Ukudluliswa kwephothi kuqhathaniswa nokufinyelela kwe-VPN: iphakethe liya kuphi ngempela

Ukudluliswa kwephothi kubhala kabusha indawo ekuyiwa kuyo bese kuma lapho; i-VPN ibopha iphakethe kuqala. Bheka ukuthi yiluphi ungqimba olushintshwayo yilelo nalelo nokuthi kusho ukuthini ku-HTTPS.

Imiklamo emibili, uhlelo olulodwa lwe-HTTPS, futhi iphakethe lithatha indlela ehlukile kuyo yomibili. Ukudluliswa kwephothi kushintsha lapho iphakethe lilethwa khona futhi kushiye okunye kunjalo. I-VPN ithwala lelo phakethe ngaphakathi kwelinye iphakethe kuqala, ngakho umlaleli wohlelo ubona umthombo ohlukile nomthwalo omkhulu omncane. Ukubethela abantu abaphikisana ngakho kukhona kuzo zombili izimo, ngoba uhlelo luseyi-HTTPS; okuhlukile ukuthi ubani ongavula uxhumano nokuthi inethiwekhi ephakathi ingabona ini. Lomehluko uxazulula iningi lemibuzo esebenzayo.

Umthetho we-DNAT ubhala kabusha indawo ekuyiwa kuyo bese ume lapho

Esangweni le-Linux, ukushicilela isevisi kusho umthetho ochungechungeni lwe-PREROUTING lwethebula le-nat, noma okulingana nakho ku-nftables. Umthetho uhambisana nekheli lomphakathi nephothi, bese ubhala kabusha indawo ekuyiwa kuyo ibe yikheli langasese lohlelo. Ikheli lomthombo, iphothi lomthombo kanye nomthwalo akuthintwa, futhi i-conntrack irekhoda ukuhlelwa ukuze izimpendulo zibhalwe kabusha lapho ziphuma. Lokhu kuziphatha yimodeli yendabuko yokuhumusha amakheli echazwe ku-RFC 3022.

sudo iptables -t nat -A PREROUTING -d 203.0.113.10 -p tcp --dport 443 \
  -j DNAT --to-destination 10.20.30.40:443
sudo iptables -t nat -L PREROUTING -n -v
sudo conntrack -L -p tcp --dport 443

Umlaleli wohlelo akakwazi ukwazi ukuthi uxhumano lufike ngokuhumusha. Ubona ikheli lomthombo langempela lekhasimende, okusizayo kumarekhodi okufinyelela nasezilinganisweni zesivinini, futhi liphendula ekhelini langasese ngoba i-conntrack iguqula ukuhlelwa. Akukho okubethelayo noma okubethela kabusha kuleyo ndlela: i-TLS isasebenza phakathi kwekhasimende nesitifiketi sohlelo uqobo.

Umthetho ubuye unqume izimo zokwehluleka ozozihlangabezana nazo kamuva. Uma isango lidlulisa kodwa isibungu sohlelo singenayo indlela yokubuyela ekhasimendeni, izimpendulo ziphuma ngomthombo ongafanele futhi ukuxhawulana kuyama. Uma umthetho wesibili uhambisana kuqala, ukulandelana kunquma umphumela, futhi iptables -t nat -L -n -v ubonisa izinto zokubala eziqinisekisa ukuthi wuphi umthetho othathe iphakethe.

Umhubhe ubopha iphakethe ngaphambi kokuba umlaleli alibone

I-VPN ayishicileli uhlelo nhlobo. Ikhasimende lakha iphakethe langaphandle elibhekiswe ekhelini lomphakathi lesango, libethela iphakethe langaphakathi ngaphakathi kwalo, futhi isango liyaqaqa futhi liqondise iphakethe langaphakathi endaweni eyimfihlo. Ku-WireGuard ukuthutha kwangaphandle yi-UDP, ngokuvamile ephothini eliphezulu; ku-OpenVPN phezu kwe-TCP 443 iphakethe langaphandle libonakala njenge-TLS kunoma yini ebuka indlela.

Ngaphakathi komhubhe iphakethe langaphakathi ligcina amakheli angasese: ikheli lomhubhe lekhasimende, ake sithi 10.8.0.6, kanye nohlelo ku-10.20.30.40. Ngakho umlaleli ubona umthombo ovela echibini lomhubhe, futhi ikhasimende ngalinye labelana ngalelo sango njengengxenye elandelayo. Amarekhodi okufinyelela ngemuva kwe-VPN avamise ukukhombisa isango esikhundleni somsebenzisi ngenxa yalesi sizathu, ngaphandle uma isango ligcina umthombo wangempela.

