OpenVPN nge-SOCKS5: ukufanisa inguqulo, ukuthuthwa ne-DNS

Enye indlela yokuphuma kulesi siteshi somsebenzi i-proxy ye-SOCKS, futhi i-OpenVPN engemuva kwayo ibika ukuphela kwesikhathi sokuxhumeka ngaphandle kwemininingwane ewusizo. Isiphequluli esikuleso sikhameli sisebenza ngaleyo proxy, imininingwane yokungena ilungile, futhi imbobo iyaphendula. Izinto ezintathu zihluka ngokwanele ukuba zihlolwe kuqala: inguqulo ye-SOCKS okhuluma ngayo i-proxy, ukuthuthwa okukhethwe yiklayenti, kanye nendawo okwenzeka kuyo ukuxazululwa kwamagama. Qinisekisa ngayinye ngaphambi kokuthi usole ucingo lomlilo.

Fanisa inguqulo ye-SOCKS ngaphambi kocingo lomlilo

I-OpenVPN yomphakathi ikhuluma i-SOCKS5 ye-socks-proxy. Yiqondise ku-proxy enikeza i-SOCKS4 kuphela, ukuxhumeka kwe-TCP kuyavuleka bese kuma, ngoba iklayenti ilindele impendulo yokubingelela okungayihlaziyi neze uhlangothi olunye. Ngaphandle, lokhu kuma kubukeka ngokufana nembobo ehlungiwe, yingakho umbuzo wenguqulo uza ngaphambi komthetho wonke wocingo lomlilo. Ukulanda okwazi i-SOCKS kukuxazulula ngomyalo owodwa.

curl --socks5-hostname 127.0.0.1:9050 gw.lab.example

Isicelo esiqediwe sifakazela izinto ezimbili ngasikhathi sinye: i-proxy yamukele isicelo se-SOCKS futhi yaxazulula igama. Asikho isikimu se-URL esidingekayo, ngoba i-curl ithatha isiphequluli esingenalutho njenge-HTTP, futhi lokho kwanele kulolu vivinyo.

Lokho kulanda futhi kususa ukwehluleka okukufihla kwilog yeklayenti. I-proxy ingavumela isiphequluli kodwa inqabe indawo ye-VPN, lapho ukunqaba kwenzeka ku-CONNECT, ngaphambi kwanoma yikuphi ukuqinisekiswa kwe-VPN. I-OpenVPN ibika ukuphela kwesikhathi kuphela, ngakho impendulo ye-proxy ngokwayo ingubufakazi obudingayo.

Ukuthuthwa kufanele kube i-TCP kuzo zombili izinhlangothi

I-SOCKS5 ithwala umfudlana we-TCP lapha, ngakho ithumbu ngokwalo lidinga i-proto tcp-client. Iphrofayela esalungiselelwe i-UDP ngeke isebenze kule ndlela, ngoba iklayenti ayisebenzisi imodi yokuhlangana ye-UDP yeprotocol. Ukuphendula iphrofayela wushintsho lwangempela hhayi umkhuba: uhlangothi olukude kufanele lilalele i-TCP embotsheni efanayo. Bese umthwalo uba i-TCP ngaphakathi kwe-TCP, lapho ingxenye elahlekile ithunyelwa kabusha kabili futhi ijubane lehla, okubonwa kakhulu yizikhathi zokuxhumana kunokudluliswa okukhulu.

proto tcp-client
remote gw.lab.example 8443
socks-proxy 127.0.0.1 9050

Lo myalo uthatha isiphequluli se-proxy, imbobo engakhethwa kanye nefayela lemininingwane yokungena elingakhethwa. Zibeke kuphrofayela uqobo ukuze ikhophi kwenye indawo yenze okufanayo.

