sshuttle ngokumelene ne-VPN egcwele: imuphi umkhakha wendlela yayo
i-sshuttle ithwala kuphela lokho okusekelwa yindlela yayo yokudlulisa: hlola kuqala ukusabalala kwe-TCP, DNS ne-UDP, ilungelo lendawo elidingekayo kanye nomsizi okude.
i-sshuttle ikhethwa ngoba i-SSH isivele isebenza futhi ukubhala ngokufihlakele kubonakala kujwayelekile, futhi leso sizathu seqa umbuzo owodwa onquma ukufaneleka kwayo. Yimaphi amaphakethe ashiya umshini, yiliphi i-akhawunti eliwathwalayo ngaphesheya, futhi idingi kangakanani ilungelo lendawo. Lezi zimpendulo ezintathu ziyahluka ngokwendlela yokudlulisa, ngakho ukuhleleka okusebenza kuhlelo lokusebenza olulodwa kungase kwehluleke buthule kolunye olulandelayo. Incazelo engezansi iqala kuphrothokholi edingwa ngempela uhlelo lokusebenza.
Qala ngephrothokholi edingwa uhlelo lokusebenza
Ukusekelwa kwephrothokholi ku-sshuttle 2.0 kuncike endleleni oyikhethayo. Izindlela ze-NAT ne-nft ku-Linux zisebenza nge-TCP ne-DNS, kanti i-TPROXY yengeza i-UDP ejwayelekile. Yiphi ipulatifomu nendlela ngayinye inemikhawulo yayo, futhi i-macOS ivimbela ngendlela ehluke ngokuphelele. Bhala inguqulo efakiwe, indlela ekhethiwe kanye namaphrothokholi adingwa uhlelo lokusebenza ngaphambi kokukhetha noma yini.
Ngakho isicelo se-TCP esisebenzayo sifakazela okuncane kakhulu mayelana nohlelo lokusebenza lwe-UDP noma mayelana nakho konke ukusesha kwe-DNS. i-sshuttle iphinda ithathe i-TCP njengemifudlana esikhundleni sokuhambisa amaphakethe e-IP aphelele emhubheni, ngakho isiphetho sokudlula esibolekwe ku-VPN evamile asidluliselwa lapha. Qhathanisa indlela oyisebenzisayo ngempela nomthwalo onawo ngempela.
| Approach | What it carries | What it needs locally |
|---|---|---|
| SSH local forward | One explicitly named TCP destination | Nothing beyond the SSH client |
| sshuttle, nft or nat method | TCP and DNS to the routed prefixes | Root or sudo for firewall rules |
| sshuttle, tproxy method | TCP, DNS and general UDP | Root or sudo, and kernel support |
| IP VPN | Routed IP traffic in a tunnel | A client with the required privileges |
Okudingwa yiklayenti endaweni
Ukuhlelwa kweklayenti okubhaliwe kudinga i-root noma i-sudo, ngoba kufaka imithetho yendawo yokuvimbela esikhundleni sokwakha isixhumi somhubhe. Lelo qiniso elilodwa lishintsha indaba yokuphepha: inqubo enalelo lungelo ingaphambukisa ukuhamba kwayo yonke imishini, hhayi kohlelo olulodwa kuphela. Thatha ilungelo njengengxenye yokwakhiwa hhayi imininingwane yokufaka.
Qinisekisa ukuthi yimiphi imithetho efakwe ithuluzi nokuthi iyanyamalala uma liphuma. Iseshini ephahlukile eshiya imithetho yokuvimbela ingathumela ukuhamba emgodini omnyama isikhathi eside ngemva kokuba umqhubi ekholelwa ukuthi ukuxhumana sekuhambile, futhi uphawu lubonakala njengokuhluleka kwenethiwekhi hhayi njengomthetho osele.
sudo sshuttle --method nft --dns 172.19.4.0/24
nft list ruleset | grep -i sshuttle
ip routeUmyalo wokuqala uyisimo sokubiza okuvamile, nesiqalo osidinga ngempela. Eyesibili ikhombisa lokho ithuluzi elikufakile, kanti eyesithathu iqinisekisa ukuthi asikho isixhumi somhubhe esivele, okuwumphumela olindelekile walo mklamo.
