Ukuzungezisa ama-IP e-proxy ngaphandle kwe-VPN: okuyibona ukuphuma
Zungezisa ukuphuma kwe-proxy ngaphandle kwe-VPN: okungakufunda i-proxy ye-HTTP, indlela amaseshini anamathelayo avimbela ngayo isimo esiphukile nokuthi yikuphi ukuphuma ongakuvikela kwinqubomgomo.
Ukuzungezisa i-proxy ne-VPN kushintsha ikheli lakho lomphakathi ezingabeni ezihlukene, futhi lowo mehluko unquma ukuthi yini ephumayo. I-VPN ihambisa yonke iphakethe lingene emhubheni, ngakho ikheli lomthombo elibona ilitshe liyindawo yokugcina yomhubhe. I-proxy ihlezi ngaphezu kwengaba lenethiwekhi: yizicelo kuphela ozithumela ngayo ezivela ekuphumeni, kuyilapho konke okunye kumshini kugcina ikheli langempela. Ukwenza lokhu kwehlukanisa kahle kuguqula ukuzungezisa kusuka ebhokisini lokumaka kuye esinqumweni somklamo.
Ikheli lomphakathi livela kuphi ngempela
Ikheli elibona ilitshe yilapho ukuhamba kwakho kwaphuma khona okokugcina, futhi ekuxhumekeni kwasekhaya lokho yikheli lomhlinzeki kurutha yakho, hhayi into enayo umshini. Ukuqala kabusha irutha kungabuyisa isivumelwano esifanayo, futhi ukushintsha ikheli layo le-MAC kwesinye isikhathi kukhiqiza elisha, kodwa akukho kokubili okukunikeza isikhethi sezwe. I-VPN ishintsha ikheli lomthombo engabeni ye-IP, ngakho yonke iphakethe evela kumshini, kuhlanganise ne-DNS nezibuyekezo zangemuva, iphuma endaweni yokugcina yomhubhe. I-proxy isebenza engabeni eyodwa phezulu: yamukela isicelo, ivula ukuxhumana kwayo nalitshe, futhi yisicelo kuphela esivela ekuphumeni. Konke okunye kumshini kusasebenzisa ikheli langempela.
Lokho kwehlukanisa kuchaza iningi lezimangaliso. Isengezo sesiphequluli esibhekiswe ku-proxy sishintsha kuphela lokho okuthunyelwa yisiphequluli futhi akukho okunye, ngakho uhlelo lwesibili kusihlalo ofanayo lusaphumisa ikheli lokuqala. I-VPN yesistimu yonke inendlela ephambene yokuhluleka: ihlanganisa ukuhamba obufuna ukukugcina kwasendaweni futhi ivala kuphela uma iklayenti lilungiselelwe kanjalo. Ukukhetha phakathi kwakho kokubili empeleni ukukhetha ukuthi yikuphi ukuhamba okufanele kunyakaze.
Khona-ke ukuzungezisa kusebenza engabeni oyikhethile. Nge-proxy, ukuzungezisa kusho ukuthi isicelo esilandelayo sisebenzisa okunye ukuphuma. Nge-VPN, kusho ukudiliza nokwakha kabusha umhubhe, okuyinto ehamba kancane futhi ebonakala njengokuxhumana kabusha okubonakalayo.
I-proxy ye-HTTP ingafunda ini, futhi ingafundi ini
Ku-HTTP evamile i-proxy ibona i-URI ephelele emugqeni wesicelo, zonke izihloko kanye nomzimba. Ingakwazi ukurekhoda konke lokho futhi ibhale kabusha noma iyiphi ingxenye, yingakho i-proxy yamahhala efaka iskripthi ezimpendulweni yenza ngqo lokho okuvunyelwe wuphrothokholi. Ukuqinisekisa kusebenzisa Proxy-Authorization, futhi imininingwane yokungena engekho noma engalungile ikhiqiza 407 Proxy Authentication Required esikhundleni sephutha lokuxhumana.
Ku-HTTPS iklayenti lithumela CONNECT host:port futhi i-proxy ivula umhubhe oluhlaza, ngemva kwalokho ibona amabhayithi ashifriwe. Isafunda igama lomsingathi emugqeni we-CONNECT futhi ngokuvamile endaweni ye-SNI ekuxhumaneni kwe-TLS, ngakho ukurekhoda ezingeni legama lomsingathi kusinda ngisho nalapho umthwalo ungadluli. Ukufunda umthwalo kudinga ukuqeda i-TLS ngesitifiketi iklayenti elithembayo, okuwumkhiqizo ohlukile onobungozi obuhlukile. Futhi isicaciso sencazelo ye-HTTP sichaza i-CONNECT njengesicelo somhubhe, okuyimodeli yomqondo efanele yalokho ukuphuma okukwazi nokungakwazi ukukubona.
curl -v -x http://proxy.example.net:8080 https://example.com 2>&1 | grep -E 'CONNECT|Proxy-'Umphumela onemininingwane ukhombisa umugqa we-CONNECT ngaphambi kwanoma yikuphi ukuhamba kwe-TLS, futhi yileso sikhathi lapho i-proxy ifunda khona indawo oya kuyo. I-proxy ephendula nge-407 ayizange ivule umhubhe, ngakho ukuzama futhi ngezinye izilungiselelo ze-TLS ngeke kusize.
