I-VPN engemuva kwe-NAT ongakwazi ukuyimisa: okusasebenza

Yonke ingxenye yokugcina yomhubhe idinga ikheli nephothi ohlangothi olunye olungafinyelela kuyo, futhi i-router ongayilawuli iyisizathu esivamile sokuthi leyo mfuneko ihluleke. Into ethakazelisayo akukhona ukuthi amaqhinga akhona, kodwa ukuthi ngalinye lincike esicini sethebula lokuhlela ongaliboni kusuka kuklayenti. Izici ezimbili zalezo zinquma cishe konke: ukuthi ukuhlela kwakhiwa kanjani, nokuthi ngabe kwamukela amaphakethe avela ekhelini umphakathi ongakaze uxhumane nalo. Hlela indawo ngokwalezo zici futhi izixazululo aziyobe zisayindaba yasenganekwaneni.

Ithebula lokuhlela linquma konke

Ukuhumusha kwekheli lenethiwekhi kugcina ithebula lapho ikheli nephothi langaphakathi kubhalwa khona ngokumelene nekheli nephothi lomphakathi. Izimpendulo ezihambisana nerekhodi zihunyushwa zibuyiselwa, futhi iphakethe elivela ngaphandle ngaphandle kwerekhodi elihambisanayo alinayo indawo yokuya ngisho nanye. Lokho kuziphatha okukodwa kuchaza ukuthi kungani umlaleli ongemuva kwe-router engafinyeleleki kusuka ku-inthanethi. Kuchaza futhi ukuthi kungani iphakethe lokuqala endleleni ngayinye kumele liqale ngaphakathi.

Bheka ithebula ohlangothini lwe-router futhi izixazululo ziyacaca: kungenzeka kukhona okwakha ukufakwa okuhlala njalo, noma kwakha okwesikhashana futhi kukugcina kusha, noma ukuhamba akulandeli leyo ndlela nhlobo. Ingxenye esele yale ndatshana yilezo zimo ezintathu ngokulandelana. Akukho lana okuncike esicini somhlinzeki ngale kwalokho okubhalwa yithebula.

Inkonzo yokuhlangana ingenzani futhi ingakwazi ukwenzani

Ukubhoboza kwe-UDP kusebenzisa irekhodi lokuphuma njengokuvuleka kwesikhashana esikhundleni sokunqoba isihlungi. Womabili ama-peer axhumana nenkonzo yokuhlangana, elanda wonke amaphuzu okugcina omphakathi futhi ibikele olunye uhlangothi iphuzu laso. Bese womabili ethumela komunye nomunye, futhi iphakethe ngalinye eliphumayo lakha noma livuselela irekhodi elivumela impendulo ukuba ingene. Ukulandelana kuyikho okukwenza kusebenze, futhi ukulandelana futhi kuyikho okukwenza kube buthakathaka: i-peer ethumela ngaphambi kokuba olunye uhlangothi lwakhe irekhodi laso lilahliwe nje, kuyilapho ukuphinda kuzame ngemva kwesikhashana kuphumelela. Inkonzo ngokwayo ayithwali thrafikhi ye-VPN, ngakho-ke insimbi yayo eyodwa isikhathi esiyihlanganisayo.

Ukuziphatha kokuhlela kunquma okusele, futhi RFC 4787 isho izinhlobo ezintathu: ezizimele ekupheleni, ezincike ekhelini, nezincike ekhelini nasephothini. Kwesokugcina, iphothi okumele i-peer ilibheke lishintsha ngayinye indawo okuyiwa kuyo, ngakho-ke ukubikezela akusathembekile. Yilapho lobu buchwepheshe bufika khona ekupheleni kwabo, ngoba i-NAT yezinga lomhlinzeki kanye ne-firewall yebhizinisi eqinile kokubili kususa ukubikezela okudingwa uhlelo, futhi akukho nani lokuzama kabusha elikubuyisayo.

