Iphrofayela eboshelwe kuseva yehluleka ngemuva kwe-TLS proxy: yisiphi isizukulwane?
I-Access Server 2.8 ne-2.9 yakha amaphrofayela aboshelwe kuseva ngendlela ehlukile. Nquma ukuthi iyiphi indlela i-proxy yakho eyiphulayo ngaphambi kokushintsha ingxenye yangaphambili.
Umsebenzisi oyedwa angaxhuma kanti omunye akakwazi, ngethuba elifanayo, ngosuku olufanayo. Bobabili banamaphrofayela aboshelwe kuseva, bobabili bakubakhiwo obufanayo be-Access Server, futhi umehluko owodwa ukuthi iphrofayela yabo yadalwa nini. Yilo nephethini okufanele uyibone, ngoba "iboshelwe kuseva" isho inqubomgomo hhayi ukulandelana kokuxhumana. I-Access Server isikhiphe izizukulwane ezimbili zaleyo nto, futhi i-TLS reverse proxy ime phambi komkhondo owodwa kuphela wemikhondo yabo. Izimo ezintathu zinquma ukuthi ukusiphi igatsha.
Izizukulwane ezimbili, ukulandelana okubili kokuxhumana
Emklamo wakudala, osebenza kuze kufike ku-2.8, ifayela elingenisiwe iyi-pseudo-profile. I-OpenVPN Connect iyisebenzisela ukuziqinisekisa ku-API yewebhu ye-Access Server nge-HTTPS, ithola iphrofayela yesikhashana eboshelwe kumsebenzisi kanye nethokheni yesikhathi, bese kuthi ngemuva kwalokho isungule i-VPN. Izingxenyekazi ezimbili zihamba ngokulandelana, futhi eyokuqala isicelo sewebhu esivamile.
Ifomethi eyethulwa ngo-2.9 ayikwenzi lokho kuqalisa kokuxhumana ngakunye. Iyiphrofayela yendabuko engasetshenziswa OpenVPN amaklayenti ahambisanayo, hhayi i-OpenVPN Connect kuphela. Ukuyilanda noma ukuyingenisa nge-URL kusengase kuhlanganise i-HTTPS — leso yisinyathelo sokushicilela, hhayi ukuthola iphrofayela yesikhashana kokuxhumana ngakunye.
| Older server-locked (≤2.8) | Newer server-locked (2.9+) | |
|---|---|---|
| Before the tunnel | Web API call with credentials | Nothing; the profile is already local |
| Client requirement | OpenVPN Connect | Any compatible client |
| What a TLS web proxy can break | The bootstrap, before any VPN attempt | Download only, not the connection |
| Expected HTTP log on connect | A request from the client | Often nothing at all |
Ukuthuthukisa akusho ukuthi kubhalwa kabusha amaphrofayela asevele akhishiwe, ngakho inguqulo yeseva yamanje isengase isabalalise into endala. Ukwakhiwa kweseva kukutshela okungenzeka, hhayi lokho lo msebenzisi akungenisile.
Izimo ezintathu ezikhetha igatsha lakho
Isimo sokuqala isizukulwane sento. Cela ifayela, bheka ukuthi lakhiwa kanjani, futhi bhala inguqulo yeklayenti elingenise. Uma ungeke ukwazi ukuthola isizukulwane efayeleni, iphrofayela entsha ekhishwe ikhonsa lokuhlola izokutshela ukuthi iseva ikhiqiza ini namuhla, futhi lokho kuyimininingwane ehlukile kunalokho okukomsebenzisi ohlulekayo.
Isimo sesibili yilokho ingxenye yakho yangaphambili eyiqedayo ngempela. I-HTTP reverse proxy yezinga lesikhombisa ededela i-TLS akuyona into efanayo ne-TCP forwarder yezinga lesine, futhi ne-UDP forwarder ayiyona. Ukuhlelwa okuvamile kwe-Access Server kuphothi 443 kwenza i-OpenVPN TCP daemon ibone ithrafikhi yesiphequluli futhi iyinikeze amasevisi ewebhu, ngakho ukufaka isiphetho se-HTTPS esingahlobene phambi akugcini ukuphathwa kweprotocol yaleyo daemon. Ukwabelana ngenombolo 443 akwenzi imiklamo emibili ilingane.
Isimo sesithathu yilapho ukwehluleka kuwela khona. Ukwehluleka ngaphambi kwe-VPN nokwehluleka kwesiteshi sokulawula kubonakala kufana kuklayenti elithi "iyaxhuma" kuphela, kodwa zishiya ubufakazi ezindaweni ezihlukile. Uma ifomethi endala isebenza, ukuqalisa kuyisihlungi. Uma ifomethi entsha isebenza, ilogi yokufinyelela yewebhu engenalutho iyalindeleka futhi ayifakazi lutho kunoma yiluphi uhlangothi.
