I-VPN Enamathelene: Iyiphi Ithuneli Ethwala Ukuxhumana Kwangaphandle?

Amaklayenti amabili e-VPN asebenza ngesikhathi esisodwa awakhi ithuneli elinamathelene; akha amathuneli amabili kanye nengxabano mayelana nokuhlelwa komzila. Ithuneli elinamathelene likhona lapho ukuxhumana kweklayenti langaphakathi nesiphakeli salo siqu kuthwalwa yithuneli langaphandle, futhi lokho kuwuhlelo olwakhiwe ngamabomu. Uma kwenzeka kahle, isiphakeli sangaphakathi sibona ikheli lesiphakeli sangaphandle; uma kungahambanga kahle, iklayenti elilodwa lixhuma kabusha buthule lizungeza elinye. Izimo ezintathu zinquma ukuthi ukunamathela kungokoqobo noma kungukwenzeka nje.

Izimo ezintathu zinquma ukunamathela

Esokuqala ukuthi iyiphi indawo yokugcina edinga umzila onjani. Shono ikheli lesiphakeli sangaphakathi, shono ikheli lesiphakeli sangaphandle, futhi usho ngokusobala ukuthi isiphakeli sangaphakathi sifinyeleleka kuphela ngethuneli langaphandle. Konke okunye kuvela kulo musho, kuhlanganise nokuthi imiphi imizila esethebuleni okuthile.

Esibili ukuthi uyawubona yini umzila esigabeni ngasinye. Uma ungakwazi ukubuza i-kernel ukuthi imuphi umzila ozosetshenziswa yindawo ethile, uthola iketanga kusukela ku-IP yokugcina yokuphuma, futhi lokho kanye ubufakazi obungeke buhlukanise ukunamathela nokwenzeka nje.

Esithathu ukuthi kwenzekani lapho ithuneli langaphandle liwa. Ithuneli langaphakathi lingama kanye nalo, lixhumeke kabusha ngenethiwekhi evamile, noma lihlale livinjiwe kuze kubuya indlela yangaphandle, futhi zontathu izinqubomgomo ezingavikelekayo. Akuzona inqubomgomo eyodwa, futhi ukuziphatha okuzenzakalelayo kwamaklayenti amaningi okwesibili. Iklayenti elixhuma kabusha indawo yalo yokugcina ngenethiwekhi ebonakalayo ngenkathi likhombisa ukuxhumana okunempilo yiyo indlela evame kakhulu yokuthi iketanga elihlosiwe lube ngamathuneli amabili angenabudlelwano buthule.

Isimo sokuqala: iyiphi indawo yokugcina edinga umuphi umzila

ip route get 203.0.113.10 liphendula lowo mbuzo ngqo: liphrinta umzila, ikheli lomthombo, kanye ne-interface i-kernel eyayizoyisebenzisa kulowo mkhondo njengamanje.

Yisebenzise kusiphakeli sangaphakathi ngaphambi kokuthi iklayenti langaphakathi liqale futhi futhi ngemuva kwalokho, bese uqhathanisa. Uma impendulo ishintsha isuka ku-interface ebonakalayo iya ku-interface yethuneli langaphandle, ukunamathela kungokoqobo ngaleso sikhathi. Uma ingashintshi, iklayenti langaphakathi lixhuma ngqo, noma yini eshiwo yipaneli. Phinda lokhu ekhelini lesiphakeli sangaphandle, okusadinga ukuxazululwa nge-interface ebonakalayo, ngoba umzila obamba zombili izindawo zokugcina ngokuphindaphinda yikhona ukwehluleka okukhipha umshini kunethiwekhi ngokuphelele.

Isimo sesibili: hlola umzila esigabeni ngasinye

Ukukhethwa komzila kungaphezu kwethebula eliyinhloko kuklayenti lesimanje. Imithetho yenqubomgomo ingathumela amaphakethe amakwe kulethebula elinye, iklayenti lingabopha isokhethi yalo ku-interface, futhi i-container noma i-namespace inamathebula ayo. ip rule kanye ne-ip route show table all yizona zindlela zokuthola ukuthi iyiphi yalezi zinhlelo ezisebenzayo.

Iklayenti elibeka i-SO_MARK kusokhethi yalo, noma elilungiselelwe ukubopha kudivayisi ethile, lidlula umzila ozenzakalelayo obucabanga ukuthi uwuhlelile. Lokhu kuyisici hhayi iphutha, futhi kusho ukuthi ukuhlola okuwukuphela kokuthembekile yikho okusebenza kuyi-namespace efanayo neklayenti. Uma amaklayenti esebenza kuma-container, sebenzisa ukuhlola kulawo ma-container hhayi kusiphakeli esikhulu.

Isimo sesithathu: kwenzekani lapho ithuneli langaphandle liwa

Ukuziphatha lapho kwehluleka kudinga isinqumo, hhayi inani elizenzakalelayo. Bhala ukuthi kufanele kwenzeke ini kuthuneli langaphakathi lapho elangaphandle linyamalala, bese wenza amaklayenti enze kanjalo.

Izinketho zisobala. Ukumisa iklayenti langaphakathi lapho indlela yangaphandle inyamalala kunikeza iketanga elihlanzekile nokuphazamiseka okusobala. Ukuyeka lixhume kabusha ngqo kunikeza ukutholakala futhi kususa buthule isici iketanga elalakhelwe sona. Ukuvimbela kuze kubuya indlela yangaphandle kuyisinqumo esiqine kakhulu nesihlupha kakhulu ukuphatha, ngoba konke ukudlikiza kwethuneli langaphandle kuba isigameko esibonakalayo.

Hlola zontathu ngethrafikhi engenabungozi kanye nokwehluleka ngamabomu kwethuneli langaphandle, ngoba ukufunda ukulungiselela ngeke kukutshele ukuthi unakho okunhani. Bulala ithuneli langaphandle, bheka ukuthi iklayenti langaphakathi lenza ini, futhi uphinde uhlole umzila ngenkathi liwile. Bese ubuyisela ithuneli langaphandle futhi uqinisekise ukuthi iketanga lakheka kabusha esikhundleni sokushiya iklayenti langaphakathi emzileni oqondile eliwukhethile phakathi nalokho.

Lokho iketanga elingakuniki

Izendlalelo ezingeziwe zengeza izindawo zokugcina, okhiye kanye nezindlela zokwehluleka; azengezi isiqinisekiso sokungaziwa futhi azivimbeli umqhubi wangaphandle ukubona ukuthi ikhona ithuneli. Noma yisiphi isimangalo mayelana nokuthi ukunamathela kuvikela ini kufanele sisho umbukeli okusivikela kuyo.

Umphumela yidokhumenti emfushane hhayi ukuxhumana okusebenzayo: iyiphi indawo yokugcina esebenzisa umuphi umzila, kwenzekani lapho kwehluleka kwangaphandle, kanye nemiyalo emithathu ekhombisa isimo samanje. Imibhalo ye-strongSwan mayelana nokudlulisa iyisandla esiwusizo mayelana nokuthi ithrafikhi yethuneli idluliswa kanjani phakathi kwama-interface kusiphakeli se-Linux. Phinda uhlole ngemuva kokubuyekezwa kweklayenti ngakunye, ngoba amanani ozenzakalelayo akha iketanga lakho awasona isivumelwano. Ithuneli elinamathelene ongakwazi ukulihlola iyindaba enombani wesimo.