Ukuqalisa imbobo kanye nokudlulisa imbobo kuseva ye-VPN yasekhaya
Ukuqalisa kuvula imephu ngemva kwethrafikhi ephumayo; ukudlulisa kubeka imephu yembobo unomphela. Iseva ye-VPN yasekhaya idinga eyesibili, ilinganiselwe kumlaleli wangempela.
Ukudlulisa imbobo nokuqalisa imbobo kusemenyu eyodwa kumarutha amaningi asekhaya, yingakho kucatshangwa njengezindlela ezimbili zokwenza umsebenzi owodwa. Ukudlulisa kuwumthetho ongashintshi: ukuxhumana okungena embotsheni ye-WAN kuhunyushwa kube ikheli nembobo yangaphakathi engashintshi, kungakhathaliseki ukuthi kukhona okunye okwenzekayo noma cha. Ukuqalisa kuncike emibandeleni: irutha ibheka ithrafikhi ephumayo futhi ivula imephu yokungena kuphela ngemva kokuba ukuxhumana okufanayo kuphume. Iseva ye-VPN ilinda ukuthi omunye aqale ukuxhumana, ngakho leso simo yiso kuphela into engasoze isifeze.
Imithertho emibili enemijikelezo yokuphila ehlukene
I-IPv4 NAT igcina isimo. Lapho isibungu sangaphakathi sithumela iphakethe ngaphandle, irutha yenza imephu ukuze izimpendulo zithole indlela yokubuya; iphakethe elingenayo imephu elifanayo liyalahlwa, futhi lokhu kuziphatha yikho okugcina ideskithophu engabuyekezwanga ngaphandle kwe-inthanethi. Ukudlulisa kuwumbhalo wokuhumusha unomphela owengezwa ngesandla. Ukuqalisa kuwimbobo yesikhashana egadwe iphethini yethrafikhi.
Umehluko osebenzayo isikhathi. Ukudlulisa kukhona kusukela lapho kugcinwa khona kuze kube yilapho othile eyisusa. Imephu eqalisiwe ikhona ngemva kokuba isiqalisi sisebenze futhi ivalwa ngesikhathi sokungenzi lutho, esikalwa ngamaminithi kuma-hardware abathengi, noma ngokushesha lapho kuqaliswa kabusha.
Akukho okuphephile ngokwedlula okunye ngendlela engaqondakali. Ukudlulisa kuveza imbobo eyodwa njalo; isiqalisi siyiveza kuphela ngemva kwethrafikhi ethile ephumayo. Kusebenzisi okufanele kwamukele iphakethe lokuqala lisuka kumuntu ongaziwa, kufanele okukodwa kuphela kulezi zimbili.
Kungani ukuqalisa kungasoze kwethule iseva
Iseva ye-VPN ayisebenzi ngokwemvelo yayo. Uzakwabo, kungaba ikhompyutha ephathwayo ekhefini noma ifoni kudatha yeselula, uthumela iphakethe lokuqala, futhi irutha ayinayo imephu yalo. Akukho lutho ngaphakathi oluqale ithrafikhi eya embotsheni yokuqalisa, ngakho umthetho awusebenzi neze futhi ukuxhumana kuyafa ngaphambi kokuba ukuxhawulana kuqale.
Lapho ukuqalisa kubonakala kusebenza khona, kukhona okunye okudala ithrafikhi embotsheni yokuqalisa: iklayenti kwi-LAN, isihloli sokuqapha, noma izivivinyo zangaphandle zeseva uqobo. Khona-ke imephu ivuleka kuleyo nsizakalo eyodwa futhi ivaleke lapho ithrafikhi ima, ngakho uzakwabo olandelayo wangaphandle wehluleka futhi kuyilapho impumelelo yokuqala ihlezi kumbhalo wamaqoqo futhi ibonakala njengobufakazi.
Ukuqalisa ngokuvamile futhi kwenzelwa isibungu esisodwa. Izinhlelo eziningi zivumela idivayisi eyodwa yangaphakathi kuphela ukuba ibambe imephu ngesikhathi esisodwa, okungafanele neze iseva okufanele iphendule izakwabo eziningana. Lesi sici sakhelwa izinhlelo ezivula ukuxhumana kokulawula ngaphandle futhi zilindele idatha engenayo embotsheni yesibili, futhi sisahambisana naleyo fomu.
