I-kill-switch ngemva kokushintsha kusuka ku-Wi-Fi kuyi-cellular: yini ephukayo

Ngolunye usuku ikhompyutha ephathekayo ise-Wi-Fi yasehhovisi, ngolunye ixhumene nocingo, futhi isibonisi se-tunnel siba luhlaza futhi ngaphambi kokuba uqede ukushintsha amawindi. Ukukhanya okuluhlaza kutshela kuphela ukuthi i-tunnel ixhumeke kabusha; okwenziwe inqubomgomo yokuhambisa nokuvimba phakathi kwesikhala umbuzo ohlukile. Leyo nqubomgomo iyisethi yemibandela yokufanisa eyedluliselwe ngesikhathi sokufakwa kokugcina, futhi isho i-interface, ikheli nomndeni wamakheli okusanda kuwasuswa ukudluliswa. Ngakho-ke ukushintsha okufanayo kuveza imiphumela emithathu ebukeka ifana: ukuvimba kuyaqhubeka, inqubomgomo ivimba ukubuyiselwa kwayo, noma kuvuleka indlela okungekho lutho oluyimbozayo.

Akukho lutho esikrinini olwehlukanisa lezo zimo ezintathu, ngakho-ke buza ukuthi imithetho yayikhokhelwe kuziphi izihlonzi hhayi ukuthi isibonisi sibonisa umbala muni. Ku-Linux umthetho ungasho i-interface noma i-ipset egcwalisiwe kusuka kuyo; ku-Android i-VpnService ingatshelwa ukuthi imiphi iminethiwekhi engaphansi okufanele iyilande ngokusebenzisa i-setUnderlyingNetworks. Ukuxhumana ngakunye kukhombisa isixhumanisi esizoshintshwa, futhi ngakunye kufanele kubuyekezwe ngemva kwalokho.

Ukudluliswa kubhala kabusha ini ngempela

Lapho isixhumanisi esidala sinyamalala, i-kernel isusa amakheli aso, ihoxisa imizila eyayidlula kuso, futhi yakha kabusha ukukhethwa kwekheli lomthombo kulokho okusele. Umzila ozenzakalelayo uya ku-gateway entsha, futhi inkomba ye-interface imithetho emidala eyayibhekisela kuyo isinyamalele noma isisetshenziswe kabusha kwenye idivayisi. Izixazululi zesixhumanisi ngasinye nazo ziyavuselelwa, nakuba kungesikhathi esifanayo nemizila. Konke lokhu kwenzeka ngaphansi komxhasi we-VPN, ngakho-ke umxhasi obheka kuphela isimo se-tunnel yakhe akaboni lutho kulokhu.

Inkinga ukuthi umthetho ufaka ikhodi yesihlonzi esithile esikhundleni senhloso engemuva kwaso. Umthetho olahla konke okungaphumi nge-interface ye-tunnel ufaka ikhodi yegama le-interface; umthetho ovumela iphuzu lokugcina ufaka ikhodi yekheli iminethiwekhi entsha engase iyihambise kwenye indawo. Lapho isihlonzi sinyamalala umthetho awubi yiphutha ngokubonakalayo: kungenzeka uyeke ukufanisa nanoma yini noma uqale ukufanisa into engalungile.

Ukwakha kabusha i-tunnel yangaphandle ngaphandle kokubhoboza imbobo

Ukuthutha kwangaphandle kwakuboshelwe kukheli lomthombo elidala, ngakho-ke kufanele kuvule isokhethi entsha kusuka kwelisha. Lapho iphuzu lokugcina liyigama lomsingathi hhayi ikheli elingokoqobo, ukusesha kufanele kuphumelele ngesikhathi ukuvimba kusasebenza. Lona umgibe wokulandelana: inqubomgomo eqinile ngokwanele ukulahla konke ngaphandle kwephuzu lokugcina izolahla nokusesha okudingekayo ukuze kutholakale, ngaphandle uma ukuxazululwa kwenzeka ngaphambi kokuphakanyiswa kokuvimba noma kuthwalwa nge-tunnel esaphila. Zombili izindlela zingasebenza, kodwa kuphela uma umxhasi azi ukuthi ukukiphi.

Abaxhasi bayehluka lapha ngendlela ebalulekile lapho uhlola. Abanye baxazulula kuqala bese befaka imithetho ngemva kwalokho, ngakho-ke ukudluliswa kubiza ukuphazamiseka okubonakalayo bese kuziphulula ngokwako; abanye bagcina ukuvimba futhi bathembele ku-tunnel esindile ukuba ithwale ukusesha, futhi lokho kwehluleka ngokuphelele lapho i-tunnel ifa nesixhumanisi. Ukwengeza umzila ozenzakalelayo oqondile obanzi ukuze kubuyiselwe ukuxhumana kuhlale kwenza isivivinyo sidlule futhi kuhlale kushiya ukuvuza obukuvimbile.

