I-relay ye-stream ye-Nginx ye-UDP ye-OpenVPN: yini eshintshayo

Iklayenti lakho lisethwe ku-UDP, iseva ye-Nginx inebhlokhi ye-location ekhomba kuphothi ye-VPN, futhi akukho okufikayo. Lokho kulindelekile: i-location ye-HTTP ayikwazi ukuthwala i-datagram ye-UDP, noma ngabe ingxenye yangaphambili ibizwa ngani. I-Nginx idinga umlaleli we-stream kulokhu, futhi uma usuwuhambisile ukucushwa lapho, iqoqo lesibili lemininingwane linquma ukuthi iseshini izophila yini.

I-layer ye-proxy iza ngaphambi kwekheli

Imoduli ye-stream ye-Nginx yenza i-proxy ye-TCP ne-UDP ngaphandle kokuhlaziya i-HTTP. Imoduli yayo ye-HTTP ilindele umugqa wesicelo, amakhanda kanye nempendulo, futhi akukho kulokho okukhona kudathagram yemvelo ye-OpenVPN. Ukukhetha i-layer yisinqumo sokuqala, futhi akuncikile ekutheni umlaleli yi-IPv4 noma i-IPv6.

Ukucushwa okubonakala kusebenza ne-OpenVPN ku-TCP akusho lutho mayelana necala le-UDP. Ukuthutha lapha kuyingxenye yephrothokholi, hhayi imininingwane yokuthunyelwa.

Umlaleli kanye ne-backend

nginx -V 2>&1 | tr ' ' '\n' | grep stream

stream {
    server {
        listen [::]:1194 udp reuseport;
        proxy_pass [2001:db8::20]:1194;
    }
}

Qinisekisa ukuthi i-build ihlanganisa imoduli ye-stream ngaphambi kokuhlela noma yini; iphakethe lokusabisa lingayihlukanisa ibe imoduli ehlukile, futhi imoduli engekho ikhiqiza iphutha lokucushwa esikhundleni somhubhe. Beka ibhlokhi kumongo oyinhloko wokucushwa, hhayi ngaphakathi kwe-http, futhi shintsha ikheli ledokhumenti nge-backend yangempela.

Kokubili imizila kanye nezindonga zomlilo ezimbili kufanele kuvumele ama-datagram: indlela eya kumlaleli kanye nendlela esuka ku-proxy iya ku-backend. Umlaleli we-IPv6 nawo awakhi indlela ye-IPv4, ngakho-ke uma amanye amaklayenti asasebenzisa i-IPv4, lowo mlaleli uyingeno ehlukile enokuhlolwa kwayo. Hlola udonga lomlilo lwe-backend uqobo kusuka ekhelini le-proxy, hhayi kusuka kukhompyutha yakho ephathekayo.

Izikhathi zokuvalwa kweseshini akuzona izikhathi zokuvalwa kwesicelo

I-proxy ye-stream igcina isimo seseshini ye-UDP futhi iyilahle ngokwesikhathi sayo sokuvalwa kanye nezilungiselelo zempendulo. Isikhathi esifushane esikhotshelwe ku-relay ye-DNS asifanele i-VPN elindele ukushintshana ngama-datagram amahora, futhi ukwehluleka kubonakala njengokuxhumana okufa ngokuthula hhayi okwenqaba ukuqala.

Funda i-proxy_timeout esebenzayo yokuthunyelwa kanye nanoma yisiphi isilungiselelo sokubala izimpendulo, bese uziqhathanisa nokuziphatha kwe-keepalive i-VPN eyisebenzisayo ngempela. Izinombolo ezimbili ezibhalwe ngabantu abahlukene kumafayela ahlukene ziyisimo esijwayelekile sohlelo olusebenzayo. Izinombolo ezimbili ezingakaze ziqhathaniswe ziyisimo esijwayelekile sohlelo oluyeka ukusebenza ngezikhathi ezithile. Bhala zombili encwadini yesevisi ukuze ukuqhathanisa kwenzeke kanye, ekukhanyeni kwemini.

Yini i-relay eyishintshayo, nani engayishintshi

I-proxy ye-stream ayiqedi ishaneli yokulawula ye-TLS ye-OpenVPN futhi ayiyiguquli ibe yi-HTTPS. I-backend ihlala iyisevisi ye-VPN, futhi ubudlelwano besitifiketi buhlala phakathi kweklayenti naleso sevisi. Ukugcina ubunikazi be-backend obuhlosiwe kusewumsebenzi weklayenti nesiseva.

I-proxy evamile nayo ishintsha ikheli lomthombo i-backend elibonayo. Amalogi azobonisa i-proxy, futhi noma yimuphi umthetho wokufinyelela osekelwe ku-IP kuseva ye-VPN uzohlola lelo kheli esikhundleni selakho iklayenti. Ukugcinwa komthombo obala kuwumklamo ohlukile womzila nezimvume, hhayi into evela ekwengezweni kwe-udp kumlaleli. Hlela lokho ngaphambi kokuba kubhalwe inqubomgomo encike ekhelini leklayenti.

Qinisekisa kusuka kuklayenti, hhayi kuphothi

Ukuhlolwa kwendawo kokuthi iphothi ye-UDP ivuliwe kufakazela ukuthi umlaleli ukhona. Akufakazeli ukuthi iklayenti lingaqinisekisa ngalo noma liqhubeke nokushintshana ngezinto ezihambayo. Qedela ukuxhumana kwangempela kusuka kuklayenti eligunyaziwe, bese uqinisekisa ukuthi iseshini ihlala isikhathi esanele ukuze ibe nengqondo.

Uma othile ebika ukuthi i-Nginx ayikwazi i-UDP ngoba ithuluzi le-relay elilula lisebenze esikhundleni sayo, lawo maqiniso amabili awahlobene. Ithuluzi lafakazela ukuthi i-backend iyaphendula; alisho lutho mayelana nalokho okusekelwa ingxenye yangaphambili. Kokubili kungaba yiqiniso, futhi okukodwa kuphela kukho okuwukucushwa kwalokhu kuthunyelwa.