Imithetho ye-VPN kurutha: hlanganisa umthombo nendawo
Umthetho we-VPN kurutha unemikhawulo emibili: idivayisi ethumela ithrafikhi kanye nendawo okufanele isebenzise itheneli. Qala ngokunquma ukuhlangana nokuziphatha kokubuyela emuva.
Ikhasi lokuthenga irutha likhombisa ukuhamba kwe-VPN njengebhokisi lokukhetha elilodwa, futhi lelo binzana lifihla imibuzo emithathu ehlukene. Ingabe umthetho uhambisana nedivayisi ethumela ithrafikhi, noma iseva eyamukelayo, noma zombili? Kwenzekani kuthrafikhi engahambisani nakukodwa? Futhi lapho imithetho emibili ihlangana, iyiphi enqobayo? Ukubhala impendulo njengepheya lomthombo nendawo kuguqula uhlu lwezici olungacacile lube umklamo ongahlolwa.
Igama lesici lifihla imikhawulo emibili
Isidlali semidiya okufanele sisebenzise itheneli ukuhambisana komthombo. Isiqalo sehhovisi sangasese okufanele sifinyeleleke ngetheneli ukuhambisana kwendawo. Isiteshi somsebenzi okufanele sisebenzise itheneli kusevisi eyodwa kuphela kuzo zombili, futhi lokho kuhlangana yi-isimo i-firmware yabasebenzisi abaningi esisingatha kabi.
Bhala isidingo njengepheya ngaphambi kokuqhathanisa imikhiqizo. Lelo pheya yilona ozolihlola kamuva.
Umkhiqizo onikeza uhlu lwamadivayisi noma uhlu lwezindawo lomhlaba wonke kungenzeka ungakwazi ukuveza «leli divayisi kuphela, lezi zindawo kuphela». Umehluko awuwona wangaphandle: umthetho wendawo yomhlaba wonke uthumela ithrafikhi yedivayisi ngayinye kuleyo sayithi ngetheneli, futhi umthetho wedivayisi uthumela yonke ithrafikhi yalelo divayisi. Akukho kokubili okuyisidingo. Hlola leso simo ngamadivayisi amabili ngaphambi kokuthemba isikrini.
Yakha umthetho njengokuhlangana
Ithebula ligcina umklamo uthembekile. Beka isimo kwesokunxele, bese usho ngokwehlukana ukuhambisana komthumeli nokuhambisana komgomo:
| Scenario | Sender match | Target match | Rule shape |
|---|---|---|---|
| Media player uses the tunnel | Player address | Any internet destination except the LAN | Source only |
| Office prefix reachable | Authorized LAN devices | 10.40.0.0/16 | Target only |
| One app on one laptop | Laptop address | The service address set | Source and target |
| Guest network never tunnels | Guest subnet | Any | Deny, evaluated first |
Umugqa wesithathu uyathakazelisa, ngoba udinga izingxenye zombili ngasikhathi sinye. Uma i-firmware ikwazi ukuveza i-eksisi eyodwa kuphela, isidingo kufanele sihlukaniswe sibe imithetho emibili noma sidluliselwe kudivayisi ekwazi lokho.
Gcina ubunikazi bomthombo buzinzile. Ukubhuka kwe-DHCP, isigaba esikhethiwe noma indlela yobunikazi bedivayisi kuyasebenza, kodwa ikheli elishintsha ngemva kokuphela kwesivumelwano sokugaya alisebenzi. Faka i-IPv6, ngoba ikheli elilodwa le-IPv4 alikwazi ukuhlonza yonke ithrafikhi yedivayisi.
Ukubaluleka kunquma ukuhlangana
Ukwahlangana kwemithetho kuvamile. Umthetho wedivayisi obanzi nomthetho wendawo omncane kungachaza ukugeleza okukodwa, futhi ukulandelana kokubaluleka okubhaliwe kunquma ukuthi iyiphi enqobayo. Isikrini sezilungiselelo esikhangayo asikutsheli lokho kulandelana.
Funda incwadi yokufundisa mayelana nokulandelana kanye nesimo sokungahambisani, bese uhlola kokubili ngethrafikhi ongayibona:
ip rule show
ip route get 203.0.113.10Uma imibhalo ingasho ukulandelana, cabanga ukuthi umthetho omncane kungenzeka unganqobi futhi dweba ngokulandela lokho. Imithetho emibili engenakushayisana kulula ukuyisekela kunomthetho ohlakaniphile owodwa onokubaluleka okungabhaliwe.
Amagama adinga inqubomgomo yokuvuselela
Indawo ebhalwe njengesizinda yengeza inkinga yesondlo. Irutha kufanele iyixazulule, ivuselele imephu, iphathe amakheli amaningi kanye namasizinda angaphansi, futhi ibhekane ne-DNS yezinhlelo zokusebenza edlula isixazululi esilindelekile.
Ukukopisha umphumela owodwa wokusesha emthethweni we-IP kuyisithombe sesikhashana, hhayi inqubomgomo yesizinda.
Nquma ukuthi impendulo ingaba endala kangakanani ngaphambi kokuba umthetho ube nephutha, nokuthi irutha yenzani lapho ukuxazulula kuhluleka. Umthetho ogcina ikheli lokugcina elaziwayo ungadlula ukufuduka kwesevisi; umthetho olahla okufakiwe ungamisa itheneli ngokuthula. Zombili izindlela zokuziphatha ziyamukeleka uma zibhalwe eduze komthetho.
Chaza isimo sokungatholakali
Ukuthanda komzila akusoqisi ithrafikhi ye-VPN kuphela. Lapho itheneli iphansi, irutha ingavimba ukugeleza, ikuthumele ngqo noma isebenzise enye itheneli, futhi ukukhetha ngakunye kunesiginesha ehlukile yokwehluleka.
Nquma ukuthi isidingo sidinga okukupi, bese uqinisekisa ngokumisa itheneli nokubuka ukugeleza:
curl -sS -o /dev/null -w "%{http_code}" --max-time 5 https://service.example/
ping -c 2 203.0.113.10Ithrafikhi evela kurutha ngokwayo iyingxenye ehlukile. Ukudluliswa kwe-DNS, ukuhlolwa kwezibuyekezo nokuqapha kungaqala ukugeleza okusha kurutha ngokwayo esikhundleni sokuthola ukuhambisana komthombo wedivayisi. Cabangela lokho kugeleza ngokucacile, kungenjalo kuzovela njengokuvuza okungachazwanga kumarekhodi.