Imithetho yephothi 80 ne-443 ayidlulisi isiphequluli nge-VPN
Ukufanisa iphothi kukhetha ukugeleza kwe-TCP, hhayi isiphequluli. I-HTTP/3 isebenza ku-UDP, i-DNS ingathatha enye indlela, futhi isibuyekezi sihambisana nawo lowo mthetho oyibhalile.
Othile ucela ukuthi isiphequluli sisebenzise umhubhe, futhi impendulo ibuya njengomthetho wodonga lomlilo ohambisana namaphothi okuya 80 no-443. Kubukeka kunembile futhi akunjalo. Ukufanisa iphothi kukhetha amaphakethe ngokwesihloko sawo sokuthutha, hhayi ngokuthi yiluphi uhlelo oluvule isokhethi, futhi ukuphequlula kwesimanje akugcini emaphothini lawo amabili ku-TCP. Umthetho uzogeja ingxenye yethrafikhi obufuna ukuyifaka futhi ubambe ithrafikhi obungakaze uhlose ukuyithinta. Ngaphambi kokuwubhala, nquma ukuthi iyiphi yemingcele emithathu ehlukene oyifunayo ngempela.
Umthetho uchaza isigaba sokuthutha, hhayi uhlelo lokusebenza
Ku-Linux, ukufanisa iphothi lokuya kuhlola isihloko se-TCP futhi akukho okunye ngaphezulu kwaso. Ukumaka lawo maphakethe nokuwahola ngomzila wenqubomgomo kusebenza ngqo njengoba kubhaliwe, futhi akukho kulezi zinto ezisetshenziswayo ezaziyo ukuthi umthwalo usho ukuthini noma iyiphi inqubo eyithumile. Umaka uyinombolo enanyathiselwe ephaketheni, hhayi ubunikazi obunanyathiselwe ohlelweni.
nft add rule inet mangle output tcp dport { 80, 443 } meta mark set 0x1
ip rule add fwmark 0x1 table 100
ip route add default dev wg0 table 100Imiphumela emibili ilandela ngokushesha. Isibuyekezi sesofthiwe esixhumana ne-TCP 443 sithola indlela efanayo nesiphequluli, okungase kube kahle noma kube ukuphazamiseka okulindele umjikelezo olandelayo wokubuyekeza. Futhi insizakalo yewebhu eshicilelwe ngamabomu kwelinye iphothi, ake sithi 8443, iwela ngokuphelele ngaphandle komthetho nakuba kuseyitho ithrafikhi yewebhu umsebenzisi abenendaba nayo.
Izinombolo zingabakhethi abasemthethweni lapho imfuneko imayelana nalawo maphothi ngempela. Ziba inganekwane lapho itikithi libhala «isiphequluli» futhi kubekwa ibanga lamaphothi kusethi yemithetho. Leyo gebe ayiyona imininingwane yombhalo. Imele umehluko phakathi komthetho ongawuvikela ekubuyekezweni nowo okungekho muntu ongawuhlola.
I-HTTP/3 ishiya umthetho wakho we-TCP buthule
I-HTTP/3 isebenza ku-QUIC, futhi i-QUIC ithwalwa ku-UDP. Umthetho ohambisana ne-TCP kuphela awukwazi ukuyibona, ngakho isiphequluli esisodwa esidlula ikhasi lakho lokuhlola singathumela isicelo sakamuva nge-UDP futhi sidlule umhubhe ngaphandle kokuthi kube nomuntu oshintsha isilungiselelo. RFC 9114 ichaza i-HTTP/3 njengephrothokholi esekelwe ku-QUIC, futhi i-QUIC isebenzisa i-UDP enephothi elizenzakalelayo 443 ekusetshenzisweni okuvamile.
Ukuthi isiphequluli esithile sizozama i-HTTP/3 kuncike ekucushweni kwaso, kusayithi nasekutheni umzamo wangaphambili uphumelele. Lokho kukwenza kube yinto embi ukuphikisana ngayo ngokukhumbula. Buza ithuluzi esikhundleni salokho:
curl --http3 -sS -o /dev/null -w '%{http_version} %{time_total}\n' https://example.com
ss -tunp | grep -E ':443\b'Umugqa we-curl uprinta inguqulo okuxoxiswene ngayo, ngakho u-3 uqinisekisa ukuthi kwasetshenziswa indlela ye-UDP. Bese uhlu lwamasokhethi lukhombisa ukuthi lokho kuxhumana kuboshelwe kusixhumi somhubhe noma sowesiliva. Uma i-HTTP/3 ingekho ekwakhiweni kwakho kwe-curl, ifulegi lehluleka ngokuzwakalayo esikhundleni sokuhlehla buthule, okuwumsizi wayo omncane.
