Iphoyinti elilodwa le-VPN nge-Squid: ukukhishwa okuncane kwe-CONNECT

I-Squid iphendula isicelo se-CONNECT ngomugqa wokuqala we-http_access ohambisanayo, futhi lowo mugqa ungaba ukwenqaba. Leli qiniso elilodwa lichaza ukuthi kungani ukukhishwa kwephoyinti le-VPN ngokuvamile kwehluleka emzamweni wokuqala, ngoba isicelo asikaze sifinyelele imvume umuntu oyengeze ekugcineni. Ukulungiswa okuncane kugcina onogada bamapoti abakhona futhi kubafundisa umthombo owodwa, indawo nopodi okubuyekezwe. Konke okunye ku-proxy kuziphatha ngendlela efanayo nangaphambili.

I-Squid inquma kanjani isicelo se-CONNECT

Isicelo se-CONNECT sisho ihhosti nephothi, futhi i-Squid idlula imigqa ye-http_access ngokulandelana ize kube owodwa ohambisanayo. Ukwenqaba okuhambisanayo kuqeda ukuhlola ngokushesha futhi iklayenti ithola i-403 ku-proxy. Yingakho indawo yomthetho ibaluleke kakhulu kunamagama awo. Ukuhambisa umugqa ofanayo isinyathelo esisodwa phezulu kungashintsha umphumela ngokuphelele.

Onogada abajwayelekile benqaba konke okungaphandle kwe-Safe_ports futhi benqaba i-CONNECT ngaphandle kwe-SSL_ports. Lawo magama ama-ACL achazwe ekulungiselelweni kwakho, ngakho okuqukethwe kwawo kungokwakho hhayi okwephrothokholi. Ukusabalalisa kungavumela ububanzi bamapoti obukhulu njenge-Safe_ports ngenkathi kuthiya i-CONNECT ngokwehlukile. Funda amanani akhona ngaphambi kokucabanga ukuthi ipoti ivinjiwe ngokwakhiwa.

Qinisekisa ukuthi i-proxy iyona ngxenye enqaba isicelo. I-403 ekhiqizwe yi-Squid ayifani neze nesexwayiso se-TLS esivela kuseva ye-VPN, futhi ukuhlanganisa kokubili kube inkinga eyodwa kubiza ihora lokuqala. Hlola umugqa wengqophamlando yokufinyelela wesicelo, ngoba ubhala kokubili isenzo kanye nomthetho owukhiqizile.

Yakha ukuhambisana okukodwa okuhlanganisiwe esikhundleni sama-ACL amathathu ahlukene

Yakha ukukhishwa ngezinto ezintathu: ububanzi bomthombo ovunyiwe, ikheli elilodwa lendawo evunyiwe kanye nephothi eyodwa kuphela i-phoyinti yokugcina elalela kuyo. Ama-ACL amabili ahlukene nokuhambisana okukodwa okuhlanganisiwe kunikeza inqubomgomo ehluke kakhulu, ngoba okuhlolwayo ukuhlanganiswa. Qamba i-ACL ehlanganisiwe ngalokho ekugunyazayo, hhayi ngendlela ekuyiphathayo.

Isimo esingezansi sisebenzisa ububanzi bemibhalo okufanele kushintshwe ngamanani abuyekezwe. I-Squid ayigcini nalinye kwalawa magama, ngakho uwena okhetha futhi uwena okugcina kuvumelana. Le recipe ikhawulelwe ku-Squid 6 no-7, okulungiselelwa kwabo okubhaliwe kusekela iqembu le-all-of. Isithenjwa samanje sikhomba lezo ziyalo njengezingatholakali ku-Squid 8, ngakho thatha lokhu njenge-recipe eboshelwe enguqulweni hhayi indlela yokufuduka, futhi hlola isiyalo esithenjweni senguqulo yakho ngaphambi kokusisebenzisa.

acl pvpn_src src 192.0.2.128/25
acl pvpn_dst dst 198.51.100.77/32
acl pvpn_port port 1194
acl pvpn_ok all-of CONNECT pvpn_port pvpn_dst pvpn_src

Iqembu le-all-of lihambisana kuphela lapho ilunga ngalinye lihambisana, okusho ukuthi umthombo, indawo kanye nephothi kuhlolwa emugqeni owodwa. Iqembu ngokwalo alinikezi lutho, futhi isicelo esihambisana nezinto ezimbili kuphela kwezintathu asikwazi ukuligcwalisa. Leyo mpawu igcina ukukhishwa kuncane lapho othile engeza isango lesibili kamuva. Kuphakathi kokuthi indawo entsha yengezwa ngamabomu, noma isicelo sibuyela konogada bokuqala.

