I-OpenVPN ngokusebenzisa i-proxy ye-HTTP: funda kuqala impendulo ye-CONNECT
I-proxy ye-CONNECT idlulisa amabhayithi, ngakho zombili iziphetho zidinga i-TCP. Funda u-407, 403 no-503 ngaphambi kokusola izitifiketi, futhi ugcine ukuqinisekiswa kweseva kuvuliwe.
Qondisa iklayenti ye-VPN ku-proxy ye-HTTP yebhizinisi, futhi iqiniso lokuqala eliwusizo ukuthi i-proxy ayikhulumi iphrothokholi ye-VPN. Ivula uxhumano oluvamile lwe-TCP iye ekhelini olikushilo bese isuka eceleni, ishiya iklayenti lakho neseva benza ukushintshana kwabo ngokwabo ngalolo chungechunge. Konke iklayenti elikudingayo, kusukela ohlotsheni lokuthutha kuya kumlaleli weseva, kufanele kuhambisane nalolo hlelo. Ukungafani okubili kuchaza ukwehluleka okuningi: iphrofayela ye-UDP eqonde ku-proxy ye-CONNECT, kanye nempendulo ye-proxy ethathwa ngephutha njengephutha le-VPN.
Okuthwelwa i-proxy, nokungakuthwali
I-proxy iyisigaba sokuthutha kuphela. Ayibi i-proxy yesiphequluli sakho, ayigcini kukhashi amasayithi owavakashela kuwo ngomhubhe, futhi ayiboni ithrafikhi yangaphakathi ngaphandle uma othile ehlele ukuhlola ngamabomu. Umhubhe ewuvulayo awucaci kuyo ngokomklamo.
Lokho futhi kusho ukuthi i-proxy ayikwazi ukulungisa iseva engenalo umlaleli ohambisanayo. Imvume yokufinyelela indawo kanye nesevisi elalela kuleyo ndawo kungamaqiniso amabili ahlukene, futhi eyokuqala kuphela ingeyomphathi we-proxy.
Isithwali kumele kube yi-TCP kuzo zombili iziphetho
I-proxy ye-CONNECT evamile idlulisa uchungechunge lwamabhayithi kuphela , ngakho iklayenti kumele lisebenzise ukuthutha kochungechunge. Ingxenye yeklayenti yalelo cala ibukeka kanje:
proto tcp-client
remote vpn.example.net 1194
http-proxy proxy.corp.example 3128Uhlangothi lweseva ludinga umlaleli we-TCP wangempela embobeni okushiwo emugqeni we-remote. Ukushintsha i-proto udp ibe yi-proto tcp-client kuphrofayela kwakha iklayenti elilindele uchungechunge; akukwenzi uchungechunge ngaphesheya. Uma iseva efanayo iphendula futhi nge-UDP kuleyo mbobo, lowo ngumlaleli ohlukile, hhayi imodi yesibili yalowo mlaleli.
Lapho kunesimo esihlukile se-TCP, idivayisi yaso yomhubhe, ichibi lamakheli kanye nomzila kuyizinsiza zaso. Ukukopisha ukucushwa okusebenzayo nokushintsha igama lokuthutha kushiya lezo zinsiza zikhomba kusimo sokuqala, okukhiqiza uxhumano oluqinisekisayo bese lungahambisi lutho.
Funda impendulo ye-proxy ngaphambi komphumela we-VPN
Ukushintshana kokuqala kweklayenti umugqa wesicelo osho umsingathi nembobo yendawo. Impendulo yalowo mugqa ikutshela ukuthi ngabe ukhona yini uchungechunge lwamabhayithi, futhi ifika ngaphambi kokuthi kuhlolwe noma yisiphi isitifiketi noma imininingwane yokungena:
CONNECT vpn.example.net:1194 HTTP/1.1
Host: vpn.example.net:1194| Proxy reply | What it means | Where to look next |
|---|---|---|
407 Proxy Authentication Required | The proxy wants its own credentials | The client's proxy auth options, not the VPN account |
403 Forbidden | The destination or method is not permitted | The proxy's access policy for that host and port |
503 Service Unavailable | The proxy could not complete the upstream connection | The proxy's own logs and the server's listener |
Impendulo yekilasi le-200 ku-CONNECT isho ukuthi uchungechunge lukhona. Ayisho lutho mayelana nokuthi isitifiketi sesango sithembekile, ukuthi ukhiye owabiwe uyahambisana, noma ukuthi i-akhawunti yomsebenzisi ivumelekile. Lokho kuhlola kwenzeka kamuva, ngaphakathi kochungechunge, futhi kwehluleka ngemilayezo yeklayenti uqobo hhayi ngomugqa wesimo we-HTTP. Sesha kuloji yeklayenti umcimbi OpenVPN wokuqala ngemva kokuxhawulana ne-proxy, hhayi umugqa wokugcina ngaphambi kokuthi iwindi livalwe.
Imininingwane yokungena ye-proxy neyokungena ye-VPN ngokuvamile iyizimpawu ezihlukene ezisezandleni zamathimba ahlukene. U-407 akusiyo iphasiwedi engalungile ye-akhawunti ye-VPN, futhi isitifiketi esenqatshiwe akusiyo inkinga yemvume ye-proxy.
Okungakudaluli i-CONNECT
Umhubhe we-CONNECT ocacile akusikho ukulalela. I-proxy idlulisa amabhayithi futhi ayiqedi iseshini ye-TLS ye-VPN, ngakho ukuqinisekiswa kwesitifiketi seseva yiklayenti kuhlala kunengqondo futhi kufanele kuhlale kuvuliwe. Ukucisha ukuqinisekiswa ukuze udlule i-proxy kuxazulula enye inkinga hhayi eyakho.
Kukhona amalungiselelo ahlukene lapho inhlangano iqeda futhi ihlola i-TLS ngamabomu. Lawo adinga ukucushwa kwayo kokuthembela kanye nesinqumo sayo senqubomgomo, futhi akuwona okufunwa umugqa ojwayelekile we-http-proxy.
Izindleko ze-TCP ngaphakathi kwe-TCP
Ukuthwala umhubhe phezu kwe-TCP kugcina uchungechunge lwangaphandle luhlelekile futhi ludluliswa kabusha, futhi ithrafikhi yangaphakathi ngokuvamile nayo iyi-TCP. Lezi zindlela ezimbili zokubuyisela azixhumani, ngakho ingxenye eyodwa elahlekile ingamisa konke okwabelana ngalolo chungechunge lwangaphandle kuze kube idluliswa kabusha. Lokho ukushintshana kwangempela ngokuhambisana, hhayi ukuthuthukiswa kwamahhala.
Sebenzisa indlela ye-proxy lapho inethiwekhi ingakushiyeli enye indlela, futhi ukhethe indlela eqondile ye-UDP lapho inqubomgomo ivuma khona. Noma kunjalo, ngemva koshintsho qinisekisa ukuthi i-proxy efanayo, indawo kanye nephrofayela efanayo kufinyelela isigaba esilandelayo; isiphequluli esilayisha ikhasi kulelo kheli sisebenzisa enye iphrothokholi futhi asifakazi lutho mayelana nomhubhe.