TAP noma TUN? Amaklayenti e-OpenVPN ku-Android namaseva anebhuloho
I-TAP ithwala amafremu e-Ethernet, i-TUN ithwala amaphakethe e-IP, kanti uhlelo lwe-Android luthola uhlobo lwesibili kuphela. Qhathanisa zombili, bese ulungisa uhlangothi lweseva.
Iphrofayela esebenza kukhompyutha ephathwayo iyehluleka ocingweni. Isinyathelo esisobala ukushintsha igama elilodwa ekumisweni kweklayenti. Lelo gama ngeke lisize, ngoba iziphetho zombili azikhulumi ngohlobo olufanayo lwethrafikhi.
I-TAP ithwala amafremu e-Ethernet. I-TUN ithwala amaphakethe e-IP. Uhlelo lwe-VPN ku-Android lunikezwa isixhumi se-IP, okwenza enye yalezi zinto ezimbili zenzeke kanti enye ayikwazi, kungakhathaliseki ukuthi ukumiswa kuthini.
Ukuqhathanisa kufushane, kodwa kunquma ukuthi ungakulungisa yini ocingweni noma kufanele ushintshe isevisi.
Izinhlobo ezimbili zemigudu enemithwalo ehlukene
Isixhumi se-TAP siziphatha njenge-adaptha ye-Ethernet. Sithwala amafremu, okusho i-ARP, ukusakaza kanye nakho konke okunye i-LAN ekuthwalayo ngaphansi kwe-IP. Yikho okwenza ibhuloho lenzeke: umgudu unweba isifunda sokusakaza futhi amaklayenti aziphatha njengokungathi axhunywe kuswishi.
Isixhumi se-TUN sithwala amaphakethe e-IP aqondiswe kuso. Akukho ungqimba lokuxhumanisa okumele kuxoxwe ngalo, akukho ARP futhi akukho kusakaza. Umzila unquma okungena emgudwini, futhi ukumiswa kohlangothi lweseva kusebenzisa isethi engaphansi esikhundleni sebhuloho.
Iziphetho zombili kufanele zivumelane ukuthi yikuphi kwalokhu ezimbili ezenzayo. Ukushintsha i-dev tap ibe yi-dev tun ohlangothini olulodwa akuguquli isevisi; kudala iklayenti elilindele umgudu onomzila neseva esathumela amafremu, futhi ukuxhawulana kungaphumelela kuyilapho kungekho lutho olusizo oludlulayo.
I-Android inikeza ini ngempela kuhlelo
I-API VpnService yesikhulumi inikeza uhlelo isixhumi esibonakalayo samaphakethe e-IP, esimiswe ngamakheli, imizila kanye ne-MTU. Kuleyo API akukho adaptha ye-Ethernet, futhi uhlelo alukwazi ukuzakhela yona.
Yikho i-OpenVPN Connect ibhala phansi ukusekelwa kokuxhumana kwe-TUN okunomzila ku-Android esikhundleni sebhuloho le-TAP. Imibuzo evamile ye-Android isitatimende sohlangothi lweklayenti mayelana nalomngcele, futhi siyahambisana ne-API yesikhulumi.
Amathuluzi enethiwekhi anegunya le-root, i-firmware yangokwezifiso noma umkhiqizo osebenzisa ungqimba lokuhumusha olucacile kwezinye izinhlelo. Icala elivamile yilelo okufanele kuhlelwe ngalo: uhlelo olukwazi ukungenisa ifayela lakho futhi lusebenze njengomsebenzisi ojwayelekile, olunesixhumi se-IP futhi akukho lutho ngaphansi kwaso.
Kubukeka kanjani uma uzama noma kunjalo
Ukuxhumana kuvame ukusungulwa. Yikho okwenza ukwehluleka kudide: iklayenti libika ukuthi lixhunyiwe, ilogi yeseva ikhombisa umlingani, futhi akukho hlelo olusebenzayo.
