I-VPN ixhunyiwe kodwa insiza eyodwa iyahluleka: hlukanisa isigaba

I-handshake eqediwe ayisho lutho ngokuthi igama, umzila, usayizi wephakethe noma isilaleli. Dabulisa izigaba ezine bese uvumela ukwehluleka kokuqala ukuthi kushiwo iphutha.

«Ixhunyiwe» iyiqiniso elinolwazi oluncane kakhulu kuthikithi ye-VPN. Ibhala ukuthi izinhlangothi ezimbili zaqeda i-handshake futhi ayisho lutho ngegama elibuziwe, i-interface iphakethe elaphuma ngayo, usayizi walo, noma ukuthi uhlangothi olukude luyamukele yini. Yingakho insiza eyodwa ingahluleka kuyilapho zonke ezinye izinhlelo kulelo laptop zisebenza. Dabulisa izigaba ngokulandelana futhi isigaba sokuqala esihlulekayo sizoshiwo iphutha.

Qala ngegama, hhayi nge-tunnel

Xazulula ngaphambi kokuhamba ngomzila, ngoba impendulo embi yenza zonke izivivinyo ezilandelayo zingabi namsindo. Buza igama kusixazululi sohlelo bese uqhathanisa leyo mpendulo nekheli uhlelo olulusebenzisile ngempela. Igama langasese elibuya njengekheli lomphakathi lisho ukuthi umbuzo waya kusixazululi esingenalo umsebenzi wokuwuphendula. Igama elingaxazululeki liseqenjini elifanayo, liphindwe kabili kuphela.

resolvectl query host.internal
getent hosts host.internal

Iziphequluli ezinesilungiselelo sazo se-DNS ephephile ziyahluleka lapha kuyilapho uhlelo olusele lusebenza. Yingakho isikhalo esithinta isiphequluli kuphela sisegabeni lokuqala lesi sigaba, ngaphambi kokuba othile athinte umzila. Qhathanisa imiyalo yomibili hhayi eyodwa, ngoba getent ilandela indlela ye-NSS futhi umbuzo wesixazululi awuyilandelanga.

Buza i-kernel ukuthi yakhetha muphi umzila

Ithebula lomzila liwuhlelo lokuncamela, futhi umzila okhethwa yi-kernel awuyona njalo leyo ekhonjiswe kumdwebo. Yibuza ngqo mayelana nendawo okuyiwa kuyo. Impendulo isho i-interface, ukugxuma okulandelayo nekheli lomthombo elizosetshenziswa. Iphakethe lingaphuma ku-tunnel liphethe ikheli lomthombo olwenqatshwa uhlangothi olukude, futhi ingeno eqondile kakhulu kuthebula lomzimba ingayithumela ngaphandle nge-interface ye-Wi-Fi.

ip route get 10.20.30.40
ip -brief address show

Funda izinkambu dev, via ne src ngalolo hlelo, ngoba ngayinye isusa ukusola okuhlukile. Lesi sigaba siphinde sibe ngumnikazi wesimo esifakwe yiklayenti, ngoba imithetho ye-firewall nemizila kungase kuhlale ngemva kokuphuma okungajwayelekile. Yingakho «akukho i-inthanethi ngaphandle kwe-tunnel» kanye «akukho i-inthanethi ngaphandle uma iklayenti lisebenza» kuwumndeni owodwa wezinkinga, hhayi emibili.

Hlola usayizi wephakethe

Impendulo encane ebuyayo ngenkathi ukudluliswa okukhulu kumile ikhomba kuqala ku-MTU yomzila. Ukuhlola okukodwa okune-bit ye-do-not-fragment ebekiwe, okuthunyelwe kusuka ngaphakathi kwe-tunnel, kwehlukanisa lesi sigaba kwezinye. Khulisa umthwalo kuze kuhluleke ukuhlola futhi ube nenombolo ebalulekile.

ping -M do -s 1400 10.20.30.40

Ukudlula kokuhlola okuncane ngenkathi uhlu lwemfolda noma ukulayisha kunamathele kuwuphawu lwalesi sigaba. Isikhalo sizwakala njengemininingwane yokungena noma umthetho we-firewall, futhi akusikho kokubili.

Inombolo iyisici somzila, hhayi sekhayenti, ngakho inani elisebenza kuxhumano lwasehhovisi lingahluleka kuxhumano lweselula. Gcina umyalo wokuhlola kanye nethikithi, ngoba umuntu olandelayo udinga isilinganiso esifanayo. Uma umthwalo omncane udlula, isixazululo i-clamp noma i-MTU ye-tunnel ephansi, hhayi i-cipher entsha.

Hlola uhlangothi olukude

Hlola indawo okuyiwa kuyo ngekheli layo, bese ubheka ukuthi yini elalela lapho. Uxhumano olwenqatshiwe nokuxhumano olungaphenduli neze kuyimiphumela ehlukile. Eyokuqala ithi kukhona okusebenzayo futhi akusebenzisi leyo port, kanti eyesibili ithi akukho okubuyile. Kokubili akusiyo inkinga yekhayenti ngokuzenzakalelayo.

curl -sv http://10.20.30.41:8080/health
nc -vz -w 3 10.20.30.41 3389
ss -lnt 'sport = :8080'

Akukho okufinyeleleka nge-tunnel okungaba insiza elalela ku-127.0.0.1 kuphela, ngoba isilaleli asilokothi sibone iphakethe. Uma i-firewall yomsingathi okude ivumela i-subnet yasehhovisi futhi inqaba ichibi le-tunnel, umphumela ubonakala njengokwehluleka kwekhayenti futhi awunjalo. I-Remote Desktop noma ukwabelana ngamafayela okwephukayo ngenkathi ithrafikhi yewebhu isaphila kuvame ukugcina lapha, noma umsebenzisi ekusho kanjani.

Hlanganisa isikhalo nesigaba esisodwa

Imibiko eminingi iwela kwesinye sezimo ezinhlanu, futhi isimo ngasinye sisho isigaba. Isayithi elilodwa elisebenza nge-tunnel kuphela liyimpendulo yegama noma inqubomgomo eboshelwe ekhelini lomthombo. Izibuyekezo ziyahluleka ngaphandle kwe-tunnel ngenkathi ukuphequlula kusebenza — leyo yinkinga yegama noma yomzila yaleyo khayenti.

Ukuthi konke kume uma iklayenti lomhlinzeki liqala kuyisimo esifakiwe, okungumbuzo womzila ne-firewall. Insiza eyodwa engafinyeleleki ngenkathi ezinye zilungile wuhlangothi olukude. Ukudluliswa okuma ngemva kwemizuzwana embalwa usayizi wephakethe. Qhathanisa isimo ngaphambi kokugijima imiyalo, ngoba yiyo enquma ukuthi ibuphi ubufakazi obuqoqwa kuqala.

Bhala phansi isigaba esidale ukwehluleka kokuqala kanye nomphumela womyalo. Ithikithi elithi ikheli lomthombo lalilimaza, nelayini yomzila efakiwe, lifanele isinyathelo, kanti elibika ukuthi i-VPN iphukile alifanele.

Izihloko ezihlobene