Ingabe ithrafikhi idlula ngempela ku-VPN? Indlela yokuqinisekisa
Ukusesha komzila, ukugxuma kokuqala, ukubamba ku-adaptha yomzimba kanye nokuhlola ikheli ngaphandle kuphendula izingxenye ezahlukene zombuzo.
Amaphutha amabili abonakala efanayo esithombeni segunya lokwazisa: ithrafikhi engena emhubheni nethrafikhi eyivimba ngokuthula. Iklayenti ikhombisa Connected kuzo zombili izimo, ngoba Connected isho nje ukuthi isixhumi esibonakalayo somhubhe sikhona nokuthi iklayenti lifake imizila eliyifunayo. Ukuthi iphakethe elilodwa lohlelo olulodwa lisebenzise leyo mizila kuwumbuzo ohlukile, ophendulwa kwenye indawo kusitaki. Izilinganiso ezine zixazulula ingxenye enkulu — ukusesha komzila, ukugxuma kokuqala, ukubamba ku-adaptha yomzimba nokubheka ngaphandle — futhi umbono wesikhathi kuseva ugubuzela okusele.
Qala ngomzila iphakethe elizowuthatha
Ithebula lomzila yisinqumo ngokwaso, ngakho libuze ngendawo eyodwa esikhundleni sokulifunda lonke bese uqagela. Ku-Linux, ip route get isho isixhumi esibonakalayo nekheli lomthombo elikhethwe yi-kernel:
ip route get 203.0.113.10
ip route get 10.20.5.7Ku-Windows, Find-NetRoute -RemoteIPAddress 203.0.113.10 uwusizo kune-route print -4 ngesizathu esifanayo: ubika umzila owinile, hhayi yonke imizila ekhona. Noma kunjalo funda ithebula kanye ngenxa yomugqa walo 0.0.0.0. Ipheya ye-/1 lapho isho ukuthi iklayenti lomhubhe ogcwele libhale kabusha umzila ozenzakalelayo: inketho ye-redirect-gateway def1 ye-OpenVPN ifaka 0.0.0.0/1 ne-128.0.0.0/1 ngomhubhe, okunqoba i-0.0.0.0/0 ekhona ekufaneni kwesandiso eside ngaphandle kokususa umzila ozenzakalelayo womzimba. Yingakho imizila emibili ozenzakalelayo ingaba khona kanyekanye ngenkathi konke kusangena emhubheni.
Imininingwane emibili yenza ithebula libe ngamanga. Okokuqala, bheka isandiso esifanile hhayi inani lemizila ozenzakalelayo, ngoba imethrikhi yesixhumi esibonakalayo noma ipheya ye-/1 inquma owinile. Okwesibili, uxhumano olukhona kakade lugcina indlela olwasungulwa ngayo; ngemva kokukhula komhubhe, isikhathi esivuliwe singaqhubeka sisebenzisa umzila omdala kuze kusethwe kabusha, yingakho ukuxhuma kabusha kubonakala kulungisa inkinga yomzila. Iklayenti elisebenzayo — ps ax | grep openvpn — liqinisekisa kuphela ukuthi inqubo yaqala.
Landela igama elilodwa langaphakathi neleledwa elilodwa lomphakathi
Ukusesha komzila kukhombisa inhloso; indlela ikhombisa ukulethwa. Ngesikhathi uxhumekile, landela igama okufanele libe langaphakathi negama okungafanele libe njalo, bese uqhathanisa ukugxuma kokuqala:
traceroute intranet.corp.example
traceroute 1.1.1.1Ukugxuma kokuqala okufanayo kukho kokubili kusho ukuthi igama langaphakathi alizange lingene emhubheni futhi iphutha lingaphezulu kwawo, ngokuvamile igama elixazulula ekhelini lomphakathi noma umzila ongakaze ufakwe. Uma ithrafikhi yangaphakathi iphuma nge-10.8.0.1 kuyilapho eyomphakathi iphuma nge-192.168.1.1, umhubhe ohlukanisiwe wenza ngqo lokho owawumiselwe ukukwenza. Umkhondo ofika esangweni le-VPN bese ubuyisela kuphela ukuphela kwesikhathi ngokuvamile inkinga yendlela yokubuya noma yocingo lomlilo lweseva, hhayi umzila wokudlulisa ongekho.
