Kungani i-kill switch yehlisa ithrafikhi uma ushintsha iseva
Kungani i-kill switch ivimba ithrafikhi ngesikhathi sokushintsha iseva, iklayenti lenzani ngaleso sikhathi, nendlela yokuhlukanisa ikhefu elivamile nomgoqo obambekile.
Ukhetha iseva ebonakala iseduze, ucindezela ukuxhuma, futhi isiphequluli siyeka ukulayisha ngaphambi kokuba umhubhe omusha unyuke. Isithonjana sishintshela esimweni sokuxhuma futhi sihlala lapho kuze kuphele isikhathi sawo wonke amathebhu. Lokho kuma kuvamise ukuba i-kill switch esebenza ngendlela eyakhelwe ngayo: ithrafikhi ivinjiwe ngenkathi iklayenti lingenawo umhubhe wokuyithumela. Ukuthi ikhefu lamukelekile noma cha kuncike kulokho iklayenti elikwenzayo kuleyo mizuzwana, nasekutheni umgoqo ukhishwa uma uthi ukhishiwe.
Iklayenti lenzani phakathi kweseva ezimbili
Ukushintsha iphoyinti lokugcina kuyizinyathelo eziningi, hhayi iswishi eyodwa. Iklayenti lidiliza umhubhe wamanje, libuyekeza imithetho yalo yokuvimba, lixazulula liphinde lifinyelele iphoyinti elisha lokugcina ngaphandle komhubhe, bese lifaka imizila emisha futhi likhiphe umgoqo. Igebe olizwayo liseduze kwesinyathelo sokuqala nesokugcina.
Ukulandelana kubaluleke kakhulu kunesivinini lapha. Uma imithetho yokuvimba ingena ngaphambi kokukhululwa kwephoyinti elisha lokugcina, iklayenti alikwazi ukuqeda ukuxhawulana futhi lihlala esimweni sokuxhuma kuze kuphele isikhathi. Uma ukukhululwa kuyikhophi yekheli leseva elidala, ukuxhawulana okusha kubonakala njenganoma yiliphi iphakethe eliphumayo futhi kuyalahlwa. Zombili lezi zimo zibonakala zifana kusiphequluli, yingakho ukushintsha okululama ngemva kwemizuzwana eyisithupha nalokho okungalulami neze kungaba nembangela eyodwa.
Iphoyinti elisha lokugcina lidinga imbobo emgoqweni
Ukwakha umhubhe, iklayenti kufanele lithumele amaphakethe ekhelini nasechwebeni leseva elisha ngosikhombisi somzimba, isibonelo i-UDP 51820 kuphrofayela evamile ye-WireGuard noma i-1194 ne-443 ku-OpenVPN, noma yini eshiwo iphrofayela yakho. Leyo thrafikhi ayikho ngaphakathi komhubhe osuzokwakhiwa, ngakho umgoqo wadivayisi yonke uyigwinya ngaphandle uma kukhona umthetho wemvume ohambisanayo.
Amaphrofayela asuselwa egameni lomsingathi engeza umbandela wesibili: ukusesha uqobo. Uma iklayenti lixazulula iphoyinti lokugcina ngaphambi kokuba umgoqo unyuke, lingasebenzisa ikheli eligciniwe, kodwa uma iphrofayela ishintsha amakheli noma ingxenye egciniwe iguga, ukuxhawulana kuya ekhelini umthetho wemvume ongalifaki. I-IPv6 ikwenza lokhu kubonakale, ngoba iphoyinti elinezingqimba ezimbili lingashicilela kokubili irekhodi le-A ne-AAAA, futhi umthetho wemvume ohlanganisa ikheli le-v4 kuphela ushiya iklayenti lizama futhi ngokumelene nekheli le-v6 elivinjiwe.
Amagama ezinketho namanye amanani azenzakalelayo ahluka ngokweklayenti nangenguqulo, ngakho funda uhlu olubhaliwe lwakho esikhundleni sokuqagela kusukela ezithombeni zesikrini. Incwadi yesethenjwa yezilungiselelo ze-OpenVPN Connect ku- openvpn.net/connect-docs/app-settings-windows iyisibonelo esisodwa sendlela iklayenti elichaza ngayo izinketho zalo zokuvimba nomhubhe ohlukanisiwe.
I-Fail-closed iwumshini wezimo, hhayi iswishi
Iningi lamaklayenti liveza umgoqo njengenqubomgomo yodonga lomlilo ezimweni ezintathu: umhubhe unyukile, ithrafikhi ihamba ngomhubhe futhi akukho mgoqo; umhubhe wehlile, umgoqo uyasebenza; kanye nokudlula, umgoqo uyasebenza kanye nokukhululwa kwesikhashana kwephoyinti lokugcina. Iziphazamisi zihlala esimweni sesithathu, ngoba kufanele sishintshe kabili phakathi nemizuzwana embalwa, futhi ukwehluleka ukuphuma kuso kubonakala kufana ncamashi nomgoqo unomphela.
