I-OpenVPN iyasebenza ekhaya kodwa ayisebenzi kunethiwekhi eyodwa: i-UDP noma i-TCP?

Iphrofayela efanayo ixhuma isuka ekhaya futhi ima kunethiwekhi yehhotela, yekhampasi noma yegatsha. Izinkomba zokungena azizange zishintshe, ngakho okuguqukayo okuthakazelisayo indlela: OpenVPN kwenzeka ini kumaphakethe ngaphambi kokuwafunda. Ukuqhathanisa izizathu ezine ezingaba khona ngokulandelana okungahlolwa ngakho kungcono kunokuqagela ngamathempeli. Ngayinye ishiya umkhondo ohlukile, futhi umkhondo yiwo ohlukanisa zona.

Isiphi isigaba esihlulekile sitshela ukuthi yikuphi ukuqhathanisa okubalulekile

Ilogi yeklayenti isivele iqopha ukuthi ufike kude kangakanani. Umugqa othi ukuxoxisana kokhiye we-TLS akwenzekanga phakathi nesikhathi esibekiwe kusho ukuthi iphakethe lokuqala liphumile futhi akukho okusizayo okubuyile, lokhu okukhomba endleleni. Ukwenqatshwa kwesitifiketi kubonakala kuhluke ngokuphelele: impendulo iyafika, bese kuba iphutha elithile lokuqinisekisa elisho isizathu. Qaphela umugqa wokugcina ngaphambi komjikelezo wokuzama futhi, ngoba yilowo nalowo inani olixhathanisayo phakathi kwamanethiwekhi.

Thwebula ngesikhathi uzama futhi, hhayi ngemuva. Kuklayenti tcpdump -ni any udp port 1194 kukhombisa ukuthi ingabe ikhona impendulo ebuyayo noma cha. Kuphinda ku-WAN interface yeseva oyilawulayo, lokhu okudalula ukuthi lawo maphakethe ayafika yini ekugcineni okude.

Ithrafikhi yohlangothi olulodwa iyisiphumo esiwusizo kakhulu esitholakalayo lapha, ngoba iguqula isikhalazo esiza ngezikhathi ezithile sibe indlela yokuphenya. Gcina amafayela okuthwebula, ngoba umbiko olandelayo wenkinga efanayo uvalwa kalula ngobufakazi kunencazelo.

Ukuhlunga kwe-UDP kanye nechweba elivaliwe

Amanethiwekhi amaningi okufinyelela abheka i-UDP eqhubekayo njengokusolisayo, futhi amanye ama-ISP ayavumelana nakho. Ichweba elivaliwe likhiqiza ukuthula okufanayo ohlangothini lweklayenti. Umehluko ukukhetha: isihlungi sijwayele ukukhetha ukuthi iyiphi indawo noma amachweba eliwisa, kuyilapho ichweba elivaliwe lenqaba konke okuqondiswe kulelo chweba.

Iphrofayela ye-TCP echwebeni 443 iyisixazululo esivamile, ngoba ifana nokugeleza kwe-HTTPS evamile futhi idlula iningi lamaphothali e-captive kanye nezihlungi zokuphuma. Kufanele kube nemibandela emibili. Iseva kufanele ilalele nge- proto tcp-server futhi iklayenti kufanele ihambisane ne- proto tcp-client, futhi umsebenzi kufanele ashicilele leyo ndawo ehlukile yokuphela. Ukubhala kabusha iphrofayela ye-UDP esebenzayo ukuze ithi yi-TCP 443 akusizi ngalutho uma ngaphesheya kungekho olalele.

Ichweba elivaliwe liyinkinga yokuhlela, hhayi inkinga yokuvinjelwa. Iseva engemuva kwerutha yasekhaya idinga ukudluliswa kwechweba le-UDP, futhi i-firewall yerutha kufanele ikuvumele. Uma ichweba lingakaze livunyelwe, iklayenti ngalinye lehluleka ekuxoxisaneni kungakhathaliseki izinkomba zokungena, futhi ukwehluleka kulandela iseva hhayi inethiwekhi.

Amaphrothokholi amadala awenzi kahle kule eksisi. I-PPTP idinga i-TCP 1723 kanye ne-GRE, futhi i-GRE iyiphrothokholi ye-IP 47 hhayi ichweba, ngakho akukho ukudluliswa kwechweba okuvamile okungayiveza.