I-ICMP ehlungiwe yenza lokhu kuhlola kube ngamanga: izinkanyezi kuyo yomibili imikhondo zibonakala njengomhubhe ofile futhi ngokuvamile uwucingo lomlilo. Hlola imbobo ye-TCP lapho unakho — traceroute -T -p 443 ku-Linux — futhi khumbula ukuthi umkhondo awusho ukuthi iyiphi isixazululi esiphendulile: igama lingaxazululeka endaweni futhi lisafinyeleleka ngomhubhe.
Bamba ku-adaptha yomzimba, hhayi emhubheni
Isixhumanisi somzimba iyona ndawo kuphela ekhombisa lokho inethiwekhi ekubonayo ngempela. Lapho umhubhe uphakeme, isikhathi sokuya ehhovisi kufanele sibonakale njengomthwalo oshifriwe oqondiswe kuseva ye-VPN, hhayi njengoxhumano oluya ku-10.20.5.7:
sudo tcpdump -ni eth0 udp port 53
sudo tcpdump -ni eth0 host 10.20.0.5Isihlungi sokuqala sibamba ukuxazululwa kwamagama okuphuma endaweni, okuwukuvuza okuvame kakhulu nokuthule kakhulu — ikhasi lisalayisha, isixazululi sibone umbuzo kuphela. Esyesibili sibamba ithrafikhi evamile eya ekhelini langaphakathi okufanele libe khona ngaphakathi komhubhe kuphela. Ku-Windows, pktmon wenza umsebenzi ofanayo ngaphandle komshayeli: pktmon filter add -p 53, bese pktmon start --capture --pkt-size 128, bese pktmon stop ne-pktmon format pktmon.etl -o capture.txt. Lezi zimpawu zihluka kancane phakathi kwezinguqulo ze-Windows, ngakho hlola pktmon filter add /? ngaphambi kokuthemba uhlelo lokubhala.
Bamba isixhumi esibonakalayo somzimba ukuthola ukuvuza; ukubamba emhubheni kuqukethe amaphakethe osuvele ukholelwa ukuthi akhona, kuseva kanye nokuqukethe amaphakethe angaphandle angafundeki okungumsuka wawo isango. Izibali zamabhayithi kunoma yisiphi isixhumi esibonakalayo zichaza amaphakethe, hhayi izinhlelo; ukwabela ithrafikhi kunqubo kudinga umqaphi ohlanganisa amasokhethi nezinqubo.
Buza isevisi yangaphandle, bese ubuza futhi ngohlelo ngalunye
Ukuhlola kuphela okuqinisekisa ukuphuma yimpendulo evela ngaphandle: isevisi ebuyisela ikheli lomthombo elikubonile. Yisebenzise kusuka ku-shell, lapho unga khetha isixhumi esibonakalayo, futhi yisebenzise kabili:
sudo curl --interface tun0 https://example.net/ip
sudo curl --interface eth0 https://example.net/ipIzimpendulo ezahlukene zikunikeza ubufakazi bemizila yomibili nendlela yokuhlola uhlelo oluthile: lubopha, noma lusebenzise endaweni yegama lenethiwekhi enomzila owodwa, bese ubona ukuthi iyiphi ikheli eliqoshwa yiphethelo elikude. Izimpendulo ezifanayo yikhona kuphutha okuthakazelisayo: mhlawumbe ukubopha akuzange kube nomthelela, noma kukhona okuthile phakathi komsingathi nephetheni elikude okubhala kabusha ikheli lomthombo ngaphambi kokufika. Ku-Windows, curl --interface idinga ikheli le-adaptha hhayi igama layo.
Isiphequluli esibika ikheli le-VPN siqinisekisa isiphequluli. Iklayenti le-imeyili, umphathi wamaphakethe, i-ejenti yokugcina ikhophi noma iphrofayela yesibili yesiphequluli ngakunye kungathatha indlela ehlukile, ikakhulukazi lapho ukulungiselelwa kwe-proxy noma umzila womhubhe ohlukanisiwe kugubuzela okukodwa kwawo. Ukushintsha kwekheli ngokwako akubona ubufakazi bokuvuza: isilinganisi somthwalo singaphendula ngendlela ehlukile kuye ngokuphuma elikubonile, ngakho qhathanisa ikheli lomthombo eliqoshiwe, hhayi ikhasi.