Ukudlulisa empeleni kwenza imephu yani
Ukudlulisa kuwumbhalo owodwa wokuhumusha: imbobo neprotocol ye-WAN kuyi ikheli nembobo yangaphakathi. Kudinga umlaleli osele esebenza ngaphesheya, futhi kudinga ukuthi ikheli langaphakathi lihlale endaweni yalo. Ukuqashwa kwe-DHCP okuthuthela komunye umshini kuthumela wonke umhubhe kusibungu esingalungile, buthule, ngakho yenza ukubhuka ngaphambi komthetho.
| Rule | Opens when | Closes when | Fits a VPN listener |
|---|---|---|---|
| Port forward | Saved, at boot | You delete it | Yes |
| Port trigger | Matching outbound traffic | Idle timeout or reboot | No |
Iprotocol ibaluleke ukwedlula okusikisela ifomu. OpenVPN phezu kwe-UDP idinga ukudlulisa kwe-UDP, i-WireGuard idinga i-UDP, futhi idatha ye-IPsec ifika njenge-ESP, iprotocol ye-IP engu-50, engenayo nhlobo imibobo. Ifomu lokudlulisa elamukela kuphela i-TCP noma i-UDP alikwazi ukuchaza lokho, ngakho i-IPsec idinga i-passthrough noma imephu emile yesinye-kuyedwa esikhundleni somthetho wembobo.
Ungqimba olungaphezu kwerutha yakho
Ukudlulisa kulawula kuphela ukuhumusha okungokwakho. Uma ikheli le-WAN lingelakho, okuyisimo esingemva kwe-NAT yomhlinzeki lapho ababhalisile babelana nge-100.64.0.0/10 njengoba kuchaziwe ku-RFC 6598, ukuxhumana okungena akusoze kwafinyelela kurutha yakho ngoba umhlinzeki uhumushe kuqala. Awukho umthetho kudivayisi yakho ongalungisa lokho kulandelana.
I-NAT ephindwe kabili iyinkinga efanayo ngokwesilinganiso esincane. Irutha yakho idlulisela kurutha yomhlinzeki we-inthanethi, engenawo umthetho ofanayo futhi elahla iphakethe. Noma faka umthetho kudivayisi yangaphandle, noma beka idivayisi yangaphandle kumodi yebhuloho bese uyeka eyakho ibambe ikheli lomphakathi.
Yingakho ukuhlolwa kufanele kuvele ngaphandle. Ukuhlolwa okuvela kuyo i-LAN efanayo ngokusebenzisa ikheli lomphakathi kuncike ekusekelweni kwe-hairpin NAT futhi kungaphumelela noma kwehluleke ngezizathu ezingahlobene nomthetho; ifoni kudatha yeselula, noma umngane kunelinye inethiwekhi, ukuhlolwa okuhlanzekile.
Nciphisa umthetho, bese uqinisekisa izingxenye zombili
Dlulisela imbobo eyodwa kukheli elilodwa. Ibanga elengezwe ngoba imizamo yokuqala yehlulekile liyindlela izixhumanisi zokuphatha eziphelela ngayo ku-inthanethi, futhi umlaleli we-VPN akadingi ikhasi lokuphatha lerutha elishicilelwe eceleni kwalo.
Gcina konke obekuvikela lowo mlaleli: ubunikazi besitifiketi noma ukhiye, udonga lomlilo lwesibungu, izinguqulo zamanje zamaphakethe. Ukudlulisa kungena iphakethe; ukuqinisekisa kunquma ukuthi iphakethe lizoba umhubhe yini, futhi lezo zizingxenye ezimbili zokwehluleka lapho okuthile kuhamba kabi.
Ukuqinisekisa kunezingxenye ezimbili. Ukuxhawulana kufanele kuqedwe kusuka kunethiwekhi yangaphandle, bese isisetshenziswa sangasese esingemva kweseva siphendula ngomhubhe. Ukudlulisa kungena ukuxhumana komhubhe hhayi okunye; ukuhambisa nokugunyaza kwe-10.8.0.0/24 kungesinye isilungiselelo kwesinye isikrini.
Nquma ngemibuzo emithathu
Imibuzo emithathu inquma ukukhetha ngokushesha kunanoma ikuphi ithebula lokuqhathanisa:
- Ingabe kukhona okuxhumana kungena kusuka ngaphandle njengephakethe lokuqala? Bese usebenzisa ukudlulisa, noma i-relay. Ukuqalisa akukwazi ukuvuleka ngaphandle kwethrafikhi ephumayo engasoze ibekhona.
- Ingabe imbobo kufanele iphile isikhathi eside kunangesikhathi sokungenzi lutho? Bese usebenzisa ukudlulisa, ngoba imephu eqalisiwe ivalwa ngohlelo lwayo.
- Ingabe ikheli le-WAN ngelelakho ukuze lishicilelwe? Uma kungenjalo, lungisa ungqimba oluphezulu ngaphambi kokuhlela noma uwuphi umthetho.
Uma impendulo kukho konke kuthathu ingu-cha, okuyisimo sekhompyutha ephathwayo ezishayela yona umhlinzeki wezebhizinisi, awukho umthetho odingekayo. Iklayenti elingemva kwe-NAT liyasebenza ngoba lizakhela lona imephu enesimo, futhi lokho kuhlanganisa iningi labantu abafunda ikhasi lokudlulisa imbobo phakathi nobusuku.