Ithebula lomzila uma liqhathaniswa nokucingwa kwangempela: uhambo lwe-VPN luya kuphi

Qala ngendawo eyodwa kanye nomthombo wayo, bese uhlola ukuthi imuphi umthetho naluphi uhlu olunquma ngempela umzila. Ukukhipha ithebula lonke ngaphandle kwalesi simo kuduhisa.

Ukukhipha ithebula lomzila kuwukuxilonga okungasizi kakhulu ekuxazululeni izinkinga ze-VPN futhi okuyikho okunamathiselwa kakhulu. Imigqa engamashumi amane yezandulela ikutshela ukuthi umshini wawungase wenze ini, hhayi ukuthi wenzani ngesicelo esihlulekile. Indlela oyidingayo ngempela ukubheka: uma kunikezwe lo mthombo nale ndawo, imuphi umthetho ohambisanayo, yiluphi uhlu olwabuzwa, futhi iyiphi i-interface kanye negxathu elilandelayo ephumile. Qala ngendawo eyodwa nomthombo owodwa, bese ufunda ithebula unalo umbuzo esandleni, futhi okukhiphayo kufanayo kuba ubufakazi esikhundleni somsindo.

Ithebula liqoqo labazongenela ukhetho, akusona isinqumo

Yonke ingeno ichaza isandulela kanye nokumele kwenziwe ngethrafikhi ehambisana naso: yithumele ku-interface, yinikezele egxathini elilandelayo, noma yilahle. Akukho okuhleliwe ngenhloso kulolo hlu, futhi ingeno ebonakala icacile kakhulu kumuntu akuyona njalo leyo ekhethwa yi-kernel, ngoba ukukhetha kulandela ukufana kwesandulela eside kakhulu futhi, phakathi kwezandulela ezilinganayo, i-metric.

Ngakho isinyathelo sokuqala ukubuza i-kernel esikhundleni sokufunda uhlu. Umyalo wokubheka uphendula ngendawo, futhi uma unengxoxo yomthombo uphendula ngababili oqondile okwakuzowusebenzisa ukuxhumana okudlulisiwe noma okuboshiwe:

ip route get 198.51.100.10
ip route get 198.51.100.10 from 10.80.0.25
ip -6 route get 2001:db8:10::40

Yonke ikheli elingenhla iyisibonelo sombhalo. Iphuzu isimo sempendulo: i-interface, ikheli lomthombo elikhethiwe, isango kanye nethebula ingeno evela kulo. Uma lokho okukhiphayo kungahambisani ne-interface obuyilindele, usuthole inkinga ngomyalo owodwa, futhi noma ngabe ufunda kangakanani ithebula eliphelele bekungeke kukutshele ukuthi yimuphi umzongenela ukhetho owine.

Ukubheka kudlula emithethweni, bese kudlula emathelini

Ku-Linux isinqumo sinezigaba ezimbili. Imithetho yenqubomgomo ihlolwa ngokulandelana kokubaluleka, futhi umthetho wokuqala ohambisanayo usho ithebula okufanele kubuzwe kulo; lelo thebula bese lenza ukufana kwesandulela eside kakhulu. Umthetho ungahambisana nomthombo, indawo, uphawu lwesibhamu somlilo, i-interface noma inhlanganisela, yingakho ukukhipha ithebula eliyinhloko kungaba nembile ngokuphelele futhi kungabi nandaba neze nephakethe oyiphenyayo.

ip rule show
ip route show table all | head -40
ip route show table 100

Uma umthetho uthumela ithrafikhi esuka echibini lakho le-VPN iya kuthebula 100, khona-ke ithebula 100 yilona elibalulekile, futhi ithebula eliyinhloko liyisihibe. Lokhu futhi kuyindlela yokuhambisa umzila esekelwe emthonjeni ku-router: indawo efanayo ingaba nezimpendulo ezimbili ezihlukene kuye ngokuthi iphakethe livela kuphi, futhi ukubheka okunengxoxo yomthombo kuphela okuveza ukuthi yikuphi okusebenzayo.

I-IPv6 inemithetho namathebula ayo. Idizayini eqhuba imindeni yomibili idinga ukubheka kokubili, futhi impendulo ye-IPv4 esebenzayo ayisho lutho ngomzila we-v6 iklayenti elinamastakhi amabili engase likuthande.

