I-HTTP proxy, i-SSH tunnel noma i-VPN: khetha isendlalelo esifanele

Buza onjiniyela abathathu ukuthi kufinyelelwa kanjani isevisi yangaphakathi futhi uzothola amadizayini amathathu: i-proxy yewebhu, i-SSH tunnel noma i-VPN ephelele. Womathathu bangafinyelelisa isevisi ekude, futhi womathathu bangenza ithrafikhi ibonakale sengathi ivela kwenye indawo. Umehluko uvela kamuva, lapho iphrothokholi esetshenziswayo kungeyona leyo ithuluzi elikhethiwe elicabangayo. Idizayini edlula ukuhlolwa okusheshayo kusiphequluli ivamise ukwehluleka kuhlelo lokusebenza olwadala isicelo.

Nquma ngamaqiniso amabili: yimiphi imiphrothokholi okufanele yeqe, nokuthi ubani ongaxazulula amagama athintekayo. Konke okunye ukuthanda.

I-proxy ihambisa kuphela lokho eyokuqonda

I-proxy yewebhu ihlaziya iphrothokholi eyakhelwe yona. Iklayenti iyinika isicelo futhi iyadlulisa leso sicelo, ngakho uhlelo lokusebenza olungenaso isethingi se-proxy aluhlanganyeli nhlobo. Ku-HTTPS iklayenti idinga isiteshi esingabonakali, esinikezwa i-proxy nge-CONNECT kunokuba ifunde isicelo.

Ukudlulisela okuguquguqukayo kwe-SSH kuvula imbobo yasendaweni ekhuluma i-SOCKS, futhi leyo mbobo idlulisa ukugeleza kwe-TCP kuyo yonke indawo eshiwo yiklayenti. Amaphrothokholi akhelwe phezu kwe-TCP ngokuvamile ayasebenza ngayo. I-UDP ayisebenzi, ngaphandle uma ithuluzi lengeza ukusekelwa ngokusobala. Ukudlulisela kwasendaweni kuncane nakakhulu: imbobo eyodwa yasendaweni ekhonjwe kumsingathi nembobo eqondile eyodwa, esebenzela isevisi eyodwa eyaziwayo futhi akukho okunye.

ssh -D 1080 user@bastion
ssh -L 8443:fileserver.internal:443 user@bastion

I-VPN ihambisa amaphakethe. Konke iklayenti elikuhambisayo lingene emhubheni kuyadlula, kuhlanganise ne-UDP ne-ICMP, yingakho ifanele isidingo senethiwekhi kunokuba ifanele uxhumano olulodwa.

Kufanele kube khona oxazulula igama

Lapho igama eliqondiwe likhona kuphela ku-DNS yenethiwekhi ekude, umshini owenza uphenyo kufanele ukwazi ukubona leyo zoni. I-proxy yewebhu yenza uphenyo ngokwayo, ngakho igama langaphakathi liyasebenza ngayo ngisho noma ikhompyutha engayixazululi nhlobo. I-SOCKS nayo ingaziphatha ngendlela efanayo, kodwa kuphela uma iklayenti idlulisa igama esikhundleni sokuxhuma kukheli eselivele ilixazulule. Lokho kukhetha kuseklayenti, hhayi kuseva.

I-curl ikhombisa ukuhlukanisa ngokucacile: ifulegi elilodwa lidlulisela igama lomsingathi ku-proxy, elinye lilixazulula ngokwasendaweni kuqala. Ngokuxazululwa kwasendaweni, igama langaphakathi kuphela liyahluleka ngaphambi kokuba kuthintwe noma yimuphi umhubhe, futhi iphutha lisola i-proxy ngento okwakuyisinqumo se-DNS ngempela.

I-VPN ithatha indlela yesithathu ngokufaka isixazululi esiyimfihlo nesizindalwazi sokusesha eceleni kwemizila. Lokho kulula, futhi kwakha inkohliso ejwayelekile: umzila okhona onesixazululi esingaphenduli ubonakala njengomhubhe ofile, nakuba amaphakethe efika ngaphesheya.

