Kungani impendulo ye-UDP ye-OpenVPN iphuma ekhelini elingalungile

Iklayenti le-OpenVPN lishayela ikheli elilodwa, iseva iphendula isuka kwelinye, futhi umhubhe awukhuphuki neze. Ilogi yeseva ibonisa ukuthi iphakethe liyafika futhi ukuthwebula kubonisa impendulo iphuma, ngakho iphutha libekwa eklayentini. Kusibambi esinamakhasi amaningi, noma amakheli amaningi kukhasi elilodwa, izinhlangothi zombili azivumelani nje ngokuthi yiliphi ikheli elisetshenziswayo. Impendulo ivumelekile kungqimba lwe-IP, nokho amaklayenti amaningi alahla idathagramu umthombo walo okungewona ikheli abaxhumana nalo.

Iklayenti libona ini uma umthombo ushintsha

Isokhethi ye-UDP engaboshelwe ekhelini lendawo elithile ayinawo umthombo ogxilile, ngakho i-kernel ikhetha owodwa ngesikhathi sokuthumela. Lokho kukhetha kuvela ekusesheni komzila obheke ekhelini leklayenti, futhi umthombo uba ikheli lesixhumi esikhethwa yilokho kusesha. Emshinini onesixhumi esisodwa ukukhetha akubonakali; kusibambi esinekhasi lokuphatha, ikheli lomphakathi kanye nekheli lesibili kukhadi elifanayo lenethiwekhi, kuncike ezilinganisweni zomzila nasemgomeni. Ukuhlelwa komzila okusekelwe kumgomo kwenza ukungafani kube nokwenzeka kakhulu hhayi kuncane, ngoba umthetho ungakhetha umgudu ophezulu iklayenti elingakaze lifinyelele kuwo. Umzila ozenzakalelayo ofundwe kumhlinzeki oyedwa kanye nomthetho womthombo okhomba komunye kuyanele ukuwukhiqiza.

Amaklayenti ahlunga izimpendulo, kanye nokulandelela ukuxhumana okulindele ingxenye yesine ngqo nomthombo, azolahla impendulo ngaphandle komlayezo owusizo. Khona-ke umhubhe uphelelwa yisikhathi sengathi akukho okufikile, futhi yingakho lokhu kuthathwa ngephutha njengenkinga yodonga lomlilo ohlangothini lweklayenti. Ukuthwebula okuthathwe kuseva kuphela kuqinisekisa iphutha esikhundleni sokulichaza, ngoba impendulo iyaphuma ngempela. Qhathanisa umthombo wempendulo nekheli iklayenti elishayele kulo ngaphambi kokushintsha enye into.

Ininga le-multihome lenza ini ngempela

Umyalo ubhalwa njenge-multihome efayeleni lokuhleleka nanjenge---multihome emugqeni womyalo, futhi wenza iseva ye-UDP iphendule isuka ekhelini iphakethe leklayenti elafinyelela kulo. I-kernel idlulisa ikheli lomgomo wangempela njengedatha eyengeziwe lapho yamukela, futhi i-OpenVPN isebenzisa lelo nani njengomthombo wempendulo. Ngakho iseva elalela ekhelini elijwayelekile, i-local 0.0.0.0 ye-IPv4 noma okulingana nayo kwe-IPv6, iziphatha sengathi iklayenti ngalinye lifinyelele isilaleli esikhethekile. Amaklayenti angena ngekheli lomphakathi athola izimpendulo ezivela ekhelini lomphakathi, futhi amaklayenti asekhelini langaphakathi awathola kulo. Akukho okunye endleleni yephakethe okunyakazayo: umzila, imithetho yokuhlunga nokuhleleka komhubhe kuhlala kunjalo njengoba kwakunjalo.

Yilesi sici sokugcina esenza leli ninga liphephe ukungezwa kuseva esebenza ngakolunye uhlangothi, futhi yiso lesi isizathu sokuthi ayikwazi ukulungisa isihlungi esivumela ikheli elilodwa kuphela. Iphakethe kusamele lamukelwe emzileni elihamba kuwo, ngakho ukulungisa umthombo kushintsha umsuka wempendulo hhayi okunye. Ingenye yokusebenzela i-UDP kuphela: isilaleli se-TCP asinayo le nkinga ngendlela efanayo, ngoba ukuxhumana kubonwa ngesine hhayi ngekheli lomthombo wempendulo.

