Imibhalo ye-split-tunnel idinga umthetho we-DNS eceleni komzila ngamunye
Umzila unquma ngokwekheli, isixazululi sinquma ngokwegama. Bhala zombili izikhethi kuwo wonke umgele, ngayinye inokuhlolwa okukodwa, kungenjalo inothi lizohluleka lapho i-DNS ishintsha.
Inothi le-split-tunnel elithi "ithrafikhi yasehhovisi idlula nge-VPN" libhale isinqumo esisodwa futhi lasikisela ezinye ezintathu. Ezingeni lamaphakethe, ithebula lomzila likhetha i-interface ngokwekheli lendawo; ezingeni lamagama, isixazululi sikhetha iseva ngombuzo, futhi lezi zinqumo ezimbili zithathwa ngokuzimela. Yingakho isiqalo esibhalwe kahle singakwazi ukukhiqiza umshini oxazulula igama langaphakathi libe yikheli lomphakathi, noma ungaxazululi lutho ngenkathi umzila ubonakala uphelele.
Izikhethi ezimbili, umzamo wokuxhumana owodwa
Lapho uhlelo luhlangana no-files.corp.example, ukusesha okubili kwenzeka ngaphambi kokuba kuvele iphakethe. Isixazululi sinquma ukuthi iyiphi iseva ethola umbuzo, sisebenzisa izizinda zokusesha, izizinda zomzila ngokuxhumana ngakunye noma umthetho ocacile wephrofayela. Ithebula lomzila libe selinquma ukuthi ikheli elivela lapho liya kuphi, lisebenzisa ukufana kwesiqalo eside kakhulu nendawo.
Akukho okuxhumanisa lezo zinqumo ezimbili. Indawo eyimfihlo ingaphendula nge-10.20.4.11, ngenkathi ithebula lomzila lithumela i-10.20.0.0/16 kumhubhe, futhi uxhumano luyasebenza. Phendula enye yazo, futhi yehluleka ngendlela ebonakala njengenye: inqubomgomo ye-DNS efanele kanye nomzila ongenakho kunikeza igama elixazululiwe kanye nokuphela kwesikhathi, ngenkathi umzila ofanele kanye nesixazululi somphakathi kunikeza ikheli eliqondiswa ngokuhlanzekile endaweni engafanele.
I-DNS enomkhathizwe ohlukanisiwe yenza lokhu kube kubi kakhulu. Igama elifanayo lingabuyisela ikheli eliyimfihlo kusixazululi sangaphakathi kanye nekheli lomphakathi kusixazululi esibheke ku-inthanethi, ngakho inothi elibhala kuphela isiqalo alikwazi ukubikezela ukuthi ikheli liphi iklayenti elizolisebenzisa ngempela. Bhala indlela yesixazululi kungenjalo ikheli liwukuqagela.
Into eliyishiya inothi lomzila kuphela
Irekhodi lomzila kuphela aliwusizo ekwehlulekeni okuvame kakhulu kwe-split-tunnel: amagama. Umsebenzisi ubika ukuthi i-intranethi ayilayishi, umhubhe uyasebenza, futhi isiqalo sikhona. Lowo othatha ithikithi akanalo irekhodi lokuthi yisiphi isixazululi okwakufanele siphendule, akanayo indlela yokuhlukanisa isijobelelo sokusesha esingalungile nesiseva esivinjiwe, futhi akanaso isisekelo sokuqhathanisa.
Ukushiywa kwesibili uhlu lwezihlengelo. Idizayini ye-split-tunnel ichazwa ngokufanayo yilokho okuhlala ngaphandle komhubhe kanye nalokho okungena kuwo, futhi izigaba ezikhishiwe ngokuvamile yizo eziphuka kuqala, ngoba umzila wasekhaya oqondile kakhulu noma isihlungi sohlangothi lweklayenti kungase kweqe inhloso ngaphandle kokuthinta iphrofayela.
Okwesithathu uhlangothi olukude lomhubhe. Umzila weklayenti ubeka iphakethe ocingweni kuphela; isango kusamele liyidlulise futhi libe nendlela yokubuya. Umhlahlandlela we-strongSwan wokudlulisa ukudluliswa uyakhumbuza ukuthi imithetho yokudlulisa kanye nodonga lomlilo esangweni iyingxenye yesici, hhayi ingxenye yamapayipi ongacabanga ukuthi akhona.
