Ingabe ukushintsha kokuphepha kwe-VPN kusinda ekuqaliseni kabusha? Indlela yokukuqinisekisa

Ukuqalisa kabusha indlela evame kakhulu abantu abayisebenzisayo ukuhlola ukushintsha kokuphepha, futhi ukuhlolwa okukhuluma amanga kaningi kunakho konke. Ibhokisi lokumaka kuseklayenti liwukuthanda nje; okubalulekile ukuthi ngabe kukhona okusebenzisa ukuvinjwa phakathi kwesikhathi lapho isitaki senethiwekhi siphakama khona nesikhathi lapho umhubhe usungulwe ngempela khona. Ku-Windows leyonto ivamise ukuba isihlungi ku-Windows Filtering Platform, ku-Linux iqoqo lemithertho elayishwa iyunithi, ku-macOS i-ankile ye-pf, ku-Android amafulegi wesistimu uqobo okuhlala-kuvuliwe nokukhiya. Lezi zinhlelo ziziphatha ngendlela ehluke kakhulu phakathi nokuqalisa kabusha, futhi yilezo ezisezingeni leplathifomu kuphela ezikhona ngaphambi kokuba noma ubani angene.

Ukuqalisa kabusha kubuza imibuzo emithathu ehlukene

Hlukanisa umbuzo. Okokuqala, ingabe inqubomgomo ikhona kudiski ngendlela okuthile eyifundayo ngesikhathi sokuqalisa? Okwesibili, ingabe lowo mfundi usebenza ngaphambi kokuba noma yikuphi ukuxhumana kuphume? Okwesithathu, ingabe inqubomgomo ihlanganisa ukuxhumana okubalulekile kuwe, okungukuthi yonke inqubo, zombili imindeni yamakheli ne-DNS. Ukuthi yebo kokokuqala kanye nocha kokwesibili kukhiqiza khona lokho kwehluleka abantu abakubika njengokushintsha kokuphepha okungasindi ekuqaliseni kabusha: ukuxhumana kuphuma ngasese imizuzwana embalwa ekuqaliseni, futhi akekho okuqaphelayo kuze kube yilapho othile eya ukubheka.

Gcina izingqimba zihlukene. Iqoqo lemithertho yodonga lomlilo eligciniwe, isevisi eqala ngesikhathi sokuqalisa kanye nokuthanda kweseklayenti kuyizinto ezintathu ezihlukene ezinempilo emithathu ehlukene. Ukuthanda kusinda ekuqaliseni kabusha ngoba kuyinani elikusefayela lokuhlela. Imithertho iyiyona kuphela evimbela amaphakethe, futhi iyanyamalala kanye ne-kernel eyayibambe.

Thola into ebuyisela ukuvinjwa

Ku-Linux imithertho ye-netfilter ihlala ku-kernel. Akukho okubuyisela emuva ngesikhathi sokuqalisa ngaphandle uma ukuhlelile: iptables-save kanye netfilter-persistent, nftables.service ilayisha /etc/nftables.conf, noma iyunithi ye-systemd eqhuba umbhalo wakho siqu. Hlola okunikwe amandla, hhayi lokho okukhumbulayo ukuthi ukuhlelile.

systemctl is-enabled nftables netfilter-persistent 2>/dev/null
sudo nft list ruleset
sudo iptables -S OUTPUT

Iqoqo lemithertho elingenalutho emizuzwaneni embalwa ngemva kokuqalisa liyimpendulo yombuzo osesihlokweni. Ku-Windows buza isevisi yeseklayenti ukuthi iqala kanjani, bese ukhipha isimo sesihlungi seplathifomu ngesikhathi umhubhe uphansi.

Get-Service | Where-Object { $_.Name -match 'vpn' } | Select-Object Name, Status, StartType
netsh wfp show state

Umyalo wesibili ubhala wfpstate.xml kukhophi yamanje. Funa izihlungi ezinesenzo sokuvimbela esivele sikhona ngaphambi kokuba iseklayenti ixhumeke. I-Base Filtering Engine iqala kusenesikhathi ngesikhathi sokuqalisa futhi ibuyisela izihlungi ezingezwe ngefulegi elihlala njalo, yingakho ezinye izinto zokushintsha kokuphepha zivimbela ukuxhumana ngaphambi kokuba kube khona iwindi leseklayenti kanti ezinye azenzi. Ku-macOS sudo pfctl -s info ibika ukuthi i-pf ivuliwe yini, sudo pfctl -s rules ikhombisa okulayishiwe, futhi amaklayenti e-VPN ngokuvamile axhumanisa imithertho yawo ne-ankile esikhundleni seqoqo eliyinhloko. Umthertho obiza utun3 ungase ngemva kokuqalisa okulandelayo ukhombe kwenye i-interface, ngoba leyo nombolo inikwa ngesikhathi sokusebenza.

Bhekisisa igebe phakathi kokuphakama kwenethiwekhi nokuphakama komhubhe

Isikhathi esiyingozi akusona ukho konke ukuqalisa kabusha, yilelo geba. I-interface ithola irenti nomzila ozenzakalelayo ngesikhathi esisodwa, isevisi ye-VPN iqala ngesinye, futhi umhubhe uqinisekisa ngisho kamuva, ngezinye izikhathi kuphela ngemva kokuba umsebenzisi engene futhi i-ejenti yobunikazi isisebenza. Uma ukuvinjwa kusetshenziswa ekugcineni, konke okusegabeni kuphuma obala.

