I-NAT elinganayo nama-VPN: linganisa ukumephwa, hhayi ilebula
Ukumephwa okuncike ekugcineni kuthinta ukutholakala kontanga, hhayi umhubhe ojwayelekile womthengi-kuya-iseva. Linganisa imbobo, bese usebenzisa isidlulisi uma indlela eqondile ihluleka.
Uchungechunge losizo luphela ngesinqumo esithi “i-NAT elinganayo, i-VPN ngeke isebenze lapha”, bese iklayenti lifakwa kabusha izikhathi ezintathu ngaphandle kwesizathu. Ilebulu lenza umonakalo ngoba liphendula umbuzo ongazange ubuzwe muntu. Iklayenti elixhuma ngaphandle kuya kuseva engaguquki lakha ukumephwa ngesikhathi lithumela iphakethe lokuqala, futhi impendulo ivunyelwa ukuba ibuye ngaphansi kwemithetho ecishe yonke inethiwekhi eyisebenzisayo. Lokho ukumephwa okuncike ekugcineni okukwenza kube nzima ngempela ukuthi ontanga ababili bazama ukufinyelela komunye nomunye ngasikhathi sinye, futhi lokho kuwukuhlolwa okunye.
Imibuzo emibili icashile ngemuva kwelebula elilodwa
Umbuzo wokuqala ukuthi ingabe umsingathi ongemuva kwale nethiwekhi angavula isikhathi sokusebenza esiya ekhelini lomphakathi nembobo eyaziwayo. Kumklayenti womhubhe leso yisimo esijwayelekile, futhi impendulo icishe ibe yebo njalo. Irutha irekhoda umthombo wangaphakathi, yabela imbobo yangaphandle, futhi idlulisa impendulo ngoba ingeyenkathi eyaqala ngaphakathi.
Umbuzo wesibili ukuthi ingabe imisingathi emibili engemuva kwamanethiwekhi ahlukene ingathola indlela eyabiwe futhi ithumele komunye nomunye ngaphandle kweseva phakathi. Lokho kuncike ekutheni inethiwekhi ngayinye iyabela kanjani leyo mibobo yangaphandle, futhi yilapho kuphela ukuziphatha kokumephwa okubalulekile.
Ukuhlanganisa kokubili kukhiqiza ukuxilongwa okungalungile okuvamile: isici sontanga siyahluleka, othile ugijima ukuhlolwa kohlobo lwe-NAT, ubona isigaba esibi kakhulu, bese ephetha ngokuthi nomhubhe ojwayelekile awukwazi ukusebenza. Umhubhe awuzange ube yikho okwahluleka.
Ukumephwa nokuhlunga kuyizici ezimbili ezihlukene
Amagama e-RFC anembe kakhulu kunamagama asetshenziswa abathengisi, futhi kufanelekile ukuwafaka kuthikithi ngoba aqeda izingxabano. Ukumephwa yindlela okwabelwa ngayo imbobo yangaphandle. Ukuhlunga ukuthi yimaphi amaphakethe angenayo avunyelwe ukudlula. Inethiwekhi ingaba nokhuqala kokunye futhi ibe nokukhululeka kokunye, futhi leyo nhlanganisela yiyo okufanele iphothuleke kuyo iphrothokholi yontanga.
| Behaviour | What it means | Effect on a direct peer path |
|---|---|---|
| Endpoint-independent mapping | One external port for every destination | Discovery works if the port is advertised |
| Address-dependent mapping | New port per remote address | Works only if both sides probe the same pair |
| Address-and-port-dependent | New port per remote address and port | Usually needs a relay |
Umugqa wesithathu yilokho iningi lamarutha asekhaya nabahlinzeki bezokuxhumana beselula abakushoyo ngegama elithi linganayo. Qaphela ukuthi ilebula lichaza ukwabelwa kuphela. Inethiwekhi enalokho kumephwa nokuhlunga okukhululekile isengakwazi ukwamukela amaphakethe angenayo embotsheni esanda kuyabelwa, yingakho ukubhoboza izimbobo kuphumelela kweminye futhi kwehluleke kweminye.
Ukuhlunga kunezimo zako ezintathu negama lako lesimo ngasinye. Ukubhala “i-NAT elinganayo” kuthikithi kuyilapho usho ukuthi “ukuhlunga okuncike ekhelini nasembotsheni” kuthumela umuntu olandelayo esahlukweni esingalungile sencwadi. Kokubili kuziphatha ngendlela ehlukile ekuhlolweni, ngakho iphutha akulona nje elokufunda.
