Izilungiselelo ze-VPN ze-Mac aziqali iseva: igateway ihlala kuphi

Imisebenzi emibili ehlukene ibizwa nge-VPN ku-macOS, futhi iphaneli yezilungiselelo ishughulikela eyodwa kuphela kuyo. Uma ufuna ukuthi uhambo lwe-Mac luyaphuma ngomhlinzeki noma nge-igateway ekude, irekhodi leklayenti lanele. Uma ufuna ukufinyelela iphrinta, i-NAS noma ikhasi lomqondisi kunethiwekhi yasekhaya usegumbini lehhotela, kufanele kube khona okuthile kuleyo nethiwekhi okwamukela ukuxhumana okuvela ngaphandle, futhi i-Mac yanamuhla akuyona leyo nto ngokuzenzakalela. Imibuzo emithathu inquma ukuthi usesimweni sini, futhi kufanelekile ukuyiphendula ngaphambi kokuthayipha ikheli ensimini.

Irekhodi leklayenti libiza indawo okuyiwa kuyo, hhayi umlaleli

Kuzilungiselelo Zesistimu > Inethiwekhi > VPN ku-macOS Ventura nakamuva, izinkambu ezazigcinwa izinguqulo ezindala ngaphansi Kwezintandokazi Zenethiwekhi zichaza indlela yokufinyelela iphoyinti lokugcina lomunye umuntu: ikheli leseva, i-ID ekude, i-akhawunti noma isitifiketi, nemithetho yokuxhuma ngokucela. Ukugcina leyo rekhodi kugcina ukuxhumana kusimo senethiwekhi ye-Mac yakho. Akukho lutho kule nqubo olubopha iphothi, oluvula umlaleli noma olubhalisa umsebenzisi okude.

Ungakuhlola lokhu ku-shell. Ku-Mac okusolayo ukuthi iyakhonza, sebenzisa sudo lsof -nP -iUDP bese ufuna amaphothi asetshenziswa iphrothokholi yakho: 500 no-4500 e-IKEv2, 1194 kokumisiwe kwe-OpenVPN, 51820 e-WireGuard. Umshini oyiklayenti kuphela ukhombisa amasokhethi abhangqwe nekheli nephothi elikude, hhayi isibopho se-wildcard okungafinyelelwa yinoma yini ku-inthanethi. Amathunjana asebenza ngaphakathi kwe-Network Extension angacasha ku-lsof, ngakho hlola nephaneli lesimo lohlelo; ongayitholi iyisilungiselelo se-Apple esenza le Mac ibe i-igateway.

Imibuzo emithathu ihlukanisa izindima ezimbili

Zihambise ngokulandelana. Owokuqala uvamise ukunquma okusele, futhi owesithathu yilapho ukuhlela okuqondene ne-Mac kwehluleka khona kakhulu.

1. Ubani oqala ingxoxo? Uma i-Mac yakho ishaya ucingo iya ngaphandle futhi elinye iceleni liphendula, udinga iklayenti. Uma amadivayisi aku-inthanethi kufanele ashaye ucingo angena ukuze afinyelele inethiwekhi yakho, udinga i-igateway enendawo yokungena yomphakathi, futhi i-Mac ingahlala iyiklayenti yaleyo gateway.

2. Yini okufanele ifinyeleleke ngenkathi ithunjana liphakeme? Isevisi eyodwa kuhosti eyodwa isinqumo sokudlulisa amaphothi. Isabnethi yonke, kuhlanganise nokuxazululwa kwamagama, isinqumo somzila ne-DNS, futhi kushintsha lokho i-igateway okufanele ikudlulise, hhayi lokho okusho irekhodi leklayenti.

3. Yiluphi uhlobo lwe-OS olusebenza ekugcineni okwamukelayo? Kuma-Mac lowo mbuzo unempendulo eqinile. I-Apple ibala i-VPN njengeyasuswa ku-macOS Server 5.7.1, futhi uhlelo lwe-macOS Server ngokwalo lwanqanyulwa ngo-21 Ephreli 2022; isaziso somlando wesevisi likhasi okufanele lifundwe lapho isifundo esidala sikusihambisa kubhokisi lokukhetha lesevisi ye-VPN elingasekho.

Lapho impendulo yokuqala iyilokhu “othile wangaphandle uyaqala”, yeka ukufuna iswishi kuphaneli leklayenti le-Mac bese uyokhetha ihosti ezophelisa ithunjana.