Kungani ikheli lendawo eligxilile liyisisekelo esingalungile

Ngaphambi kokusebenzisa leli ninga, hlola ukuthi iseva ibopha ikheli elilodwa lendawo, ngoba isilaleli esiboshiwe sihlala siphendula sisuka kulelo kheli. Lokhu kulungile ekusetshenzisweni kwesixhumi esisodwa futhi akulungile ngokushesha lapho amaklayenti esebenzisa ngokusemthethweni amakheli angaphezu kwelilodwa. Uma ukubopha bekwenziwe ngamabomu, thatha isinqumo sokuthi iseva kufanele yamukele yini ithrafikhi kumakheli engeziwe. Ukususa ukubopha kwandisa ukuchayeka, ngakho izixhumi namathungo omthombo avunyelwe kufanele kuqinisekiswe yisevisi nesihlungi, hhayi ngekheli lokubopha kuphela.

Incwadi yokubhekisa ye-OpenVPN ikhawulela leli ninga kumaseva e-UDP, iphawula ukucutshungulwa okwengeziwe emzileni wephakethe futhi ibhala ukuthi yiziphi izinkundla ezilisekelayo. Qinisekisa lokho kusurili efakiwe ngaphambi kokuhlela ngokusekelwe kulo. Lapho kungasekelwe khona, enye indlela ukubopha ikheli elithile noma ukulungisa umzila wokubuya, futhi kokubili kuyizinguquko ezincanyana kunalokho okubonakala ngamehlo okuqala. Ukulalela ekhelini elijwayelekile kunemiphumela engaphezu kwezimpendulo: iseva kuwo wonke amakheli iyafinyeleleka kusukela kunethiwekhi ngayinye isibambi esixhunywe kuyo, futhi lokho kungenzeka kungesikho ukuchayeka okwakuhloswe ngumuntu.

Fakazela umthombo wempendulo ngaphandle

Hlola ngaphandle kweseva, futhi bhala ikheli nokuthuthwa okuqondile iklayenti elikusebenzisile ngaphambi kokuthwebula noma yini. Izivivinyo ezintathu ezingezansi ziphendula imibuzo emithathu ehlukene, futhi ukulandelana kubalulekile.

tcpdump -ni any udp port 1194
ss -lunp 'sport = :1194'
ip route get 203.0.113.10 from 198.51.100.20

Ukuthwebula kubonisa ikheli lomthombo empendulweni, futhi lesi yisimo i-athikili yonke esekelwe kuso. Uhlu lwamasokhethi lubonisa lokho iseva ekubopheleke ngempela, ngoba isilaleli esijwayelekile nesithile kubonakala kufana efayeleni lokuhleleka kodwa kuziphatha ngendlela ehlukile kunethiwekhi. Ukusesha komzila kubonisa umthombo i-kernel engawukhetha kuleyo mgudu, futhi lokho kuchaza ukuthwebula ngaphambi kokushintsha noma yini. Phinda kokuthathu kwe-IPv4 ne-IPv6 ngokwehlukana, ngoba yizilaleli ezihlukene nokusesha okuhlukene, futhi ingeno ejwayelekile yomndeni owodwa ayisho lutho ngomunye.

Ukuhlelwa komzila, ukutholwa nokuhlunga kuhlala kwehlukene

Ukugcina umthombo wempendulo akufaki umzila ophumayo, akubuyekezi i-DNS eguquguqukayo, futhi akwenzi umndeni wamakheli owodwa wamukele omunye. Kuseva enemigudu eminingi ephezulu umzila wokubuya womthombo ngamunye kufanele kuvunyelwane ngawo ngamabomu, uma kungenjalo izimpendulo ziphuma ngesixhumi isihlungi seklayenti esingazange sisivumele. Ngokufanayo, ikheli elisha ngemva koshintsho lwesimo kufanele lifinyelele kumaklayenti ngokutholwa nangomgudu wokuxhuma kabusha osekelwayo, hhayi ngerekhodi elidala.

Shiya izivivinyo zobunikazi beseva nokuqinisekiswa kwesitifiketi kunjalo njengoba zinjalo, ngoba ikheli elishintshiwe alikuthetheleli ukwamukela umlingani ongaqinisekisiwe. Uma impendulo manje isiphuma kumthombo obekuhloswe wona futhi umhubhe wehluleka namanje, thatha inkinga yomthombo njengexazululiwe bese uqhubeka. Iphutha elilandelayo elibonwayo ngelokuhlelwa komzila, ukuhlunga noma ukuqinisekisa, futhi ukushintsha isilaleli futhi ngeke kufinyelele kulo. Bhala umthombo wempendulo ethikithini eceleni kwekheli iklayenti elishayele kulo, ukuze umuntu olandelayo ahlole iqiniso elifanayo ngomyalo owodwa.