I-DNS isinqumo esihlukile okufanele usithathe
Umthetho wephothi wethrafikhi yewebhu awusho lutho ngokuxazululwa kwamagama. Isiphequluli singasebenzisa isixazululi sohlelo, isixazululi esilungiselelwe ngaphakathi kwesiphequluli, noma leso esicindezelwe ukuxhumana kokugcina. Ngakunye kwazo kungathumela imibuzo ngomzila ohlukile kuleyo ekhethwa umthetho wakho, okudala ukwehlukana okuvamile: ikhasi liyalayishwa, igama lixazululwa endaweni obungalindele, futhi isayithi langaphakathi lixazululwa libe ikheli lomphakathi noma lingaxazululwa nhlobo.
Nquma lokho ngokucacile. Uma amagama angaphakathi kufanele axazululwe ngomhubhe, isixazululi kufanele sibe ngaphakathi kuwo, futhi isethi yemithetho kufanele ivumele i-DNS kuleso sixazululi kuyilapho igcina eminye imibuzo ngaphandle. Uma isiphequluli sisebenzisa i-DNS over HTTPS kumhlinzeki womphakathi, umbuzo udlula ngokuphelele isixazululi sakho futhi umthetho wephothi awukwazi ukusiza. Bhala ukukhetha kurekhodi lokushintsha elifanayo nomthetho womzila, ngoba kokubili kufundwa ndawonye yilowo ozolungisa ukwehluleka okulandelayo.
Bese uqinisekisa ngesixazululi hhayi ngekhasi:
resolvectl query intranet.example.internal
resolvectl status | grep -A3 'Current DNS Server'Impendulo engekho iyinkinga yokuxazulula ngisho lapho umlayezo wephutha wesiphequluli usola inethiwekhi. Lokhu kwehluleka okubili kubukeka kufana kumsebenzisi futhi kungamatikithi ahluke ngokuphelele.
Imingcele emithathu, izindlela ezintathu ezihlukile
Iningi lokudideka liyanyamalala uma usho umngcele owufunayo. Awekho ashintshanayo, futhi ngakunye kunendlela ehlukile yokwehluleka lapho umhubhe uwa.
| What you actually want | Mechanism that fits | What it does not cover |
|---|---|---|
| These transport ports use this exit | Firewall mark plus policy route | Applications, HTTP/3 over UDP, DNS |
| This browsing session stays separate | Application-aware VPN, or a separate network namespace plus a proxy | Other applications in the same session |
| Only these private sites are reachable | Destination-based routes with private DNS | Public sites on the same address family |
Iphrofayela yesiphequluli ehlukile iwugibe emugqeni ophakathi. Ihlukanisa amakhukhi nomlando, futhi ayishintshi lutho kuthebula lomzila lomsingathi, ngakho zombili izingqikithi zithatha indlela efanayo. Ukwehlukanisa kudinga into ephoqwa i-kernel, okungukuthi isikhala samagama, isiqukathi noma uhlelo olunosixhumi somhubhe salo.
Noma yimuphi umugqa osebenzayo, bhala ukuthi kufanele kwenzeke ini lapho umhubhe uwa. Umzila osekelwe kumaka onyamalala nosixhumi uvame ukubuyela emzileni ozenzakalelayo wesiliva, okuwukuziphatha kwe-fail-open. Lokho kungase kwamukeleke ekuphequluleni futhi kungamukeleki kukho konke okunye, futhi kuyisinqumo, hhayi imininingwane yokusebenza.
Hlola ukugeleza okuthi ukumboza
Ukuhlolwa kokwamukela kufanele kulandele umngcele owubhalile, hhayi izinombolo zephothi ezazilula. Khetha ukugeleza okukodwa okufanele kudlule emhubheni, okunye okungafanele, nokunye okusebenzisa ukuthutha obungakucabangi:
ip route get 203.0.113.40
curl -sS -o /dev/null -w 'v4 %{http_version} %{remote_ip}\n' https://example.com
nft list ruleset | grep -A2 'dport'Ukusesha komzila kukutshela ukuthi isixhumi sini isiphetho esisisebenzisayo ngempela, futhi lelo iqiniso imibiko eminingi eyithola kabi. Umugqa we-curl uqinisekisa inguqulo okuxoxiswene ngayo nomndeni wamakheli. Ukukhipha kwesethi yemithetho kubamba umthetho owawengeza ngesikhathi sokuhlola wakhohlwa ukuwukhawulela, futhi yileyo ndlela umaka wesikhashana ophenduka umzila we-fail-open unomphela.
Rekhoda yonke imiphumela emithathu nesitembu sesikhathi futhi uyigcine kanye noshintsho. Lapho othile ebika kamuva ukuthi «i-VPN yephule i-intranethi», umehluko phakathi komngcele obuhloswe nosaqaliwe uzobonakala kulelo rekhodi, futhi ukulungisa kuzoba ukushintshwa komthetho, hhayi impikiswano.