Yini eyenziwa uhlangothi olukude
Uhlangothi olukude i-akhawunti ye-SSH egunyaziwe kanye nendawo yomsizi we-Python ehambisanayo. Ukungena okuphumelelayo ngaphansi kwe-shell ekhawulelwe akukunikezi ngokuzenzakalela imvume yokusebenzisa lowo msizi, futhi i-akhawunti ekwazi ukusebenzisa umsizi ayifinyeleli ngokuzenzakalela kuyo yonke insizakalo ehlosiwe. Womabili amaqiniso angawesicelo sokufinyelela hhayi amanothi okuxazulula izinkinga.
Vikela ukuqinisekiswa kobuwena bomsingathi nokuqinisekiswa kwe-akhawunti. Ukwamukela ukhiye womsingathi ongaziwa ukuze ukuxhumana kokuqala kusebenze kususa ukuhlolwa kokuthi uhlangothi olukude iwumshini owawuqondile, futhi lokho lapha kusinda kakhulu kunasekudlulisweni kwenhloso eyodwa.
Khawulela i-akhawunti ekude ezinsizakalweni ezidingwa ukugeleza komsebenzi, futhi xoxisana ngalobubanzi nalabo abasebenzisa umsingathi. Bayingxenye yobudlelwano bokuthembana, futhi asikho isethingi ohlangothini lweklayenti esikushintshayo lokho.
Umgcele wokuthembana ukuphi
Ukudlulisa ukuxhumana kwe-API okuyimfihlo nge-SSH akugunyazi yonke into yokusebenza kwe-API. I-TLS yohlelo lokusebenza nokungena kuhlelo lokusebenza kusasebenza, futhi ithuluzi alikwazi ukwenza insizakalo engaqinisekisiwe iphephe. Nokugxuma okulandelayo okuvela kumsingathi okude akuyona ngokuzenzakalela ingxenye evikelwe efanayo nechweba le-SSH, ngoba lokho kuxhumana kwesibili kulandela noma yimuphi umgomo onabo umsingathi okude.
Bhala umngcele njengomusho owodwa: ukuhamba okuya kulezi ziqalo kuphuma ngale akhawunti kulo msingathi. Uma umusho udinga isigaba sezikhiphile, umklamo wenza okungaphezu kwalokho okushiwo imibhalo yawo futhi ufanele ukubukwa futhi ngaphambi kokufinyelela ekukhiqizweni.
Kufakazela ngephrothokholi ngayinye, bese ukhetha ithuluzi
Hlola yonke iphrothokholi edingekayo ngesicelo esingenabungozi, kubandakanya indlela yesixazululi kanye nemindeni yamakheli esetshenziswa uhlelo lokusebenza. Fakela ukunqanyulwa ekuhlolweni, ukuze indlela yokwehluleka evunyelwe yohlelo lokusebenza ibe umphumela owaziwayo hhayi isimangaliso ngesikhathi sehlakalo. Iseshini edlulise ngendlela efanele ngenkathi isebenza ayisho lutho mayelana nokwenzeka uma iwa.
Ezinsizakalweni ezimbalwa ezishiwo ngokucacile, ukudluliswa kwendawo okuvamile kulula ukukuthola nokuphawula. Ngokuhamba kohlelo lokusebenza okuhambisana nendlela yayo, i-sshuttle inikeza indlela ephakathi esemthethweni. Uma imfuneko iwukuxhumana kwe-IP okubanzi, umklamo we-VPN uyimpendulo eqotho, futhi ukukhetha kulandela ukusabalala nomthwalo wokusebenza hhayi ukuhlelwa kwama-algorithm okubhala ngokufihlakele.