Kumabhodi e-systemd funda ukulandelana esikhundleni sokukuqagela. Qhuba systemctl cat kumayunithi e-VPN nodonga lomlilo bese ufuna After= noma Before= uma kuqhathaniswa ne- network-pre.target kanye ne- network-online.target. Iyunithi yodonga lomlilo ehlelwe ngemva kwe- network-online.target iyahlulwa i-interface; leyo edingwa futhi ehlelwe ngaphambi kwe- network-pre.target iyanqoba. Ku-Windows imibuzo efanayo uhlobo lokuqalisa lwesevisi kanye nokuncika kwayo, ngoba isevisi ebekwe ku-Manual ayikwazi ukuvimbela inqubo ngesikhathi sokuqalisa. Uma imfuneko yakho ihlanganisa ukuxhumana ngaphambi kokungena, isimiso sezinga ledivayisi kuphela esiyifezayo: umhubhe wedivayisi we-Always On VPN uqinisekisa ngesitifiketi somshini futhi uxhuma ngaphambi kokuba umsebenzisi angene, futhi i-Microsoft ibhala ukuhlelwa komhubhe wedivayisi ngokwehlukile kumhubhe womsebenzisi. I-Android ithatha enye indlela, iphoqa i-VPN ehlala ivuliwe futhi ivimbela ukuxhumana ngaphandle kwayo isuka kusistimu hhayi enkambisweni yohlelo lokusebenza.

Qhuba ukuhlolwa, bese uqhathanisa imigqa emibili yesikhathi

Qalisa kabusha ngendawo okungekho okulahlekayo uma kuputshuka, futhi thwebula isimo phakathi kwegesi hhayi ngemva kwalo. Indlela ehlanzekile kakhulu isihloli sesikhathi sokuqalisa: iyunithi ye-oneshot noma umsebenzi ohleliwe oqala ngokushesha ngangokunokwenzeka okuvunyelwe yiplathifomu, irekhoda umzila ozenzakalelayo nesimo sodonga lomlilo, izame isicelo esisodwa ngesikhathi esifushane bese ingeza umugqa kufayela lendawo. Qhathanisa lokho kurekhodwa nesikhathi sokuqala kwesevisi ye-VPN esivela ku- journalctl -b -u noma ilogi yesistimu.

Bese wenza ukuhlolwa okuvamile: umhubhe phezulu, nqamula uxhumano, bheka ukuthi ukuxhumana okuqondile kuvinjiwe yini, buyisela. Ukuphasa owesibili nokwehluleka kowokuqala umphumela ojwayelekile, futhi kusho ukuthi ukusebenzisa kungasohlangothini lweseklayenti, kusetshenziswa lapho iseklayenti ixhumeka hhayi ngesikhathi sokuqalisa. Kumshini wokugcina engiwuhlolile, ukuvinjwa kwakuvela kumbhalo womhambisi we-NetworkManager: ukhona futhi uqondile futhi awunamsebenzi emizuzwaneni engaphambi kokuba i-interface iphakame. Bhala imiphumela yomibili, ngoba ukusinda ekuqaliseni kabusha kunencazelo kuphela uma usho ukuthi yiluphi ungqimba olwasinda nokuthi kusukela nini.

Vala igebe ngaphandle kokunqamula indlela yakho yokubuya

Uma ukuvinjwa kungekho ngesikhathi sokuqalisa, yehlisa ukusebenzisa ungqimba olulodwa phansi esikhundleni sokwengeza umthertho weseklayenti wesibili. Gcina iqoqo lemithertho bese ulilayisha kusuka kuyunithi ehlelwe ngaphambi kokuba inethiwekhi isebenzeke, futhi uqinisekise ukuthi leyo yunithi ayidingi uphenyo lwe-DNS noma ukugxunyekwa kwenethiwekhi okufanele ikuvikele. Ububanzi bubalulekile njengesikhathi: imithertho ehambisana ne-ID yomsebenzisi noma i-cgroup ishiya yonke i-daemon yesistimu ngaphandle kokuvinjwa, futhi iqoqo elibhekana ne-IPv4 kuphela lishiya i-IPv6 ne-DNS kufinyeleleka.

Zishiyele indlela yokubuya. Umshini ovimbela konke ngesikhathi sokuqalisa bese ungakwazi ukuqinisekisa awunayo inethiwekhi nhlobo, futhi isixazululo akusona ukususa ukuvinjwa kodwa ukulungisa ubunikazi noma ukulandelana. Gcina inqubo ebhaliwe yekhonsoli yendawo kanye nokukhishwa okuncane nokwenziwe ngamabomu kwalokho umhubhe okuyikho ngempela akudingayo, njengekheli leseva nesixazululi esisetshenziswa ngaphambi kokuba umhubhe ube khona.

Ngaphambi kokuthemba le nhlelo, qinisekisa izinto ezine ngokulandelana. Inqubomgomo igcinwe lapho ukuqalisa kuyifunda khona. Lowo mfundi usebenza ngaphambi kokuba i-interface isebenzeke. Ukuvinjwa kuhlanganisa zombili imindeni yamakheli ne-DNS. I-VPN isengaqinisekisa ngesikhathi ukuvinjwa kusebenza. Uma zozine zikhona, ukuqalisa kabusha akushintshi lutho.