Sebenzisa umbono weseva ukuqinisekisa i-peer
Iseva iphendula umbuzo ohlukile: ukuthi i-peer ixhunyiwe yini, ingakanani ethwelile nokuthi isikhathi siqalile kabusha. I-peer esebenzayo kuseva ngesikhathi izibali zeklayenti cishe zinganyakazi kusho ukuthi ithrafikhi yohlelo ayingeni emhubheni, kungakhathalise ukuthi ithebula leklayenti lisho ini. Futhi i-peer ehambisa idatha eningi kumsebenzisi obika ukuthi akukho okusebenzayo uphenyo olunye.
Kukhona izicupho ezimbili lapha. Umhubhe ofihliwe wenza konke ukugeleza kubonakale sengathi kuvela esangweni, ngakho amalogi nokubalwa ngeklayenti ngakunye kuwela ekhelini elilodwa. Futhi iklayenti lithathwa njengomsingathi wasekhaya, ngakho umbuzo wokuthi kukhona okopisha amafayela nge-VPN uphendulwa ithrafikhi yokwabelana amafayela kuseva noma ukucwaninga komsingathi kuseva — ukubuka umhubhe kunikeza iziphethelo nomthamo, hhayi amagama amafayela.
Hlukanisa isinqumo sokwakha nokuvuza
Akukona konke okungaphandle komhubhe okuwukuvuza. Ithrafikhi yesixhumanisi sasendaweni neyokusakaza ihlala isendaweni ngokomklamo, iphrinta etholakala nge-multicast iyaqhubeka imemezela ku-LAN, futhi i-DHCP kufanele iphume endaweni. Uhlelo oluboshwe kusixhumi esibonakalayo esithile ludlula ithebula lomzila ngamabomu, futhi umthetho wocingo lomlilo, indawo yegama noma umzila wenqubomgomo kuphela oshintsha lokho.
I-IPv6 ifanele umugqa wayo ohlukile ohlwini lokuhlola. Umhubhe othwala i-IPv4 kuphela ushiya umsingathi onezigaba ezimbili indlela yesibili esebenzisekayo, futhi indawo enezigaba ezimbili izoyithanda — kuhlanganise ne-DNS, uma isixazululi sifinyeleleka nge-IPv6. Khubaza i-IPv6 ku-adaptha noma qinisekisa ukuthi umhubhe uyayithwala ngaphambi kokuthatha umphumela we-IPv4 njengophelele.
Lapho ukuhlola kungavumelani, ukungavumelani ngokuvamile kusho iphutha:
| What you see | What it means | Next step |
|---|---|---|
| The route picks tun0 but the capture shows cleartext to 10.20.5.7 | Something bypassed the table: a bound app, a policy route or a session older than the tunnel | Reset the flow, check the app bind, check the ip rule list |
| The route picks eth0 for an internal name | The name resolves to a public address, or the route was never installed | Compare the resolved address with the routes the server pushes |
| The capture shows DNS to the LAN resolver | Resolver leak: data is tunneled, lookups are not | Point the resolver inside, or push it from the server |
| All four checks agree and one app still fails | Path selection is fine; suspect MTU, a per-app proxy or the far end | Test the same destination from a known-good client |
Ukulandelana okusebenzayo: gcina ithebula lomzila ngaphambi nangemva kokuxhuma, landela igama elilodwa langaphakathi neleledwa lomphakathi, bamba i-DNS ku-adaptha yomzimba, buyisela ikheli lokuphuma kusuka ku-shell kohlelo oluthile, bese ufunda iseva ngomthamo. Uma ezine zokuqala zivumelana, umhubhe uthwala lokho ocabanga kukho futhi inkinga esele ingaphezulu kwawo. Uma ezimbili kuzo zingavumelani, ipheya engavumelani iyona iphutha, hhayi isithombe.