Iphothi elilodwa le-OpenVPN, izinsizakalo ezintathu: kungani amaphothi angaphakathi ebalulekile

Isikhathi esisodwa se-SSH, uhlelo lokusebenza lwewebhu olulodwa kanye nokusesha igama okukodwa kungabelana ngoxhumano olulodwa lwe-VPN ngaphandle kokulwela amaphothi. Iklayenti lakha ukuhamba okubethelwe okukodwa okuya kusango, futhi yonke ingxoxo yohlelo lokusebenza ihamba ngaphakathi kwayo. Ngaphandle kubonakala kuphela ukuthutha nophothi lombhubhe ngokwawo. Ngaphakathi, insizakalo ngayinye igcina iphothi layo futhi isadinga imvume yayo.

Ukuhamba kwangaphandle kuthwala ini, futhi kufihla ini

Iklayenti lisonga iphakethe ngalinye ekuthutheni kombhubhe ngaphambi kokuba liphume emshinini. Lokho kuhamba kwangaphandle kunephothi elilodwa lendawo, eliqiniswa ngenkathi i-VPN ilungiswa. Ngaphakathi kwesongelo, iphakethe ngalinye lokuqala ligcina ikheli nephothi yensizakalo eliyiqondisile. Isango lisusa isongelo futhi lihamba ngokwesiqondiso saphakathi, ngakho indawo ibona iklayenti elijwayelekile elifika livela kunethiwekhi.

Ngakho ukubamba kusixhumi se-WAN kubonisa ingxoxo eyodwa, hhayi ezintathu. Amaphothi angaphakathi avela kuphela ngemuva kokukhipha isongelo. Yingakho imbobo eyodwa yodonga lomlilo ingathwala i-SSH, i-HTTPS ne-DNS ngesikhathi esisodwa.

# WAN side: one outer tuple, whatever the inner services are
tcpdump -ni wan0 'udp port 443'
# tunnel side: the inner tuples appear after decapsulation
tcpdump -ni tun0

Idokhumenti ye-TUN/TAP ichaza ukudluliswa lapho idivayisi ye-TUN ehamba ngomzila idlulisa amaphakethe e-IP phakathi kwe-kernel nenqubo yesikhala somsebenzisi. Lokho kudluliswa yikho okwenza isiqondiso sangaphakathi sibonakale kukhodi yomzila nodonga lomlilo lwesango. Iphinde ichaze ukuthi kungani iphothi langaphandle lingasho lutho mayelana nokuthi iziphi izinsizakalo zivunyelwe.

Ukudluliswa kwe-NAT kungokwesilaleli, hhayi izinhlelo zokusebenza

Isango elizihosha ngokwalo ngemuva kwe-NAT ye-IPv4 lidinga ukuhunyushwa okukodwa kokungena: ikheli nephothi lomphakathi kuhlanganiswa nesilaleli se-VPN. Akukho mthetho odingekayo we-SSH, i-HTTPS noma i-DNS ngoba nje abasebenzisi bombhubhe bayafinyelela. Ukushicilela lawo maphothi kungadalula izinsizakalo umhubhe osuvikela zona. Umthetho wokudlulisa uchaza ukufinyeleleka kwesilaleli, hhayi imvume yanoma yini engaphakathi.

Okuphambene nakho kuyiqiniso. Ukuvula iphothi lombhubhe akudaluli enye into, ngakho insizakalo efinyeleleka kuphela ngomhubhe igcina ingaphezulu layo lomphakathi livaliwe. Lokho kwehlukana ngokuvamile kuyisizathu sokugcina insizakalo iyimfihlo.

Inqubomgomo yangaphakathi yindawo lapho ukufinyelela kunqunywa khona ngempela

Ukubethela kuvikela indlela; akuginisekisi indawo. Imizila yeklayenti ikhetha ukuthi yimiphi imikhawulo engena emhubheni, inqubomgomo yokudlulisa yesango inquma ukuthi amaphakethe angaphuma yini, futhi udonga lomlilo nokungena kwendawo kunquma ukuthi insizakalo izophendula yini. I-DNS iyisimo esicace kakhulu: ukuthwala imibuzo akwenzi isisombululi samukele imibuzo kusuka echibini lakho lamaklayenti. Isendlalelo ngasinye singasho cha ngokuzimela.

Hlola insizakalo ngayinye ngokwehlukana ngomhubhe. Ukusesha okuphumelelayo akusho lutho mayelana nephothi yewebhu, futhi isicelo sewebhu esiphumelelayo asisho lutho mayelana ne-SSH.

dig @10.40.0.53 app.corp.example
nc -vz 10.40.0.10 8443
ssh -p 2222 [email protected]

Lapho umhubhe usebenza futhi konke kwehluleka, funda kuqala ithebula lemizila yeklayenti. Lapho insizakalo eyodwa yehluleka kanti ezinye ziyasebenza, iphutha lisekulowo nalowo mkhakathi. Lokho kubona okubili kukhomba kubanikazi abahlukene, futhi ukukuhlanganisa kuchitha isikhathi.

I-WireGuard idweba umugqa ofanayo

I-WireGuard ibiza isilaleli sayo sangaphandle ListenPort, futhi uhlelo lokusebenza lwangaphakathi lusasebenzisa iphothi lensizakalo eliyidingayo. AllowedIPs iyisethi yemikhawulo ehamba ngomzila, hhayi uhlu lwamaphothi ensizakalo avunyelwe. Ukuliyifunda njengohlu lwemvume yephothi kukhiqiza imithetho engahambisani nokwenziwa umhubhe. Ukuqamba kuhlukile; ukugqamisa akuhlukile.

Vumela insizakalo kunqubomgomo yokufaka yasendaweni lapho isebenza kusihambisi uqobo, noma kunqubomgomo yokudlulisa lapho ingemuva kwalowo sihambisi. Umehluko unquma ukuthi iyiphi isethi yemithetho ebona iphakethe.

Isimo esijwayelekile ukuthutha okukodwa kwangaphandle okunezingxoxo eziningi zangaphakathi. Imikhiqizo edinga ukushintshana okuningi kwangaphandle, noma enye iphrothokholi ye-IP, ikhumbuza ukuthi iphethini yephothi elilodwa lomphakathi ichaza lo mklamo hhayi wonke ama-VPN.