Indlela ummeleli womphakathi afinyelela ngayo kumthombo oyimfihlo nge-VPN

Ukushicilela iwebhusayithi ngetsheli nokunikeza abasebenzisi ukufinyelela kwe-VPN kuyizinhlelo ezimbili ezihlukene ezabelana ngentambo eyodwa. Kweyokuqala, ummeleli ophambene womphakathi wamukela isicelo somvakashi futhi usithumela ngetsheli kumthombo okungekho muntu ongafinyelela kuwo ngqo. Kweyesibili, umsebenzisi kufanele ajoyine i-VPN ngaphambi kokuba uhlelo lokusebenza lufinyeleleke nhlobo. Ukuhlanganisa lezi zincazelo ezimbili yiyo indlela i-backend eyimfihlo egcina ngokuchayeka ngayo emphakathini.

Amamodeli amabili abukeka afana kudayagramu

Dweba imicibisholo ngaphambi kokukhetha noma yini. Imodeli yokushicilela yomphakathi ihamba isuka kusiphequluli iye kummeleli nge-HTTPS, bese isuka kummeleli iye kumthombo ngetsheli, futhi umthombo awukaze wamukele ukuxhumana okuvela ku-inthanethi. Imodeli ye-VPN kuphela ihamba isuka kuklayenti iye esangweni, futhi uhlelo lokusebenza lufinyeleleka kuphela ngaphakathi kwaleyo ndlela. I-laptop yomsebenzisi ihlezi kunethiwekhi efanayo nohlelo lokusebenza, futhi yilokho okushiwo yimodeli yonke.

Amamodeli ahluka ngokuthi ubani oqinisekisayo nokuthi kuphi. Kweyokuqala, ummeleli uyisango lomphakathi futhi udlulisa noma yisiphi isicelo esifikayo, kuhlanganise nesitha, ngokuhambisana nenqubomgomo emisiwe kuyo. Kweyesibili, ukufinyeleleka ngokwako kuyisango, ukwamukela okukhohlakele kodwa kwangempela.

I-TLS ima kuphi, futhi ikhombisani ngempela

I-TLS phakathi kwesiphequluli nommeleli ivikela lelo gxuma futhi ivumela isiphequluli ukuthi siqinisekise isayithi esasihlose ukuyivakashela. Uma ummeleli eqeda i-TLS, isicelo sikhona ngendlela efundekayo ngaphakathi kwaleyo nqubo ngaphambi kokudluliswa. Iseshini yesibili ye-TLS eya kumthombo ingavikela ugxuma olulandelayo futhi iqinisekise ngokwehlukana isiphetho sohlelo lokusebenza. Akukho seshini enqumayo ukuthi yimuphi umuntu ongasebenzisa uhlelo lokusebenza. Isitifiketi se-wildcard kummeleli naso asidluleli kulolo gxuma lwesibili.

Lena ingxenye abantu abayifingqa egameni elithi kubethelwe. Imfihlo, ubuqotho nobuwena beseva kuyizici zokuthutha; ukugunyazwa yisinqumo sohlelo lokusebenza. Ikheli eliyimfihlo ngemva kwetsheli lishintsha ukuthi ubani angafinyelela kusokhethi, hhayi ukuthi ubani angangena ngemva kokufinyelela.

Themba izihloko ezidluliswayo kuphela kusuka kummeleli

Izinhlelo zokusebenza ezilogayo noma ezigunyaza ngokwekheli leklayenti zivamise ukufunda isihloko esingeziwe ummeleli. Leso sihloko simane siwumbhalo, ngakho noma yini engafinyelela ngqo kumthombo ingafuna noma yiliphi ikheli. Khawulela umthombo ukuze kube ikheli letsheli lommeleli kuphela elingaxhuma, futhi uhlele uhlelo lokusebenza ukuthi lwamukele isihloko kusuka kulelo kheli kuphela.

curl -s -o /dev/null -w '%{http_code}
' -H 'X-Forwarded-For: 203.0.113.9' http://172.20.5.40/

Uma leso sicelo siphumelela kusuka kusibungu okungesona ummeleli, umthombo uthemba isihloko obekufanele asishaye indiva. Lungisa isilaleli ngaphambi kokuthinta uhlelo lokusebenza. Ukwenqaba kungumphumela ongcono kakhulu kunomugqa welogi ophethe ikheli lokukhohlisa.

Gcina umthombo ufinyeleleka endaweni eyodwa kuphela

Bopha isilaleli somthombo ekhelini letsheli noma sihawule ngodonga lomlilo oluya kummeleli, bese uqinisekisa ukuthi yini elalelayo ngempela. Isevisi eqalwe ngokubopha kwe-wildcard yamukela ukuxhumana kuyo yonke i-interface enayo isibungu, kuhlanganise naleyo oyikhohliwe ukuthi iyadluliswa. Ithebula lokulalela iyiqiniso eliyisisekelo, hhayi ifayela lokuhlela obuhlose ukulisebenzisa. Uma ukubopha kwe-wildcard kuyisinqumo, udonga lomlilo kumele namanje lube yingxenye elinciphisa.

ss -ltnp | grep -E ':(80|443)'

Yenza ukubuyekezwa okufanayo kuma-interface okuphatha, okuwukuchayeka okungazelelwe okuvamile. Bese ubhala amamodeli amabili ngokwehlukana: isayithi yomphakathi ngommeleli, kanye ne-interface yokuphatha efinyeleleka kuphela ngetsheli. Umusho wokuthi iseva ingemva kwe-VPN awusho lutho kwalokho.