I-TunnelCrack ne-TunnelVision: yini ngayinye eyephula ngempela

Amagama amabili ocwaningo asetshenziswa ngokushintshana kunoma yikuphi ukuhamba kwe-VPN okuphuma emhumeni, kodwa izindlela ezingemuva kwawo azifani. I-TunnelCrack ichaza imindeni emibili yezihluzi zomzila; i-TunnelVision ichaza umzila ohlinzekwa yi-DHCP kudivayisi yokugcina. Kokubili akukwephuli ukubethela, futhi akukho okutshela ukuthi ukwakhiwa okuthile kweklayenti kwenzani namuhla. Izivivinyo ezinhlanu zihlukanisa izindlela nesihloko.

Isinyathelo sokuqala: shono indlela oyihlolayo

Ukudalulwa kwe-TunnelCrack ngo-Agasti 2023 kuchaza imindeni emibili yokuhlaselwa. Esimeni senethiwekhi yasendaweni, ukuhamba okuqondwa yiklayenti njengokwasekhaya kuthatha okuhlukile kokufinyelela kwasendaweni bese kuphuma emhumeni. Esimeni sekheli lesiphakeli, umzila odingwa yiklayenti ukufinyelela isiphakeli se-VPN uqobo ungaphandle komhume, futhi isitha esilawula lelo kheli singasebenzisa okuhlukile.

I-TunnelVision ingumbiko ohlukile mayelana nemizila eqinile engenazo izigaba ehlinzekwa yi-DHCP. Isiphakeli se-DHCP esikhohlakele singanikeza idivayisi yokugcina imizila eshintsha indlela ukuhamba okuthathayo, kuhlanganise nendlela eya kusiphakeli se-VPN. Umbiko uyavuma umsebenzi wangaphambili mayelana nemiphumela yomzila ehlobene, okukhumbuza ukuthi indlela eyisisekelo indala kunegama.

Gcina amagama eboshelwe ezindleleni zawo. Ukusebenzisa ukulungisa kwelinye ngenxa yokuthi elinye lisemithombeni iyona ndlela okwenza ngayo ukubuyekezwa kudale ukunyakaza ngaphandle kokumboza.

Isinyathelo sesibili: bheka okuhlukile kokufinyelela kwasendaweni

Iningi lamaklayenti likhulula ukuhamba kwenethiwekhi yasendaweni ukuze amaphrinta, ukusakaza kwesikrini nokwabelana ngamafayela kuqhubeke kusebenza ngesikhathi umhume uvuliwe. Lokho kuhlukile yisinqumo senqubomgomo esinezindleko zokuphepha: isitha esikulowo nethiwekhi singazethula njengomsingathi wasendaweni, futhi ukuhamba okufinyelela kuso akukaze kungene emhumeni.

Buza ukuthi ingabe iphrofayili esetshenzisiwe iyasidinga ngempela isihluzi. Amandla okusebenza akude angakaze asebenzise ukutholwa kwasendaweni ngokuvamile angayicisha, futhi izinsizakalo zasendaweni ezisele zingafinyelelwa ngomzila obhaliwe. Lapho isihluzi sidingeka khona, shono ukuthi yimaphi amaphuzu okufika ewahlanganisayo esikhundleni sokuchaza njengokuhamba kwasendaweni.

Ukuhlola kuwumbuzo wokucushwa, hhayi ukubanjwa kwamaphakethe. Funda isetingi sephrofayili nemibhalo yeklayenti yokwakhiwa okusebenzisa kona, ngoba inani elizenzakalelayo liyahluka phakathi kwemikhiqizo naphakathi kwezinguqulo zomkhiqizo ofanayo. Bhala impendulo eceleni kwephrofayili, ukuze umhloli olandelayo angadingi ukuyithola ekuziphatheni. Isihluzi okungekho muntu osibhalile yisihluzi okungekho muntu osihlolayo.

Isinyathelo sesithathu: bheka ukuthi ikheli lesiphakeli lifundwa kanjani

Iklayenti kufanele lifinyelele isiphakeli se-VPN ngaphambi kokuba kube khona umhume, ngakho lowo mphuzu wokufika uhanjiswa ngaphandle komhume ngokomklamo. Uma ikheli lifundwa egameni, isinyathelo sokuxazulula siyingxenye yomzila wokuthembela, futhi isitha esingaphendula lowo mbuzo singakhomba iklayenti kumsingathi eliwulawulayo.