Uma into indala: ukuqalisa kwehluleka kuqala
Funda iphutha langempela leklayenti hhayi isimo salo sokugcina. Izinkambu ezithakazelisayo iphutha le-HTTPS, ubunikazi beseva ebelilindelwe yiklayenti, indawo eya kuyo isicelo, nokuthi ukuqinisekiswa kwesitifiketi kuphelile yini. Bese uziqhathanisa namalogi esevisi yewebhu ne-proxy ohlangothini lweseva.
Ukufika kwesiphequluli ekhasini lokungena akubona ubufakazi bokuthi ukuqinisekiswa kwe-API kwale klayenti kuphumelele. Lezi zicelo ezihlukile, ezinokulindelwa okuhlukile kwesitifiketi futhi ngokuvamile amagama okusingatha ahlukile. Uma ingosi iseviswa kahle futhi iklayenti lisahluleka, ukungavumelani kusemkhondweni wokuqalisa, hhayi ephasiwedi yomsebenzisi.
Ungayenzi inqubo yokuqhathanisa iphumelele ngokucisha ukuqinisekiswa kwe-TLS noma ngokuxega inqubomgomo yokuqinisekisa. Lokho kuguqula ukungafani kokucushwa okungatholakala ukuhlolwa kube umkhondo osebenzayo kodwa ongaqinisekisiwe, futhi yilolo shintsho oluguqula ukuhlolwa kwesikhashana kube imbobo ehlala njalo. Idokhumenti ye-Access Server mayelana namaphrofayela okuxhumana ichaza izizukulwane zombili nokugeleza kwephrofayela yesikhashana, futhi yiyo incwadi okufanele ihlolwe ngaphambi kokucabanga ukuthi i-proxy inecala.
Uma into intsha: funda isiteshi sokulawula
Ngephrofayela yesitayela se-2.9, iklayenti liya ngqo endaweni yokugcina ye-VPN yendabuko. Phenya izindawo zokugcina ezisephrofayela, ingxenyekazi esetshenziswayo, nephutha lesiteshi sokulawula. Uma iklayenti lingakhiphi isicelo se-HTTP, lokho kuhambisana nomklamo futhi akulona uphawu.
Lapha nombuzo we-proxy ushintsha isimo. Ukukhipha i-HTTPS ngeke kwephule umfudlana we-TCP kuphela engakuboni, kodwa kusengase kwephule ukulandwa okushicilela iphrofayela, futhi i-TCP forwarder kuphela ngeke ithwale i-UDP nhlobo. Hlola ukuthi iphrofayela icela yiphi ingxenyekazi ngaphambi kokuphetha ngokuthi ingxenye yangaphambili ayibalulekile.
Ukudlulisa i-TLS komfudlana owodwa kuwukuhlelwa okuncane. Akunikezi ukudluliswa kwe-UDP, futhi akukhiqizi kabusha ukuziphatha kwe-daemon uqobo ekudluliseni amasevisi ku-443. Uma ingxenye yakho yangaphambili yenza okukodwa kwalokho, shono ukuthi yikuphi, ngoba ikhambi lihlukile.
Amathuluzi okulungisa ahlala emancane
Ukuhlola okungangeneli kangako ukwakha iphrofayela entsha esekelwayo yekhonsa lokuhlola nokuxhuma ngendawo yokugcina yendabuko ehlosiwe ngezidingo ezifanayo zokuqinisekisa. Uma lokho kusebenza kanti iphrofayela endala egciniwe ayisebenzi, uhlukanise into kuseva nakwi-proxy ngesinyathelo esisodwa.
Ukusatshalaliswa kwephrofayela eboshelwe kumsebenzisi kususa ngokuphelele ukuncika ekuqaliseni kwakudala, ngoba akukho ukushintshana kwephrofayela yesikhashana okungase kwehluleke. Kufanele ikhishwe kumsebenzisi ohlosiwe, ingalokothi ikopishwe kusiphathi, futhi ishintsha lokho iklayenti eligunyaziwe ukukwenza, ngakho kuyithathe njengesinqumo senqubomgomo hhayi njengeqhinga.
Bese ulungisa ukuhlelwa kokushicilela ukuze yonke indlela edingekayo ibekhona: umkhondo wewebhu wokulanda nokusetshenziswa kwengosi, kanye nomkhondo we-VPN wendabuko kuleyo ngxenyekazi amaphrofayela ayilindele. Gcina umsebenzi we-proxy kungqimba olulodwa. Umhubhe oboshelwe kumsebenzisi osebenzayo ufakaza ukuthi lowo mkhondo uyasebenza; awufakazi ukuthi konke ukuhlelwa kwe-proxy kusekela zonke izizukulwane, futhi ukwehluleka kokuqalisa kwakudala akugwebi ifomethi entsha.
- Thola isizukulwane sento ngaphambi kokuthinta i-proxy.
- Nquma ukuthi ukwehluleka kwenzeka ngaphambi komhubhe noma ngaphakathi kuwo.
- Qinisekisa ukuthi ingxenye yangaphambili iqeda ini: i-HTTP, umfudlana we-TCP, noma i-UDP.
- Hlola iphrofayela esanda kukhishwa ngokumelene nendawo yokugcina yendabuko ngenqubomgomo engashintshwanga.