I-Redsocks ilalela ku-loopback kodwa ithrafikhi ye-VPN ayifiki neze

Ithumbu liyenyuka, iklayenti lingenza i-ping kugethiweyi, kodwa sonke isicelo sewebhu esidlula endleleni ye-proxy siyafa. Inqubo ye-redsocks iyasebenza futhi imbobo yayo iyalalela, ngakho umsebenzi ubonakala uphilile kusuka kugethiweyi ngokwakho. Okuhlulekayo isinyathelo sokulethwa: iphakethe eliqondiswe kabusha lisuka ethumbeni alihlali ku-socket oyisungule. Ikheli lokuboshelwa kanye nomgomo wokuqondisa kabusha kufanele kuvumelane, futhi ngokuvamile kubhekwa okukodwa kuphela kukho.

Iphakethe eliqondiswe kabusha lihlala kuphi ngempela

I-proxy esobala kugethiweyi isebenzisa i-REDIRECT kuthebula le-nat ku-PREROUTING ukubhala kabusha indawo okuyiwa kuyo koxhumano olungena iye embotsheni yasendaweni. Indawo ebhalwe kabusha iyikheli lasendaweni njengoba libonwa isixhumi lapho iphakethe langena khona, hhayi ikheli le-loopback lenqubo esungulwe kwenye indawo. Isilaleli esiboshelwe ku-127.0.0.1 kuphela samukela ukuxhumana okwakusele kusendaweni kusibambi-mgcini, futhi lesi yisimo esiqhubeka sisebenza ngesikhathi ithrafikhi yethumbu ihluleka. I-loopback yeklayenti ngokwakho iyikheli lesithathu futhi ayisoze ibe umgomo womthetho wegethiweyi.

Ngakho ngaphambi kokuthinta ubufakazi bamazwe aphezulu, thola amaqiniso amabili: umthetho ubhala kabusha uya kuyiphi ikheli lasendaweni, futhi i-socket ye-proxy iboshelwe kuyiphi ikheli.

Funda isilaleli kanye nomthetho wokuqondisa kabusha ndawonye

Phrinta ithebula le-socket kanye nemithetho ye-nat ngokuhamba okukodwa, ngoba umthetho okhomba embotsheni okungekho muntu onayo ubonakala ufana nomthetho okhomba ekhelini elingalungile. sudo ss -ltnp | grep redsocks ikhombisa ikheli lokuboshelwa kanye nenqubo engumnikazi. sudo iptables -t nat -S PREROUTING ikhombisa umgomo we-REDIRECT, futhi sudo iptables -t nat -L PREROUTING -v -n ikhombisa ukuthi kukhona yini okuhambisana nawo.

Ukugxuma uye ochungechungeni lomsebenzisi olubizwa nge-REDSOCKS akufezi lutho ngaphandle uma lolo chungechunge lukhona futhi luthwala okukhishiwe okuhlosiwe kanye nesenzo se-REDIRECT. Funda uchungechunge esigxuma kulo nge-sudo iptables -t nat -S REDSOCKS esikhundleni sokucabanga ukuthi igama lenza umsebenzi.

Bese uqhathanisa amanani amabili. Uma umthetho uqondisa kabusha uya ekhelini legethiweyi embotsheni engu-12345 futhi isilaleli sibika 127.0.0.1:12345, ukungavumelani kuchaza ukwehluleka ngaphandle kokunye ukuxilongwa.

Bopha ngokukhawulelwe, bese ukhawulela okungafinyelela kukho

Ukulungiselelwa kwesibonelo kwezinga eliphezulu kubeka isilaleli ku-loopback ngesizathu esihle: i-proxy esobala yamukela ukuxhumana egameni lanoma ubani ongafinyelela kuyo. Ukushintsha ukuboshelwa kube ngu-0.0.0.0 kulungisa ukulethwa futhi ngesikhathi esifanayo kuvula imbobo kuzo zonke izixhumi, okuwushintsho lwezokuphepha, hhayi ukulungisa okungathathi hlangothi. Khetha ukubopha ekhelini lasendaweni elithile elihloswa ukuqondisa kabusha, futhi gcina imbobo ivaliwe kuzixhumi ezingathenjwa. Uma ukuboshelwa okubanzi kungenakugwenywa, engeza umthetho we-firewall yokusingatha ovumela kuphela ububanzi bomthombo wethumbu kanye nethrafikhi yasendaweni yegethiweyi ngokwakho.

Ukuvula imbobo esixhumini esidlangalaleni akudingeki neze ethrafikhini ye-VPN eqondiswe kabusha, ngoba ukuxhumana kuphela kusendaweni ngemva kokubhala kabusha. Ungayivezi i-proxy ku-inthanethi ukuze ukuqondisa kabusha kwasendaweni kusebenze.

Kufakazele ngokuxhumana okusha okuvela kuklayenti

Hlola kuklayenti le-VPN langempela ngokuxhumana okusha kwe-TCP, hhayi kusuka ku-shell ekugethiweyini. I-curl -sS -o /dev/null -w '%{http_code}\n' http://example.com kuklayenti ihamba indlela eqondiswe kabusha kusuka ekuqaleni kuze kube sekupheleni.

Bese uqinisekisa ukuthi ukuxhumana okuqondile okuya kusilaleli okuvela kunethiwekhi engathenjwa kusenqatshwa, nokuthi ukuxhumana okuphezulu kwe-proxy ngokwakho akubanjwanga futhi ngalowo mthetho. Ukubanjwa okuphindaphindayo kuvela njenge-proxy ezixhumanisa yona uqobo futhi engaqedi isicelo. Engeza umgomo we-proxy kusethi okukhishiwe, noma maka amaphakethe ayo aphumayo ukuze uchungechunge luwadlule.

Ekugcineni, khumbula ukuthi le ndlela ayikubandakanyi. Ukuqondisa kabusha kwe-TCP okuvamile kwe-redsocks akuguquli i-UDP, i-QUIC noma i-DNS ibe ithrafikhi ye-SOCKS, futhi izindawo zangasese ngokuvamile zidinga okukhishiwe okucacile. Ukuhlola kwasendaweni okuphumelelayo kufakazela kuphela indlela ye-loopback eyayingakaze ibe inkinga.