Ingabe i-tunnel ephelele ilula kunezinhlu ezinde ze-split-tunnel?

Uhlu lwe-split-tunnel luqala ngezinhlelo ezintathu futhi lugcine luhlinzeka ingxenye enkulu yomshini, futhi umugqa ngamunye omusha uyisihluzo sothile. Ngaleso sikhathi uhlu seluphenduke i-default enezinyathelo ezengeziwe ngokuthula. I-tunnel ephelele iguqula ukuhlelwa: konke kungena ku-tunnel ngaphandle uma isihluzo esibhaliwe sisho okunye. Ukuthi lokho kulula yini kuncike ku-gateway nakumasevisi endawo ongawaphula.

Qala ngokubala imithetho oyigcinayo

Bala okufakiwe, bese ubala ukuthi kungaki okunomnikazi oqanjiwe nosuku lokugcina okuqinisekiswa ngalo. Inombolo yesibili iyona ebalulekile, ngoba isihluzo esingenamnikazi asikwazi ukuhlolwa lapho isoftware esiyikhomba sishintsha igama noma sikhishwa esikhundleni. Imithetho eboshelwe endleleni yefayela elisebenzayo iyahluleka ngokuthula ngemva kokubuyekezwa, futhi ukuhluleka kubonakala njenge-VPN engazinzile hhayi njengomthetho osuphelelwe yisikhathi. Bhala uhlu phansi ngaphambi kokuba ube nombono ngalo.

Okufakiwe ngakunye kufanele kuphendule imibuzo emithathu: yini ephukayo ngaphandle kwayo, ubani onqume lokho, futhi uzokubona kanjani uma isizathu siphelelwe yisikhathi. Okufakiwe okungakwazi ukuphendula yomithathu kungabangaba abafanele ukususwa hhayi ukufuduswa, futhi ukukususa kuqala kwenza ukuqhathanisa kwakamuva kube nokwethembeka.

Uma okuningi okufakiwe kuhambisa ingxenye enkulu yethrafikhi, usuvele usebenzisa i-tunnel ephelele enomthwalo wokunakekela. Isinqumo-ke simayelana nokuthi i-default ihlala kuphi, hhayi ukuthi kufanele ibe khona yini.

Hlola ukuthi i-gateway ingayithwala yini i-default

I-tunnel ephelele ihambisa iphakethe ngalinye iye kudivayisi eyodwa, lokho kushintsha ngesikhathi esisodwa umthwalo we-CPU yaleyo divayisi, ithebula le-conntrack, ukuhunyushwa kwamakheli kanye nesidingo se-bandwidth ephezulu. I-gateway eyayikhonza ngokukhululeka ama-subnet ambalwa angaphakathi ingase ingakalwa ukuba ikhonze ukuphequlula konke komsebenzisi oyedwa. Bheka inani elikhulu kakhulu lamaseshini ngesikhathi esisodwa olindelelo, hhayi isilinganiso, ngoba umvuthwandaba uwona ophuka kuqala.

ip -s link show dev tun0
conntrack -C
ss -s

Linganisa umthwalo womsebenzi ofanayo ngaphambi nangemva koshintsho esikhundleni sokuphikisana ngokusuka kuzincazelo. Intambama eyodwa yokusetshenziswa okuvamile kumsihini owodwa izobonisa ukuthi i-gateway iseduze nomkhawulo yini, futhi akubizi lutho uma kuqhathaniswa nokukuthola ngolwesiHlanu ekuseni.

Hlola futhi i-path MTU kusuka ekugcineni kuya ekugcineni, ngoba i-default ephelele ibeka uhlelo ngalunye ebukhoneni bosayizi omkhulu wephakethe we-tunnel. Izinhlelo ezazisebenza ngaphandle kwe-tunnel manje zingase zincike ekuziphatheni kokuhlukaniswa ongakaze ube nokukucabanga ngakho.

Qinisekisa ukuthi amasevisi endawo ne-DNS yangasese asasebenza

Bhala phansi okufanele kuhlale kusendawo ngokwe-protocol hhayi ngokwegama lohlelo: ama-protocol okuthola ngezinto zokuphrinta nezikrini, ibhuloho lekhaya elihlakaniphile, ikhasi lokuphatha le-router, iseva yentuthuko yendawo efinyelelwa ngegama elixazululwa ku-LAN kuphela. Lezi ziyaphuka lapho indlela eyi-default iqala ukukhomba ku-tunnel, futhi ziyaphuka ngokuthula ngoba akukho okubhala iphutha kuklayenti.

I-DNS yangasese ingenye incikilelo. Uma amagama angaphakathi ayexazululwa i-resolver ye-tunnel ngaphambili, akukho okushintshayo; uma ayexazululwa endaweni, i-default ephelele kufanele iwahambise kwi-resolver eyazi izifunda. Hlola igama elilodwa langaphakathi negama elilodwa lomphakathi ngemva koshintsho esikhundleni sokucabanga ukuthi uhlu lwe-resolver lwasinda.

Bhala izihluzo zendawo kuphrofayili enazo. Isihluzo esigcinwa kuphela emqondweni wothile yiso into yokuqala elahleka ekufudusweni okulandelayo.

Hambisa iphrofayili eyodwa futhi uqinisekise imingcele

Shintsha iphrofayili ngokuhlelwa okunayo, esikhundleni sokubeka i-default entsha phezu kwemizila yamanzi eyenziwe ngesandla eyashiywa ukuhlolwa kwangaphambili. Leyo mizila esele iyisizathu esivamile sokufuduswa okubonakala kusebenza futhi kuziphathe ngendlela engafanayo ngemva kosuku olulodwa. Gcina iphrofayili endala itholakala ukuze ukubuyela emuva kube ukukhetha hhayi ukwakha kabusha.

Bese uqinisekisa imingcele emibili ngokwehlukana: ukuthi izindawo zomphakathi nezangasese ziyasebenza zombili, nokuthi ithrafikhi engafunwa ayiphumi ngaphandle kwe-tunnel. Ukulayishwa kwekhasi okuphumelelayo kuqinisekisa okokuqala futhi akusho lutho ngokwesibili.

ip route get 203.0.113.10
ip route get 10.40.8.15
resolvectl query intranet.example
curl -sS -o /dev/null -w "%{remote_ip}\n" https://example.com

Phinda ukuhlola ngemva kokuxhuma kabusha nangemva kokuphazamiseka, ngoba i-kill switch evimbela ithrafikhi ngesikhathi sokuwa iyisici esihlukile kunomzila obuyiselwa kahle ngemva kwalokho. Idizayini elula yileyo ongasakwazi ukuyichaza ukumbozwa kwayo kwangempela ngemva kokuba uhlelo noma inethiwekhi kushintshile.