Kungani umhubhe wesibili we-VPN uphula owokuqala?

Ukufaka iklayenti lesibili le-VPN ukuze kufinyelelwe inethiwekhi eyodwa yekhasimende iyona ndlela evamile okwenzeka ngayo lokhu, futhi umhubhe wokuqala uyashabalala ngesikhathi womabili amaklayenti ebika impumelelo. Iklayenti ngalinye lafaka umzila wokuzenzakalela, owesibili wawucace kakhudlwana, futhi i-kernel manje iwulandela kukho konke ngaphandle koxhumano lwangaphandle lomhubhe wokuqala uqobo. Akukho okwawa futhi ayikho iphrofayela engalungile. Umzila owodwa wathatha indawo yomunye, futhi isixazululo siwukuthi unqume ukuthi yimuphi umhubhe okufanele ube nomzila wokuzenzakalela.

Uphawu: iklayenti lesibili liyawina buthule

OpenVPN: inketho redirect-gateway def1 ayiwubhali kabusha umzila 0.0.0.0/0. Yengeza 0.0.0.0/1 kanye 128.0.0.0/1: ndawonye bahlanganisa yonke ikheli le-IPv4, futhi isiqalo ngasinye sihlula umzila wokuzenzakalela ojwayelekile ngobude. Umzila wokuzenzakalela wangempela uhlala kuthebula futhi awusasetshenziswa kuthrafikhi evamile, futhi umzila wehosti oya kuseva ye-VPN uvimbela umhubhe ukuthi ungabambi amaphakethe awo angaphandle. Womabili amaklayenti enza lokhu, futhi elesibili limane lifake ipheya lalo kamuva.

Yingakho umhubhe wokuqala ubonakala ufile hhayi unqanyuliwe. Isixhumi sawo sikhona, isiteshi sokulawula siyaphila, futhi akukho thrafikhi yohlelo elusafinyelela kuso. Isikhalo esiphambene sinokuntuleka okufanayo kwe-push: ifoni exhumayo kodwa engathumeli lutho ivamise ukukhuluma neseva engakaze imemezele i-redirect-gateway, ngakho idivayisi igcina umzila wayo wokuzenzakalela futhi ifinyelela kuphela echibini.

Thatha isithombe semizila ngaphambi nangemva kokuxhumana kweklayenti lesibili. Imizila emibili yengxenye evela kuthebula iwukuphela koshintsho, futhi ichaza zombili izikhalo. Akukho okunye kuthebula okudinga ukunyakaza ukuze uphawu lube khona. Yingakho ukususa iklayenti lesibili kubuyisela okokuqala ngokushesha.

Funda ukuthi yimuphi umhubhe owina ngempela

Ungaqageli owinile ngokulandelana amaklayenti aqala ngakho noma ngesithonjana esithreyini. Buza i-kernel ukuthi iyiphi indlela eyayizosebenzisa endaweni engaphandle kwazo zombili izixhumanisi zangasese, bese ufunda isixhumi esibuyayo.

ip route show
ip route get 198.51.100.24
route print -4
Find-NetRoute -RemoteIPAddress 198.51.100.24

Ezimbili zokuqala ziyimpendulo ye-Linux kanti ezimbili zokugcina ziyisilinganiso se-Windows. Zisebenzise ngesikhathi womabili amahubhe ekhona, bese unqamula elilodwa futhi uzisebenzise futhi. Umehluko phakathi kwemiphumela emibili iyiqiniso olidingayo ngaphambi kokukhetha isixazululo, futhi kuthatha isikhathi esincane ukunokufunda ilogi yanoma iyiphi iklayenti.

Rekhoda umphumela, kufaka igama lesixhumi nesiqalo esihambisanayo. Ithikithi elithi i-VPN yesibili yephule eyokuqala yincazelo yophawu, hhayi isitatimende somzila umuntu angasebenza ngaso. Ukusesha kuyikwenza kube yiqiniso uminjiniyela olandelayo angakwazi ukuliphinda ngomyalo owodwa.

Windows: vimbela iphrofayela eyodwa ekubeni nomzila wokuzenzakalela

I-Windows igcina amaphrofayela agciniwe, futhi iklayenti elakhelwe ngaphakathi livumela elilodwa ukuthi lincike kwelinye ukuze okokuqala kuphakame ngokuzenzakalela lapho kwesibili kuxhuma. Iphrofayela exhumbe kokugcina ivamise ukugcina umzila wokuzenzakalela, ngakho umnikazi ongokoqobo ukuxhumana kokugcina hhayi okokuqala. Nika iphrofayela ngalinye imizila yalo yokupusha futhi uvule i-split tunneling kulelo okungafanele libe nomzila wokuzenzakalela.