Ukugxilisa ikheli, ukusebenzisa isitifiketi esiqinisekisiwe esinegama elifanele nokwenqaba ukubuyela kusiphakeli esingaqinisekisiwe konke kunciphisa ukuchayeka. Akukho kukho okususa isidingo sokufinyelela isiphakeli ngaphandle komhume; kushintsha ukuthi ubani angaphendula ngaleo kheli.

resolvectl query vpn.lab.example
ip route get 198.51.100.24
ip rule show

Ukusesha komzila kubonisa isixhumanisi iklayenti elizosisebenzisa ekhelini lesiphakeli, futhi lokho yikho okuhlukile ngendlela ebonakalayo. Uma lokho kusesha kubuyisa isixhumanisi somhume, iklayenti alikwazi ngisho ukusungula umhume, ngakho umzila wangaphandle ulindelekile futhi umbuzo ukuthi umphuzu wawo wokufika ukhethwa kanjani.

Isinyathelo sesine: bheka imizila ehlinzekwa yi-DHCP

Imizila eqinile engenazo izigaba ivumela isiphakeli se-DHCP ukuthi sisabalalise okufakiwe kuthebula lomzila, futhi idivayisi yokugcina ngokuvamile ikwamukela ngaphandle kokubuza. Kunethiwekhi lapho isitha singaphendula i-DHCP ngokushesha ukudlula isiphakeli esisemthethweni, lokho kufakiwe kungaphambukisa ukuhamba umsebenzisi acabanga ukuthi kungaphakathi komhume.

Qhathanisa imizila ekudivayisini yokugcina nemizila oyilindele. Umzila ozenzakalelayo noma isiqalo esibanzi esikhomba esangweni lasendaweni ngesikhathi umhume uvuliwe yiwona mphawu ofanele uphenywe, futhi ubonakala ngaphandle kwanoma yikuphi ukuhamba kokuhlasela.

ip route show table all
ip route get 203.0.113.55
nmcli -g ipv4.ignore-auto-routes con show "Wired connection 1"

Isethingi sokugcina ukulawula ohlangothini lwedivayisi yokugcina okudalulwa amaklayenti amaningi namapulatifomu ngendlela ethile: ziba imizila ehlinzekwa inethiwekhi. Ukucisha ukwamukela imizila okuzenzakalelayo kuwukuyekelela, ngoba kucisha nokuhamba okuhlukanisiwe okusemthethweni okuvela kusiphakeli se-DHCP senkampani, ngakho nquma ngokwezigaba zenethiwekhi hhayi ngokwembulunga.

Isinyathelo sesihlanu: hlukanisa isaziso nokwakhiwa kwamanje

Ukuhlasela okushicilelwe kuchaza ukuziphatha okwabonwa ezinguqulweni ezithile zeklayenti ngesikhathi esithile. Akufakazeli ukuthi ilaptop ephambi kwakho ithintekile, futhi akufakazeli ukuthi ilungisiwe. Zombili izimangalo zidinga inombolo yokwakhiwa yangempela nesaziso samanje somhlinzeki.

Rekhoda inguqulo yeklayenti, ipulatifomu, izilungiselelo zephrofayili ezilawula izihluzi ezingenhla kanye nosuku oluhlole ngalo. Lelo rekhodi liguga ngokwethembeka, kuyilapho inothi elithi i-VPN yafakwa isichibiyelo ngenxa ye-TunnelCrack aligugi ngokwethembeka. Yifunde futhi njalo lapho iklayenti libuyekezwa, ngoba inani elizenzakalelayo lephrofayili lingashintsha ngaphansi kwenguqulo ongayithintanga.

Uma uqinisekisa ngempela, sebenzisa uhlelo olugunyaziwe ngokumelene nedivayisi yakho yokugcina nomphuzu wokufika ongenangozi. Ukuphinda ukuhlasela ngokumelene nabanye abasebenzisi kunethiwekhi eyabiwe akulona uvivinyo, futhi ukucisha ukuqinisekisa kontanga noma ukubethela kohlelo lokusebenza ukuze ukubona kube lula kususa isivikelo obuzama ukusikala.

Ekugcineni, gcina isivikelo sasezingeni lohlelo lokusebenza esithombeni. Isihluzi somzila singadalula ukuhamba umhume obuzokuthwala, futhi i-TLS yohlelo lokusebenza isavikela lokho kuhamba kusukela ekupheleni kuya ekupheleni. Izingqimba ezimbili zehluleka ngokuzimela, ngakho isiteshi sokulawula esixhunyiwe akusona ubufakazi bokuthi konke ukugeleza kwathatha umzila obuhloselwe.