni olukwazi ukubona uhlelo, umsebenzisi noma isilungiselelo sohlelo uqobo.

Indawo eyodwa iseyindawo yokuywa, hhayi umthetho wohlelo. Ku-macOS indlela ejwayelekile ukususa uphawu ku "Thumela yonke ithrafikhi nge-VPN" bese wengeza umzila womsingathi: sudo route add -host internal-tuner.example -interface ppp0, bese usususwa ngalokhu sudo route delete -host internal-tuner.example -interface ppp0. Qala ngokufunda igama lesixhumanisi ku ifconfig, ngoba ppp0 kuwumzekelo nje. Ama-wildcard awasebenzi kumzila womsingathi, ngakho isevisi ekhuluma namagama amaningi idinga ingeno eyodwa ngegama ngalinye, futhi umthetho uhlanganisa yonke inqubo emshinini, hhayi leyo obukade uyicabanga.

Bopha isokhethi ekhelini lethumbu

Uma ulawula iklayenti, ukubopha kuyisikhethi esishibhe kakhulu. Isokhethi eboshwe ekhelini lendawo sethumbu iyaphuma ngaleso sixhumanisi uma nje kunomzila wendawo ekuyiwa kuyo lapho, futhi konke okunye emshinini kugcina indlela yako ejwayelekile. Ubuciko bokuthi ukubopha kukhetha ikheli lomthombo kuyilapho ithebula lemizila lisakhetha indlela yokuphuma. Ukubopha kukodwa akuhambisi ithrafikhi engenawo umzila phakathi kwethumbu, futhi yilokho iphutha elingemuva kwemibiko eminingi ethi "ngikubophile kodwa isaphuma ngendlela engalungile".

import socket
s = socket.socket()
s.bind(("10.8.0.2", 0))
s.connect(("build.internal.example", 443))

Amathuluzi asezingeni eliphezulu aveza umqondo ofanayo: curl --interface 10.8.0.2, CURLOPT_INTERFACE ku-PHP kanye nengxoxo source_address kumaklayenti e-HTTP e-Python. Ikheli kumele libe lelethumbo, futhi iphutha lokuthayipha lapha lehluleka njengephutha elijwayelekile lokuxhumana, hhayi njengezikhalazo zomzila. Ukubopha egameni ledivayisi esikhundleni sekheli kuyilungelo le-Linux futhi akudluleli ku-Windows noma macOS, yingakho ama-script aphathekayo edlulisa ikheli.

Linux: fanisa umnikazi, hhayi igama lohlelo

I-kernel ingafanisa umsebenzisi ongumnikazi wesokhethi, ngakho i-akhawunti ezinikezelwe iba yisikhethi. Beka ithumbu kuthebula lalo lemizila bese uthumela kuphela ithrafikhi yalelo khawunti lapho:

ip rule add uidrange 1001-1001 lookup 100
ip route add default dev tun0 table 100

Lokhu kusebenza kuphela uma ithumbu lingakabi umzila ozenzakalelayo. Qala iklayenti nge --route-nopull, noma hlunga ukudluliselwa okucindezelwe nge --pull-filter ignore "redirect-gateway" ku OpenVPN 2.4 nakamuva, bese wengeza ingeno yethebula ngokwakho. Uma kungenjalo zombili izindlela zikhona futhi kuyawina lowo onokubaluleka okuphansi. Inguqulo yamabomu yalokhu ukuqondisa umzila ozenzakalelayo esangweni lethumbu, noma ukukwenza kusukela ku-script yokunqamula: kugcina ithrafikhi ingaphandle kwe-inthanethi lapho ithumbu liwa, kodwa lokho kuyiswishi yokubulala, hhayi isikhethi, futhi ihlala kuze kube umuntu uyisusa.

Inguqulo enamandla kakhulu isikhala samagama senethiwekhi. Yidale, gijimisa iklayenti ngaphakathi, bese uqala uhlelo nge ip netns exec. Akukho lutho ngaphandle kwesikhala samagama olubona isixhumanisi sethumbu, ngakho uhlelo alukwazi ukubuyela emzileni womsingathi ngengozi. Izindleko zingokoqobo: isikhala samagama sidinga ipheya le-veth ukufinyelela inethiwekhi yomzimba kanye nefayela laso lesixazululi, ngoba isikhala samagama sokufaka asabelani izilungiselelo zokuxazulula zomsingathi.

Izindlela ezimbili zokwehluleka zichaza iningi lokuvuza. Ukuxazululwa kwamagama kusenzeka kusixazululi somsimgathi, ngakho umbuzo uphuma ngaphandle kwethumbu ngisho lapho ukuxhumana kwe-TCP kungena ngaphakathi. Futhi i-IPv6 idinga elayo ip -6 rule, ngoba umthetho we-v4 awuyihlanganisi.

