I-SOCKS5 proxy ye-OpenVPN: i-TCP tunnel noma ukwenza i-proxy kwezinhlelo?

Amanethiwekhi avumela ukuphuma ngokusebenzisa i-proxy kuphela yiwo lapho iphrofayela esebenzayo ifa khona ngokuzumayo. Ikheli le-proxy iwukuguquguquka okungathakazelisi kakhulu kulokho kwehluleka. Konke kunqunywa uhlobo lwethrafikhi i-proxy ezoyidlulisa, ngoba lawa ma-proxy adlulisa umfudlana wamabhayithi futhi i-UDP tunnel ayikho njalo. Lokho kushiya izakhiwo ezimbili, futhi ziphuka ezindaweni ezihlukene.

Umkhawulo owodwa unquma umklamo

I-SOCKS5 ngempela icacisa imodi yokuhlangana ye-UDP. Noma kunjalo ukusekelwa kwe-proxy kweklayenti le-OpenVPN kwakhiwe ezindaweni eziwumfudlana: socks-proxy kubhalwe emadokhumentini eziphrofayela ze-TCP, futhi i-proxy ye-HTTP CONNECT ayinayo indlela yamadatagramu. Umugqa owodwa wemibhalo unquma isakhiwo ngaphambi kokuthi uthinte ifayela lokumisa.

Ngakho umbuzo awukho kokuthi iyiphi i-proxy okufanele uyikhethe. Umbuzo ukuthi i-tunnel iyaba umfudlana, noma ihlala iyidatagramu bese ivumela enye into ukuba ithathe ukwenza i-proxy.

Inketho A: yenza i-tunnel ibe umfudlana

Lokhu kudinga iseva enesilaleli se-TCP, nephrofayela yeklayenti equka i-proxy. Izingxenye zombili ziyadingeka, futhi uhlangothi lweseva yilona abantu abalukhohlwayo:

proto tcp-client
remote vpn.example.net 443
socks-proxy 127.0.0.1 1080

Shintsha umugqa wokugcina nge-http-proxy proxy.internal 8080 uma i-proxy ikhuluma i-HTTP, futhi wengeze ifayela lemininingwane uma likudinga. I-proxy kufanele ivume ukwenza i-CONNECT ephothini lakho le-VPN, futhi iseva kufanele iphendule nge-TCP; isilaleli se-UDP kuphela siyayishaya indiva leyo mizamo. Ukukhetha u-443 kuyisinyathelo esisebenzayo, ngoba amanethiwekhi amaningi anomkhawulo avumela loko nokuncane okunye.

Izindleko i-TCP efakwe phezu kwe-TCP. Ingxenye eyodwa yangaphandle elahlekile ivimba wonke umfudlana wangaphakathi owabelana ngalokho kuxhumana, ngakho ukululama obekungazimela kuba okwabiwe. Ukusetha nakho kuthatha isikhathi eside, futhi indlela yangaphandle engazinzile iba i-tunnel engazinzile esikhundleni sokuhamba kancane.

Inketho B: shiya i-tunnel yodwa

Uma i-tunnel kufanele ihlale ku-UDP, i-tunnel akuyona indawo lapho uhlela khona okuthile. Esikhundleni salokho, i-TCP ephuma ezinhlelweni iqondiswa esilalelini se-SOCKS sendawo, futhi izinhlelo azikaze zazi ukuthi ikhona i-proxy. Ku-Linux lokho ngokuvamile yi-redsocks kanye nomthetho we-NAT REDIRECT kuthebula le-nat.

I-TCP kuphela, futhi. I-proxy ye-HTTP kuphela njenge-privoxy ayikwazi ukudlulisa amaphrothokholi angenasizathu, futhi lo mklamo awengezi ukusekelwa kwamadatagramu ezinhlelweni.

Ukutshela uhlelo ngalunye mayelana ne-proxy ngqo ngokuvamile kungcono lapho isofthiwe ikusekela. Kulula ukuyihlola, futhi yehluleka endaweni ongayibona ngempela.

Inketho ngayinye yehluleka kuphi

Inketho A yehluleka lapho iseva ingenayo isilaleli se-TCP, lapho i-proxy inqaba umgomo we-CONNECT, noma lapho umfudlana wangaphandle uncishiswa ngaphansi kwalokho i-tunnel ekudingayo. Ezimbili zokuqala zishiya umbhalo kungobo yomlando ye-proxy; eyesithathu ishiya ukuxhumana okusungulwayo bese kuzwakala kungalungile. Funda lowo mbhalo ngaphambi kokuhlela iphrofayela, ngoba uhlukanisa inkinga yemvume nenkinga yomthamo. I-CONNECT eqediwe ihambisa uphenyo ngaphakathi kwe-tunnel.

Inketho B yehluleka kukho konke okudinga amadatagramu, kumaphrothokholi i-proxy engawaqondi, nangokuthule kubasingathi lapho umthetho wokuqondisa ukhona kodwa umzila udlulisela ithrafikhi eceleni kwawo.

Awekho anketho ashintsha isidingo sedivayisi. Amaphakethe asadinga i-node ye-TUN noma i-TAP ngaphambi kokuba i-kernel iwadlulise, ngakho inqubo isadinga imvume ku-/dev/net/tun. Isimbobo sishintsha okwenzeka ngemva kokuvulwa kwaleyo node, hhayi ukuthi uyidinga yini.

Fakazela ukuthi wakha yiphi indlela

Bheka amasokhethi hhayi isithonjana setreyi. Inqubo ye-VPN kufanele igcine ukuxhumana okusunguliwe kokukheli kwe-proxy, futhi i-proxy kufanele ibe ibhalile umgomo eyacelwa ukuba ifinyelele kuwo:

ss -tnp | grep openvpn

Bese uya endaweni okungayedwa i-tunnel kuphela engayisebenza, naku-igama okungayedwa isixazululi se-tunnel kuphela engaphendula kulo. Ukuxhumana kwe-proxy okuqediwe ne-tunnel efile ngokuvamile kusho ukuthi uhlangothi olukude aluzange lunikeze ukuthutha okuqanjwe kuphrofayela yakho.

Bhala ukuthutha kanye ne-proxy eyamukelayo endaweni ehlala isikhathi eside. Uma iphrofayela efanayo yehluleka kwelinye inethiwekhi, lowo mbhalo ususa noma uqinisekisa i-proxy ngemizuzwana.