Goba onogada bamapoti ngaphandle kokubasusa

Ezindaweni zabo zamanje, imigqa emibili yonogada ejwayelekile ibukeka kanje. Ngokuvamile ihlezi ngemuva kokuqinisekisa kanye nangaphambi kwemigqa yenqubomgomo evumela konke.

http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports

Engeza ukuhambisana okuhlanganisiwe okuphikisiwe kumugqa ngamunye, ukuze ukukhishwa okuhambisanayo kudlule kunogada obekuyokwenqaba. Yimigqa yonogada kuphela eshintshayo, futhi ngamunye ngombandela owodwa owengeziwe.

http_access deny CONNECT !SSL_ports !pvpn_ok
http_access deny !Safe_ports !pvpn_ok

Imibandela emugqeni owodwa wokufinyelela iyahlanganiswa, ngakho umugqa manje wenqaba kuphela izicelo ezihlulekayo ekuhloleni kwasekuqaleni nasekukhishweni. Isicelo esiya kuphoyinti lokugcina elivunyiwe siyadlula, futhi zonke ezinye izicelo zigcina ukuziphatha kwephothi lakudala. Lokhu kuncane kunokwengeza iphothi ohlwini lomhlaba wonke lwe-SSL_ports, obekuyovumela lelo phothi kuyo yonke indawo. Uma iphothi isivele ikulolo hlu, le ACL ayinciphisi lutho futhi imvume endala ebanzi isasebenza kwezinye izindawo, ngakho funda uhlu olukhona ngaphambi kokusho ukuthi ukukhishwa kwavula iphothi. Kuyabuyiseka futhi, ngoba imigqa emibili ibuyela esimweni sayo sangaphambilini. Isithenjwa sokulawula ukufinyelela sibhala ukulandelana kanye nonogada abajwayelekile lokhu kushintshwa okuncike kubo.

Lapho ukukhishwa akufanele kubekwe khona

Isilingo siwukubeka imvume phezu konogada bese uqeda. Leyo ndawo yeqa nokuvikelwa kokuqinisekisa nendawo yasendaweni okuvamise ukuba seduze nesiqongo sokulungiselelwa okusebenzayo. Umphumela awukona ukukhishwa okuncane, kuyimbobo enombono phezu kwayo. Gcina noma iyiphi imvume entsha esigabeni esibuyekezwe esifanayo nayo yonke enye inqubomgomo yeklayenti.

Hlola ukuthi isicelo sisadinga ini ngemva konogada bamapoti. I-akhawunti eqinisekisiwe, ikheli leklayenti elivunyiwe kanye nenqubomgomo yendawo kusasebenza konke, futhi ukukhishwa akushintshi lutho kulokho. Uma i-proxy yakho isivele ivumela i-akhawunti evunyiwe ukuba ifinyelele izindawo ezinganqunywanga, umgada wephothi awukaze ube ukulawula kwangempela.

Cabanga ukuthi i-phoyinti yokugcina ingabe i-TCP. Ukukhishwa kwe-CONNECT kuthwala imisakazo ye-TCP, futhi iphrofayili ye-OpenVPN esebenzisa i-UDP ngeke ifinyeleleke ngayo. Shintsha iphrofayili ibe i-TCP kuphela uma iseva ilalela kanjalo futhi umqhubi emukela umehluko wokuziphatha.

Hlola umngcele ngomhlaziyi nangesicelo sangempela

Hlaziya ukulungiselelwa ngaphambi kokulayisha kabusha, futhi gcina isikhathi sesibili sivuliwe ngenkathi wenza lokho. Iphutha lolimi ekulayisheni kabusha lingashiya i-proxy ekulungiselelweni kwakudala noma lenqabe ngokuphelele okusha. Umhlaziyi ubika umugqa owenqatshiwe, okungaphezu kwalokho iphutha leklayenti elizokutshela khona.

Bese ulayisha kabusha futhi uthumele i-CONNECT eyodwa yangempela nge-proxy isuka kumthombo ovunyiwe. Ukugijima komhlaziyi kuza kuqala, ngoba ukulayisha kabusha okunephutha lokuthayipha akukufundisi lutho mayelana nenqubomgomo.

squid -k parse
squid -k reconfigure
curl -v -p -x http://proxy.lab.internal:3128 https://vpn.lab.internal:1194/ --max-time 5

Hlola izimo ezintathu: umthombo ne-akhawunti okuvunyiwe, umthombo ongavunywanga, kanye nendawo ehlukile kupothi olufanayo. Isimo sesithathu yisona esibonisa ukuthi ukukhishwa kuncane, ngoba sisebenzisa iphothi ngaphandle kokuhambisana kwendawo. Funda ingqophamlando yokufinyelela kukho konke okuthathu esikhundleni sokwethemba umlayezo weklayenti. I-CONNECT ephumelelayo isungula umsakazo we-TCP futhi akukho okunye, ngakho ukuxhawulana kwe-VPN kuhlala kuwukuhlolwa okuhlukile.