Ukushintsha abahlinzeki be-VPN: hlela igama lomsingathi, hhayi i-IP kuphela
Irekhodi entsha ye-DNS ayizihambisi izingxoxo ezikhona. Hlela ukuthi ubani olawula igama, ukuthi iklayenti ngayinye iyixazulula nini, nokuthi uzoyeka kanjani iphoyinti lokugcina elidala.
Irekhodi yakho ye-DNS ilungile, okubuyiselayo kunempilo, futhi amanye amaklayenti achitha amahora eshayela ikheli elidala. Ambala ehlehluka ngokushesha kunegama elixazululwayo futhi elingaphenduli neze. Imiphumela yomibili ivela esikhaleni esisodwa: igama lomsingathi lishintsha lokho iklayenti elikufunayo, hhayi ukuthi likufuna nini, futhi hhayi lokho elikuthembayo lapho impendulo ifika.
Isibonakaliso: irekhodi elilungile, imigudu emidala
Iphrofayela egcina igama ayiyona iklayenti eqhubeka nokulixazulula. Iningi lixazulula kanye, lapho kusetshenziswa ukucushwa noma lapho umgudu ukhuphuka, bese isebenzisa lelo kheli kuze kuphele isikhathi. I-TTL ende ebekwe phezu kwalokho iyisizathu sokuthi ukushintsha kuhlelwe ngokuzungeza ukuxhuma kabusha, hhayi ngokuzungeza ukuhlela kwe-DNS.
Akukho kokubili lokhu kuziphatha okuyiphutha, futhi yikho okwenza isibonakaliso sidideke. Iklayenti lisebenza ngempendulo elayithola ngaphambili, futhi akukho lutho ohlangothini lweseva olukhombisa ukuthi yayiyiphi impendulo. Hlela ukuxhuma kabusha efasiteleni lesondlo futhi utshele abasebenzisi ukuthi bazobona ini, noma chitha ifasitele ngokuphendula amathikithi. Umgqa wemibiko efanayo umphumela ojwayelekile.
Ubani olawula igama, nokuthi iklayenti liqinisekisa ini
Ukulawula isifunda kunquma ukuthi ukufuduka kungahamba ngokushesha kangakanani. Gcina irekhodi kumbhalisi ongakwazi ukungena kuwo, futhi ubhale ukuthi ubani omunye ongayishintsha.
Ukuthembela akulandeli igama. Iklayenti elisekelwe ku-TLS lingahlola ubunikazi besitifiketi noma igama eliboshelwe, kuyilapho i-WireGuard iqinisekisa ukhiye womphakathi womlingani futhi ingalinaki neze igama lomsingathi. Lowo mehluko unquma ukuthi ukuhlela kwe-DNS kwanele yini noma iphrofayela ngayinye idinga umnyakazo omusha. Ukushintsha kwerekhodi akumele neze kugunyaze iphoyinti lokugcina elingakagunyazwa muntu.
Gcina ukufinyelela kokuphatha nokufinyelela kokubuyisa kude negama leklayenti lomphakathi. Ukulahlekelwa yi-akhawunti yokusingatha akumele futhi kukwehlise irekhodi eliqondisa amaklayenti. Gcina indlela yokubuyisa endaweni engaxhomekekile kumhlinzeki oyishiyayo.
Iklayenti ngayinye ilifunda nini kabusha igama
Isikhathi sokuxazulula siyisici seklayenti ngayinye, ngakho hlola ukusetshenziswa okusabalalisa ngempela ngaphambi kokuthembisa ifasitele lokushintsha. I-wg-quick ixazulula iphoyinti lokugcina lapho isixhumi esibonakalayo sikhuphuka futhi igcina lelo kheli kuze kuqale kabusha umgudu. Iklayenti le-OpenVPN lifuna igama lapho lixhuma, futhi ukuthi liphinda libheke lapho lixhuma kabusha kuncike kuzinketho zalo.
| Client | When it resolves | What it verifies |
|---|---|---|
| wg-quick | At interface start, cached for the session | Peer public key, not the name |
| OpenVPN 2.6 | On connect, possibly again on reconnect | Certificate identity or pinned name |
| Mobile clients | May hold the answer across sleep or a network change | Platform trust store, same certificates |
Amaklayenti eselula ayisimangaliso esijwayelekile, ngoba angagcina ikheli elixazululiwe phakathi kokulala noma ukushintsha kwenethiwekhi. Shicilela amarekhodi e-A ne-AAAA kuphela uma okubuyiselayo kuphendula emindenini yomibili. Ikheli eliphendula emndenini owodwa alifakazeli lutho ngomunye, futhi irekhodi le-AAAA elifile lengeza isikhathi sokulinda emzameni ngamunye. Bhala phansi ukuziphatha kokuxazulula kweklayenti ngayinye oyisekelayo, bese uhlola kumadivayisi abantu abawasebenzisa ngempela.
Ukuxhuma kabusha kuyisenzo somsebenzisi kumaklayenti amaningi, futhi iseva ayikwazi ukukuphoqelela. Faka lelo sinyathelo kunothi lesondlo, nomugqa mayelana nalokho umsebenzisi azokubona lapho kwenzeka.
Shintsha ngokusekelwe ebufakazini, bese uyeka iphoyinti lokugcina elidala
Ngaphambi kokushintsha, fakazela isendlalelo ngasinye kokubuyiselayo: umlaleli uyaphendula, i-firewall idlulisa iphothi, imizila ibuyela ngendlela efanele, igama lixazululeka ekhelini elisha, futhi ubunikazi obaziwayo buyamukelwa. Umlaleli owamukela ukuxhumana akafani nalowo oqeda ukuxhawulana, ngakho hlola ukuxhawulana hhayi iphothi. Gcina uhlu lokuhoxiswa lwamanje eduze kokucushwa, ngoba ikhophi yokugcina ebuyisiwe yakha kabusha uhlu lozakwethu njengoba lwalunjalo futhi ingavula futhi ukufinyelela osuvele ukwavalile. Bhala ukuthi wahlola ngobunikazi buni, ngoba «kuyasebenza» akusiyo ubufakazi umuntu angabuphinda.
getent hosts vpn.example.com
ss -lunp | grep 51820
wg show wg0 latest-handshakesNgesikhathi sokushintsha, bheka imizamo yokuxhumana kumaphoyinti wokugcina womabili ngobunikazi obufanayo. Iklayenti elisaqinisekisa ngokumelene nekheli elidala liyiphrofayela noma impendulo egcinwe kunqolobane engakaze yahamba. Yeka iphoyinti lokugcina elidala ngohlelo olunosuku, ngoba izinsizakalo ezimbili ezamukela ubunikazi obunye zishiya iminyango emibili ivuliwe.
Ukuhlolwa kokushintsha kuyisikhathi sokuxhumana sohlelo lokusebenza ngokusebenzisa iphoyinti lokugcina elisha, hhayi i-ping. Lapho leso sikhathi sisebenza futhi iphoyinti lokugcina elidala lingabhali mzamo ogunyaziwe emjikelezweni ogcwele wokuxhuma kabusha, ukufuduka kuphelile.