Ikliyenti ye-VPN ifaka ini

Amaklayenti ngokuvamile awashintshi umzila ozenzakalelayo, ngoba lokho kungaphula umzila wangaphandle wethumbu ngokwalo. Afaka okuthile okuqondile okunqoba ngobude besandulela: ipheya lemingcele engu-0.0.0.0/1 kanye ne-128.0.0.0/1 iqhinga lakudala, ngoba zombili izandulela ezinde kune-0.0.0.0/0 futhi ndawonye zimboza yonke indawo. Abanye bafaka izandulela ezithile zangasese kanye nomthetho wenqubomgomo, futhi abanye banezela uphawu ukuze kuthathwe kuphela ithrafikhi ekhethiwe.

Yingakho "i-VPN ayizange ishintshe umzila wami ozenzakalelayo" kungebona ubufakazi bokwehluleka. Hlola ukuthi yengeze ini ngempela, nokuthi indawo okukhulunywa ngayo ingena yini kulezo zandulela:

ip route show | grep -E 'tun|wg|ppp|ipsec'
ip route get 10.20.30.40 from 10.80.0.25

Imigcele emibili engu-engxenye kulula ukuyiphosa ekukhipheni ngoba ayibonakali njengomzila ozenzakalelayo. Ukuhlelwa kwe-split-tunnel okukhohlwe ukufaka isandulela kukhiqiza isibonakaliso osilandelayo ngqo: uhlelo lokusebenza obekufanele lusebenzise ithumbu luyaxazulula futhi lixhumane sendaweni esikhundleni salokho. Qhathanisa izandulela ezifakiwe nezindawo umsebenzisi azidinga ngempela, hhayi namakheli owakuhlola ngengozi. Uhlu lwe-split-tunnel olumboza iseva yamafayela kodwa lungayimbozi isixazululi yayo lukhiqiza ukuxhumana okuxazulula kukheli lomphakathi bese kwehluleka ekuqinisekiseni, okubonakala njengenkinga yephasiwedi kodwa okuyinkinga yomzila.

Umzila wangaphandle nawo kufanele uphile

Ithumbu ngokwalo iwuthrafikhi. Amaphakethe athwala umthwalo ofakwe ngaphakathi aya ekhelini lozakwabo nge-interface yomzimba, futhi lowo mzila akumele uhambiswe umzila ubuyela ethumbini. Uma kwenzeka lokho, uthola ukwehluleka okukhethekile lapho ithumbu lisungulwa bese liyeka ukudlulisa ithrafikhi, ngoba ezokuthutha zethumbu manje zingaphakathi kwethumbu.

Hlola ikheli lozakwabo ngendlela owahlola ngayo indawo yangaphakathi, futhi uqinisekise ukuthi lixazulula ku-interface yomzimba hhayi ethumbini:

ip route get 203.0.113.10
traceroute -n -m 5 203.0.113.10

Umzila ophindaphindayo, umthetho wenqubomgomo obamba ozakwabo, noma umzila ozenzakalelayo oshintshwe ikliyenti yethumbu eligcwele yizizathu ezintathu ezijwayelekile. Zonke zintathu zibonakala ekubhekeni kwangaphandle, futhi akukho ngisho eyodwa ebonakala ekukhipheni ithebula eliyinhloko elithathwe ngemuva kwesigameko.

Okungeke kukutshele okukhiphayo kokuhambisa umzila

Ukubheka okulungile kusho ukuthi i-kernel ingathumela iphakethe endaweni enengqondo. Akusho ukuthi isibhamu somlilo siyavuma, inqubomgomo ye-IPsec iyayimboza, umthetho we-NAT uyayihumusha, noma uhlangothi olukude lunomzila wokubuya. Ngakunye kwalokho kuyisigaba sakamuva, futhi amanothi e-strongSwan ngokudlulisa achaza iketanga iphakethe okufanele lidlule kuyo kuzo zombili iziphetho.

Futhi akucabangi ukubopha ezingeni lohlelo lokusebenza. Inqubo ingabopha ku-interface, ibeke uphawu, noma isebenzise isixazululi sayo futhi ixhumane ngegama elixazulula ngendlela ehlukile kunalokho okuhlolile. Uma ukubheka kulungile futhi ukuxhumana kusahluleka, umbuzo olandelayo ukuthi yiluphi uhlelo olwenza lokho nokuthi lolo hlelo lubona ithebula elifanayo nawe.

Ngakho gcina ukuxilonga kuhlelekile: shono indawo nomthombo, gijimisa ukubheka, funda kuphela ithebula nomthetho okushiwo ukubheka, bese uhlola isigaba esilandelayo. Lokho kulandelana kugcina uphenyo lomzila lungaphezu kwemizuzu futhi kushiya irekhodi abanye abangalilandela, into ithebula elinamathiselwe elingasoze liyenze.

Izihloko ezihlobene