Ithrafikhi eqondiswe ekhelini elinikezwe ucingo ayifiki, ngoba iseva idlulisa amafremu ngebhuloho iye ekhelini le-MAC ucingo olungakaze lube nalo. Ukutholwa okuncike ekusakazeni kuhlala kungenalutho. Uma i-LAN incike ku-DHCP ngaphesheya kwebhuloho, ucingo ngeke luthole ukuqashwa ngaleyo ndlela, futhi ikheli elinikezwe ngesandla kusethi engaphansi enebhuloho alikadali isixhumi esingekho.
Amanye amaklayenti ehluleka kusenesikhathi, ekungeniseni iphrofayela, uma ebona uhlobo lwedivayisi angakwazi ukulusebenzisa. Zombili lezi zimo zisho into efanayo, futhi akukho kokubili okulungiswa ngokwengeza imizila, ukushintsha i-DNS noma ukunweba ibanga lamakheli omgudu.
Uhlangothi lweseva kufanele lushintshe ini
Ukulungiswa kungokwalowo osebenzisa isevisi ye-VPN, futhi ngokuvamile kungukwengeza hhayi ukufuduka. Qalisa isikhathi sesibili se-OpenVPN ngedivayisi enomzila, isethi engaphansi yamaklayenti yayo kanye nokumiswa kohlangothi lweseva okwaba amakheli futhi kuthumele imizila edingwa amacingo. Isikhathi esikhona esinebhuloho siyaqhubeka ukukhonza amadivayisi adinga ngempela i-Ethernet.
Imininingwane emibili yenza lokhu kusebenze empilweni. I-LAN idinga umzila wokubuyela wesethi engaphansi yamaklayenti emisha, okhomba kusibungu se-VPN, ngaphandle kwalokho izimpendulo aziyi kubuya. Futhi udonga lomlilo kusibungu somgudu kufanele ludlulise phakathi kwesixhumi somgudu ne-LAN, futhi leso yisinyathelo esivame ukukhohlwa uma ukuhlolwa okuvela kusibungu uqobo kuphumelela.
Uma umqhubi engakwazi ukwengeza isevisi, enye indlela idivayisi engajoyina ibhuloho, okusho ikhompyutha ephathwayo noma i-rawutha esebenza egameni locingo. Lokho kuyindlela yokuzungeza enezindleko zayo zokuphatha, hhayi ukumiswa kwe-Android.
Nquma ngokuhlelo, hhayi ngomgudu
Buza ukuthi ucingo kufanele lufinyelele ini ngempela, bese ukubeka emephini. Ukwabelana ngefayela noma isayithi ye-intranet efinyelelwa ngegama noma ngekheli kuyisidingo se-IP, futhi umgudu onomzila uyasigcwalisa uma i-DNS isixazulula igama futhi umzila ukhona. Ithuluzi lokuthola elidlulisa isifunda sokusakaza sasendaweni akusona isidingo se-IP, futhi akukho nani lomzila olizogcwalisa.
| Requirement | Tunnel that satisfies it |
|---|---|
| File server or intranet by hostname | Routed TUN, with working DNS |
| Broadcast or ARP-based discovery | Ethernet bridging, so not an ordinary Android client |
| Multicast delivery | Bridging or an explicit multicast relay |
| One application to one address | Routed TUN, narrowest possible route |
Leyo thebula futhi iyisicelo okufanele sithunyelwe. Shono uhlelo, ikheli noma igama elilusebenzisayo, nokuthi lincike yini ekutholeni. Umqhubi angasebenza ngaleyo ncazelo, into okungekho muntu ongayenza ngocingo olungaxhunyi.
Ekugcineni, gcina isevisi ye-TAP yamadivayisi ayidingayo esikhundleni sokuphoqa iklayenti ngalinye ukuthi lilingise i-adaptha ye-LAN. Amasevisi amabili anezinhloso ezicacile kulula ukuwasekela kunezinye ezingafinyeleli phakathi kubo bonke.