Ungayikhetha kanjani iKlayenti ye-Mac VPN Yesango Osuvele Unalo

Izinhlelo zokusebenza eziyisithupha ze-Mac VPN zivela ekhasini lokulanda futhi akukho neyodwa yazo ethi iyiphi isango lomqashi wakho elizokwamukela. Lokho akusona igebe esitolo; kuyigebe ku-handoff. I- SSL VPN iwumndeni womkhiqizo, hhayi umthetho olandelwayo, ngakho-ke amasango amabili anezikrini zokungena ezifanayo angadinga amaklayenti ahlukene. Nali i-oda engilisebenzisayo lapho othile enginika i-Mac nekheli leseva: thola ukuthi isango likhuluma ini, khetha iklayenti elifana nalo, bese uqinisekisa imizila futhi DNS ngaphambi kokuthi uthembe umhubhe ngomsebenzi.

Qala ngesango, hhayi isitolo sohlelo lokusebenza

Uhlelo lokusebenza lusebenza ku-Mac yakho, kodwa okunye kufanele kwamukele uxhumano futhi kunikeze ukufinyelela: isango elino-opharetha, ikheli, izilungiselelo ezihambisanayo kanye nendlela yokukugunyaza. Iklayenti lamahhala lingaba isofthiwe enhle futhi linganikezi neyodwa yalezo zinto. Ukufinyelela emsebenzini, isango lasekhaya kanye ne-inthanethi yezohwebo izindawo zokuqala ezihlukene ezenzeka ukwabelana ngekhasi lokulanda.

Ngaphambi kokufaka noma ukushintsha noma yini, thola izimpendulo ezine kunoma ubani osebenzisa isevisi:

• Imodi yokufinyelela: ingosi yesiphequluli, ukufinyelela kohlelo lokusebenza olukhethiwe noma umhubhe wenethiwekhi ogcwele. Lokhu kunquma ukuthi uyalidinga yini iklayenti nhlobo.

• Umndeni wesango kanye nokukhululwa okusekelwayo: umkhiqizo, isevisi enikwe amandla kanye nenguqulo yeklayenti esasekela i-macOS yakho yokwakha kanye nehadiwe ye-Mac.

• Ukuqinisekisa: iphasiwedi kanye MFA, ukungena ngemvume kwesiphequluli, isitifiketi sedivayisi noma ukuhlola ukuma. Iklayenti elingenakho ukugeleza okugunyaziwe lizoxhumeka bese lenqatshwa.

• Ubunikazi: ukulanda okuthenjwayo noma umthombo wokuphatha, iphrofayela ehlosiwe nokuthi ubani oyisekelayo uma iphuka.

Ubunikazi yinto abantu eyeqayo. Ku-Mac ephethwe iphrofayili ivamise ukufika ngohlelo lokuphatha lwenhlangano, futhi ukucushwa okwakhiwa ngesandla kungashintshwa ekungeneni okulandelayo. Buza ukuthi ingabe ulindeleke ukuthi uzifakele noma yini ngaphambi kokuthi uyofuna uhlelo lokusebenza lwenkampani yangaphandle.

U-SSL VPN ilebula lomndeni, hhayi umthetho olandelwayo

I-TLS ingavikela uxhumo kuyilapho ukushintshanisa okuqondene nomkhiqizo ngaphakathi kwayo kusingatha ukungena ngemvume, ukwabiwa kweseshini kanye nethrafikhi yomhubhe. Lokho kushintshisana kwangaphakathi yilokho iklayenti okufanele likusebenzise. Isiphequluli esifinyelela kusango elithi HTTPS ikhasi lokungena lifakazela uchungechunge lwesitifiketi kanye neseva yewebhu; akufakazeli ukuthi uhlelo lokusebenza lwe-VPN olungahlobene lungakha umhubhe emshinini ofanayo.

OpenConnect uwumfanekiso ocace kunawo wonke engiwaziyo. Yakho amadokhumenti akhuphukayo ibala amamodi ephrothokholi ahlukene emindeni yamasango ahlukene futhi ihlukanise ukusebenzisana nosekelo lomthengisi olusemthethweni. Uma wonke u-SSL VPN ekhuluma iphrothokholi eyodwa, lezo zindlela zizobe zingadingeki.

Iphrofayela ethi OpenVPN inomkhawulo ofanayo ngenye indlela: iyifomethi yokungenisa yokuthunyelwa okuhambisanayo kokuthi OpenVPN. Ukwabelana ngo-TLS njengebhulokhi yokwakha akuliguquleli libe ifayela lokumisa lesango lebhizinisi elingenamthetho. Kungakho ukungena ngemvume kwesiphequluli esisebenzayo kuwukuphozithivu okungamanga: ukufinyelela kwengosi kungaphumelela kuyilapho ungekho umhubhe, futhi umhubhe ovelayo usenganqatshwa ukuhlolwa kokuma kamuva.

Qondanisa iklayenti nalokho okushiwo yisango

Lapho umndeni usuwaziwa, ukukhetha kuncipha ngokushesha. Lena imephu engiyihlola kuqala, futhi ikholomu yokugcina ibaluleke ngaphezu kwanoma yisiphi isilinganiso sohlelo lokusebenza.

Imigqa emibili ifanelwe isexwayiso. Iklayenti elakhelwe ngaphakathi elithi macOS liwukusebenzisa kwangempela kokuthi IKEv2, akulona iklayenti elejwayelekile elithi SSL VPN: isevisi eyakhelwe lona idinga iphrofayili efanele, ubunikazi beseva obulindelwe kanye nemininingwane, futhi emshinini ophethwe leyo phrofayela ingase ikhiyelwe phansi. I-OpenConnect ihlanganisa izivumelwano ezimbalwa zabathengisi ezivela kanambambili eyodwa, kodwa iphrojekthi yayo ayifuni ukwesekwa komthengisi; ukuskena komsingathi, imithetho yomhubhe ohlukanisiwe ophushwe esangweni noma ukugeleza okuthile kokuthi SSO kungase kube khona kuklayenti lomthengisi kuphela.

WireGuard unomumo ofanayo. Isevisi ihlinzeka kontanga, iklayenti lihlinzeka ngomhubhe, futhi iphrofayili ethi OpenVPN ayithathi indawo. One macOS wrinkle: iklayenti le-App Store ligcina imigudu yalo ngaphakathi a Network Extension, ukuze wg show kusuka kumathuluzi we-Homebrew angakwazi ukubika lutho ngenkathi isixhumi esibonakalayo siphezulu. Qinisekisa ngemizila nethrafikhi esikhundleni salokho.

Lungiselela, bese uqinisekisa ngohlelo olungaguquki

Faka iklayenti elilodwa kanye nephrofayela eyodwa, futhi ugcine inothi yalokho okushintshile. Ngaphambi kokuxhuma, thwebula isisekelo ukuze wazi ukuthi umhubhe ushintsha ini:

scutil --nc list
networksetup -listallnetworkservices
netstat -rn | grep -E "^default|utun"
scutil --dns

Xhuma nephrofayili enikeziwe bese uphinda imiyalo efanayo. Ukuze uthole umhubhe ogcwele umzila ozenzakalelayo kufanele ubheke kusixhumi esibonakalayo esingu-utun; ngokuhlukanisa umhubhe iziqalo zangaphakathi kuphela okufanele zihanjiswe futhi ukuphuma kwakho esidlangalaleni kufanele kubukeke kungashintshile. U-DNS uwuhhafu ovame ukuhlala uphukile: scutil --dns ubala izixazululi ngokulandelana kwazo uhlelo oluzozisebenzisa, futhi isixazululi sangaphakathi esihlezi ngaphansi kwesosesidlangalaleni sizothumela amagama angaphakathi kuseva engalungile.

Ensizakalweni ethi OpenVPN, Tunnelblick iklayenti elinengqondo elingenazindleko, futhi umhlahlandlela walo uqondile mayelana nengxenye engekho: ayinikezi isevisi ethi VPN. Chofoza kabili ku-.ovpn owunikiwe, vumela u-Tunnelblick ayifake, futhi hlola ukukhishwa ngokumelene nenguqulo yakho ye-macOS ngaphambi kokuthi uthembele kuyo.

