I-UDP ayisikhathi sonke eshesha kakhulu: ukukhetha ukuthutha kwe-OpenVPN

Yonke incwadi yokuhola ithi i-UDP yeqisa i-TCP ku-OpenVPN, futhi leso seluleko siyisimo esizenzakalelayo, hhayi isilinganiso. Ukuthutha kushintsha indlela amaphakethe alethwa ngayo nokuthi kwenzekani lapho indlela iwalahla, hhayi ukuthi umhubhe ubhalwa ngokufihla kanjani. Ngemuva kwengosi eboshiwe noma i-proxy evumela kuphela ingosi 443, inketho enensayo yiyona exhuma noma ngabe kancane. Lokhu okulandelayo kuhlukanisa okwenziwa iphrothokholi nalokho okuvunyelwa inethiwekhi yakho yokufinyelela.

Ukuthutha kushintshani ngempela

I-TCP ihlinzeka ngokugeleza kwamabhayithi okuthembekile nokuhleliwe futhi ithumela kabusha konke okulahlekile, njengoba RFC 9293 icacisa. I-UDP idlulisela amadathagram kunethiwekhi, futhi i-OpenVPN iqhubeka nengqimba yayo yokuthembeka phezu kwaleyo socket. Ukufaka i-TCP ngaphakathi kwe-TCP kubeka izingqimba ezimbili zokululama, ngakho ingxenye eyodwa elahlekile ingabamba ukugeleza kwangaphakathi kuze kufike ukuthunyelwa kabusha kwangaphandle. Lokho kusebenzisana yikho okuyisizathu sangempela se-UDP, futhi kubonakala njengokubambezeleka hhayi njengokugeleza.

Umthelela ukhula ngokulahleka nesikhathi sokuhamba nokubuya. Endleleni yasendaweni ehlanzekile zombili izindlela zokuthutha zizwa zifana, yingakho ukuhlolwa kwelabhu akuvamisile ukuphinda kukhiqize isikhalo. Kuxhumano lweselula olugcwele umehluko ubonakala ezingxoxweni ezisebenzisanayo kudala ngaphambi kokuthi ukudluliswa okukhulu kubone lutho.

Akukho kulokhu okuthinta imfihlo noma ubuqotho. Ukuxhawula kwe-TLS nesibalo somfudlana wedatha kuyafana kuzo zombili izindlela zokuthutha, ngakho ukushintsha akukwazi ukusindisa iqoqo lokubhala elibuthakathaka.

I-TCP iyizuze kuphi indawo yayo

Amanethiwekhi okufinyelela ayisizathu esivamile sokukhetha i-TCP. Ihhotela, isikhumulo sezindiza noma inethiwekhi yezivakashi ingase ivumele u-443 ophumayo futhi ilahle konke okunye, futhi umlaleli we-TCP kuleyo ngosi uyiprofile kuphela esebenzayo. Lokho ukufinyeleleka, hhayi ukusebenza, futhi kuyisizathu esihle ngokwanele ngokwaso.

I-TCP iyasiza futhi lapho indlela izinzile kodwa amabhokisi aphakathi anobutha. Amanye amanethiwekhi asetha kabusha ukugeleza kwe-UDP kwesikhathi eside kuyilapho ebekezelela izikhathi ze-TCP ezibukeka njengethrafikhi ejwayelekile yewebhu. Ukuthi lokho kufana kuyaphumelela noma cha kuyisici senethiwekhi ethile, futhi asikho isiqondiso esingakuthembisa kubo bonke. Hlola ngaphakathi kwenethiwekhi ehlulekayo ngaphambi kokusola iphrothokholi.

Ukungena okunqatshiwe akuyona inkinga yokuthutha. Ukukhubaza ukuqinisekiswa kwesitifiketi ukuze kuphoqelelwe ukuxhumana kungolunye ushintsho olunomphumela omubi kakhulu.

Ukugcina iprofile ye-TCP ilungile kungukuyekelela okungokoqobo. Iningi lamakhompyutha akhasayo ligcina kokubili futhi likuvumela ukuthi ushintshe lapho inethiwekhi inqaba indlela ye-UDP, okungabizi lutho kuze kube yilapho uyidinga. Into okufanele ungayenzi ukuthumela amaprofile amabili akhomba kumaphoyinti okugcina ahlukene, ngoba khona ukulinganisa kwakho kukala amaseva.

Hlola ukuthi yiluphi umlaleli onalo ngempela

Ngaphambi kokuqhathanisa ukusebenza, qinisekisa ukuthi izinhlangothi zombili ziyavumelana ngokuthutha nangengosi. Ukushintsha i-proto udp ibe i-proto tcp efayeleni lekhompyutha akudali umlaleli weseva. Iseva kufanele ihlelwe yalolo phrothokholi, futhi iprofile kufanele ihambisane nayo.

grep -E '^(proto|port|remote)' /etc/openvpn/server.conf
ss -lunp | grep openvpn
ss -ltnp | grep openvpn

I-grep iphrinta lokho okwatshelwa iseva ukuthi ikusebenzise, kuyilapho izinhlu ezimbili zamasokhethi zibonisa ukuthi ixhunywe kunini. Umlaleli we-UDP uvela ohlwini lokuqala kuphela kanti umlaleli we-TCP ohlwini lwesibili kuphela, ngakho umugqa ongekho uyindlela eshesha kakhulu yokuthola iprofile engakaze isetshenziswe. Qhathanisa nengosi, ngoba iprofile ye-TCP ku-1194 iziphatha ngendlela ehlukile kunaleya ku-443 eminingi yamanethiwekhi okufinyelela. Qala kabusha isevisi ngemuva koshintsho bese ufunda umugqa welogi obika ukubopheka.

Ukuqinisekisa ohlangothini lwekhompyutha akubizi: qhuba ukuxhumana nge---verb 4 bese ufunda umugqa wokuthutha kulogi. Uma ikhompyutha ithi UDP kuyilapho iseva ilalele ku-TCP, ukuxhawula akukaze kuqale futhi akukho ukulungisa okuzosiza.

Qhathanisa umthwalo womsebenzi, hhayi ilebula yokuthutha

Ukuqhathanisa okulinganayo kugcina konke kungaguquki ngaphandle kokuthutha. Idivayisi efanayo, inethiwekhi yokufinyelela efanayo, umsingathi wendawo efanayo, uhlelo lokusebenza olufanayo futhi ngokufanele iseva efanayo. Uma amaprofile amabili akhomba kumsingathi ohlukene, ukala nalabo msingathi.

Rekhoda imiphumela emithathu ngokugijima ngakunye: ukuthi umhubhe uyasungulwa, uyahlala futhi umsebenzi uyaqedwa. Izicelo ezincane ezisebenzayo kuyilapho ukudluliswa okukhulu kumile zikhomba kubukhulu bephakethe ne-MTU, hhayi ekuthutheni. Ukuxhumana kabusha okuphindaphindiwe kukhombisa indlela noma isikhathi sokuphela sebokisi eliphakathi.

Gcina iprofile esebenza ngaphansi kwezimo ohlangabezana nazo ngempela, bese ugcina enye. Ukukhetha kungenethiwekhi, hhayi umuntu, yingakho noma iyiphi impendulo eyodwa ezimisiwe iyiphutha kwenye indawo.