Ukugxuma Kwe-VPN Okubili Ngokulandelana: Ubani Ngempela Obona Ithrafikhi Yakho?
Ukugxuma okulandelanayo kukhipha nokubuyisela ukubethela kugeyithi yokuqala; ukugxuma okufakwe ngaphakathi kususa ingqimba yangaphandle kuphela. Hamba kuzo zombili izakhiwo futhi ubone ukuthi iyiphi i-opharetha efunda ini.
Iphrofayela ngayinye yeklayenti isho iseva eyodwa, ngakho-ke endaweni yomsebenzisi kunethubhu elilodwa nendawo eyodwa lapho ukuvikelwa kuphela khona. Okwenzeka ngemuva kwalelo geyithi lokuqala yisinqumo sokuklama iklayenti elingakaze likubone, futhi izakhiwo ezimbili ezivamile ziziphatha ngendlela ehluke kakhulu lapho zihlolwa. Ochungechungeni olulandelanayo igeyithi lokuqala liyakhipha bese libuyisela ukubethela. Ochungechungeni olufakwe ngaphakathi lisusa ingqimba yangaphandle futhi lidlulise ithubhu langaphakathi elingakwazi ukulivula. Inani lokugxuma liyafana kukho kokubili, ngakho-ke umehluko kufanele udwetshwe hhayi ubalwe.
Qala eklayentini futhi usho zombili iziphetho
Qala lapho umsebenzisi eqala khona, kuphrofayela yoxhumano. Iqukethe ikheli elilodwa elikude, indlela eyodwa yokuqinisekisa kanye, uma isakhiwo sisekela, uhlu lwemizila. Bhala igama kulelo thubhu langaphandle ukusuka eklayentini kuya kugeyithi A futhi ulinike amakheli ayisibonelo: ikheli lethubhu leklayenti 10.77.0.2, elika-A 10.77.0.1 kanye nendawo yokugcina yomphakathi ka-A 198.51.100.10, athathwe ebangeni lemibhalo ye-TEST-NET-2 ukuze kungabikho lutho esibonelweni olungashayisana nomphathi wangempela.
Akukho lutho kuleyo phrofayela olukhuluma ngegeyithi B, futhi lokho akusona iphutha. Ukugxuma kwesibili kungokuka-A, futhi umsebenzi oyedwa weklayenti ukuletha ithrafikhi ku-A nokwamukela okubuyayo. Ukuthi i-A iyaliqeda ithubhu, iyalidlulisa noma ivula elisha umbuzo owuphendulwa yingxenye esele yalolu hambo, futhi yikho okunquma ukuthi i-A ingafunda ini.
Ngokulandelana: i-A iyakhipha, bese ibuyisela ukubethela
Kusakhiwo esilandelanayo i-A iqeda ithrafikhi kabili. Isusa ukuvikelwa eklayentini, ithola iphakethe le-IP lohlelo, bese ithumela lelo phakethe ngethubhu lesibili i-A elakha libheke ku-B. Phakathi kwalezi zenzo ezimbili iphakethe lihlala endleleni yokudlulisa ye-A njengephakethe le-IP elijwayelekile elibhekiswe endaweni eyimfihlo.
Lokho kuveza imiphumela emibili okufanele ishiwo ngokuqondile. I-A ingasebenzisa inqubomgomo kuphakethe langaphakathi, ngendlela yemizila, imithetho yokuhlunga kanye nokurekhoda komthombo nendawo, futhi i-A kufanele igcine amasethi amabili ezimpawu zokungena: elilodwa njengesiseva seklayenti nelinye njengeklayenti lika-B. Ukuvikelwa kukhona ngaso sonke isikhathi, kodwa into evikelwe ishintsha ubunikazi ku-A.
Lokho akusho ukuthi i-A ifunda umbhalo ocacile wohlelo. Lapho iklayenti nensiza kusebenza nge-TLS futhi kuqinisekisa izitifiketi zomunye nomunye, i-A ibona ukugeleza kwamarekhodi e-TLS hhayi isicelo esifundekayo. Ukuqinisekisa lapho lokho kuvikelwa kuphela khona kudinga ukubheka uchungechunge lwezitifiketi zensiza, hhayi umdwebo wethubhu.
Kufakwe ngaphakathi: i-A isusa ingqimba yangaphandle kuphela
Kusakhiwo esifakwe ngaphakathi iklayenti lakha ithubhu langaphakathi eliya ku-B kuqala bese lithwala lelo thubhu ngaphakathi kwelangaphandle liye ku-A. I-A isusa isihloko sangaphandle, ithola ithubhu langaphakathi futhi ilidlulisa ngaphandle kokugcina okhiye balo, ngakho-ke ukuvikelwa kwangaphakathi kusaphela ku-B.
Khona-ke isixhumanisi esiphezulu seklayenti sithwala izingqimba ezimbili, kanti indlela phakathi kwe-A ne-B ithwala eyodwa. I-A ibona amakheli angaphandle ethubhu langaphakathi, okwanele ukwazi ukuthi ithrafikhi ikhona nokuthi ngokulinganiselayo iya kuphi, futhi akwanele ukufunda umthwalo. Lowo wonke umehluko kusimo esilandelanayo, futhi asikho isibali sokugxuma esikubonisayo. Okusengakwenza i-A ukwenqaba ukudlulisa lokho engakwazi ukukufunda, futhi lokho kuhlala kuvulekile kumqhubi walelo geyithi.