Indlela iyahluka ngeplathifomu, kanjalo nokwehluleka. Izihlungi ze-Windows Filtering Platform zinesisindo, ngakho isihlungi sokuvimba esidlula imvume yakho siqhubeka silahla amaphakethe nakuba imvume ikhona, futhi izihlungi ezishiywe inqubo yeklayenti ebulewe zingagcina umshini ungaxhunyiwe emoyeni ngemva kokunyamalala kohlelo. Amaklayenti e-macOS avamise ukubhala imithetho ye-pf kwi-anchor, lapho ukulandelana kwemithetho nezinqumo ezisheshayo kunquma ukuthi yimuphi umthetho osebenzayo. Amaklayenti e-Linux avamise ukuphatha uchungechunge lwe-nftables noma i-iptables olwenqubomgomo ye-drop kanye nemvume ecacile yephoyinti lokugcina, isikhombisi somhubhe kanye ne-loopback. Isimo se-always-on VPN se-Android nokukhetha ukuvimba ukuxhumana ngaphandle kwe-VPN kunzima kakhulu eqenjini, ngoba uhlelo lokusebenza lusebenzisa umgoqo kudivayisi yonke hhayi kuhlelo ngalunye.
I-WireGuard idinga inothi layo, ngoba i-AllowedIPs iyisikhethi somzila, hhayi isivimbi. Inquma ukuthi yiziphi izindawo ezingena emhubheni; ayenzi lutho ukuvimbela iphakethe elingenawo umhubhe ukuthi liphume nge-Wi-Fi. Ekuhlelweni kwe-WireGuard kuphela ngaphandle komthetho wodonga lomlilo, i-kill switch empeleni iwukungekho komzila, futhi ngemva kokuxhawulana okulahiwe iphakethe langempela lingaphuma ngosikhombisi somzimba.
Linganisa igebe esikhundleni sokubuka isithonjana
Qaphela amaphakethe, hhayi isibani sesimo. Kwi-Linux qala i-ping enensayo eya ekhelini lomphakathi kutheminali eyodwa bese ubamba ichwebe lokuthutha lomhubhe kusikhombisi somzimba kwelinye:
ping -i 0.2 -c 100 1.1.1.1 | tail -5
sudo tcpdump -ni eth0 'udp port 51820'
Shintsha iseva kuklayenti ngenkathi zombili zisebenza. Izinto ezintathu zibalulekile: ukuthi ama-ping ama isikhathi esingakanani, ukuthi ukubamba kukhombisa ukuxhawulana kufinyelela iphoyinti elisha lokugcina yini, nokuthi ithrafikhi ibuya ngaphambi noma ngemva kokuba isimo seklayenti sishintshe saba sixhunyiwe. Uma igebe le-ping liphela kuqala, kungenzeka umgoqo ukhishwe ngaphambi kwesikhathi noma umhubhe usunyukile ngaphambi kokuba isikhombisi sivume. Uma igebe liphela kamuva, isikhombisi sinezinga lokwethemba elikhulu kakhulu.
Kwi-Windows, netsh wfp show state ibhala isifinyezo lapho ungangena khona ufuna izihlungi zokuvimba ezisekhona ngenkathi iklayenti lithi alixhunyiwe. Kwi-macOS, sudo pfctl -sr ibala imithetho elayishiwe nokulandelana kwayo. Hlanganisa noma yisiphi isifinyezo nerekhodi leklayenti uqobo; umugqa wesikhathi ovela ku-ping yakho utshela ukuthi umgoqo waphela sekwephuzile noma awuzange uphele.
Ubumnyama obujwayelekile ngokumelene nomgoqo obambekile
Ukuphazamiseka okuthile kuyinjongo yalesi sici, ngakho hlukanisa ngaphambi kokushintsha noma yisiphi isilungiselelo:
| What you see | Usually means | Next check |
|---|---|---|
| Two or three seconds of timeouts, then normal browsing | Expected fail-closed gap | Nothing to fix |
| State says connected, traffic stays dead | Block filter or route left behind | Firewall snapshot, client log |
| One app dead while others work | TCP session bound to the old exit address | Restart the app |
| LAN devices unreachable after the switch | LAN exception not reapplied | Allow-LAN or split-tunnel setting |
| New server hangs, the old one reconnects | Permit covers only the old address | Resolved address of the new host, including AAAA |
Uma uwela emugqeni wesibili noma wesihlanu, ungacishi i-kill switch ukuze uhlole, ngoba lokho kuguqula iphutha lomzila libe ukuvuza. Qala kabusha insizakalo yeklayenti, noma qala kabusha umshini lapho izihlungi zisinda khona ekubulaweni kwenqubo, bese ubheka ukuthi umgoqo uyahamba yini. Uma uhamba, iphutha lisekuhlanzeni ngesikhathi sokushintsha hhayi kumgoqo uqobo.
Ngaphambi kokushintsha kwakho okulandelayo, qinisekisa izinto ezine: imvume yephoyinti lokugcina ihlanganisa zonke imindeni yamakheli exazululwa iphrofayela yakho, irekhodi leklayenti likhombisa ukudlula okuqediwe, ukuhlolwa kwakho kwe-ping kulinganisa igebe hhayi isithonjana, futhi ukuvala iklayenti kubuyisela ukuxhumana okuvamile. I-kill switch ebamba ngesikhathi sokushintsha bese iyekelela ngemva kwalokho yenza umsebenzi wayo. Leyo eyekelela ngaphambi kwesikhathi, noma ingakaze iyekelele, ifanele ukulungiswa.