I-igateway ingahlala kuphi esikhundleni salokho

Izinhlelo ezine zihlanganisa iningi lezimo zasekhaya nezasehhovisi elincane. I-rawutha enemodi yeseva yangempela, hhayi imodi yeklayenti enelinye ilebula, iphelisa ithunjana emaphethelweni futhi igcine inani lamahosti liphansi, kodwa ngenani lokuboshelwa ekusekelweni kwephrothokholi yaleyo firmware. I-NAS noma i-mini PC ehlala ivuliwe isebenzisa iphakethe leseva lomkhiqizi futhi ikusalele imibhalo ongayifunda. I-VM encane yamafu ikunika ikheli lomphakathi olilawulayo futhi ifinyelela ekhaya ngethunjana lesibili. Isembozo se-mesh esakhiwe phezu kwe-WireGuard, noma isevisi ephethwe edlulisa phakathi kontanga, igwema ukudluliswa kwamaphothi angenayo ngokwenza zombili iziphetho zishaye ucingo ziphume.

Umngcele phakathi kwalezo zinketho ngokuvamile ukuxhumana kwakho kwe-inthanethi, hhayi isofthiwe. Uma i-ISP ikubeka ngemuva kwe-NAT yezinga lomhlinzeki, akukho nani lokudluliswa kwamaphothi ku-rawutha elikhiqiza indawo yokungena efinyelelekayo, futhi uhlelo lwe-relay noma lwe-mesh iyimpendulo eqotho. Qhathanisa ikheli le-WAN elibikwa i-rawutha yakho nekheli elibonwa umhlaba wangaphandle; uma ehlukile futhi inani le-rawutha lisendaweni eyimfihlo noma eyabiwe, hlela ikesi le-relay.

Noma iyiphi ihosti oyikhethayo, dlulisa iphrothokholi eyodwa kuphothi elilodwa esikhundleni sobubanzi, futhi gcina i-Mac ingaphandle komzila ongenayo ngaphandle uma lowo mkhiqizo uqoka indima yeseva kuhlobo lwe-macOS olusebenzayo.

Qinisekisa indima ngaphambi kokwaba amaphrofayili

Ku-igateway engumfakisicelo, fakazela ukuthi umlaleli ukhona esikhundleni sokwethemba ukuthi umfaki wahlela owodwa. Ku-macOS lokho kusho sudo lsof -nP -iUDP elihlungiwe emaphothini angenhla, kanye ne-sudo pfctl -s nat uma imithetho yesihlungi samaphakethe iyingxenye yomklamo. Ku-Linux i-ss -lunp ikhombisa amaqiniso afanayo ngaphandle kokungaqondakali.

Bese uhlola ngaphandle kwenethiwekhi, usebenzisa iphrothokholi uqobo. I-Ping ifakazela okuncane: i-ICMP ivamise ukuhlungwa futhi ayisho lutho nge-UDP 51820. Ukuxhawana kweklayenti okunombhalo ocacile, okwenziwe kusuka ocingweni kudatha yeselula, ukuhlola kwangempela okushibhe kakhulu ngoba kudlula emzileni ofanayo umsebenzi wakude azowudlula.

Kungemva kwalokho kuphela lapho uthinta amaphrofayili eklayenti. Ku-Mac, i-scutil --nc list iphrinta amasevisi e-VPN aziwa isistimu; uma i-igateway osanda kuyakha ingekho phakathi kwazo, ulungiselela umshini ohlukile kuleyo oyihlolile. Uma ukuxhawana kuphumelela ku-LAN kodwa kwehluleka ngaphandle, iphutha likumzila ongenayo: umthetho we-NAT, i-CGNAT yomhlinzeki, noma i-firewall ku-igateway, ngalowo myalo.

Ngaphambi kokwakha noma yini, nquma amaphuzu amane:

• Hlangu luluphi uqala ukuxhumana, i-Mac yakho noma idivayisi ekude.
• Ingabe uhlobo lwe-OS nomkhiqizo wehosti okwamukelayo kusekela ngempela indima yeseva.
• Ingabe i-ISP yakho ikunika ikheli lomphakathi elifinyelelekayo nhlobo.
• Yiluphi iphothi nephrothokholo elilodwa i-igateway ezolamukela, futhi iyiphi isevisi ngemuva kwayo ephendulayo.

Isinyathelo esilandelayo sibonakala: khetha ihosti ye-igateway, qinisekisa umlaleli wayo ngaphandle, bese kube ngakho kuphela wakha irekhodi leklayenti ku-Mac elikhomba kuyo.