I-OpenVPN ngemuva kwe-stunnel: dlulisa isembozo, hhayi iphothi engu-1194
Abalaleli ababili, amaphothi amathathu. Hlola lapho ukudluliswa kuhla khona, lapho isembozo sibopha khona, lapho sixhuma khona, okwashiywa ukuhlolwa kwasendaweni kanye nobuwili bobabili.
Beka isembozo se-TLS phambi kwe-OpenVPN bese ukusetshenziswa kuthola umlaleli wesibili, okunguwo oyedwa kuphela kuwo okufanele ubheke i-inthanethi. Lapho umhubhe usebenza kusuka emshinini ofanayo kodwa wehluleka ngaphandle, ukudluliswa ngokuvamile kuqondiswe kwelinye elingalungile kulawo mabili. Okufanele kuhambisane kuyiketanga: umthetho womphakathi ufika esembozweni, futhi ukuxhumana kwangemuva kwesembozo uqobo kufika kusokhethi ye-VPN yangempela. Ukweqa okune kuthwala lelo ketanga, futhi noma yikuphi kukho kungaqeda uphenyo ngaphambi kwesikhathi.
Amasokhethi amabili, abanikazi ababili, elinye liwumphakathi
Isembozo siqeda i-TLS kuxhumano lwangaphandle bese sidlulisela ukugeleza kwamabhayithi okususiwe ukubhala kumlaleli ojwayelekile we-OpenVPN TCP. Lawa amasokhethi ahlukene anamafayela wokuhlela ahlukene, ngakho ukuhlela elinye kushiya elinye lingathintekile futhi kubonakala liphilile. Kushiwo futhi ukuthi womabili angahlukana lapho elinye lishintshwa ngaphandle kwelinye.
Ukusebenza kusuka emshinini uqobo kufakazela okuncane mayelana nendlela yomphakathi. Ukuxhumana okuqondile kwiphothi yokuqala kweqa isembozo, ukuxhumana nesembozo ekhelini laso le-LAN kweqa ukuhunyushwa, futhi ukuhlelwa okuphelele kohlangothi lweklayenti kuphela okuqeqesha lokho okwenziwa umsebenzisi wangaphandle. Amagama nawo kufanele afundwe ngokucophelela, ngoba localhost kusho umsingathi osebenzisa leyo ngxenye ethile, hhayi umsingathi okuqondile okutayipha kuwo. Gcina lowo mehluko emanothini akho, ngoba ukuhlolwa okubhalwe ngaphandle kokusho ukweqa okwakuyigubungela kumema ukuqhathaniswa kwezinto ezimbili ezahlukene.
Ukudluliswa kuhla kuphi ngempela
Iketanga kulula ukulibamba njengokweqa okune kunokuba kube izinombolo zamaphothi amathathu, ngoba inombolo efanayo ingasho izinto ezahlukene emaphethelweni womabili. Funda ithebula umugqa ngomugqa: umugqa ngamunye uyisokhethi elilodwa okufanele lamukele ukuxhumana bese livula elilandelayo. Lapho umugqa uqondiswe kumlingani ongalungile, uphawu olusekholomu yokugcina yilokho okubikwa umsebenzisi.
| Hop | Listens on | Must reach | Symptom when it points elsewhere |
|---|---|---|---|
| Client machine | A local plaintext port | The wrapper's public TLS address | Plain text offered to a TLS endpoint |
| Router forward | Public TCP 443 | The wrapper host on its translated port | Wrapper records no connection at all |
| Wrapper, server mode | Its accepted port, 8443 here | The native VPN socket on loopback | Handshake completes, then silence |
| Native VPN listener | Loopback TCP port | Its peer, over TCP only | A UDP socket behind a byte-stream relay |
Umthetho oqondise kwiphothi ye-VPN yokuqala esikhundleni sesembozo weqa ngokuphelele ukuqedwa kwe-TLS, futhi lona wuhlobo oluvame kakhulu lwale phutha: iklayenti livula ukuxhawulana ngesandla nomlaleli olindele ukuhlanganiswa kwe-OpenVPN, ngakho ukuxhumana kungavuleka bese kuma. Qinisekisa iphothi elihunyushwe ngokubhekisela kufayela lokuhlela lesembozo hhayi enkumbulweni, ngoba umuntu olandelayo ozohlela lelo fayela kungenzeka ukuthi ukhethe enye inombolo. Imiyalo emibili engezansi ibonisa izinhlangothi zombili zalo mbuzo ngasikhathi sinye.
grep -nE '^[[:space:]]*(accept|connect)' /etc/stunnel/stunnel.conf
ss -lntp | grep -E ':443|:8443|:1194'Ikheli lokubopha elikwenqabayo
Umugqa we-accept oboshelwe ku-127.0.0.1 uphendula kuphela kumsingathi uqobo, ngakho ukudluliswa okufika ekhelini le-LAN akukwazi ukuxhuma futhi iklayenti libona ukwenqatshwa okuzwakala njengenkinga yesihlungi samaphakethe. Bheka isokhethi ngaphambi kokuthinta udonga lomlilo, ngoba isokhethi iyimpendulo eshibhe kakhulu. Noma bopha isembozo kusixhumi esibonakalayo okubhekiswe kuso ukudluliswa, noma siyeke ku-loopback bese wenza ukuthi ukudluliswa kufinyelela ku-loopback ngokusebenzisa into esebenza ngempela. Lezi izinhlobo ezimbili zomklamo, futhi ngayinye idinga umthetho wayo.
