I-OpenVPN kusengu-443 isavinjiwe? Bheka ukuthi inethiwekhi ihlola ini

Iphothi engu-443 ishintsha inombolo, hhayi ukuma kwephrothokholi. Uma indlela ihlola noma iqeda i-TLS, isigaxa kanye nomzila womsingathi olungile yizivivinyo ezilandelayo.

Ithunge lixhuma lisuka kulayini wasekhaya bese limile kunethiwekhi yehhotela noma yehhovisi, futhi ukuthutha iseva kuphothi engu-443 akushintshanga lutho. Lowo mphumela uvamile ngokwanele ukuthi ube nokuma: iphothi kwakuyingxenye elula, futhi isinqumo esisele singesakho konke okuhlezi phakathi kwekliyenti neseva. Imibuzo emibili ixazulula izimo eziningi, futhi akukho neyodwa yayo emayelana namakhodi. Ingabe inethiwekhi yamukela ukuxhawulana kwe-TLS kulelo kheli, futhi ingabe ikliyenti igcina umzila oya esigaxeni sayo ngenkathi ithunge liphakeme?

Ukuxhawulana kwembula okungaphezu kwenombolo

Isilaleli se-VPN somdabu ku-TCP 443 sikhuluma iphrothokholi yaso kusukela kupakethe lokuqala. I-ClientHello inensimu yenguqulo, inani elingahleliwe kanye nohlu lwezandiso, futhi idivayisi efunda amakhulu ambalwa amabhayithi ingabona umehluko ngaphandle kokukhipha umfihlo walutho. Izinombolo zamaphothi zilula ukuzanelisa, futhi ukuma kwephrothokholi yikho okuhlolwa isihlungi ngempela. Imithetho ngokuvamile ibhalwa futhi ngokwephrothokholi, ngakho inqubomgomo ehlola i-TLS ayisho lutho nge-UDP.

Ummeleli osobala ofuna isikhathi se-TLS esivumelekile wehlisa ukuxhumana ngesikhathi sokusetha, ngokuvamile ngemva kokuqedwa kokuxhawulana kwe-TCP. Leyo ncazelo ibalulekile kamuva, ngoba isho ukuthi ilogi yekliyenti iyama ngemva kokusungulwa kwesokhethi.

Ukusonga ukuhamba kwedatha kwakha izindawo ezimbili zokwehluleka

Isigaxa se-TLS esifana ne-stunnel sibuyisela ukuma obekulindelekile: ikliyenti ixhuma kusilaleli sasendaweni, isigaxa sivula isikhathi se-TLS sangempela esiya kuseva ku-443, futhi isigaxa sesibili kuseva sidlulisela amabhayithi akhishiwe kudemon ye-VPN. Isikhathi sangaphandle manje sibukeka njenganoma yikuphi okunye ukuxhumana kwe-HTTPS. Idemon ye-VPN kuseva kufanele ilalele ku-loopback kuphela, ngoba akukho lutho olungaphandle kwesigaxa oludinga ukuyifinyelela.

Izinto ezintathu ezihlukene kufanele zihambisane ngalolo hlelo. Iphrofayela yekliyenti ikhomba kusilaleli sasendaweni, isitifiketi seseva sihambisana negama eliqinisekiswa yikliyenti, futhi ukudluliselwa ohlangothini lweseva kuqondise kuphothi edemon eyisebenzisa ngempela. Uma wehluleka kwenye yazo, ukuxhumana kufa ngaphambi kokufinyelela ungqimba lwe-VPN. Khona-ke ukungafani kwesitifiketi kubonakala njengephutha lesigaxa hhayi njengephutha le-VPN, futhi yingakho kufanelekile ukufunda womabili amalogo ndawonye.

Umzila oya esigaxeni uyisihewu

Ngokushesha nje lapho ithunge liphakama, umzila ozenzakalelayo ukhomba ngaphakathi kulo, futhi isikhathi se-TLS sangaphandle sidinga indlela engangeni kulelo thunge eliyithwelayo. Ikliyenti evamile ye-VPN ivikela ikheli eliyishayayo; ikliyenti esongelwe ishaya i-loopback yayo, ngakho ikheli lendawo okufika kuyo isigaxa alibonakali kulokho kuvikela.

sudo ip route add 198.51.100.20 via 192.168.0.1
sudo openvpn --config client.ovpn
sudo ip route del 198.51.100.20

Amakheli anembile uwafaka wena, futhi umzila kufanele ube khona isikhathi sokuphila konke kokuxhumana, hhayi ngesikhathi sokuqala kuphela. Iskripthi sesigaxa esincane esengeza umzila ngaphambi kwekliyenti bese siwususa ngemva kwaso sithembekile ukudlula umyalo okhunjulwayo.

Ku-Android, okulingana nalokho kukhetho yisimo sesethingi sesicelo ngasinye: khipha isicelo sesigaxa ethungeni ukuze ithrafikhi yaso siqu iphume ngoxhumano lweselula. Uma singakhishwa, isigaxa siqondiswa ethungeni elizama ukulakha, futhi umjikelezo wokuxhuma kabusha ubonakala njengenkinga yeseva.

Funda isikhathi ngaphambi kokushintsha noma yini

Isikhathi esifa ngemva kwesikhala esifanayo njalo siwukuphawula kwenqubomgomo hhayi ukwehluleka kwekhodi yomfihlo, futhi imikhawulo yokugeleza yesikhathi eside ikhiqiza lokho kanye. Ukuxhumana okusethwa kabusha ngokushesha ngemva kokuxhawulana kusikisela ummeleli ongayithandanga iketango yesitifiketi.

Qhathanisa umkhiphi wesitifiketi sesayithi ye-HTTPS evamile kusuka kunethiwekhi zombili. Uma umkhiphi ehlukile kunethiwekhi ekhawulelwe, kukhona okuphetha i-TLS phakathi, futhi asikho isigaxa esizosinda kulokho kungenelwa ngaphandle koshintsho. Ukufaniswa okufanayo kutshela ukuthi ukuvinjelwa kuqondise igama leseva lakho noma zonke izikhathi ze-TLS kulelo kheli.

Bhala indlela ebonwe: isikhathi sathatha isikhathi esingakanani, isokhethi yavuleka, isigaxa sibhale ukuxhawulana. Ngakunye kulokho kunciphisa isivivinyo esilandelayo.

Hlola into eyodwa ngesikhathi

Hlola i-UDP kuqala, ngoba ezinye izinethiwekhi ziyilahla ngokuphelele futhi ukwehluleka kwe-UDP akusho lutho ngo-443. Bese uzama i-TCP 443 ngaphandle kwesigaxa, bese kuba isigaxa ku-443. Funda ilogi yekliyenti esitebhisini ngasinye futhi ume ngokushesha lapho indlela ishintsha.

Shintsha into eyodwa esivivinyweni ngasinye. Iphothi entsha, isigaxa esisha kanye nekhodi entsha emzameni owodwa kukushiya ungakwazi ukusho ukuthi yikuphi kwezintathu okwakubalulekile.

Izihloko ezihlobene