I-VPN nge-UDP iyama lapho ingasebenzi: i-firewall ikhohliwe ukugeleza kwakho

I-VPN iyaxhuma, isebenza isikhashana, bese iyeka ukudlulisa ithrafikhi ngenkathi iklayenti lisabonisa isikhathi. Ukuxhuma kabusha kuyalungisa, okwenza kubonakale njengephutha leklayenti. Ngokuvamile i-firewall noma idivayisi ye-NAT elahle ukumephwa kwe-UDP okungasebenzi futhi engazi ukuthi ithumbu lisekhona.

Uphawu luvumelana ngokwanele ukuthi luhlolwe: luvela ngemva kokungasebenzi, hhayi ngaphansi komthwalo.

Ukuma ngenxa yokungasebenzi kubukeka kanjani

Kulinganise esikhundleni sokukuchaza. Bhala ukuthi ithumbu lihlala isikhathi esingakanani lingasebenzi ngaphambi kokuba ithrafikhi ime, ukuthi iphakethe elisha eliphumayo liyalivuselela yini, nokuthi isixhumi seklayenti sisabambe ikheli laso yini. Uma isicelo esisha esivela kuklayenti sisebenza kodwa impendulo ekugelezeni okukhona ingasebenzi, ukumephwa kuyasolwa. Uma kungenjalo lutho olusebenzayo kuze kuxhunywe kabusha, isimo sesikhathi seklayenti naso silahlekile.

Kokubili kuhlobene nokungasebenzi, futhi kudinga izixazululo ezihlukile.

Bhala izikhathi ngaphambi kokushintsha noma yini. Umbiko wokuthi kuyama ngemva cishe kwamaminithi ayishumi okungasebenzi uyahlolwa, kuyilapho umbiko wokuthi kuwa ngokungahleliwe ungeke uhlolwe. Lowo mehluko unquma ukuthi ulandela isikhathi noma ushintsho lomzila.

Thola idivayisi ekhohliwe

Amadivayisi amaningi angagcina isimo sokugeleza okufanayo: i-router yasekhaya, isihumushi esiphezulu, umngcele wefu kanye ne-firewall yomsingathi. Ngayinye inesikhathi sayo, futhi esifushane kakhulu siyawina. Ukuphazamiseka kwemaminithi amahlanu ngokuvamile kusho ukuthi idivayisi eyodwa ihlelwe ngaphansi kakhulu kunezinye.

Ungacabangi ukuthi okumisiwe okubhalwe phansi yikhona isikhathi esinqunyiwe emzileni wakho. Kuwukumsiwe kwedivayisi eyodwa.

• I-router yasekhaya: ngokuvamile amaminithi, ngezinye izikhathi ngaphansi kakhulu.
• I-NAT yasefu noma isilinganisi somthwalo: bheka isikhathi sokungasebenzi esibhalwe phansi esiqondene ngqo ne-UDP.
• I-firewall yomsingathi: izikhathi zokulandelela ze-netfilter zisebenza kukho konke ukugeleza.

Hlola izikhathi emzileni wangempela

Ku-Linux, izikhathi zokulandelela ze-netfilter ziyabonakala futhi ziyalungiseka: sysctl net.netfilter.nf_conntrack_udp_timeout kanye net.netfilter.nf_conntrack_udp_timeout_stream. Eyesibili sisebenza lapho ithrafikhi isibonakele kuzo zombili izinhlangothi, yingakho ithumbu elisunguliwe lingaphila isikhathi eside ukudlula ukuhlola okulula.

RFC 4787 ichaza ukuziphatha kwe-UDP NAT kanye nobuncane obunconyiwe. Yiso isethenjwa okufanele sikhulunywe ngaso lapho okumsiwe komthengisi kubonakala kufushane ngokungajwayelekile.

I-Keepalive nokuxhuma kabusha amathuluzi ahlukene

I-Keepalive igcina ukumephwa kuphila; ukuxhuma kabusha kwakha isikhathi esifile kabusha. Zixazulula iziphambeko ezahlukene futhi azizona izilungiselelo zesivinini ezishintshayo. Ukukhetha PersistentKeepalive kwe-WireGuard kuthumela iphakethe ngesikhathi esinqunyiwe ukuze kugcinwe ukubopha kwe-NAT kuvuliwe. Ukukhetha keepalive kwe-OpenVPN kwenza umsebenzi ofanayo ngendlela yayo. Akukho okusiza uma idivayisi ephakathi isikhohliwe ukugeleza futhi ilahla izinhlangothi zombili.

Ukuhlola okuvamile kakhulu kwengeza umsebenzi ngaphandle kokulungisa umngcele ongafanele.

Qinisekisa ngesicelo esisha, hhayi ngokulayisha kabusha ikhasi

Ngemva kokushintsha isikhathi noma ukwengeza i-keepalive, phinda isimo sokungasebenzi ngendlela efanayo nangaphambili. Bese wenza isicelo esisha ngempela esivela kuhlelo olumboziwe. Ithebhu yesiphequluli esivele ilayishiwe ingase iboniswe kusuka kunqolobane futhi ayikutsheli lutho.

Uma ukuma kuqhubeka, hambisa igxathu elilodwa ngaphandle bese uhlola ithebula lesimo saleyo divayisi.