I-kill switch ivimbela iseva ye-VPN ngaphambi kokuba noma yikuphi ukuhamba kugeleze
Yisiphi isigaba esivinjwa yi-kill switch: ukusesha kwephoyinti lokugcina, umzila wangaphandle, indlela yokubuya kanye nokukhishwa kwe-peer okuphelelwe yisikhathi — ngamakhawundi esikhundleni sokuqagela.
Ama-kill switch ehluleka ngendlela abantu abangayilindele: aklhiwe ukuvimbela ukuhamba ngesikhathi ithumbu liphansi, futhi amaphakethe akha ithumbu ngokwawo ukuhamba. Yilo lonke iphutha. Iqoqo lemithetho elahla konke okungaphumi ngethumbu lilahla nesandla sokuxhawula ebesifanele ukuliphakamisa, ngakho iklayenti lizama futhi emjikelezweni futhi iphutha libekwa esigabeni esihlolwa kuqala. Ngaphambi kokwandisa i-firewall, thola ukuthi yisiphi sezigaba ezintathu esinqatshwayo: ukusesha kwegama, iphakethe langaphandle eliya ku-peer, noma impendulo ebuyayo.
Ithumbu nokuhamba kwalo ngokwako kuncike kanjani komunye nomunye
Funda iklayenti le-VPN njengezimo ezimbili zenethiwekhi ezabelana ngomzila owodwa we-socket. Ngaphambi kokuba ithumbu libe khona, iklayenti livula i-socket ku-adaptha yomzimba futhi lithumela amafreyimu ekhishwe ngemfihlo ekhelini nasebhodini le-peer. Kuphela ngemva kokuphumelela kwalokho kushintshisana lapho idala khona idivayisi yethumbu futhi ifake imizila. I-kill switch iyinqubomgomo mayelana nesimo sesibili, ebhalwe ngobubanzi obanele ukuthi isebenze kuzo zombili.
Imithetho esekelwe ku-interface iyindlela evamile: yamukela okukhishwa nge- tun0 noma wg0, lahla umzila wokuphuma osele. Lokho kubhalwa akukwazi ukuxolela ukuxhumana kweklayenti ngokwalo nesiseva, ngakho ukusetshenziswa okulungile kwengeza lokho kukhishwa ngokucacile, nawe wenza njalo uma ubhala imithetho ngesandla. Imithetho ngohlelo ngalunye ku-Windows ne-macOS igwema ingxenye yalokhu ngokufanisa inqubo esikhundleni se-interface, kodwa inqubo kusafanele iphume ngaphambi kokuba ithumbu libe khona.
Izigaba ezintathu, ngokulandelana kwazo
Isigaba sokuqala ukuxazulula. Uma iphrofayili igcina igama le-host esikhundleni sekheli elingokoqobo, iklayenti lidinga impendulo ye-DNS ngaphambi kokuthumela noma yini. Iphrofayili eqondisa i-DNS kusixazululi sethumbu idala ukungaphumeleli: isixazululi sifinyeleleka kuphela ngethumbu okwakufanele ukusesha likuvule. Ukuxazulula ngaphandle kwethumbu, noma ukubopha iphoyinti lokugcina ekhelini, kususa lokho kungaqondakali.
Isigaba sesibili iphakethe langaphandle, okufanele lidlule kuqala ekuhambeni kwemizila bese lidlula ku-firewall, ngalolo landelano. I-wireguard-tools yenza ingxenye yomzila yalokhu ku-WireGuard ngokumaka amaphakethe ayo futhi yengeza umthetho wenqubomgomo ukuze yeqe umzila ozenzakalelayo esanda kuwufaka; ikhasi lemanuwali le-wg-quick lichaza lowo mthetho nethebula eliyisebenzisayo. Yakha kabusha lowo mzila ngesandla, noma vumela ithuluzi lesibili ukuthi libhale kabusha imithetho, futhi amaphakethe amakiwe angabuyiselwa ethumbini okwakufanele likwake.
Isigaba sesithathu indlela yokubuya. Ukuxhawula okungenampendulo akusona ubufakazi bokuphonswa ngaphandle; kuhambisana ngokulinganayo nomthetho wokungena wesiseva noma idivayisi ye-NAT ekhohliwe ukumaka. Hlukanisa lokho ngaphambi kokuthinta iklayenti.
| What you see | Stage | Where to look |
|---|---|---|
| The client log repeats a resolve step and no packets appear on the wire | 1, name lookup | Resolver path while the tunnel is down |
| The send counter on the physical adapter stays flat | 2, routing | Peer route and policy rules |
| The send counter rises and a firewall drop counter rises | 2, firewall | Rule order, mark, and interface match |
| Packets leave and nothing comes back | 3, return path | Server input rules, NAT, listening port |
Ama-klayenti arekhoda uphawu alutholayo, hhayi isigaba esihlulekile, ngakho ithebula ngokuvamile liyashesha kune-log.
Amakhawundi anquma ngokushesha kunama-log
Ku-Linux, nft list ruleset noma iptables -vnL OUTPUT liphrinta ikhawundi lamaphakethe ngomthetho ngamunye. Xhuma kanye, vumela kuhluleke, bese ufunda amakhawundi futhi. Umthetho okhunyuka kuwo ikhawundi yiwo mthetho okwashaywa kuwo ukuxhawula; uma kungekho okunyakazile ndawo, iphakethe alizange lifinyelele ku-firewall. Ngake ngabona iqoqo lemithetho lilahla ukuxhawula kwalo uqobo, futhi amakhawundi ukuphela okwasho lokho.