Ama-keepalive, ukuqala kabusha kanye nephuzu lokugcina elihambayo

Indlela ebhobhoziwe iwukugeleza hhayi umlaleli, ngakho-ke konke okusebenza phezu kwayo kumele kubekezelele ushintsho. Kumele kugcine ukuhlela kuphila ngethrafikhi yezikhathi, kuqaphele lapho iphuzu lomphakathi lihamba, futhi kusungule kabusha ngemva kokuqala kabusha kwe-router noma ukwabiwa kabusha kwekheli. Imikhiqizo ye-mesh VPN ibeka lowo mqondo endaweni yayo yokulawula, kuyilapho iseva ejwayelekile ikushiya kuwe. Ama-keepalive asiza kuphela uma ukuhlela okufanayo kuphila, futhi adla ibhethri kuklayenti yeselula, ngakho-ke isikhathi esinolaka asimahhala.

I-laptop elele ihora ngokuvamile ibuya kwelinye iphuzu lomphakathi. Konke okusungula kabusha indlela kumele kusebenze futhi kusuka ngaphakathi, lokho okubuyisela imfuneko efanayo kuklayenti.

Izindlela ezintathu zokuzungeza ukudluliswa okungekho

Indlela yokuqala icela i-router ukuthi yenze ukufakwa ngokwayo, nge-UPnP IGD, i-NAT-PMP noma i-PCP, uma isici sikhona futhi sivuliwe. Eyesibili inikela ngethrafikhi ku-relay enekheli lomphakathi, esebenza njalo futhi ehlala ibiza umkhawulo wokudlulisela kanye nomngcele wokuthemba ohlukile. Eyesithathu ihlinzeka indlela: umsingathi wangaphakathi uvula umhubhe ophumayo oya kuseva yomphakathi futhi konke okunye kugibela ngaphakathi kwawo.

[Peer]
PublicKey = 6yGj3kQ2wVb8sTn1pLx4dRc7hZa9mKf2uYe5oNq0iXw=
Endpoint = relay.corp.internal:51820
PersistentKeepalive = 25
AllowedIPs = 10.44.0.0/24

Iphuzu lokugcina le-relay lenza lokho kushintshana kubonakale ekusethweni kweklayenti, lapho iphuzu lokugcina liyi-relay hhayi ikheli le-peer ngokwalo. I-keepalive ehlala njalo igcina ukuhlela kufudumele, futhi iziqalo ezivunyelwe zinquma ukuthi iklayenti ingathumela ini ngayo. Umhubhe ophambene ovela kumsingathi wangaphakathi uwumqondo ofanayo nomunye umnikazi, futhi awudingi nhlobo ushintsho lwe-NAT. Ngakunye kokuthathu kususa imfuneko yokungena ngaphandle kokunqoba i-firewall evimbela thrafikhi engacelwanga ngokwakhiwa, ngoba ithrafikhi isaqala ngaphakathi.

Hlanganisa isixazululo nomnikazi we-router

Uma ulawula i-router, ukudluliswa kwe-UDP okungaguquki kulula ukukuhlola kunanoma yiluphi uhlelo lokubhoboza futhi kwehluleka ngezindlela ozibonayo. Uma kungenjalo, thola ukuthi umhlinzeki unikeza i-relay noma indawo yokulawula ebungazwayo, nokuthi inqubomgomo ingakuvumela yini ukusetshenziswa kwayo. Uma kungekho nalutho kulezo, izinketho ezisele umhubhe ophambene noma ukwamukela ukuthi iphuzu lokugcina alifinyeleleki ngaphandle. Ukubhala phansi ukuthi usebenzise kuphi kubaluleke kakhulu kunalokho okuzwakala, ngoba izinketho ziyahluka ngokuthi ubani angabuka ithrafikhi nokuthi kwenzekani uma umuntu wesithathu eshintsha okuthile.

Qaphela ukuthi indlela owagcina ngayo yayiqondile noma idlula ku-relay, ngoba lelo qiniso elilodwa libikezela kokubili ukubambezeleka nokuziphatha kokuhluleka. I-RFC 4787 isalokhu iyisithenjwa sokuziphatha kokuhlela ngaphansi kwakho konke lokhu, futhi ukufunda isigaba sayo sokuhlela kushesha kunokuhlola izixazululo ezintathu ngokulandelana. Ithebula alinandaba nokuthi ukhethe yiphi inketho; libhala kuphela lokho iphakethe elilandelayo elivunyelwe ukukwenza.