Valela lonke uchungechunge kusiqukathi esisodwa

Ukwenza uchungechunge kusiphequluli kusho ukuthatha indlela yaso ezenzakalelayo nokushiya isixazululi esimweni okungekho muntu ongayichaza kamuva. Indawo yamagama noma isiqukathi iwukhawulela esikhundleni salokho, ngakho isiphequluli sigcina indlela yaso ngesikhathi ukugxuma kwe-SOCKS nethumbu kuhlala ndawonye. Akukho okukhuphukayo ngaphakathi ngaphandle kwedivaysi yethumbu, amalungelo okulungiselela leyo divaysi kanye ne-proxy efinyelelekayo. Isevisi ye-Compose ikuthola nge-cap_add: NET_ADMIN ne-/dev/net/tun efakwe nge-bind.

cap_add:
  - NET_ADMIN
devices:
  - /dev/net/tun:/dev/net/tun

Lokhu kubhangqa kuncane kunokuqhuqha isiqukathi ngamalungelo aphelele, futhi iyona yonke indlela yokufinyelela idivaysi edingekayo. Iklayenti ye-Tor noma isiqukathi se-proxy esihlukile kunganikeza umlaleli. Kuzo zombili izimo sibophe ku-loopback, bese usifinyelela kusuka endaweni yamagama ngesiphequluli esikhundleni sokuveza i-proxy kunethiwekhi.

Ukuxazululwa kwamagama yikho lapho ukuhlukaniswa kwehluleka khona

Ithumbu elithwala amaphakethe kodwa libuze isixazululi sesiphequluli alihlukanisanga lutho. Izinto ezimbili zenza ukuhlukaniswa kube kwangempela: indawo yamagama inesixazululi sayo, futhi imibuzo yayo idlula ku-proxy noma ethunjini, ayidluli noma nini kusixhumi sangempela. Sebenzisa amagama amabili esivivinyweni: elilodwa elikhona ngemuva kwethumbu kuphela, nelinye elomphakathi okufanele lilandele indlela efanayo.

docker compose exec vpn cat /etc/resolv.conf
docker compose exec vpn getent hosts internal.lab.example

Uma igama elikude lixazululwa kanti elomphakathi alixazululwa, uchungechunge lukhetha hhayi ukuphuka, futhi umehluko ukutshela ukuthi umbuzo ngamunye uthathe yiphi indlela. Uma womabili exazululwa kusiphequluli kodwa akukho noyedwa oxazululwa ngaphakathi kwesiqukathi, isiqukathi sisaboleka isixazululi sesiphequluli. Bhala ifayela lesixazululi olitholile, ngoba yisilungiselelo lokho okufanele sishintshwe.

Fakazela ukugxuma ngakunye ngokulandelana

Uhlu lufushane. Isicelo se-SOCKS5 sithola impendulo, ithumbu lifinyelela umlaleli walo nge-proxy, namaphakethe aphuma endaweni yamagama athwala ikheli uhlangothi olukude olulindele. Qinisekisa ngakunye ngesikhathi esisodwa esikhundleni sokwengeza ukulungiselela okunye. Uma iklayenti lithi kuxhunyiwe futhi akukho okunyakazayo, ukuphuka cishe njalo kusefakazini lesibili noma lesithathu.

curl --socks5-hostname 127.0.0.1:9050 gw.lab.example
docker compose exec vpn ip route get 203.0.113.10
docker compose exec vpn getent hosts internal.lab.example

Bhala inhlanganisela eyasebenza: inguqulo ye-SOCKS, ukuthuthwa, isixazululi nezilungiselelo zendawo yamagama. Ukuxazulula lolu chungechunge okwesibili ngokukhumbula kubiza kakhulu kunombhalo. Gcina lawo maqiniso amane kuthikithi hhayi engxoxweni.

Uchungechunge olubika ukuthi kuxhunyiwe futhi olungadlulisi lutho luvame ukwehluleka ekugxumeleni ongakakufakazeli. Hlola lokho kugxuma ngaphambi kokwengeza olunye ungqimba.