Lapho inethiwekhi ivumela ukuphuma okukodwa kuphela

Amanethiwekhi amaningi ezinkampani avumela ukuxhumana okuphumayo kuphela nge-proxy yewebhu eqinisekisiwe. OpenVPN ne-SSH kungasetshenziswa kokubili lapho, eyokuqala ngokwenza umhubhe wokuthutha kwayo nge-proxy, eyesibili ngomyalo we-proxy osebenzisa umsizi omncane we-CONNECT.

Imihubhe eyakhelwe ku-TCP iyasinda kuleso sithiyo, kanti i-VPN esekelwe ku-UDP ayisindi, okuchaza izilungiselelo eziningi ezisebenza ekhaya futhi zehluleke ehhovisi. Izindleko zesibili kulula ukuzishaya indiva: umhubhe we-TCP othwelwe ngaphakathi koxhumano lwe-TCP oludlule ku-proxy manje unezingqimba ezimbili eziphinde zithumele, futhi ngaphansi kokulahlekelwa lokho kubhangqa kuyama ngendlela okungekho ngqimba eyodwa eyikhiqizayo iyodwa.

Ukuxhumanisa abalamuli kuwumbuzo ohlukile ekukhetheni ingqimba. Ukwengeza i-proxy yesibili noma i-Tor kushintsha ukuthi ubani abona ini, futhi indawo ekuchungechungeni inquma ukuthi yikuphi ukweqa okubona umbhalo oguqulelwe ngemfihlo.

Ukulandelana kubaluleke kakhulu kunenani lokweqa. Ukweqa kwangaphandle kubuka ukugeleza okubethelwe kuyilapho okwangaphakathi kubona umbhalo osobala okuthwelwayo, ngakho uchungechunge luyimfihlo kuphela ngokwekhonco lalo elinganaki kakhulu. Ukuxuba amaphrothokholi phakathi kokweqa akukuthuthukisi lokho ngokuzenzakalela. Ikakhulukazi kwenza izimo zokwehluleka zibe nzima ukucabanga ngazo.

Ikheli lokukhohlisa akusilo olunye lwezinketho

Ukwakha amaphakethe ngekheli lomthombo womunye umuntu akuzuzi lutho oluwusizo: izimpendulo ziya kumnikazi wangempela, futhi amanethiwekhi amaningi ayilahla ngqo ithrafikhi. Umxhumanisi uyadingeka ngoba umthombo awukwazi ukuqanjwa, futhi leso yisizathu esithembekile sazo zontathu izinhlelo.

Futhi kukhawulela lokho ngamunye wabo angakusho. Ukubonakala sengathi usuka kukheli elithile kuwumbuzo wokuthi lelo kheli labelwe ngokusemthethweni kuphi nokuthi ubani angalihambisa, hhayi mayelana nokuthi iyiphi ithuluzi engakhohlisa isihloko. Uma idizayini icabanga okunye, umcabango uyahluleka kumhlinzeki wokuqala oyihlungayo. Bhala phansi umcabango ukuze ukwehluleka kubonakale lapho kufika.

Nquma ngamaphrothokholi namagama

Sebenzisa i-proxy lapho iklayenti yewebhu eyodwa idinga isevisi yewebhu eyodwa futhi inezilungiselelo ze-proxy. Sebenzisa umhubhe we-SSH lapho izevisi ezimbalwa ze-TCP ezaziwayo zanele futhi ukufinyelela kwe-SSH sekukhona. Sebenzisa i-VPN lapho izinhlelo eziningi, ithrafikhi engeyona ye-TCP, i-DNS eyimfihlo noma indlela esetshenziswa kabusha kuyingxenye yesidingo.

Bese uqinisekisa ngeklayenti yangempela nangegama langempela. Ukulayisha ikhasi nge-proxy akukufundisi lutho nge-UDP, futhi ukwenza ithuluzi elilodwa lisebenze nge-SOCKS akukufundisi lutho ngesixazululi sohlelo. Funda ukuthi iyiphi ikheli lasendaweni eliboshwe inqubo nokuthi yisiphi isixazululi esiphendulile. Lowo umehluko phakathi kwendlela esebenzayo naleyo eye yasebenza ngengozi kanye.