Ishaneli yokulawula neyensiza yedatha ye-VPN: hlola ungqimba olulungile

Iklayenti lithi lixhunyiwe, iseva ibona umlingani, kanti uhlelo lokusebenza alukafinyeleli ndawo. Ngaleso sikhathi umbuzo owusizo awukho kokuthi iyiphi i-cipher okufanele ishintshwe, kodwa ukuthi iyiphi ishaneli ehlulekile. OpenVPN ibiza imisebenzi emibili ngokucacile: ishaneli yokulawula exoxisana ngesikhathi futhi eyilawulayo, neshaneli yedatha ethwala uhambo oluvikelekile. IKEv2 iveza ukuhlukaniswa okufanayo ngenhlangano ye-IKE kanye nenhlangano ye-CHILD. Yenza izivivinyo ezingezansi ngokulandelana, ngoba ukulungisa komzila wedatha okusetshenziswa ephutheni lomzila wokulawula kuchitha iwindi loshintsho.

Qamba ishaneli ngaphambi kokuyilungisa

Uhlangothi lokulawula luxoxisana ngempahla yezokuphepha, luqinisekisa abalingani futhi lulawula ukuxhumana. Uhlangothi lwedatha luthwala uhambo olukhethiwe lapho isimo esidingekayo sivele sikhona.

Zihluleka ngezindlela ezihlukene. Ukuhluleka kokulawula ngokuvamile kukushiya ungenaso isikhathi esisodwa esisebenzisekayo, noma unesikhathi esiphinde sixoxisane emjikelezweni. Ukuhluleka kwedatha kushiya isikhathi esibonakala siphilile kuyilapho amaphakethe elahliwa, ehambiswa endleleni engalungile, noma evikelwa ngamapharamitha angewona angamukelwa uhlangothi olulandelayo. Umugqa wokuloga owufundayo ukutshela ukuthi usesimweni sini kulezi zimbili, ngakho funda ilebula ngaphambi kombhalo wephutha.

Hlola ukushintshana kokulawula

Qinisekisa ukuthi ukuxhawulisana kuyaqedwa nokuthi izinhlangothi zombili ziyavumelana ngokuthutha, inguqulo ye-TLS nendlela yokuqinisekisa. Amalogi e-OpenVPN anyathelisa imigqa ehlukene yeshaneli yokulawula neyeshaneli yedatha, futhi ukungafani kwesitifiketi, kwenguqulo ye-TLS noma kwe-tls-crypt kuvela emugqeni wokulawula.

Uma ukushintshana kokulawula kuhluleka, bheka umgudu ofinyelelekayo, uchungechunge lwezitifiketi nezinsuku zalo zokusebenza, iwashi lesistimu, ukweqa kwama-cipher phakathi kweklayenti nesiseva, nanoma yisiphi isihluthulelo se-tls-auth noma se-tls-crypt. Uchungechunge olukhulu lwezitifiketi lungase futhi luhluleke ku-MTU yomzila ngaphambi kokuba nakuphi ukuqinisekisa kuqedwe, lokhu okubonakala njengokuphelelwa yisikhathi hhayi njengephutha le-cryptographic.

Lungisa ukuhluleka kokulawula ngezilungiselelo zokulawula. Ukunyusa i-cipher yedatha noma ukuxega inqubomgomo yokuqinisekisa idatha ngeke kuqedele ukuxhawulisana okungakaze kweqe ukushintshana kwezitifiketi.

Hlola ishaneli yedatha ngokwahlukana

Lapho isikhathi sesiphakanyisiwe, qinisekisa i-cipher nemodi yedatha okuvunyelwene ngayo, ukukhishwa kwezihluthulelo nokuziphatha ekukhulisweni kwesihluthulelo. Ku-OpenVPN, umugqa weshaneli yedatha usho i-cipher nosayizi wesihluthulelo abaqaliswe ngempela, futhi lokho kungahluka kwi-cipher yokuqala kuphrofayela.

Bese uhlola ukuthi isikhathi safaka ini. I-PUSH_REPLY ingangeza imigwaqo, isiseva se-DNS nomyalelo we-redirect-gateway, futhi noma yikuphi kwalokho kungathumela uhambo endaweni uhlelo lokusebenza olungenakukusebenzisa khona. Ku-IKEv2, umbuzo olinganayo ukuthi izikhethi zenhlangano ye-CHILD ziyafana yini namakheli asemgudwini wangempela.

I-tls-auth ne-tls-crypt ngeyeshaneli yokulawula. Ziqinisekisa noma zibethela ukuxhawulisana, futhi azikhethi i-cipher yedatha yohlelo lokusebenza. Uma wengeza enye yazo ulindele ushintsho emzileni wedatha, into oyishintshile ukuxhawulisana kuphela.

Xhumanisa amagama ne-IKEv2 ne-OpenVPN

I-IKEv2 inenhlangano yezokuphepha ye-IKE kanye nenhlangano eyodwa noma eziningi ze-CHILD. Inhlangano ye-IKE ithwala ukushintshana kokulawula; inhlangano ye-CHILD ithwala uhambo oluvikelekile nezikhethi zalo. Ziyaxoxisanwa futhi izihluthulelo zazo ziyakhuliswa ngokwezinhlelo ezihlukene, ngakho enye ingaba nempilo kuyilapho enye ingenayo.

I-ESP ayinayo ishaneli yokulawula yohlobo lwe-TLS ngaphakathi kwayo. Iphrothokholi yokulawula i-IKE, futhi i-ESP ingumthwalo ovikelekile. Ukubiza i-ESP ngeshaneli yedatha isifinyezo esixegayo esiba nokudida lapho ufunda ukubanjwa kwamaphakethe, ngoba ukubanjwa kukhombisa imilayezo ye-IKE namaphakethe e-ESP njengamaphrothokholi ahlukene ocingweni.

Gcina ukuxhumanisa kucacile emanothini akho: ishaneli yokulawula ye-OpenVPN ne-IKE SA zinguhlangothi lokuphatha, ishaneli yedatha ye-OpenVPN ne-CHILD SA zinguhlangothi lohambo, futhi ukusetshenziswa akukwazi ukushintshwa ngisho lapho ukuhlukaniswa kubonakala kufana.

Yeka ukushintsha isilungiselelo esingalungile

Hamba umzila ngendlela eyodwa: ukushintshana kokulawula, ukuvikelwa kwedatha, ukudlulisela, bese kuba ukuxazululwa kwamagama. Ma ngqo esigabeni sokuqala esihlulekayo futhi lungisa leso sigaba kuphela. Isikhathi esixhunyiwe esine-ping esebenza kuya kusango kodwa singenawo uhambo lohlelo lokusebenza siyinkinga yokudlulisela noma yezikhethi, hhayi inkinga yokuxhawulisana.

Bhala ubufakazi besigaba ngasinye ngokwahlukana kwithikithi: umugqa wokuloga kokulawula, amapharamitha edatha okuvunyelwene ngawo, imigwaqo efakiwe kanye nesicelo esisodwa sangempela. Leso sakhiwo sivimbela ukuqinisekiswa kobuwena okusebenzayo ekwenziweni buthaka ukuze kulungiswe inkinga yomzila yakamuva engazange iyibange, futhi sivimbela ukudayiswa koshintsho lwe-cipher yedatha njengokulungiswa kwephutha lesitifiketi.

Imibhalo yephrothokholi ye-OpenVPN iyisihlahla sokuqondisa sokuhlukaniswa kokulawula nedatha; yisebenzise lapho isixhumanisi somthengisi sisebenzisa amanye amagama emisebenzini emibili efanayo.