Windows ne-macOS: khawulela i-firewall noma nikela nge-proxy

I-Windows nayo ayinayo isikhethi somzila ngohlelo, kodwa imithetho yayo ye-firewall ingakhawulelwa kwiphrofayela, futhi i-adaptha ye-VPN ingahlukaniswa njengeyomphakathi ngenkathi i-LAN yasekhaya ihlala iyimfihlo. Dala imithetho yokuvimba ukuphuma yohlelo kumaphrofayela womuntu siqu kanye nesizinda, shiya owomphakathi uvulekile, futhi uhlelo lungafinyelela inethiwekhi kuphela ngethumbu. Qala ngokusetha isigaba senethiwekhi soxhumano, bese uqinisekisa kufasitela lokuqapha le-firewall ukuthi umthetho uhambisana. Kuwukuvimba, hhayi umzila: kwehluleka kuvaliwe lapho ithumbu liwa, futhi akukwazi ukumisa uhlelo olushaya indiva i-firewall.

I-macOS ilandela umqondo ofanayo ngamathuluzi ahlukile. Isilaleli se-SOCKS esifinyelelwa nge-SSH siyinketho engangeni kakhulu, ngoba ssh -D 1080 user@host sidala imbobo eyodwa yasendaweni futhi izinhlelo ezilungiselelwe ukuyisebenzisa kuphela ezithatha leyo ndlela. Umthetho we- pf ungavimba uhlelo ngomsebenzisi noma iqembu, kodwa awukakwazi ukukhetha ithumbu lalolo hlelo kuphela. I-Tunnelblick ayikwazi ukuhlunga ngesizinda nhlobo, ngoba imizila isebenza ngamakheli; abasebenzisi be-OpenConnect baphendukela ku- vpn-slice lapho iseva ithumela uhlu lwezandiso olubanzi kakhulu.

Izixazululo ezimbili zemboza lokho amathuluzi eplatifomu akushiyayo. Izandiso zesiphequluli ezishintsha i-proxy ngesizinda ziyimpendulo esebenzayo "yale sayithi kuphela", ngoba zisebenza ongqimbeni lohlelo lapho amagama esekhona; zihlanganisa isiphequluli esisodwa futhi akukho okunye. Indlela engahluzekile ukugijimisa iklayenti lomthengisi kumshini wobuciko ukuze isivakashi sibe ngumnikazi wokushintshwa komzila ngenkathi umsingathi egcina indlela yawo, ngezindleko zezitaki ezimbili zenethiwekhi okufanele zigcinwe.

Ukugxuma kwe-SOCKS kwamathuluzi angenayo inketho yokubopha

Iningi lezinhlelo lingaqondiswa ku-proxy ye-HTTP noma ye-SOCKS ngisho zingazi lutho ngezixhumanisi. Iklayenti le-SSH linikeza elilodwa ngaphandle koshintsho ohlangothini lwesiseva:

ssh -N -D 127.0.0.1:9999 [email protected]

Noma yini elungiselelwe ukusebenzisa leyo mbobo iphuma ku-bastion ngenkathi ingxenye esele yedesktopi igcina uxhumano lwayo olujwayelekile. Isibonelo sasendaweni se- 3proxy esiboshwe ekhelini lethumbu senza okufanayo embotsheni eyodwa ngaphandle kwe-SSH, futhi stunnel sihlanganisa imbobo eyodwa esongwe nge-TLS. Imikhawulo ingokoqobo: i-proxy ithwala kuphela izivumelwano ezikwazi ukuyisebenzisa, i-UDP idinga ukuhlangana kwe-UDP ye-SOCKS5 okungayivuli isilungiselelo se- "SOCKS5" samaklayenti amaningi, futhi i-DNS kumele ixazululwe yi-proxy (socks5h ku-curl) kungenjalo igama liyavuza ku-solver yasendaweni.

Gcina isilaleli ku-loopback ngaphandle uma omunye umshini uyasidinga.

Qinisekisa indlela ngokubamba, hhayi ngomlayezo wesimo

Amawindi esimo sohlelo achaza isilungiselelo, hhayi iphakethe. Bhamba ithrafikhi kuzo zombili izixhumanisi bese uqhathanisa:

tcpdump -i any -n port 443
ss -tnp | grep 443

Uma ukuxhumana kuvela esixhumanisini somzimba ngaphandle kwengeno ehambisanayo ethumbini, isikhethi asisebenzi, noma iklayenti libika ini. Hlola i-IPv6 nesixazululi ngokwehlukana, futhi ufune enye indlela njengenqubo yosizo noma i-proxy yohlelo elizuzwe njengelifa.

Bese ukhetha umngcele ohambisana nemfuneko: i-proxy yanele isayithi eyodwa, umthetho we-UID wanele i-akhawunti eyodwa, iphrofayela ye-firewall yanele lapho ukuxhumana kumele kwehluleke kuvalelekile, futhi isikhala samagama ukuphela kwendlela efihla ithumbu kukho konke okungaphandle kwayo.