Lapho iswishi iyona elahla amaphakethe

Iswishi elawulwayo lingalahla umhubhe ngamabomu. Amanye amamodeli e-HPE ne-Aruba anokulawula kokuvikela izikhukhula ze-UDP, ngezinye izikhathi okubizwa nge-Prevent UDP Blat Attack, esigabeni sazo sokuphepha okuthuthukile. Lapho lokho kulawula kusebenza, iseva engemuva kweswishi ayiphenduli lutho futhi iklayenti ngalinye liphelelwa yisikhathi ngendlela efanayo. Ukukususa nokugcina ukuhlela okusebenzayo kuwukulungisa konke, kodwa kuphela ngemuva kokuthola ukuthi iswishi isendleleni ngempela.

Ubufakazi obuphikisayo yibo obuhlukanisa ukulahla kweswishi nokuvinjelwa komhlinzeki. Funda izibali ze-interface kanye nelogi yokuvikela izikhukhula ngaphambi kokuvula ithikithi ku-ISP. Amarutha abathengi anokuvikela kwe-DoS noma izikhukhula ayahluleka ngendlela efanayo, futhi kanjalo nanoma yisiphi isikhwama esiphakathi esinesikhathi esifushane sokungenzi lutho se-UDP. Ukuxhawulisana okungaqedi kukhomba ekulahleni, kuyilapho umhubhe ofa ngemuva kwemizuzu embalwa yokuthula ukhomba esikhathini esibekiwe.

Bhala phansi idivayisi ngayinye phakathi kweklayenti neseva ngaphambi kokushintsha iphrofayela. Ukulungisa okusetshenziswe esigabeni esingalungile kubonakala kulungile kuze kube inethiwekhi elandelayo. Lolo hlu lutshela nonjiniyela olandelayo lapho okufanele abheke khona ngaphandle kokuphinda uphenyo lonke.

Ukuhlangana kwamakheli okubonakala njengokwehluleka kwe-DNS

Inethiwekhi yokufinyelela enezinombolo ngaphakathi kwe-10.0.0.0/8 ingahlangana nechibi lomhubhe, futhi isixazululi sivamise ukuhlala kulelo chibi. Uma ikhompyutha ephathwayo ithola ikheli elifana ne- 10.184.178.50 eline-mask ye-/8 ku-Wi-Fi, yonke indawo ye-10.x iyendawo ngokwencazelo. Amaphakethe aya ku- 10.4.0.1 abe eseya ku-LAN, umhubhe uhlala uphakeme, futhi ukuxazululwa kwamagama kuyahluleka.

ip addr iveza ukuhlangana ngokubona okukodwa, futhi ip route get 10.4.0.1 ikhombisa ukuthi iphakethe lizolethwa ngempela kuphi. Njengoba uphawu olubonakalayo ukwehluleka kwesixazululi, lokhu kuvame ukusinda emijikelezweni eminingi yezinguquko ze-DNS.

Phinda unombolo ichibi noma gcina leyo nethiwekhi yokufinyelela ngaphandle kobubanzi. Asikho isilungiselelo sohlangothi lweklayenti esilulama ekuhlangana.

Ukukhetha phakathi kwendlela yokugcina ye-TCP nokulungiswa kwendlela

Khetha indlela yokugcina ye-TCP uma ungayilawuli indlela futhi abasebenzisi kudingeka basebenze namuhla, futhi wamukele izindleko zayo: i-TCP ngaphakathi kwe-TCP iyaziphatha kabi kumakhonkco anokulahlekelwa, futhi indlela yokugcina idinga isilaleli osisebenzisayo. Khetha ukulungiswa kwendlela uma ukuvinjelwa kusesimisweni esingokwakho, ngoba umthetho we-firewall ushibhe kunesilaleli sesibili. Noma kunjalo, dabulula izigaba ngokulandelana: isixhumanisi, ukuthutha kwangaphandle, ukuxoxisana, ukuhambisa kwangaphakathi. Isigaba esahluleka kuleyo nethiwekhi iqiniso elilodwa elibalulekile.

Qopha umphumela ngenethiwekhi, hhayi ngomsebenzisi. Umbiko olandelayo wokwehluleka okufanayo ube usuqala esigabeni esaziwayo esikhundleni sombono wesitifiketi. Lelo rekhodi futhi yilo elilungisa isilaleli sesibili esihlala njalo, uma kudingeka.