Izinkambu ezenza inothi lisebenziseke
Umugqa owodwa ngomgele ngamunye, futhi umgele uyindawo kanye negama kanye nomnikazi. Lezi yizinkambu ezisinda lapho zihlangana nesigameko sangempela:
| Field | Why it has to be written down |
|---|---|
| Destination prefix and address family | The route is per family; an IPv4 note says nothing about a AAAA answer |
| Selected tunnel or direct path | Names the decision, not the symptom |
| Private namespace and resolver | Which domain, which server, which search suffix |
| Public name path | Confirms public names do not accidentally use the private resolver |
| Where the rule lives | Client profile, server push, OS policy or management tool |
| Owner and review date | Namespaces change owner more often than routes change |
Umugqa othi "uhlala kuphi" yiwona abantu bawugxumayo. Isiqalo esisunduzwa iseva, umzila owengezwa iphrofayela yeklayenti kanye nomzila obhalwe ku-shell kuyahluka ngokuthi ubani ongawushintsha nokuthi ayasinda yini lapho kuxhunyanwa kabusha. Ngaphandle kwale nkambu, unjiniyela olandelayo akakwazi ukusho ukuthi yikuphi kokuthathu akubhekile.
Ukuhlolwa okukodwa kumthetho ngamunye, hhayi kumhubhe ngamunye
Umugqa ngamunye udinga izivivinyo ezimbili ezingenabungozi: esisodwa esijwayeza umzila nesisodwa esijwayeza igama. Komzila, cela into okufanele yeqe umhubhe futhi uqinisekise indlela hhayi ukufinyeleleka, isibonelo tracert -d 10.20.4.11 ku-Windows noma ip route get 10.20.4.11 ku-Linux. Kwegama, buza igama eliyimfihlo futhi urekhode ukuthi iyiphi iseva ephendulile, usebenzisa resolvectl query files.corp.example noma dig files.corp.example ngokumelene nesixazululi esikhonjwa yinothi.
Faka nokulindela okungalungile: yini okufanele yenzeke lapho umhubhe uvaliwe. Uhlelo olukhishiwe kudivayisi ye-Android noma ye-iOS enokuvinjelwa ngaphandle kwe-VPN kungase lungabi nokuxhumana nhlobo, futhi iklayenti ledeskithophu lingashiya uhlelo olufanayo lusebenza ngenkathi umhubhe uxhuma kabusha. Ukurekhoda impendulo ehlosiwe kuguqula "i-VPN yephula uhlelo lwami" libe isitatimende esingahlolwa.
Gcina irekhodi kanye nokucushwa
Gcina inothi eduze kwephrofayela eliyichazayo futhi ulinike inguqulo kanye naleyo phrofayela. Idokhumenti ku-wiki okungekho muntu oyibuyekeza iyindaba nje; ithebula elikusitoreji esifanayo nemizila esunduziwe kanye nenqubomgomo yesixazululi lingabuyekezwa kushintsho olulodwa.
Lapho okuthile kuphuka, qhathanisa umzila osetshenzisiwe nesixazululi esisebenzayo kanye nerekhodi ngaphambi kokufaka esinye isihlengelo. Izimbangela ezimbili kwezintathu ezijwayelekile — umthetho wakudala wendawo yamagama kanye nenqubo yosizo engaphandle kwenqubomgomo yohlelo — zibonakala njengempungukelo ye-VPN futhi azibonakali uma inothi libala iziqalo kuphela.
Ngaphambi kokuthi inothi liphelile, qinisekisa ukuthi liphendula ngokubhaliwe lezi: isiphi isiqalo, sawuphi umndeni wekheli; iyiphi indawo yamagama eyimfihlo, ephendulwe yisiphi isixazululi; amaphi amagama ahlala ngamabomu esesidlangalaleni; umthetho ngamunye ucushwe kuphi futhi ungobani; kanye nomlayezo owodwa oqinisekisa umzila nowoqinisekisa igama. Uma kukhona okungekho kulezi, isigameko esilandelayo sizohlolwa kusukela ekuqaleni.