Linganisa ukumephwa esikhundleni sokukupa igama
Ungabuka imbobo eyabelwe ngqo ohlangothini lweseva yanoma yiluphi usizo lwe-UDP olulawulayo. Qala ukuthwebula kumsingathi womphakathi, thumela kusuka kuklayenti, bese ufunda imbobo yomthombo iphakethe elafika nayo:
sudo tcpdump -ni eth0 -c 10 'udp port 51820'
sudo wg show wg0 endpoints
sudo conntrack -L -p udp --dport 51820Umugqa wokugcina uwusizo kakhulu kwezintathu, ngoba i-WireGuard irekhoda ikheli lokugcina nembobo eyatholwa kontanga ngamunye. Qhathanisa leyo mbobo nembobo iklayenti elicabanga ukuthi iyisebenzisa. Zizohluka njalo lapho kwenzeka noma yikuphi ukuhunyushwa, futhi umbuzo obalulekile ukuthi ingabe inani lihlala lizinze.
Phinda ukubuka kubhobo yomgomo yesibili noma kuseva yesibili bese uqhathanisa futhi. Uma imbobo yangaphandle ishintsha ngokomgomo, ukumephwa kuncike ekhelini nasembotsheni. Uma ihlala injalo, inethiwekhi ikunikeza ukumephwa okukodwa futhi ukutholakala kunethuba.
Amathuluzi asekelwe ku-STUN abika ukuhlukaniswa okufanayo ngesinyathelo esisodwa, futhi angasetshenziswa lapho inethiwekhi ivumela i-UDP ephumayo eya kuseva ye-STUN yomphakathi. Uma ingavumeli, indlela yokuthwebula engenhla isasebenza futhi ayidingi lutho ngaphandle komsingathi osuvele uwulawula.
Khetha ukulungiswa okuhambisana nokwehluleka
Uma isici esihlulekayo kungesontanga, izimpendulo ezisekelwayo isidlulisi, usizo lokuhlangana ontanga bobabili abangafinyelela kulo, noma esinye isakhiwo. I-TURN ikhona ngqo ngenxa yalokhu, futhi umkhiqizo oletha isidlulisi saso uyakutshela ukuthi ulindele ukuthi amanye amanethiwekhi abe yizitha.
Uma isici esihlulekayo kuwumhubhe ojwayelekile, ukuziphatha kokumephwa akusiyona inkinga yakho futhi akukho kulokhu okungenhla okusebenzayo. Hlola ukuthi iklayenti lithumela ngempela, iseva iyabona iphakethe, futhi impendulo iyabuya. Leyo kulandelana kuyizinto ezintathu zokubuka futhi ayidingi ukwazi lutho mayelana nesigaba se-NAT serutha.
Okungasebenzi ukusabalalisa izinguquko zembobo yasendaweni kuze kuxhumane okuthile. Ukushintsha imbobo yomthombo yeklayenti akushintshi indlela inethiwekhi eyabela ngayo ukumephwa. Impumelelo yenzekalanga emzamweni wesihlanu ingumbono ongamanga, futhi izokhonjiswa njengesixazululo izinyanga.
Rekhoda isakhiwo, hhayi isinqumo
Inothi eliwusizo lisho ukuthi yiphi iphrothokholi, isikhathi sokusebenza siqala ngakuphi uhlangothi, ingabe isidlulisi sikhona endleleni, nokuthi kwabonwa ini entanjeni. “i-NAT elinganayo, ayisebenzi” ayisebenziseki, ngoba kanyekanye inephutha ngomhubhe futhi ayinikezi lwazi ngendlela yontanga.
Fakisa ukuzinza kwembobo okulinganisiwe nokuziphatha kokuhlunga uma ukuhlolile. Lawa maqiniso amabili avumela omunye umuntu ukuba abikezele ukuthi isici esisha sizosebenza kuleyo nethiwekhi ngaphandle kokuphinda lonke uphenyo. Futhi aguga kangcono kunesigaba somthengisi esisho okuthile okuhluke kancane ekhasini ngalinye losizo.
Ekugcineni, gcina amagama e-RFC 4787 eduze lapho ubhala lokhu. Ukusebenzisa amagama anembe kubiza umusho owodwa futhi kuvimbela umfundi olandelayo ukuphinda ukuxilongwa okungalungile okufanayo, futhi yiyo yonke inhloso yokubhala inothi.