I-VPN ivinjiwe kunethiwekhi ye-web kuphela? Sebenza izingqimba

Inethiwekhi yasekhampasi noma yasehhotela lapho isiphequluli sisebenza khona futhi yonke ithaneli ifa khona akuyona inkinga eyodwa, kuyizingqimba ezine ezibekwe phezulu. Indlela ingase ivumele i-TCP 443 kuphela, ifune i-proxy eqinisekisiwe, ihlole ukuxhawulana, noma ivele ivimbe ukufinyelela kude ngenqubomgomo. Ukuzisebenza ngokulandelana kukuvimbela ekuthengeni iklayenti elisha ukuze ulungise umthetho wenethiwekhi. Umhlahlandlela ongezansi uthatha cishe imizuzu eyishumi futhi uphetha ngempendulo ebhaliwe yokuthi yiluphi ungqimba olukwenqabile.

Fakazela ukuthi yiluphi ungqimba olwenqaba ukuxhumana

Ungaqali ngeklayenti le-VPN. Qala ngesicelo esijwayelekile se-HTTPS kuleyo ndawo yokubamba bese ufunda izigaba zesikhathi, ngoba isigaba esihlulekayo sitshela ukuthi iyiphi idivayisi enecala:

curl -sS -o /dev/null -w 'connect=%{time_connect} tls=%{time_appconnect} code=%{http_code}\n' \
  --max-time 8 https://vpn.example.net/

Akukho mpendulo futhi akukho sikhathi se-connect kusho ukuthi i-TCP ayikaze iqedwe, ngakho kukhona udonga lomlilo, imfuneko ye-proxy noma indawo okungafaneleki ukuya kuyo. Isikhathi se-connect ngaphandle kwesikhathi se-tls kusho ukuthi okuthile phakathi kwamukele ukuxhumana kwase kumisa ukuxhawulana, futhi yileyo indlela i-proxy ehlolayo ebonakala ngayo kusukela ohlangothini lweklayenti.

Manje hlola isitifiketi osithola ngempela. Le yindlela esheshayo yokuthola ukuthi ukhuluma neseva noma nebhokisi eliphakathi elisayine kabusha iseshini:

openssl s_client -connect vpn.example.net:443 -servername vpn.example.net -brief </dev/null

Funda umugqa womkhiphi. I-CA yakho siqu isho ukuthi ufinyelele insizakalo; umkhiphi wenkampani noma wedivayisi usho ukuthi isihlungi siphethe ukuxhumana futhi sinquma ukuthi kwenzeka ini ngemuva kwalokho. Rekhoda kokubili okuphumayo ngesigxivizo sesikhathi, ngoba ukuhlolwa okufanayo ngemuva kwehora kunethiwekhi yezihambeli kungase kunikeze impendulo ehlukile.

Iklayenti elazi i-proxy lishintsha iphakethe lokuqala, hhayi inqubomgomo

Uma inethiwekhi ifuna i-CONNECT nge-proxy eqinisekisiwe, iklayenti le-VPN kufanele litshelwe, kungenjalo lizozama ukuvula isokhethi ekhelini elingakwazi ukulihambisa. Hlola i-proxy ngokwehlukana neklayenti, ukuze ukwehluleka kube nencazelo eyodwa:

https_proxy=http://proxy.example.edu:3128 curl -v -o /dev/null https://vpn.example.net/
sudo openvpn --config /etc/openvpn/corp.conf --proto tcp-client \
  --remote vpn.example.net 443 --verb 4

Umyalo wokuqala ufakazela ukuthi i-proxy izothwala indawo ekuyiwa kuyo. Owesibili ucela iklayenti ukuthi lisebenzise i-TCP ku-443, okuwukuphela kokuthutha izindlela eziningi ze-web kuphela ezikudlulisayo. Uma owokuqala uphumelela kanti owesibili usahluleka, i-proxy akuyona isithiyo.

Amanye amaklayenti afunda i-proxy yesistimu yokusebenza esikhundleni sokubhala phezu, kanti amanye awafundi kokubili. Hlola imibhalo yohlelo ngokwalo ngaphambi kokucabanga ukuthi isilungiselelo sesistimu sonke siyasebenza. Iklayenti elixazulula indawo yokugcina ngesixazululi i-proxy engayisebenzi lizohluleka nalapha, yingakho ukushintsha kwe-DNS kungabonakala njengokulungisa kuyilapho kuwumjikelezo nje.

Qaphela futhi iphethini yokuqondisa. Inethiwekhi ehlungiwe ingaphendula igama lomgcini lokuthola lomthengisi ngokwayo, okushintsha ukuthi iklayenti likhetha iphrofayela le-proxy eliphi. Ungakhi inqubo eduze kwalokho kungajwayelekile. Kuyahluka ngendawo, kushintsha ngaphandle sesaziso, futhi akusiyo into ongayisekela omunye umuntu.