Ngesango lomthengisi ngivame ukuhlola ngo-OpenConnect kusuka kumugqa womyalo:

brew install openconnect
sudo openconnect --protocol=anyconnect --user=you vpn.example.com

Ithuluzi liphrinta isitifiketi esisitholile futhi liyalinda ngaphambi kokwethemba iketango elingaziwa; lokho kwaziswa kuyisici, futhi ukuphina ngokuthi --servercert pin-sha256:... kungcono kunokwamukela isexwayiso ongasifundanga. Ctrl-C ubhidliza umhubhe, ngoba i-openconnect yangaphambili ayinaso isishintshi sokubulala futhi ayinakho ukuxhuma kabusha okunengqondo. Lokho kulungile ngeseshini yokuxilonga kanye nokuzenzakalelayo okungalungile komsebenzi wansuku zonke.

Lapho lingekho isango lokufanisa

Abanye abantu bafika nenkinga ephambene: akukho opharetha, akukho kheli, akukho sevisi. Uhlelo lokusebenza lwamahhala lwe-Mac alukwazi ukudala ukufinyeleleka kwangaphakathi kumzila wasekhaya. Uma ufuna inethiwekhi yakho ehhotela, othile kufanele avule isango ekhaya, aligcine linezichibiyelo, ashicilele noma axazulule ikheli lalo futhi anqume ukuthi imaphi amadivayisi afinyelelekayo.

Uma ufuna ukuphuma kwe-inthanethi okuhlukile kunokufinyelela kunethiwekhi yangasese, khetha isevisi ngaphambi kweklayenti. Uhlu lwephrofayela olungenalutho kuklayenti elizimele ngokuvamile alikona ukubhalisa kwamahhala okuphukile; kungase kungabikho ukubhalisa futhi kungabikho neseva enamathiselwe. Gcina izindleko zihlukene futhi: ilayisensi yeklayenti, uhlelo lwesevisi kanye nesango elizisebenza ngokwalo kuyizinto ezintathu ezihlukene zokuthenga.

I-Mac yomsebenzi ingeza isendlalelo senqubomgomo. Uhlelo lokusebenza olungakhokhisi lungaba nephutha ngisho nalapho luxhumeka, ngoba iklayenti eligunyaziwe lingase liphoqelele ukuhlolwa kwedivayisi noma ukugeleza kokuqinisekisa okunye okushodayo. Cela enye indlela egunyaziwe esikhundleni sokukopisha izifakazelo phakathi kwezinhlelo zokusebenza ezingahlobene, futhi ungathathi ukukhubaza ukuvikela kwenkundla njengokulungisa ukuhambisana.

Isibukeli sedeskithophu esikude siwumkhiqizo ohlukile futhi. Ikubonisa iseshini kwenye ikhompuyutha; ayiziniki izinhlelo zakho zokusebenza zasendaweni ze-Mac indlela yenethiwekhi ehlinzekwa wumhubhe.

Uhlu lokuhlola olufushane ngaphambi kweseshini yokuqala yangempela

Yisho umndeni wesango kanye nemodi yokufinyelela ngokubhala, faka kuphela iklayenti elifana nawo, bese urekhoda iphrofayela oyisebenzise. Bese uqinisekisa izinto ezintathu ngethrafikhi yangempela: imizila efakwe umhubhe, i-oda lesixazululi, kanye nohlelo lokusebenza lwangaphakathi olulodwa olufinyelelwe ngegama esikhundleni se-IP.

Uma okuthile kwehluleka, shintsha okuguquguqukayo okukodwa ngesikhathi: iklayenti, iphrofayela, ukugeleza kwe-auth. Ingosi elayishayo ngenkathi umhubhe wenqaba ukuqala ihlukanisa inkinga yeseva yewebhu kweyokusebenzisana neklayenti. Uma insizakalo yomsebenzi isiphendulile nendlela yomphakathi iziphatha ngendlela elindelekile, unelungiselelo eliqanjwe igama, elisekelwayo esikhundleni senqwaba yokuqagela.