Set-VpnConnection -Name "Contoso" -SplitTunneling $true
rasdial Contoso

I-split tunneling ishintsha lokhu: kungena kuthebula kuphela iziqalo ezicindezelwa yiseva, okushiya umzila wokuzenzakalela kumhubhe wokuqala. Idizayini isehluleka uma zombili iziseva zicindezela umzila wokuzenzakalela, ngoba lapho kuyawina ukuxhumana kokugcina futhi asikho isilungiselelo sohlangothi lweklayenti esishintsha lokho. Lungisa i-push ohlangothini lweseva noma wamukele umnikazi oyedwa.

Amaphrofayela aqalwa uhlelo ayisici esinye futhi kufanele kwaziwe: iphrofayela ye-Windows ingaqala lapho kuqalwa ifayela elisebenzayo eliqanjiwe, futhi izihlungi zethrafikhi zininquma ukuthi ithwala ini. Lokhu kuyisilungiselelo sephrofayela hhayi umthetho we-firewall, futhi kuxazulula inkinga ehlukile engxabanweni yomzila wokuzenzakalela.

Linux: gcina umhubhe wesibili ngaphandle kwethebula eliyinhloko

Ukusebenzisa izenzakalo ezimbili ze-openvpn --config emshinini owodwa kubeka womabili amaklayenti kuthebula elilodwa, futhi izinketho ezintathu ziwehlukanisa ngokwahlukaniswa okukhulayo. Okulula kakhulu ukuvimbela iklayenti lesibili ukuthi lihlele ithebula nhlobo: route-nopull nemizila ecacile, noma iskripthi se-route-up esifaka kuphela lokho okuhlosile. Lapho umhubhe wesibili uthwala ngqo iziqalo ozishilo futhi akukho okunye. Lapho wena unquma ukuthi yiziphi iziqalo eziya kuphi esikhundleni sokuzithola kamuva.

Umzila wenqubomgomo iyinketho ephakathi. Umthetho ukhetha ithebula elihlukile lekheli elilodwa lomthombo noma uphawu lwe-firewall, futhi lelo thebula lithwala imizila yomhubhe wesibili. Ukuhlunga komzila ophambene kuwugibe lapha, ngoba impendulo efika kwisixhumi esihlukile kunalelo ithebula elingalikhetha iyalahlwa, ngakho hlola isilungiselelo rp_filter ngaphambi kokuphetha ngokuthi umhubhe uphukile.

ip rule add from 10.44.7.0/24 table 100
ip route add default dev tun1 table 100
sysctl net.ipv4.conf.all.rp_filter

Izindawo zamagama zenethiwekhi ziyinketho esinda kakhulu futhi ehlanzekile kakhulu. Qala iklayenti lesibili ngaphakathi kwe-ip netns, linike ipheya le-veth, futhi ungene kuleyo ndawo yamagama ukuze ulisebenzise. Ukuphazamiseka kuyanyamalala ngoba indawo yamagama ngayinye inamathebula ayo esikhundleni sokwabelana ngelilodwa, lokho okufanele ukulungiselelwa okungeziwe lapho womabili amahubhe kufanele ahlale ekhona amasonto.

Ngohlelo ngalunye, futhi ukuxhumanisa kuyinkinga ehlukile

Kwesinye isikhathi uhlelo olulodwa kuphela okufanele lusebenzise umhubhe wesibili. Ku-Linux, umzila wenqubomgomo ngomsebenzisi, i-cgroup noma iphothi ufinyelela lowo mphumela, futhi indawo eyodwa ingabekwa esixhumini ngaphandle kokuthinta umzila wokuzenzakalela nhlobo. Uhlelo olubeka isokhethi yalo esixhumini esisodwa alubuzi ithebula lemizila nhlobo, ngakho isiqalisi singaqhubeka sisebenzisa i-adaptha ebonakalayo kuze kukhethwe ikheli kusilungiselelo salo.

Ukuxhumanisa kuwumsebenzi ohlukile ekusebenziseni amahubhe amabili ndawonye. Ukuxhumanisa i-A phezu kwe-B kusho ukuthi ikheli leseva yangaphakathi kufanele lifinyeleleke ngaphakathi komhubhe wangaphandle. Iklayenti langaphandle futhi akumele licabange ukuthi amaphakethe abethelwe eklayenti langaphakathi awukuvuza. Iklayenti elilodwa ngaphakathi komshini ongokoqobo iyinguqulo eqinile kodwa ethembekile; womabili kumsingathi oyedwa adinga umsebenzi womzila ongenhla kanye nomzila wangaphandle oya kuseva yangaphakathi ongayingeni nhlobo kumhubhe wangaphakathi.

Bhala umnikazi womzila wokuzenzakalela, uhlu lweziqalo umhubhe ngamunye owuthwalayo kanye nomzila we-DNS. Lezo zinto ezintathu zenza isigameko esilandelayo sibe ukusesha hhayi uphenyo.