Indlela ukudluliswa kwendawo kwe-SSH okuthwala ngayo iseshini ye-TCP OpenVPN

Lapha izindlela ezintathu zokuthutha ziyahlangana, futhi ngayinye inohlaka lwayo. Umthwalo we-VPN uhamba ngaphakathi kweseshini ye-TLS, leyo seshini ye-TLS ihamba ngaphakathi koxhumano lwe-TCP oluya ephothini ye-loopback, futhi amabhayithi alolo xhumano ahamba ngaphakathi kwe-SSH aya kumsingathi we-relay, ovula uxhumano lwe-TCP lwangempela oluya kumlaleli we-VPN. Akukho okushintsha kulokhu kuhleleka lokho OpenVPN okufakazelayo, futhi akukho okukwenza umlaleli we-UDP afinyeleleke nge-TCP. Funda okusele njengencazelo yomzila wamabhayithi, hhayi njengeresiphi yokugwema ukulawulwa kwenethiwekhi.

Lokho ukudluliswa kwendawo okuhambisa ngempela

Iklayenti le-SSH lilalela ephothini lendawo. Uma inqubo yendawo ixhuma, iklayenti liphinda lihlanganise amabhayithi esiteshini salo esibethelwe, futhi uhlangothi lweseva luvula uxhumano lwe-TCP olusha oluya endaweni eshiwo esicelweni sokudluliswa.

Leyo ndawo ixazululwa yi-relay, hhayi umshini wakho, yingakho igama elikhona kuphela ngaphakathi kwenethiwekhi ekude lisaqhubeka lisebenza. Lokhu futhi kusho ukuthi i-relay kufanele ifinyelele kumlaleli we-VPN futhi ibe nomzila wokubuyela kuwo. Igama elixazululwa kukhompyutha yakho yomuntu siqu alisho lutho mayelana nalokho i-relay engakubona.

Ukuqala iseshini ye-SSH kufakazela kuphela ukuthi i-relay iyafinyeleleka futhi iqinisekisiwe. Akusho ukuthi umlaleli olandelayo uyasebenza, ukuthi i-firewall phakathi kwe-relay nomlaleli iyawamukela uxhumano, noma ukuthi i-VPN izoyamukela iphrofayela yakho.

Qondisa iklayenti kumlaleli wendawo

Isibonelo esimenyezelwe: i-relay ingafinyelela kumlaleli we-TCP ku-gw.internal.example:443, futhi iphothi eliphezulu lendawo liveza lowo mzila kulo mshini kuphela.

ssh -N -L 127.0.0.1:24011:gw.internal.example:443 [email protected]

Incwadi ye-OpenSSH ichaza ukudluliswa kwendawo njengokwamukela izixhumanisi ze-TCP endaweni nokuvula uxhumano olulandayo ohlangothini olukude. Bopha umlaleli ku-loopback hhayi kuzo zonke izixhumanisi, ngoba ukudluliswa okufinyeleleka kunethiwekhi kuyi-relay evulekile enegama lakho. Ukubopha ngesimo esibanzi futhi kuvula iphothi kunoma iyiphi enye i-akhawunti yendawo kumshini owabiwe.

Bese ubeka iklayenti le-VPN kumodi ye-TCP futhi uliqondise ku-127.0.0.1:24011. Uma iphrofayela isebenzisa i-UDP, lo mklamo awukwazi ukusiza: ukudluliswa kuthwala ukugeleza kwamabhayithi, futhi awukho umzila we-datagram kuwo.

Gcina ukufakazela okubili kuhlukene

I-SSH ifakazela umsingathi we-relay. I-OpenVPN isafakazela ozakwabo be-VPN, futhi indawo ye-loopback ayishintshi lolo dingeko. Ukuvala ukuhlolwa kwesitifiketi ngoba isokhethi manje ikhomba ku-localhost kuyisinqamuleli esibi kakhulu kulo mklamo. Kuguqula ukuhleleka kokuthutha kube ukuhleleka kokwethemba, futhi akekho ovumile kwesibili.

Gcina i-ankile yokwethemba yephrofayela, ukuhlolwa kwendima yeseva nokuqinisekiswa kwegama kungashintshiwe. Uma iklayenti lakho liqhathanisa igama leseva nekheli elilifonile, i-loopback ingase idinge isethingi yegama elicacile esikhundleni sokuhlolwa okuvaliwe, futhi imibhalo yephrofayela iyindawo yokuqinisekisa ukuthi iyiphi inkambu eqhathaniswayo.

Thatha i-relay njengohlangothi lwesibili endabeni yokwethemba: umphathi wayo angabona imethadatha yezixhumanisi futhi angaphinda aqondise ukudluliswa uma ukucushwa kushintshwa. Ukuhleleka kudinga imvume evela ku-relay kanye nomnikazi wensizakalo ye-VPN, hhayi kuphela kumuntu oyidingayo namuhla.

Ungakhi umjikelezo ngaphansi komhubhe

Uma i-VPN isifaka imizila, uxhumano lwe-SSH oluyithwalayo lusadinga umzila oluya ku-relay ongadluli emhubheni. Uma umzila ozenzakalelayo uya ku-VPN futhi i-relay ifinyeleleka kuphela ngalowo mhubhe, ukuthutha kuyawa futhi i-VPN ihamba nako. Ukwehluleka kubonakala njengomhubhe owile hhayi njengephutha lomzila, yingakho kuxilongwa kabi.

Isixazululo esivamile umzila womsingathi oya ekhelini le-relay oboshelwe kusixhumanisi esibonakalayo ngaphambi kokuba umhubhe unyuke, kanye nokuhlola ukuthi umzila uyasinda ekuxhumaneni kabusha. Qinisekisa ngokusesha umzila wekheli le-relay esikhundleni sokucabanga ukuthi ukulandelana kwakulungile.

Futhi lindela ukuthi lesi sitaki sizohamba kancane futhi sibe buthaka kunoxhumano oluqondile, ngoba manje kunezindlela ezimbili zokuthutha ezihleliwe kanye nenye indawo yokugcina okufanele igcinwe. Kuyindlela yokuwela umngcele wenethiwekhi, hhayi ubuchwepheshe bokusebenza.

Vala umlaleli uma usuqedile

Misa iseshini ye-SSH uma umhubhe ungasadingeki, futhi qinisekisa ukuthi iphothi lendawo likhululiwe. Ukudluliswa okukhohliwe kushiya umzila oqinisekisiwe uvulekile kumshini ongase wabiwe.

Buyekeza futhi izindawo zokudluliswa ezivunyelwe ze-relay, ngoba ukucushwa okuvumelayo kuguqula noma iyiphi i-akhawunti ehlaselekiwe ibe yindawo yokuxhasa evamile. Bhala iphothi, i-relay nendawo kanye kanye, ukuze umuntu olandelayo azi ukuthi ukudluliswa kwakungenxa yani nokuthi kusavunyelwe yini.