Umzila osakhombisa ku-gateway endala unikeza ukubuyiselwa okubambekayo okufanayo ngesinye isizathu, ngakho-ke funda ithebula ngaphambi kokusola umxhasi. Imiyalo engezansi isho i-interface nekheli lomthombo i-kernel ebiyolisebenzisa ngempela, futhi lokho kunquma ngomugqa owodwa ukuthi indlela endala isafakiwe yini.

ip route get 1.1.1.1
ip -6 route get 2606:4700:4700::1111

Lapho isixhumanisi esisha siletha i-IPv6 kodwa imithetho ingayilethi

Amanethiwekhi e-cellular kanye nezivakashi avame ukunikeza isiqalo se-IPv6 somhlaba wonke ngisho noma i-LAN enezintambo yasehhovisi ingakaze ikwenze lokho. Inqubomgomo ebhalwe njengemithetho ye-IPv4 kuphela — isimo esizenzakalelayo samarisiphu amaningi e-iptables ne-nftables enziwe ngesandla — ayimbozi lutho kulokho. I-tunnel ihlala ixhunyiwe, izinhlelo ezinokufinyeleleka kwe-IPv6 ziyaphuma ngaphandle kwayo, futhi isibonisi asikwazi ukukhombisa umehluko ngoba i-tunnel isikhona ngempela. Icala eliphambene livamile ngokufanayo: isethi yemithetho ye-IPv6 kuphela ayenzi lutho kunethiwekhi engayinikezi i-v6.

Qhathanisa lokho isixhumanisi esikunikezayo nalokho inqubomgomo ekushoyo, ezinhlangothini zombili zokudluliswa. Le miyalo iphrinta amaqiniso afanayo umxhasi asebenza ngawo:

ip -4 route show default
ip -6 route show default
sudo nft list ruleset | grep -c 'ip6 '

Uma umyalo wesibili uphrinta umzila ozenzakalelayo kuyilapho owesithathu ubuyisa uziro, isixhumanisi esisha singakhipha umshini ngaphandle nge-IPv6 ngaphandle kwanoma yimuphi umthetho oqaphile. Gijima yomithathu futhi ngemva kokushintsha, ngoba inombolo ethakazelisayo iyumehluko phakathi kokugijima kokubili. Uma owesibili ungarhinti lutho, icala eliphambene liyasebenza futhi noma iyiphi inqubomgomo esindayo ku-v6 lapho iwumhlobiso nje.

Isixazululi sishintsha izandla phakathi nesikhathi

Ezinhlelweni zesimanjemanje izixazululi zixhunywe ezixhumanisini, ngakho-ke isixhumanisi esisha siza nesethi entsha yezixazululi futhi mhlawumbe nombono ohlukile we-split-DNS. I-systemd-resolved igcina isikophu esisodwa sesixhumanisi ngasinye futhi ikhetha phakathi kwazo ngokomzila, kuyilapho i-macOS ifunda izixazululi ezinesikophu esuka esitolo esiguqukayo futhi ihlonipha ukulandelana kwe-interface. Umxhasi ofaka isixazululi sakhe uzihambela nokwesixhumanisi, futhi imithetho yokubaluleka okungekho muntu oyibhekayo ingquma owinile. Khona-ke ukuxazululwa kwamagama kungaphuka kuyilapho ukuhlunga kwamaphakethe kwenza kahle lokho okwakubhalelwe kona.

Funda isixazululi esisebenzayo hhayi leso esilungisiwe. Kusisebenzi se-systemd umyalo ongezansi we-status ukhombisa ukuthi yisiphi isixhumanisi okwavela kuso isikophu ngasinye nokuthi igama le-private-DNS liyasebenza yini:

resolvectl status --no-pager
resolvectl query intranet.example.com

Uma umbuzo uphuma ngesixhumanisi somzimba hhayi nge-tunnel, umxhasi wehlulwe umncintiswano wokubaluleka futhi akukho kulungiswa kwe-firewall okuzolungisa ukuqanjwa kwamagama. Qhathanisa indlela yombuzo ezinhlangothini zombili zokudluliswa ukuze ubone ukuthi iyiphi ehambile. Igama elixazuluka ekhlelini yangasese iminethiwekhi entsha engakwazi ukuyihambisa iyicala lesithathu, futhi ibonakala njengokuphelelwa yisikhathi hhayi njengephutha.

Zijwayeze ukudluliswa futhi ugcine irekhodi

Zihlukanisele ukushintsha ngamabomu esikhundleni sokukulinda. Phakamisa i-tunnel esixhumanisini sokuqala, qala ukudluliswa kwesikhathi eside nokusesha okuphindaphindiwe, bese ushintsha isixhumanisi futhi ubone ukuthi yikuphi okusindayo. Bhala isikhala phakathi kokunyamalala kwesixhumanisi esidala nokubika kwe-tunnel ukuthi ixhunyiwe, ngoba kulelo windi inqubomgomo yagcina noma ayizange igcine. Gijima ukulandelana ngakolunye uhlangothi futhi, ukuze umphumela ungabi ngowohlangothi olulodwa.

Okuhlukile kudinga uhambo lwako, ngoba ukweqa okwakufanele kunethiwekhi endala akukufanele ngokuzenzakalela kwelisha. Iphrinta, i-NAS noma i-captive portal ku-LAN yasekhaya akunakulingana nakho ku-cellular, futhi okuhlukile okwakufinyelela kukho kuba umthetho ongenakulingana nakho.

Bhala amagama e-interface, imindeni enikeziwe, isixazululi esisebenzayo nobude bokuphazamiseka kuhlangothi ngalunye. Ukuxhumeka kabusha kufakazela ukuthi ukuthutha kwaphulukuka, hhayi ukuthi ukuvimba kwagcina phakathi nesikhala, futhi lezo ziyizitatimende ezihlukene zethikithi. Ngokwalelo rekhodi ukudluliswa okulandelayo kuqhathaniswa nesimo esaziwayo hhayi nenkumbulo.