Uhlelo lokusebenza lwe-VPN noma i-IKEv2 eyakhelwe ngaphakathi ku-iPhone: ukukhetha kanjani
Uhlelo lwe-VPN lwe-iPhone kanye nekhasimende le-IKEv2 elakhelwe ngaphakathi zixazulula izinkinga ezihlukene. Qhathanisa kuqala ukusekelwa kwephrothokholi, ukuqinisekisa, ukulawulwa kwedivayisi nokubuyisela.
Ngesonto eledlule uzakwethu wanginika i-iPhone yakhe enezinto ezimbili ze-VPN kuzilungiselelo: enye yashiywa uhlelo lomhlinzeki, enye yayivela kuphrofayela ye-IKEv2 eyananyathiselwa kusuka ekhasini losizo. Lezi akuzona izinguqulo ezincintisanayo zento eyodwa. Uhlelo lomhlinzeki luyisitsha esingathwala ikhodi yalo yomhubhe, kuyilapho ikhasimende lakwa-Apple elakhelwe ngaphakathi liyikhasimende le-IKEv2, elilungiselelwa ngesandla noma ngephrofayela. Iphrothokholi, ukuphathwa kobufakazi, ukulawulwa kwedivayisi nokubuyisela kunquma ukukhetha.
Uhlelo nekhasimende lendabuko zisezintweni ezihlukene
Ikhasimende le-VPN elakhelwe ngaphakathi lakwa-Apple ngokwenzekayo liyikhasimende le-IKEv2. Ifomu lesandla lisabala i-L2TP phezu kwe-IPsec nezinketho ze-Cisco IPsec eseziphelelwe yisikhathi, kodwa asikho isikhala sokuthutha komhlinzeki futhi akukho lapho unamathisela khona ukulungiselelwa kwe-OpenVPN noma i-WireGuard. Uyagcwalisa ifomu kuzilungiselelo > Jikelele > VPN & Ukuphathwa Kwamadivayisi noma ungenise iphrofayela enomthwalo we-VPN; indawo yayo iyikheli leseva, ubunikazi obubili, indlela yokuqinisekisa nemithetho yokucela engakhethekile.
Uhlelo lomhlinzeki lusebenza ezingeni elilodwa phezulu. Luhlinzeka umhlinzeki womhubhe wamaphakethe we-Network Extension, ngakho ikhodi yephrothokholi nengqondo yomzila kuhlala kuhlelo futhi i-iOS idlulisa amaphakethe kuphela. Ezinye izinhlelo zisebenzisa i-WireGuard noma i-OpenVPN, ezinye ukuthutha kwazo okufihliwe, futhi ezimbalwa zifaka iphrofayela ye-IKEv2 kuphela bese ziqhuba ikhasimende lendabuko ngemuva kwesikrini esihle kakhulu. Leli qembu lokugcina yilona elenza ukukhetha kohlelo noma iphrofayela kube ukukhetha okungelona iqiniso ngezinye izikhathi.
Umphumela unengqondo: ifayela le-.ovpn noma i-WireGuard alithathi indawo yalezo zinkambu, ngoba ukuxhawulana kungenye iphrothokholi.
Funda umthwalo ngaphambi kokuqhathanisa izici
Lapho iphrofayela iyi-IKEv2, okhiye bomthwalo bachaza amaphutha amaningi kunanoma yikuphi ukuqhathanisa kwezici. Incwadi yezilungiselelo ze-IKEv2 yakwa-Apple ibhala wonke ukhiye; umthwalo ofingqiwe ubukeka kanje:
<key>VPNType</key><string>IKEv2</string>
<key>RemoteAddress</key><string>vpn.example.net</string>
<key>RemoteIdentifier</key><string>vpn.example.net</string>
<key>LocalIdentifier</key><string>[email protected]</string>
<key>AuthenticationMethod</key><string>Certificate</string>
<key>ServerCertificateIssuerCommonName</key><string>Example Issuing CA</string>Izinkambu ezintathu zithwala ingxenye enkulu yesisindo sokuxilonga. I-RemoteIdentifier yigama okulindele ukhasimende ukuthi iseva iliveze, ngakho isango elingemuva kwe-NAT noma isilinganisi somthwalo esisitifiketi saso sisho ichibi esikhundleni sekheli siyahluleka nakuba ikheli lilungile. I-LocalIdentifier ubunikazi iseva ecabanga ukuthi unguwe, futhi ngokuqinisekisa ngesitifiketi kufanele ihambisane nobunikazi obuxhunywe ne-akhawunti yakho. I-ServerCertificateIssuerCommonName igxilisa i-CA ekhiphayo, ngakho iphrofayela ingahluleka ngosuku okukhishwa ngalo kabusha isitifiketi, ngaphandle komlayezo wephutha osho izitifiketi.
Uma i-AuthenticationMethod ilingana ne-SharedSecret, iseva yenza ukuqinisekisa komsebenzisi we-EAP futhi imfihlo oyinikiwe iyisibonakaliso se-akhawunti ngempela. Lokho kubalulekile lapho umhlinzeki ethumela amadokhumenti amabili, elilodwa legama lomsebenzisi nephasiwedi nelinye lesitifiketi, futhi lilodwa kuphela elihambisana nalokho okungenisile.
Okungenziwa uhlelo okungeke kwenzeke ukhasimende lendabuko
Ukukhetha iphrothokholi yinzuzo esobala. Uma iseva yakho ikhuluma i-WireGuard noma i-OpenVPN, uhlelo ilona kuphela ikhasimende le-iOS elingayisebenzisa, futhi ukuhlela ifomu lendabuko ngeke kuxoxisane nakho. Uhlelo lungabuye lusebenzise umhubhe ohlukanisiwe ngendawo noma ngohlelo, ukuphathwa kwayo kwe-DNS, ukuvimbela okwesitayela se-kill switch, ukukhetha iseva nokuxhuma kabusha okulungiselwe inethiwekhi yalo.
