Ukusethwa kabusha kwe-TCP akufakazeli ukuthi i-VPN yakho iyavinjwa

«Ukuxhumana kusethwe kabusha, kuyaqala kabusha» kuvela kulogi yeklayenti, futhi isiphetho sifika ngaphambi kobufakazi. Othile unquma ukuthi inethiwekhi ivimba i-VPN, noma isitifiketi asilungile, noma izwe elithile liyangenelela. Ukusethwa kabusha kuyiphakethe le-TCP eliqeda ukuxhumana, futhi umugqa welogi ubhala ukuthi iklayenti yakho ithole elilodwa. Awusho idivayisi eyithumele noma isizathu.

Ukusethwa kabusha kuyiphakethe, akusona isinqumo

I-TCP ichaza ukucutshungulwa kokusethwa kabusha: ingxenye enefulegi le-RST iqeda ukuxhumana ngokushesha. Umamukeli akaxoxisani, akazami futhi, futhi akabuzi ukuthi kungani. Ibika ukusethwa kabusha bese iqhubeka.

Yilokho kuphela okwaziwa yiklayenti. I-RST kungenzeka ukuthi yavela kuseva, ku-proxy, ku-firewall noma kusibalaniseli somthwalo esalahlekelwa isimo saso.

Ukuthola umsuka kuwumsebenzi ohlukile. Ikheli lomsuka elibonakala ekubanjweni akusona ubufakazi bomdabuko wenyama futhi alisho lutho mayelana nesinqumo senqubomgomo esingemuva kwalo. Amathuluzi aphakathi nendawo angakhohlisa amakheli, futhi amadivayisi anesimo angasetha kabusha ngenxa yokuphelelwa yisikhathi hhayi ngenhloso. Ukuthatha ukusethwa kabusha njengesinqumo kweqa ingxenye lapho uthola khona iqiniso.

Qinisekisa ukuthi yikuphi ukuxhumana okusethwe kabusha

Okokuqala hlola ukuthi iphrofayela esebenzayo isebenzisa ngempela i-TCP. Ukusethwa kabusha kumhubhe we-UDP akunangqondo, futhi ilogi ye-proxy ye-HTTP ingase ibhekisele engxenyeni ehlukile ye-TCP kuneyo-VPN uqobo.

Bhala indawo okuyiwa kuyo, imbobo, isikhathi somzamo kanye nesigaba iklayenti elalikufinyelele.

Isigaba yikhona okusetshenziswa kakhulu. Ukusethwa kabusha ngesikhathi sokuxhawulana kwe-TLS kukhomba iqembu elilodwa labasolwa; ukusethwa kabusha ngemuva kokuqinisekisa kukhomba elinye. Ngaphandle kwesigaba, yonke ithiyori iyafaneleka.

Qhathanisa iziphetho zombili zomzila

Uma uphatha iseva, qhathanisa izehlakalo zayo zomzamo ofanayo. Ingabe yamukele ukuxhumana? Ingabe yakuvala ngamabomu? Ingabe impendulo ishiye umngcele owodwa futhi ayizange ifinyelele kwelilandelayo?

Bamba kuklayenti nakuseva uma unakho. Ukusethwa kabusha okuvela kuklayenti kodwa hhayi kuseva akuzange kuqale kuseva.

Qaphela izingxenye ze-RST kuzo zombili izinhlangothi:

sudo tcpdump -ni any 'tcp[tcpflags] & tcp-rst != 0' -c 20
ss -tnp | grep 198.51.100.20

Nciphisa ngokuqhathanisa okulawulwayo

Inethiwekhi yesibili egunyaziwe ingakutshela ukuthi ukwehluleka kulandela iklayenti noma umzila. Uma iphrofayela efanayo isebenza kwenye indawo, ukucushwa kweklayenti cishe kulungile futhi okuguqukayo umzila.

Lokhu akukakakhombisi idivayisi eyodwa ethile ephakathi nendawo. Kunciphisa ububanzi kumzila owodwa, okuwumphumela owusizo futhi othembekile.

Gcina umehluko phakathi kokuthi lo mzila uyahluleka nokuthi lo mlingiswa oshiwo uyimbangela. Okokuqala kuyahlolwa; okwesibili ngokuvamile akunakwenzeka kusuka kuklayenti eyodwa.

Hlola ukulungiswa ngaphandle kokushintsha izilungiselelo zokuthemba

Ungavali ukuqinisekiswa kwe-TLS, ungakhi kabusha izifakazelo futhi ungamemezeli inqubomgomo yokuvimbela kusuka kumugqa owodwa wokusethwa kabusha. Ngakunye kwalokhu kushintsha kushintsha uhlelo oluhlolwayo futhi kwenza ukuqhathanisa okulandelayo kungabi nancazelo.

Lungisa ingxenye ekhonjiwe ngomnikazi wayo, bese uphinda iphrofayela efanayo nokubonwa okufanayo:

openvpn --config client.ovpn --verb 4
sudo tcpdump -ni any 'host 198.51.100.20 and tcp' -c 40

Umphumela owusizo ukwehluleka okutholwe kahle, hhayi indaba ethembeke kakhulu. Uma ukusethwa kabusha kunyamalala ngemuva kokulungiswa kwe-proxy, unesizathu. Uma kudlulela kwesinye isigaba, ufunde okuthile ngomzila. Noma kunjalo, ubufakazi kufanele bukhombise ukumelana nokufundwa ngumuntu wesibili. Bhala lokho okubonile, hhayi lokho okuphethe.