Ukubopha kudla isikhala sekhanda, futhi lowo umahluko kuphela ezingeni lomshini onomphumela ongalinganiswa. Ikhanda le-IP langaphandle kanye ne-UDP kanye nekhanda le-WireGuard uqobo zidla ku-MTU yendlela, ngakho amaphakethe amakhulu kufanele ahlukaniswe noma isitaki se-TCP sangaphakathi kufanele sinciphise i-MSS yaso. Ukudluliswa okusebenza endleleni edlulisiwe kungama emhubheni lapho idivayisi ephakathi ilahla i-ICMP ebezoazisa nge-MTU encane.

ip route get 10.20.30.40
ping -M do -s 1400 10.20.30.40
sudo iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
  -j TCPMSS --clamp-mss-to-pmtu

Ukuchayeka kunqunywa emnyango wokungena, hhayi nge-cipher

Yomibili imiklamo iphela kumlaleli ofanayo we-TLS, ngakho yomibili izuza isitifiketi esifanayo, izinguqulo zeprotocol ezifanayo nokungena kohlelo okufanayo. Okushintshayo ukuthi ubani ovunyelwe ukuqala ukuxhawulana. Ngokudluliswa komphakathi, noma yisiphi isibungu esifinyelela ku-203.0.113.10:443 sithola ukuxhawulana kwe-TCP kanye ne-TLS ClientHello ngaphambi kokuthi ukugunyazwa kohlelo lwakho kubhekwe. Ngokufinyelela ngomhubhe kuphela, umlaleli ufinyeleleka kuphela kumakheli isango eliwahambisa aya emhubheni, futhi i-SYN yomfokazi ifela kunqubomgomo yesango.

Lowo mehluko umayelana nokufinyeleleka, hhayi ngokuyimfihlo. Isevisi ye-HTTPS edlulisiwe ayiwona umbhalo ovulekile, futhi i-VPN ayikususi isidingo sokuqinisekisa uhlelo: ukwamukela emhubheni kuphendula ukuthi idivayisi ingathumela amaphakethe kule nethiwekhi, kuyilapho uhlelo lwefayela luphendula ukuthi umsebenzisi angafunda idokhumenti. Ukuhlanganisa kokubili yindlela amaqembu agcina ngayo i-VPN enikeza lonke i-LAN kanye nohlelo olunephasiwedi eyodwa eyabiwe.

Hlola umlaleli kanye nenqubomgomo ngokwehlukana, ngoba noma yikuphi kwako kungaba banzi kunalokho okucabangayo:

sudo ss -ltnp 'sport = :443'
sudo nft list ruleset
openssl s_client -connect 203.0.113.10:443 -servername files.example.com </dev/null

Uma ss ikhombisa ukuthi umlaleli uboshelwe ku-0.0.0.0, uhlelo lufinyeleleka noma kuphi lapho ukuhambisa nendlela yenqubomgomo yodonga lomlilo kuvuma, futhi ukudluliswa kungenye yezindlela zokungena. Ukubopha ekhelini langasese, noma ukunciphisa ububanzi bomthombo odongeni lomlilo, kuyisinqumo esihlukile ekukhetheni i-VPN, futhi yisona sinqumo esinciphisa ukuchayeka ngempela.

Linganisa indlela, hhayi ilebula

Lapho othile ethi ukudluliswa kushesha kakhulu, ukuqhathanisa okuqotho kugcina konke okunye kunjalo: ikhasimende elifanayo, inethiwekhi yokungena efanayo, ifayela elifanayo, ukucushwa kwe-TLS okufanayo, isibungu sohlelo esifanayo. Gijimisa ukudluliswa kabili ngendlela ngayinye futhi urekhode isikhathi esiphelele, inani lokwehluleka kanye nokuphendula, hhayi umphumela wokuhlolwa kwesivinini okungahlobene.

curl -sS -o /dev/null -w '%{time_connect} %{time_appconnect} %{time_total}\n' \
  https://files.example.com/report.pdf
mtr -rwc 20 203.0.113.10
mtr -rwc 20 10.20.30.40

Lezi zinombolo zihlukanisa ukusethwa koxhumano nesikhathi sokudluliswa, okubalulekile ngoba izindlela ezimbili ngokuvamile zihluka ekubambezelweni kokuhamba nokubuya kanye ne-MTU hhayi ezindleleni ze-cipher. Umsebenzi we-TLS wenzeka emikhawulweni kuyo yomibili imiklamo, futhi umhubhe wengeza ukugoqwa, indlela ehlukile kanye mhlawumbe isango elimatasa kakhulu. Uma indlela yomhubhe yinde noma isango layo linomthwalo, umehluko ungowendlela hhayi igama elithi ukubethela.

Khetha inqubomgomo yokungena isevisi eyidinga ngempela, bese unquma ukuthi umehluko olinganisiwe uyasithethelela yini ukushintsha kwayo. Ukudluliswa komphakathi kufanele isevisi ehloselwe i-inthanethi evulekile, ngemikhawulo yomthombo, i-TLS ebuyekeziwe kanye nokuqapha phambi kwayo. Ukufinyelela ngomhubhe kuphela kufanele ithuluzi langaphakathi abasebenzisi balo asebebhalisiwe, inqobo nje uma ukuhambisa kwesango nezimvume zohlelo zombili zincane kune-LAN yonke.

Ngaphambi kokumemezela umklamo ukuthi uphelile, qinisekisa izinto ezine: umlaleli uboshelwe kuyiphi ikheli, wuphi umthetho noma indlela evumela iphakethe ukungena, indlela yokubuya iyasebenza yini kusukela ekhelini langempela lekhasimende, futhi imithwalo emikhulu iyadlula yini ku-MTU. Ngayinye yazo inomlayezo ongenhla, futhi akukho nokukodwa okuphendulwa ngegama elithi kuphephile noma ngeshadi lebhandi.

Izihloko ezihlobene