Ukuzihlanganisa yikho okwenza isembozo esisebenzayo singafinyeleleki ngaphandle kuyilapho wonke amafayela ebukeka elungile. Ukuhlolwa okungezansi kungumyalo owodwa, futhi kuphendula umbuzo ongakwazi ukuphendulwa ukubuyekezwa kwemithetho yodonga lomlilo. Uma umphumela ubonisa ikheli le-loopback kuyilapho ukudluliswa kubhekise ekhelini le-LAN, ukulungiswa kungokwasekholomu ye-accept, hhayi kwesihlungi samaphakethe.
ss -lntp '( sport = :8443 )'Ukuhlolwa kwasendaweni kwafakazela ini ngempela
Impumelelo ebhalwe ngaphandle kokusho ukweqa okwakuyigubungela akubona ubufakazi mayelana nokunye ukweqa. Bhala ukuthi ukuhlolwa kwasebenzisa liphi ikheli nokuthi iyiphi inqubo ephendulile. Bese uphinda ngaphandle kwenethiwekhi hhayi ocingweni olukwi-Wi-Fi efanayo, ngoba ukuziphatha kwe-hairpin kuyahluka phakathi kwamarowutha futhi ukuxhumana okungakaze kuphume ku-LAN kungagculisa iklayenti ngaphandle kokuthi ukudluliswa kuhlanganyele nhlobo. Yilowo mzamo wesibili kuphela ozilolonga indlela ehamba ngayo umuntu ongaziwa.
Uma umzamo uhluleka, landela ukuxhumana okukodwa kuzo zombili izingqikithi: imigqa eyamukelwe nexhunyiwe yesembozo, bese kuba ingqikithi yesesheni yedemon ye-VPN uqobo. Umngcele wokuqala ongabhali lutho yiwo okufanele kube khona ushintsho olulandelayo. Lapho i-OpenVPN iqala ukuqhathanisa izinketho zomlingani, ahlulele lawo mayezi ngemithetho yalokho kusetshenziswa. Isexwayiso sokungavumelani kwe-link-mtu akubulali ngokuzenzakalela, ukubophela i-link-mtu ku-1500 akufakazeli ukuthi ukuhlukaniswa kumile, futhi ukuxoxisana nge-cipher kungokokuhlela kwangaphakathi kwe-OpenVPN hhayi ukudluliswa kwerowutha.
nc -vz 127.0.0.1 1194
journalctl -u stunnel -n 50 --no-pagerLokho kuhlola kuhlanganisa isokhethi yangemuva kanye nengqikithi yesembozo, okuhlukanisa ingemuva elenqatshiwe nokuxhawulana ngesandla okwenqatshiwe. Kugijimise ngesikhathi umzamo owodwa uqhubeka hhayi ngemva kwawo. Izitembu zesikhathi zomzamo owodwa yizo ezenza ukuqhathanisa kuthembeke.
Ubuwili obubili, ukulandelana kokwehluleka okubili
Isitifiketi sangaphandle singesesembozo futhi ubuwili bangaphakathi bungobuka-OpenVPN, futhi kungenzeka buvela eziphathimandla ezahlukene. Ukucisha noma yikuphi kokuhlolwa okubili ukuze indlela ibukeke iphilile kushintshanisa isivikelo sangempela ngomphumela wobuso. Gcina zombili iziqinisekiso bese uzilungisa ngokulandelana, ngoba ukulandelana kwemilayezo kubiza isendlalelo: inkinga yesitifiketi sesembozo ivela ngaphambi kokuxoxisana nganoma yikuphi ukukhetha kwe-VPN, kuyilapho ukwehluleka kobuwili bangaphakathi kuvela kuphela lapho ukugeleza sekusungulwe.
incwadi ye-stunnel ichaza ngokunemba i-accept, i-connect kanye nemodi yeklayenti, futhi lezo zigaba ziphendula umbuzo wesokhethi ngokushesha kunokuqagela. Uma ungakwazi ukusho ukuthi yisiphi isendlalelo esiphendulile, funda isitifiketi esivezwa iphothi lomphakathi ngomyalo ongezansi. Ukuba khona kwesitifiketi sesembozo kumphumela kusho ukuthi ukudluliswa kwafika esembozweni, futhi ukuthula noma iphutha lephrothokholi kusho ukuthi akufikanga. Lowo mehluko owodwa wonga isikhathi esiningi kunanoma yikuphi okunye ukuhlolwa lapha.
openssl s_client -connect vpn.example:443 -servername vpn.example </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer