Ucingo Oluqashwayo lwe-VPN? Humusha Isidingo Kuqala

Isiphakamiso sisho ucingo oluqashwayo oluthile lwe-VPN yasehhovisi, futhi inombolo iza ngaphandle kwanoma yisiphi isichasiselo. Ngaphambi kokusayina, hlukanisa umusho ube izidingo ezine oziqhubayo ngempela: ukunikezwa kwenyama, ukuhlelwa kokulethwa kwe-IP, umthamo kuzo zombili izinhlangothi, kanye nokuzibophezela kokusekelwa ngemuva kwesekhethi. Ziqhube njengezango ngalelo ukulandelana, ngoba isekhethi ehlulekayo ekunikezweni ayikwazi ukusindiswa ngenombolo enkulu yomkhawulokudonsa. Bese uqinisekisa lokho okunikeziwe uma kuqhathaniswa nalokho okubhalile.

Humusha isidingo, hhayi igama lomkhiqizo

I-IPsec ivikela ithrafikhi esigabeni se-IP futhi ishiya ukuthuthwa kucingo oluthengayo. Isakhiwo se-IPsec ichaza indlela ithrafikhi evikelwa ngayo phakathi kwezinhlangothi; ayisho lutho mayelana nohlobo lokunikezwa, isilinganiso esiqinisekisiwe noma izikhathi zokulungiswa. Lezo yizimfanelo zesivumelwano sesevisi.

Lo mehluko uyisizathu sonke sokuthi isidingo sosekhethi singaba semthethweni kodwa singabi isidingo se-VPN. Isango eline-interface yokulandelana kuphela ngempela lidinga ukunikezwa kokulandelana, futhi lokho kuwumkhawulo wehadiwe, hhayi wephrothokholi. Shintsha ithuluzi bese umkhawulo unyamalala. Bhala isidingo ngasinye ngendlela ethi «isango lidinga i-X ngoba i-Y» futhi wenqabe noma yimuphi umugqa ongakwazi ukuqedwa.

Qamba ukunikezwa ngaphambi kokuthi uqambe ijubane

Ukunikezwa ukuxhumana kwenyama nokwesigaba sokuxhumanisa endaweni yokwehlukanisa: i-Ethernet yethusi, i-fiber ene-transceiver ethile, i-interface yokulandelana, noma into endala ekhona kuphela ngoba ithuluzi lamanje linayo. Iphutha lapha liyabiza ngendlela umkhawulokudonsa ongakaze abize ngayo, ngoba ngokuvamile kusho ihadiwe entsha kuzo zombili iziphetho. I-optic engekho akuyona inkinga yomthamo futhi akukho kuphuculwa okukulungisayo.

Qinisekisa isixhumi, ukuxoxisana ngejubane kanye nokuthi ubani ohlinzeka ngesiguquli semidiya noma i-router. Bese uqinisekisa ukuthi umthwalo wakho womsebenzi uphela kuphi, ngoba indawo yokwehlukanisa inquma ukuthi ubani ovunyelwe ukuthinta ini lapho ucingo luwa ngo-03:00. Bhala lowo mkhawulo kurekhodi eceleni kwesihlonzi sesekhethi. Uwukuphela komugqa oguqula ucingo lokusekelwa lube ingxoxo yemizuzu emihlanu esikhundleni sehora lokudlulisa.

ip -br link show
ethtool eth0 | head -20
sudo lshw -class network -short

Qinisekisa ukulethwa kwe-IP, hhayi ikheli kuphela

Buza ukuthi isevisi iletha ikheli liphi noma isiqalo esiphi ngempela, nokuthi simile yini. Isekhethi enikeza ikheli eliguqukayo ayifaneleki isango eliphakathi kwamasayithi, ngoba ukuhlelwa komlingani kufanele kubekezelele ushintsho ongaluhlelanga. Qinisekisa nobude besiqalo, ngoba ikheli elilodwa kanye ne-/29 elisetshenzisiwe kuyimikhiqizo ehlukene.

Bese ubuza ukuthi kukhona yini okuhumusha ikheli ngaphambi kokuthi lifike kuwe. I-NAT ohlangothini lomhlinzeki noma i-NAT yezinga lomhlinzeki phambi kwesevisi yephula amaseshini angenayo, ngakho isango elilindele ukwamukela i-IPsec evela kumasayithi akude alikwazi ukufinyeleleka. Ijubane alikubuyiseli: ucingo olusheshayo ngemuva kwesihumushi ongalilawuli alukwazi ukwamukela ukuxhumana okungena kuphothi okungekho muntu oyidluliselayo.

Rekhoda ukuthi i-router ne-DNS ngeyabani. Uma umhlinzeki ehlinzeka nge-router, uzuzwa ifirmware yayo, ukuziphatha kwayo kwe-NAT kanye nombono wayo womzila ozenzakalelayo, futhi zonke izinguquko zakamuva zidlula kuthikithi. Cela umuntu ongaphandle kwenethiwekhi yakho ukuthi azame ukuxhumana okungena kuphothi ohloselwe ukuthi kufinyeleleke, ngoba yilokho kuphela ukuhlolwa okuqinisekisa indaba yokuhumusha.

ip -br addr
ip route get 198.51.100.10
traceroute -n 198.51.100.10

Linganisa umthamo kusukela emthwalweni womsebenzi, kuzo zombili izinhlangothi

Umthamo kufanele uchazwe ngomsebenzi, hhayi ngenombolo ngomsebenzisi ngamunye. Ukufinyelela amafayela amaningi, ukuphatha okusebenzisanayo kanye nokulondoloza ebusuku ngakunye kukhiqiza iphethini ehlukene yethrafikhi, futhi kukodwa kuphela okukhathazayo ngokugeleza okusimeme okuya phezulu. Inombolo yomkhawulokudonsa ngesihlalo ngasinye iwubulula bokuthengisa, hhayi imodeli.

Linganisela izinhlangothi zombili, engeza umthwalo wokufaka, futhi phawula ukuthi ithrafikhi iyagqabuka noma iqhubeka. Bese uhlola izinga eliqinisekisiwe lesivumelwano hhayi izinga lesimemezelo, ngoba imvume yokuqgabuka ephela ngemva kwamasekhondi ambalwa ayisizi ekulondolozeni kwasebusuku. Faka nomkhawulo wesango ngokwalo kwisabelomali esifanayo, ngoba ukucutshungulwa kokubethekela kanye nenani lamaseshini akhona ngasikhathi sinye kungaba umkhawulo kusenesikhathi kakhulu kunesekhethi. Ucingo olusheshayo ngeke lulungise isango eligcwele.

Qinisa izibopho zokusebenza

Ukutholakala, ukusabela kokulungisa, indlela yokukhuphuka kanye nesaziso sokunakekela kufanele kube ngokubhaliwe, nendlela yokulinganisa ibiziwe. Izinga le-inthanethi lesimemezelo alisimisi neyodwa yalezo zimfanelo, futhi nekhasi lokumaketha elithembisa ukuthembeka ngaphandle kokuchaza ukuphazamiseka alisimisi. Buza ukuthi iwashi liqala kanjani, ngoba isikhathi sokusabela esikalwa kusukela ekuqinisekisweni komhlinzeki uqobo akusiyo inombolo efanayo naleyo ekalwa kusukela esixwayiso sakho sokuqapha. Lezo zincazelo ezimbili zingahluka ngamahora ngaphandle kokuthi kukhona oqambayo amanga.

Rekhoda nomkhawulo wokusekelwa. Uma umthwalo womhlinzeki uphela ekunikezweni okuphethwa i-router yakho, ihora lokuqala lesigameko ngasinye lichithwa ekunqumeni ukuthi iphutha ngelabani, futhi awukho umkhawulo we-SLA okuvalayo.

Qinisekisa isekhethi ngokwemibandela ebhaliwe

Lapho isevisi isiqala ukusebenza, linganisa lezo zimfanelo ozenzele ngempela isivumelwano, hhayi lezo eziboniswe umfaki. Ukugeleza, ukubambezeleka kanye nokulahleka emzileni wangempela yibufakazi, futhi kufanele kurekhodwe ngesikhathi nangendawo ongayisho. Phinda isilinganiso ngehora elimatasa, hhayi kuphela ngesikhathi sokunikezwa. Ukuhlolwa kokwamukela okwenziwe ngo-10:00 ngosuku oluthule kukutshela okuncane kakhulu mayelana nocingo ngo-15:00.

iperf3 -c speed.example.net -t 30 -P 4
mtr -n --report -c 50 198.51.100.10
curl -sS -o /dev/null -w '%{time_connect} %{time_starttransfer}\n' https://speed.example.net/

Gcina imiphumela kanye nesivumelwano, ngoba ingxoxo yokusebenza ngaphandle kwesisekelo ingumbango mayelana nemibono. Uma isilinganiso singafinyeleli isibopho, siphakamise ngesikhathi ubufakazi busha futhi isevisi isisesikhathini sokwamukela esihlinzekwa yisivumelwano. Umphathi oqanjiwe kusicelo ugcina futhi ukuxhawulana kwe-TLS kusemthethweni, ukuze isixwayiso sesitifiketi singadidaniswa nesekhethi ehlulekile.

Ekugcineni, phinda ufunde izango ezine uma uqhathanisa nalokho okunikeziwe. Ukunikezwa, ukulethwa kwe-IP, umthamo kanye nemibandela yokusekelwa ngakunye kunomugqa kurekhodi, futhi umugqa ngamunye unegama eceleni kwawo.