Ukufaka ngaphakathi kukhokha ngaleso simo. Ingqimba ngayinye yengeza ukusetshenziswa kwesihloko, ngakho-ke ukuhlelwa kwe-MTU ne-MSS kuba yimpoqo hhayi ukuhleleka nje, futhi indlela esebenza ngengqimba eyodwa ingase ilahle ngokuthula amaphakethe amakhulu ngezimbili. Ingqimba ngayinye idinga nokuziphatha kwayo kokuphinda ixhumane nokugcina iphila, futhi ukwehluleka kwengqimba eyodwa kubonakala njengokuphazamiseka okwengxenye ngolunye.
Dweba ababukeli, hhayi amathubhu kuphela
Amathubhu ayingxenye elula yomdwebo. Ababukeli yikho okumayelana nakho ukuklama, ngakho-ke bhala umugqa owodwa ngombono ngamunye futhi ugcwalise ukuthi ngamunye angafunda ini ngempela.
| Vantage point | Serial chain | Nested chain |
|---|---|---|
| Client's access network | Outer tunnel only | Outer tunnel only |
| Operator of A | Inner IP packet between A and B | Outer addresses of the inner tunnel, not its payload |
| Path between A and B | Second tunnel | Second tunnel |
| Operator of B | Inner packet re-originated by A | Payload after the inner layer is removed |
| Service edge | Traffic from the exit address | Traffic from the exit address |
Imigqa emibili ihlanganiswa njalo: umqhubi ka-A kanye nomhlinzeki wethubhu leklayenti. Bangaba yinto eyodwa, futhi amagama ageyithi ahlukene awabeni abazimele. Ubunikazi obuzimele budinga ukuphathwa okuhlukile kwezokuphatha, izimpawu zokungena ezihlukile kanye nokurekhoda okuhlukile.
Imethadatha iyasinda kuzo zombili izakhiwo. Isikhathi, ubukhulu bamaphakethe kanye nenani lokuxhumana kuhlala kubonakala kukho konke ukugxuma, ngakho-ke ukugxuma okubili kukhulisa izindleko zokuhlobanisa esikhundleni sokususa isignali. Isakhiwo esithembisa ukungabonakali kufanele sihlolwe ngalolo hlu ngaphambi kokuthi othile encike kuso.
Hamba ngezindlela zokwehluleka ngaphambi kokukhetha
Phula izinto ngamabomu kusukela eklayentini, ngokulandelana umsebenzisi angahlangana nazo. Qala ngesixhumi esibonakalayo ne-MTU yaso, ngoba ukufaka ngaphakathi kwehluleka ngobukhulu bephakethe kakhulu ngaphambi kokwehluleka ekuqinisekiseni.
ip -4 addr show dev tun0
ip link show dev tun0 | grep mtu
ping -M do -s 1380 -c 2 10.77.1.1Bese uqinisekisa iziphetho zokuvikelwa esikhundleni sokuzicabangela. Cela insiza ukuthi inikeze isitifiketi sayo sisuka ngaphakathi kwanoma iyiphi ithubhu evuliwe, futhi uqhathanise uchungechunge iklayenti elikubonayo nochungechunge insiza eqinisekisa ngalo ngempela. Igeyithi elisayina kabusha noma elingena phakathi lishintsha leso sitifiketi, futhi ukuhlola kubonakala ngomyalo owodwa.
openssl s_client -connect intranet.example.com:443 -brief < /dev/nullQedela ngematriki yokuphinda uxhumane: ithubhu leklayenti liyawa, ithubhu lika-B liyawa, indlela phakathi kwe-A ne-B iyashintsha. Bhala lokho okubuyayo nalokho okungabuyi, nokuthi ukuxhumana kwangaphakathi kwenzeka yini ukuba kuwele emzileni ongaphandle komthwali wawo ohlosiwe. Rekhoda amakheli asetshenziswa yisivivinyo ngasinye, ngoba ukuwaphinda kwenye inethiwekhi yokufinyelela kuphendula omunye umbuzo. Phinda futhi ukuhlolwa kwe-MTU ngemuva kokuxhumana kabusha ngakunye, ngoba indlela eshintshile ingehlisa ubukhulu obusebenzisekayo ngaphandle kokuthi umugqa owodwa wokuhlela unyakaze.
Khetha okulandelanayo lapho i-A kufanele isebenzise inqubomgomo kuphakethe langaphakathi, noma lapho iklayenti lingakwazi ukugcina amathubhu amabili abekwe phezulu. Khetha ukufaka ngaphakathi lapho umthwalo wangaphakathi kufanele uhlale ungafundeki ku-A. Bhala ukukhetha kanye nababukeli bakho kanye nezinombolo ze-MTU zako, futhi umuntu olandelayo ngeke adinge ukudweba kabusha isithombe sonke ukuze aphendule umbuzo owodwa.