Inkokhelo iyisoftware ongayihlolanga, esebenza ngamalungelo esandiso senethiwekhi. Ikhwalithi iyahlukahluka kakhulu kunalokho okushiwo amakhadi esitolo: uhlelo olulodwa luxhuma kabusha ngokuhlanzekile kuyilapho olunye luconsa imizuzwana embalwa ngemuva kokushintsha kwenethiwekhi, futhi i-kill switch ngaphakathi kohlelo iyisici salolo hlelo, hhayi se-iOS. Kudivayisi elilawulwayo, hlola kuqala uhlu olugunyaziwe.
Okwenziwa kahle yiphrofayela ye-IKEv2 eyakhelwe ngaphakathi
Izingxenye ezimbalwa ezinyakazayo yiyo yonke impikiswano. Ikhasimende le-IKEv2 kanye nesitaki saso se-IPsec kufika nohlelo lokusebenza, ngakho akukho sandiso esingawa, akukho nqubo yohlelo ngalunye okufanele igcinwe iphila, futhi akukho mjikelezo wokubuyekezwa kwabantu besithathu phakathi kwakho nomhubhe osebenzayo. Iphrofayela ingabuye ikhiywe: kudivayisi egadiwe umsebenzisi akakwazi ukususa lokho okufakwe ukuphathwa, futhi i-Always On VPN, exhumanisa kabusha kunoma iyiphi inethiwekhi ngaphandle kweswishi yomsebenzisi, ikhona kuphela kuleyo ndlela egadiwe, elawulwa ngephrofayela.
Okungakunikezwa yindlela eyakhelwe ngaphakathi ukuguquguquka. Akukho VPN ngohlelo ngalunye ngaphandle kwezinhlelo ezilawulwayo, akukho kill switch yomsebenzisi, futhi akukho ukuthutha okubukeka njenge-HTTPS kunethiwekhi evimbela i-IPsec. Emanethiwekhi asehhotela alahla i-UDP 500 ne-4500, i-IKEv2 eyakhelwe ngaphakathi ayinayo indlela yokubuyela emuva.
Ithebula lesinqumo elixazulula izimo eziningi
Ngokwenzekayo umbuzo wephrothokholi unquma izimo eziningi ngaphambi kokuthi izici zibaluleke.
| What you were given | Device situation | What to use |
|---|---|---|
| An .ovpn or WireGuard config | Personal phone | Provider app; the native form cannot load it |
| IKEv2 host plus CA name | Personal or managed | Profile, or the app's own IKEv2 mode |
| IKEv2 with username and secret | Personal phone | Either; the profile is simpler if you never switch servers |
| A management-installed profile | Supervised, MDM | Native client; do not add a second app entry |
| A per-app tunnelling requirement | Personal phone | App, or accept a full tunnel; iOS cannot split by app without management |
| IPsec blocked on your main network | Any | App with a transport that survives the block |
Imigqa emibili ifanele ukubukwa okwesibili. Isidingo sohlelo ngalunye ocingweni lomuntu siqu yisimo abantu abasifunda kabi: isilungiselelo sikhona ku-iOS kodwa siqhutshwa ukuphathwa, ngakho idivayisi engalawulwa ngeke isinikeze. Inethiwekhi evinjiwe ayisona isizathu sokungathembi i-IKEv2; yiso isizathu sokuthi uhlelo lomhlinzeki lukhona.
Qinisekisa ukukhetha ngokuhlolwa okukodwa
Hlola izimo zokuhluleka, hhayi inkinobho yokuxhuma. Xhuma kanye, qinisekisa ukuthi isibonisi se-VPN siyavela, bese uvula ikhasi elibuyisela ikheli lakho lomphakathi bese uqhathanisa neledlule. Shintsha usuka ku-Wi-Fi uya kudatha yeselula ngaphandle kokuthinta i-VPN futhi ubheke ukuxhuma kabusha, bese udlulisa ucingo ngemodi yendiza. Qalisa kabusha bese ubona ukuthi umhubhe uyabuya yini ngokwakho: iphrofayela ene-OnDemandEnabled kufanele ibuye, kuyilapho izinhlelo eziningi kufanele zivulwe kuqala.
Uma ingabuyi, hlukanisa ukuhluleka ngokuthi umhubhe ukhona yini nhlobo. Ukungabikho kwesibonisi se-VPN kusho ukuthi umhubhe awukaze wenyuka: mhlawumbe ukuxhawulana kuhlulekile ku-RemoteIdentifier, ku-CA egxilisiwe noma kubufakazi, noma ukuxhumana akuzange kuzanywe ngoba umthetho wokucela awuhambisananga futhi akukho hlelo oluyiqalile. Isibonisi nethrafikhi ehlulekayo kusho ukuhamba komzila, i-DNS noma inqubomgomo yohlangothi lweseva, futhi ukufaka kabusha ikhasimende akuthinti lutho kulokho.
Uhlu olufushane ukuze idivayisi ichazeke kumuntu olandelayo:
- into eyodwa ye-VPN, hhayi ezimbili;
- iphrofayela noma uhlelo luqanjwe ngeseva elixhuma kuyo;
- amanani obunikazi abhalwe lapho ungawathola khona.
Qala ngomugqa wephrothokholi kuthebula, futhi uma uphendula umbuzo, yima lapho.