Izimfuno zamachweba e-VPN: imigqa emithathu okufanele ibhalwe ngaphambi kokuqhathanisa
Thola ukuthi uwuphi umbuzo wechweba onawo ngempela: indawo ephumayo, ukushicilela okungena noma ukuthutha komhubhe ngokwawo. Bese ubuza umnikezeli lokho kuphela.
Uhlu lwamachweba ezinsizakalo ze-VPN lukopishwa phakathi kwamakhasi okuqhathanisa ngaphandle kwemininingwane enquma ukuthi abalulekile yini: ubani oqala ukuxhumana. Umthetho ovumela i-TCP 443 ephumayo awusho lutho mayelana nokuthi enye isibungu ingafinyelela yini umlaleli emshinini wakho. Bhala izimfuno ezintathu ezihlukene ngaphambi kokuqhathanisa uhlelo olulodwa, futhi umake ukuthi yiziphi umsebenzi wakho oziqhakambisayo. Uma lelo khasi likhona, ukuhlolwa okuningi kuncipha kube umbuzo owodwa omfishane.
Hlukanisa isimfuno ngaphambi kokufunda noma yiluphi uhlu lwamachweba
Imigqa emithathu ihlanganisa cishe zonke izimo: ukufinyelela indawo engaphesheya komhubhe, ukushicilela okuthile ukuze abanye bakwazi ukuxhumana ngaphakathi, nokuthwala umhubhe ngokwawo. Umugqa ngamunye wehluleka ngesizathu esihlukile, futhi inqubomgomo yomnikezeli eyanelisa owodwa ingashiya eminye emibili ingathintwanga. Ukubeka umsebenzi wakho emugqeni ofanele kuthatha iminithi emihlanu futhi kugcine ingxabano kamuva.
| Line | Who starts it | What can block it | Question for the provider |
|---|---|---|---|
| Outbound destination | Your application | Egress filter on the exit node | Is this protocol and port allowed to that destination? |
| Inbound publishing | A remote peer | No mapping, no public address, short lifetime | Which protocol, which external port, and how long does the mapping last? |
| Tunnel transport | Your client to the gateway | The access network drops that protocol | Does the client offer a fallback the local network permits? |
Izitatimende zokukhangisa zifiphalisa imigqa emithathu ngamabomu. Imvume ye-P2P ichaza inqubomgomo yendawo, ikheli elikhethekile lichaza ikheli, futhi isimangalo sokuthi akukho mikhawulo yamachweba ngokuvamile sisho ukuthi uhlelo aluwabalisi. Asikho isitatimende kulezo esiphendula ezinye.
Khetha ukugeleza okukodwa okubonakalayo bese ukubhala njengomusho: umqalisi, ukuthutha, ichweba, umndeni wamakheli, indlela. Iklayenti lesipele sasebusuku elilayisha kusibungu esikude liphuma kuphela. Iseva yomdlalo etafuleni lakho abangane abajoyina kuyo ingena. Ukugijima kokubili ngomhubhe owodwa kusho ukuthi lelo khasi lidinga imigqa yomibili, hhayi ukuvumelana phakathi kwayo.
Ukufinyelela okuphumayo kwehluleka kunqubomgomo yendawo, hhayi emhubheni
Ukuthutha okuphumayo ngokusebenzisa isango elihumushayo kwakha isimo. Iphakethe lokuqala elivela ekhelini langaphakathi nechweba lakha ingqelembo yokuhumusha, futhi izimpendulo zihambisana nayo, okuwukuziphatha kokumephu okuchazwe ku-RFC 3022. Leyo ndlela iyisizathu sokuthi ithebhu yesiphequluli ngokuvamile isebenza ngaphandle kwesicelo sechweba.
Izinto ezimbili zisayiphula. Inodi yokuphuma ingase ihlunge izindawo noma izinombolo zamachweba ezibona zingasetshenziswa kabi, futhi uhlelo lungase lilale echwebeni inqubomgomo yokuphuma engakaze ililindele. Buza ngomabili wendawo hhayi ngemithetho yokungena, futhi ulindele izimpendulo ezihlukile ze-TCP ne-UDP.
Kala ngaphambi kokuphikisana. Gijima lezi kumshini ozoba ngemuva komhubhe, kanye lapho umhubhe uvaliwe futhi kanye lapho uvuliwe:
ss -lntup | sort
nc -vz -w 3 203.0.113.10 443
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 5 https://example.com
Imiyalo efanayo, indawo efanayo, izimo ezimbili zomhubhe, zinika umsebenzisi ukuqhathanisa kwangaphambi nangemuva angasebenza ngakho. Faka ikheli lemiqulu endaweni yesibungu osidinga ngempela; okubalulekile ukuthi ukuqhathanisa kuphindwe, hhayi ukuthi inombolo ethile ibonakala ihlaba umxhwele.