Iphothi 443 iyafinyeleleka, ayivunyelwe

Ukugoqa ithaneli ku-TLS ku-443 kuxazulula ukufinyeleleka futhi akukho okunye. Isihlungi esihlola iphothi sizolivumela; isihlungi esithatha umnyatselo wokuxhawulana ngeke, futhi ukubingelela kweklayenti okubethelwe kufihla igama leseva kuphela lapho zombili izinhlangothi zikusekela. Gijima ukuhlolwa futhi wazi ukuthi usemuva kwaluphi uhlobo lwesihlungi esikhundleni sokuthemba.

Kukhona futhi izindleko zokusebenza abantu abazithola kamuva. Ukuthutha okwethenjwayo ngaphakathi kokuthutha okwethenjwayo kwandisa ukulahleka, ngoba isiteki sangaphakathi sithumela kabusha izingxenye isiteki sangaphandle esezithumele kabusha. Emgqeni ohlanzekile akekho oqaphelayo. Kunethiwekhi engenantambo yasekhampasi egcwele ithaneli liba elingasasebenzi ngesikhathi esifanele lapho ulidinga, futhi igrafu ibonakala njengokulahleka kwamaphakethe yize kungekho okulahlwa ngamabomu.

I-UDP imvamisa iyisisulu sokuqala, futhi kufanele kuqinisekiswe esikhundleni sokuqagela. Uma i-WireGuard noma i-OpenVPN ezenzakalelayo ingakaze iqede ukuxhawulana kuyilapho i-TCP 443 isebenza, inethiwekhi ilahla i-UDP, futhi akukho ukukhiqizwa kabusha kokhiye okuzokushintsha lokho:

sudo wg show
dig +short vpn.example.net
dig +short vpn.example.net @1.1.1.1

Isigxivizo sesikhathi esingenalutho sokuxhawulana eduze kozakwethu owayesebenza izolo iyimpendulo ye-UDP. Imibuzo emibili ye-DNS iphendula umbuzo ohlukile: uma isixazululi sasendaweni nesixazululi somphakathi kungavumelani ngekheli lendawo yokugcina, uyaqondiswa futhi impikiswano yokuthutha iyona engalungile.

Qinisekisa ukuthi yini eyashiya umshini ngempela

Amarekodi eklayenti achaza lokho iklayenti elikukholwayo. Ukuthwebula kuchaza lokho inethiwekhi eyakubona, futhi umehluko phakathi kwalokhu kokubili yindawo lapho iningi lalezi zigameko lixazululwa khona:

sudo tcpdump -ni any -c 20 'tcp port 443 and host 203.0.113.10'
sudo ss -tunp | grep -E ':(443|1194|51820)\b'

Uma ubona amaphakethe e-SYN futhi kungekho SYN-ACK, ukuvinjwa kungaphezulu futhi iklayenti elimsulwa. Uma ubona ukuxhawulana okuqediwe kukheli okungewona owe seva, ukhuluma ne-proxy noma umgadli. Uma ungaboni lutho, hlola ukuthi uthwebule kusixhumi esilungile ngaphambi kokuphetha noma yini.

Uhlu lwamasokhethi lubamba icala elicashile: ithaneli lesibili esevele liphethe indlela ezenzakalelayo. Amaklayenti amabili alwela ithebula lokuhambisa indlela adala ukwehluleka kwezikhathi okubonakala kufana ncamashi nenethiwekhi evinjiwe, futhi ukuthwebula kuzobonisa ithrafikhi ephuma ngesixhumi obungasilindele.

Ukuhoxisela emuva, kanye nenothi elifanele ukugcinwa

Hoxisa izinguquko ngokulandelana okuphambene nalokho okuzenzile. Susa iziguquli ze-proxy, misa iklayenti olisungule ngesandla, futhi susa noma yikuphi ukubhala phezu komzila noma kwesixazululi okwengezile:

unset https_proxy http_proxy
sudo systemctl stop openvpn-client@corp
sudo ip route show default

Ukushiya iklayenti eliqalwe ngesandla lisebenza yikho okuyenza ilaptop iphele inenethiwekhi ephukile ekuhambeleni ihhovisi okulandelayo. Iziguquli ze-proxy ezishiywe kuphrofayela ye-shell ziphula amathuluzi angahlobene emasontweni kamuva, futhi umuntu ozilungisayo ngeke ahlobanise izigameko ezimbili.

Bese ubhala imigqa emine: inethiwekhi, isigxivizo sesikhathi, isigaba esihlulekile, kanye nomkhiphi owubonile. Indlela esebenza kukhempasi eyodwa futhi ihluleke kwelandelayo ijwayelekile, futhi umuntu olandelayo udinga ukwazi ukuthi umehluko kwakuyi-proxy, isixazululi noma isihlungi. Uma impendulo iwukuthi inethiwekhi ivimbela ukufinyelela kude, misa lapho futhi buza umlawuli ngomzila osekelwayo esikhundleni sokuphatha umjikelezo ungene kunqubomgomo ongakayifundi.