Ukuthwebula i-VPN: amaphakethe angaphakathi ku-tun0, umgqomo ku-eth0

Ukuthwebula kusisibungu se-VPN akubhali into eyodwa kuphela. I-kernel iveza iphakethe kabili: lisongelwe, ku-adaptha yomzimba, futhi livuliwe, kudivayisi yomhubhe. Ukukhetha isixhumanisi ukukhetha ukuthi iyiphi yalezi zindaba oyifundayo. Izingxabano eziningi mayelana nokuthi ukuthwebula kufakazelani empeleni ziyizingxabano mayelana nokuthi iyiphi indaba eqoqiwe.

Ukufaka emgqonyeni kudala imibono emibili

Umhubhe uthatha iphakethe elikhiqizwe uhlelo lokusebenza futhi ulifaka ngaphakathi kwelisha okuyiwa kulo iseva ye-VPN. Isimo sangaphakathi sivela ku-tun0, ku-wg0 noma kunoma yidivayisi edalwe iklayenti. Isimo sangaphandle sivela ku-adaptha eyisa kuyo kunethiwekhi. Zombili izimo zisemthethweni; ziphendula imibuzo ehlukene. Qoqa ngayinye ngokuhlukile, ngoba zozimbili zinezingqamuzi nezifundi ezihlukene.

sudo tcpdump -i tun0 -n -s 0
sudo tcpdump -i eth0 -n host 198.51.100.20 and udp port 51820

Isixhumanisi esingesona any siyisinqumo esibi salokhu kuqhathanisa. Amaphakethe adluliswayo angabhalwa kabili, futhi iphakethe elikhiqizwe endaweni livela kuzo zombili izimo, okukhulisa izibalo. Uma inombolo ibonakala ingenakwenzeka, hlola isixhumanisi ngaphambi kokusola umhubhe.

Ngaphakathi komhubhe, iphakethe livamile

Kudivayisi yomhubhe, okubonayo yilokho uhlelo lokusebenza olucela i-kernel ukuba ikuthumele. Amakheli okuyiwa kuwo, amachweba, amagama e-DNS, amagama eseva ye-TLS, osayizi nesikhathi konke kukhona. Umthwalo we-TLS uhlala ubethelwe yiseshini yohlelo lokusebenza uqobo, ngakho ukuthwebula akudaluli okuqukethwe kwekhasi. Umbuzo we-DNS ngombhalo ocacile uyabonakala lapha nakuba umthwalo wawo ubethelwe, ngoba awuzange uvikelwe.

I-DNS ebetheliwe isusa leyo nkambu eyodwa ebonakalayo. Ayifihli ikheli lokuya kulo, inani lamabhayithi noma isigqi, okuyizici zokugeleza hhayi zombuzo.

Ngaphandle kuphela umgqomo nokuma kwawo

I-adaptha yomzimba ibonisa ikheli lakho, ikheli leseva, ichweba, osayizi bamaphakethe nesikhathi. Izindawo okuyiwa kuzo ezithwalwa ngaphakathi azikho, nakuba ukuma kwazo kusengasekela ukuqagula. Osayizi nesigqi kungase kuphakamise ukusakaza kwevidiyo, ukudlulisa okukhulu noma iseshini yengxoxo ngaphandle kokuqamba noma iyiphi yazo. Umbukeli oseduze ubona umbono ofanayo cishe, okuchaza indlela umhubhe ongafihla ngayo amasayithi kuyilapho umemezela ubukhona bawo.

Leyo mibono incike ekuhambiseni imizila. Umzila omncane, i-IPv6 ezenzakalelayo engangeni emhubheni, noma inqubo eboshelwe kusixhumanisi somzimba kuzobeka ithrafikhi ngaphandle komgqomo. Funda umzila wangempela ngaphambi kokuphetha ngokuthwebula.

Ikheli likantanga nokuhlanzeka kokuthwebula

I-OpenVPN kumodi ye-TCP igcina isokhethi esisunguliwe, ngakho ithebula lamasukhethi lingasho untanga. I-OpenVPN kumodi ye-UDP ivamise ukushiya isokhethi ingaxhunyiwe, futhi ss ingase ibonise uhlangothi lwasekhaya kuphela. Funda esikhundleni salokho remote yephrofayela, ilogi yeklayenti enemininingwane noma umzila oya endaweni yokugcina. I-WireGuard ibika indawo yayo yokugcina nokuxhawana kwesandla kokugcina ngqo.

wg show
ss -tunp | grep 51820

Ifayela lokuthwebula liphila isikhathi eside kuneseshini elilikhiqizile. Lingakopishwa, futhi lingase lifundwe yinoma ubani onokufinyelela kwasekhaya. Gcina kuphela lokho okudingwa uphenyo, khawulela izimvume futhi ulisuse uma umsebenzi usuphothuliwe.

Ukuthwebula okwabiwe kufanele kusho ukuthi yisiphi isixhumanisi esikukhiqizile nokuthi nini. Ngaphandle kwalowo mbhalo, umfundi olandelayo kufanele aqagele ukuthi ubheka yiphi isendlalelo.