I-kill switch iyasebenza: kwenzekani kumaseshini e-TCP avuliwe?

I-tunnel iyawa, i-kill switch iyasebenza, futhi ukulanda obekusekuceleleni kwezintathu kwezine kuyagxuma noma kwehluleka ngokushesha. Le miphumela emibili ivela ekukhetheni okuhlukene kokuphoqelela, hhayi emazingeni ahlukene okuvikelwa. Iphakethe elilahliwe lishiya ukuxhumana kulindile, kuyilapho iphakethe elenqatshiwe livala futhi lazisa uhlelo lokusebenza. Ukunquma ukuthi uyiphi indlela ozoyifuna kuwumbuzo wokuklama, futhi ukuyihlola kuwumsebenzi ohlukile.

Ukulahla, ukwenqaba nokusetha kabusha kuhlukile

Umthetho we-firewall olahla ithrafikhi uyilahla iphakethe futhi awubuyiseli lutho, ngakho umthumeli uyaqhubeka ethumela futhi ngezikhathi zakhe. Umthetho owenqaba nge-TCP reset uvala ukuxhumana ngokushesha futhi uhlelo lokusebenza lubona iphutha. Iningi lama-kill switch liyalahla, ngoba ukwenqaba kungadalula inqubomgomo nangoba ukulahla kufana nokuziphatha kwenethiwekhi efile.

Ukuvimba akufani nokuvala isokhethi. Uhlelo lokusebenza lusabambe isichazi esisesimweni esisunguliwe, futhi iziphakethe kuphela ezingekho. Yingakho ikhasi lingahlala ku-spinner imizuzu ngenkathi uhlelo lokusebenza lwengqondo lugcizelela ukuthi ukuxhumana kukhona. Funda ukuphoqelela okubhaliwe esikhundleni sokukucabangela kumlayezo wohlelo, ngoba zombili izindlela zibonakala sengathi inethiwekhi iwile.

Uhlelo lokusebenza lwenzani ngenkathi isikhala siqhubeka

I-TCP ithumela futhi ngokulibaziseka okukhulayo, futhi isabelomali sokuphindela esizenzakalelayo se-Linux siphela cishe ngemva kwekota yehora, hhayi ngemizuzwana. Kuze kube yileso sikhathi isokhethi ayivulekile ngendlela ewusizo futhi ayivaliwe. Izinhlelo ezinama-keepalive azo noma izikhathi zokuphela kwezicelo zivame ukunikezela ngaphambi kwesikhathi, yingakho izinhlelo ezimbili kumshini owodwa ziziphatha ngendlela ehlukene ngesikhathi sokuphazamiseka okukodwa.

Uma i-tunnel ibuya, isokhethi yasendaweni ayishintshanga kodwa indlela kungenzeka ishintshile. Ikheli lomthombo lomphakathi elisha likhiqiza i-tuple emine ehlukile kuseva, ngakho i-firewall enamazwe asezingeni ohlangothini olude ayisahambisani neshini. Ukuxhumana sekufile nakuba iklayenti lingakaze libone iphutha.

Nquma ukuthi ukubuyiswa kuyadingeka yini

Khetha phakathi kwezivumelwano ezimbili. Kumelwe iseshini yeqe isikhala esifushane, lokhu kudinga ukukhethwa kwekheli okuqinile kanye neseva egcina isimo sayo, noma uhlelo lokusebenza kufanele luxhumane kabusha ngokuhlanzekile, lokhu kudinga ingqondo yokuphinda ephephile ukuyiphinda. Noma yini ephakathi ikhiqiza umphumela omubi kakhulu: iklayenti eliphinde lithumele lokho osekuvele kwaqoshwa yiseva, noma elibika impumelelo yeseshini okungekho muntu ongayibona.

Ukukhethwa kwekheli okuqinile yingxenye abantu abayikhohlwayo, ngoba ukuxhumana kabusha okuhla kukheli lomphakathi elihlukile kwenza isimo sohlangothi lweseva singasebenzi ngisho lapho isokhethi yeklayenti ibonakala inempilo. Bhala ukuthi yisiphi kwezivumelwano ezimbili esisebenza kuhlelo ngalunye, ngoba akuvamile ukuthi zonke zihambisane.

Hlola ukuvinjwa nokubuyiswa ngokuhlukene

Thatha ukuvikelwa kokuvuza nokuhlala kweseshini njengezici ezimbili, ngoba ukudlula kwesinye akusho lutho ngokunye. Iseshini esindile ayibona ubufakazi bokuthi ithrafikhi eqondile yavinjwa, futhi iseshini efile ayibona ubufakazi bokuthi yonke indlela eqondile yavinjwa.

ss -tnp state established '( dport = :443 )'
sudo conntrack -L -p tcp --dport 443
sudo tcpdump -ni any 'tcp port 443 and tcp[tcpflags] & tcp-syn != 0'

Lapho ubheka ukubuyiswa sebenzisa umsebenzi wokuhlola ongenabungozi, ukuze ukuthunyelwa okuphindiwe kungabi yisigameko. Bhala uhlobo lokuhluleka okuyikho owakubona ngempela: uhlelo lokusebenza lubonise ini, isokhethi yasinda yini, nokuthi yabuya nini ngokwayo.

Bhala ukuziphatha okulindelekile eduze komthetho wokuphoqelela futhi ufake usuku. Umuntu olandelayo ozoshintsha lowo mthetho kufanele azi ukuthi yisiphi kwezivumelwano ezimbili esathenjiswa ukuthunyelwa.