Ukuze uhlukanise ukungakaze kufinyelele ku-firewall nokungakaze kuphume ku-host, qaphela i-interface uqobo. ip -s link show dev wlan0 libika amaphakethe athunyelwe, futhi tcpdump -ni wlan0 udp port 51820 likhombisa amafreyimu. Uma lihlala licijile ngesikhathi iklayenti lizama futhi, iphutha lingaphezu kwe-netfilter: umzila we-peer ongekho, umthetho wenqubomgomo okhomba idivayisi engekho namanje, noma iphutha le-socket eliwugwinya iklayenti.
Hlola ukukhishwa kumakheli emibhalo njenge- 203.0.113.10, ukuze iphutha lingakwazi ukuhlola i-host yomunye umuntu.
Ukukhishwa kwephoyinti lokugcina okuphelelwe yisikhathi kufundwa njengokuwohloka kwesiseva
Inguqulo ekhohlisa kakhulu ivela ngemva kokushintsha kwekheli le-peer: isevisi yekheli eliguqukayo iyisusile, i-host yakhiwe kabusha, noma ikheli lokuphuma lenethiwekhi yakho lihlukile. Ukukhishwa kusabiza ikheli elidala, ngakho amaphakethe aya kwelisha ashaywa umthetho wokulahla. Ukucushwa okufanayo kwasebenza izolo, yingakho abantu beqala ngokuhlola isiseva.
Igama le-host ngaphakathi komthetho we-firewall alikuhlanguli. Ku-nftables igama lixazululwa lapho iqoqo lemithetho lilayishwa, ngakho libopha ikheli elalikhona ngaleso sikhathi futhi liyaphelelwa yisikhathi njengekheli elingokoqobo. Isixazululo esihlala njalo ukubuyekeza ukukhishwa lapho iphoyinti lokugcina lishintsha nokuligcina lincane: ikheli elilodwa le-peer, imbobo eyodwa yokuhamba. Ibanga elibanzi ngokwanele ukumelana noshintsho lwekheli libanzi futhi ngokwanele ukuvumela ukuhamba okungahlobene kuphume.
Lapho i-kill switch isebenza ku-host yesiseva
Ukuncika okufanayo kukhona kolunye uhlangothi, futhi lapho kulula khona ukukushiya. Uma umshini osebenza njengesiseva sakho se-VPN uphinde usebenzise iklayenti ledeskithophu eline-kill switch, noma iphrofayili ye-firewall ekhotshelwe kusukela ku-laptop, imithetho yayo yokulahla isebenza kusevisi eqeda amathumbu. Izimpendulo ekuxhawuleni kweklayenti ziyalahlwa, ngakho wonke amaklayenti ahluleka ukuxhuma ngesikhathi isiseva sibonakala siphilile futhi i-interface yethumbu lalo ihlezi ingasetshenziswa.
Leyo host idinga ukwamukelwa okuncane okuthathu ngaphambi kokulahla: imbobo yokulalela ku-interface yomzimba, i-interface yethumbu yokuhamba okususiwe ukufihla, nokudlulisela kusuka ethumbini kuye lapho amaklayenti kufanele afinyelele khona. Funda iqoqo elifakiwe nge- nft list ruleset, iptables -S, noma pfctl -sr ngaphambi kokushintsha noma yini, futhi khumbula ukuthi iqoqo lemithetho eligciniwe lidlula ukuqalwa kabusha, ngakho iphutha lapho lidlula inqubo eyalidala.
Ukulandelana kokubuyisela okugcina umshini uvaliwe
Sebenza usuka kuphrofayili uye ngaphandle. Funda ikheli le-peer nembobo esetshenziswa yiklayenti, qinisekisa ukuthi igama le-host lixazululeka ngaphandle kwethumbu, bese wengeza ukukhishwa okukodwa kwalelo kheli nembobo ku-adaptha yomzimba kuphela. Xhuma futhi bese uqaphela ikhawundi lokuthumela; ukuxhawula okuqediwe kuwuphawu lokuthi isigaba sesibili silungisiwe.
Shiya enye ingxenye yenqubomgomo yokulahla endaweni yayo ngesikhathi uhlola. Ukuhlola okungenabungozi ukuzama ukuxhumana nekheli lemibhalo elingahlobene nokuqinisekisa ukuthi lisaphelelwa yisikhathi, lokho okubonisa ukuthi i-kill switch iyasebenza hhayi ukuthi icishiwe. Qinisa ukukhishwa lapho ithumbu lizinza, futhi ungashiyi imvume ehlala njalo yakho konke kubhinari yeklayenti nje ngoba kulula.
Uma ithumbu likhuphuka kodwa uhlelo lusahluleka, izigaba ezisele akusizo lesi: i-DNS ehlukanisiwe, i-MTU nokuhamba komzila ngohlelo ngalunye ngakunye kunikeza ithumbu elixhunyiwe nokuhamba okuphukile, futhi ngakunye kunokuhlola kokuqala okuhlukile.