Ubukhulu bokuzungezisa bunquma ukuthi yini eyophuka
Ukuzungezisa kusizo ngalunye kuyisilungiselelo esibonakala siphephe kakhulu futhi siphuka kakhulu. Amakhukhi, amathokheni e-CSRF namaseshini ohlangothini lweseva aboshelwe kubunikazi, futhi ubunikazi obushintsha phakathi kokungena nokushaya okulandelayo bubonakala kuyo indawo njengokwebiwa kweseshini. Abahlinzeki abaningi banikeza iseshini enamathelayo ngokuyifaka ekhodini egameni lomsebenzisi le-proxy, ngakho ukuphuma kuhlala kugxilile esikhathini esikhethiwe.
Khetha ubukhulu emsebenzini, hhayi kokumisiwe komhlinzeki. Isiseshi esiletha amakhasi azimele singazungezisa kusicelo ngasinye, kuyilapho ukugeleza kokukhokha noma i-API eqinisekisiwe kufanele kubambe ukuphuma okukodwa kukho konke ukugeleza. Izingcingo ezimbili ngezansi zikhombisa igama lomsebenzisi elinamathelayo nendawo yokugcina ezungezayo elula, futhi socks5h isikimu sixazulula amagama ku-proxy hhayi kwasendaweni.
curl -sS -x http://user-session-a1b2:[email protected]:8080 https://ifconfig.me
curl -sS -x socks5h://127.0.0.1:1080 https://ifconfig.meI-DNS yasendaweni ingukuvuza okuthulile. Uma iklayenti lixazulula igama ngaphambi kokuxhuma, isixazululi sisafunda wonke umsingathi omvakashelayo ngisho noma isicelo se-HTTP siphuma kwenye indawo. Futhi socks5h isimo nokuxazululwa ohlangothini lwe-proxy kugwema lokho, futhi ukukusebenzisa akubizi lutho.
Indawo ihlukanisa ini ngaphandle kwekheli
Idumela lekheli kungenye yezinto ezimbalwa zokufaka. Izindawo zihlanganisa i-ASN kanye nelebula yayo yesikhungo sedatha noma yendawo yokuhlala, umbhalo weminwe we-TLS weklayenti, izilungiselelo ze-HTTP/2, ukulandelana kwezihloko, izinga lezicelo kanye nokuma kokuzulazula. Ukuphuma kwendawo yokuhlala okuqhutshwa isiphequluli esingenakhanda kungahluleka lapho ukuphuma kwesikhungo sedatha okuqhutshwa iseshini langempela kudlula khona.
Uhlobo lokuphuma lunquma ukuthi yini ongayisho ngobuqotho mayelana nokuhamba, futhi ngakunye kunezindleko ezihlukile.
| Exit type | What the target sees | Main cost |
|---|---|---|
| Datacenter proxy | Hosting ASN, cheap, often pre-blocked | Low reputation, easy to detect |
| Residential network | A consumer ISP address belonging to someone else | Consent and terms-of-service exposure |
| Mobile carrier | A carrier NAT address shared by many subscribers | Price, plus shared blame for abuse |
| Your own cloud egress | An address you are accountable for | Recognisable, but defensible |
Ukuphuma okwabiwe akunangakwesokunxele. Konke okunye okusebenza kulelo kheli kuwela esitsheni esifanayo sedumela, futhi ikheli eselishiswe abanye abaqashi lihluleka ngaphambi kokuba isicelo sakho sokuqala sifundwe.
Khetha ukuphuma ongakuchaza kunqubomgomo
Umbuzo owusizo akukhona ukuthi ungafihla kanjani ikheli kodwa ukuthi ubani onomthwalo wokuhamba okuphuma kulo. Ukuphuma kwakho kwefu emsebenzini ngamunye, umhlinzeki onesivumelwano sokucubungula idatha nokugcinwa okushicilelwe, kanye ne-VPN ozihosha ngokwakho enobunikazi obubodwa emsebenzini ngamunye konke kungachazwa emshweni owodwa. Uhlu lwamahhala alunjalo, ngoba umqhubi walo akanasibopho kuwe futhi unazo zonke izisusa zokurekhoda.
Gcina imikhawulo yakho yesivinini ngaphansi kwalokho okubekezelela indawo, futhi uqoqe kuphela izinkambu ezidingwa umsebenzi, ukuze iphutha lihlale lincane. Ukuzungezisa ngokushesha ukuze ubaleke ibhlokhi ngokuvamile kukhuphula izinga lezicelo eliyibangele.
Bhala ukuphuma okukhethiwe, iwindi lakho lokuzungezisa kanye nomnikazi walo kukho ukulungiselelwa komsebenzi ngaphambi kokugijima kokuqala. Uma ibhlokhi lifika, leyo nothi iyona ekutshela ukuthi ushintshe ukuphuma noma ushintshe indlela yokuziphatha.