Ukushicilela okungena kudinga imephu, ikheli nesikhathi sokuphila
Akukho okungaphandle okungaqala ukuxhumana nomlaleli wakho ngaphandle uma okuthile ohlangothini lomphakathi kwazi lapho kuyolethwa khona. Ukubekelwa ichweba okuqinile okugcinwa umsebenzisi, imephu ecelwa iklayenti nge-UPnP, i-NAT-PMP noma i-PCP, nekheli lomphakathi elihambisiwe kuyimikhiqizo emithathu ehlukene enemikhawulo emithathu ehlukene.
Buza imibuzo emihlanu nganoma iyiphi yazo: iyiphi iphrothokholi, iliphi ichweba langaphandle, ingahluka yini ichweba langaphandle kwelangaphakathi, iyiphi imindeni yamakheli eliyihlanganisayo, futhi imephu ihlala isikhathi esingakanani ngemuva kokuxhuma kabusha. Ukubekelwa okuboshelwe kuseshini esebenzayo kuyanyamalala lapho leso seshini siphela, noma ngabe ikhasi lohlelo lithini.
Qinisekisa kuqala ingxenye yasekhaya, ngoba umlaleli ofile kanye nomzila wokungena ovinjiwe kubonakala kufana ngaphandle:
ss -lntup | grep -E ':(8080|51820)\b'
python3 -m http.server 8080 --bind 0.0.0.0
curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080
Lapho isicelo sasekhaya sibuyisela i-200 futhi isicelo esivela kunethiwekhi ongeyilawuli sisaphelelwa isikhathi, igebe lisehlangothini lomphakathi. Yiso leso sikhathi sokutshela umsebenzisi iphrothokholi nechweba langaphandle esikhundleni sokuchaza uhlelo ngegama.
Ukuthutha komhubhe ngokwawo kuwumbuzo ohlukile
Amachweba omthwali ayingxenye encane kakhulu yenkinga futhi kulula ukuwathola. Amanani okuzenzakalelayo ahluka ngephrothokholi, futhi lokho iklayenti elingakwazi ukuxoxisana ngakho kubaluleke kakhulu kunanoma yisiphi isichasiselo sohlelo.
| Client | Outer transport | Default port | When it helps |
|---|---|---|---|
| OpenVPN | UDP | 1194 | Default mode; needs outbound UDP to pass |
| OpenVPN | TCP | 443 | UDP is dropped and TCP 443 is not |
| WireGuard | UDP | 51820 | Short handshake; there is no TCP mode |
| IKEv2/IPsec | UDP | 500 and 4500 | Mobile clients; 4500 carries NAT traversal |
Inethiwekhi elahla i-UDP ephumayo izokwamukela umhubhe we-TCP 443 futhi yenqabe owedwa we-UDP, ngakho imodi yokubuyela emuva ingeyekhasi lezimfuno. Ukushintsha umthwali akuhambisi ichweba lohlelo ngaphakathi komhubhe futhi akwandisi inqubomgomo yendawo; leyo ihlala emigqeni yayo.
Ukuhlukaniswa kufanele ukuhlolwa okukodwa ngenkathi ukhona, ngoba umhubhe oxhumayo bese uyagxadazela ekudlulisweni okukhulu ngokuvamile une-MTU engalungile hhayi ichweba elivaliwe:
ping -M do -s 1400 203.0.113.10 ping -M do -s 1372 203.0.113.10
Ku-Windows ukuhlolwa okufanayo yi-ping -f -l 1400 203.0.113.10. Setha i-MTU yomhubhe ngaphansi kwesilinganiso esikhulu esidlulayo, bese uphinda uhlole ukudluliswa okwehlulekile.
Qinisekisa imigqa emithathu ngaphambi kokukhokhela uhlelo
Beka imigqa emithathu ekhasini elilodwa futhi ugcwalise iseli ngayinye ngomphumela okaliwe esikhundleni sesithembiso. Le miyalo ikhiqiza ingxenye yasekhaya yalelo khasi cishe ngeminithi eyodwa:
ss -lntup | sort
nc -vz -w 3 203.0.113.10 443
python3 -m http.server 8080 --bind 0.0.0.0
curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080
ping -M do -s 1400 203.0.113.10
Funda okukhiphayo njengohlu lokuhlola. Ukuphuma kuyasebenza lapho indawo iphendula ngomhubhe uvuliwe. Ukungena kusebenza kuphela lapho isibungu esingaphandle konethiwekhi yakho sifinyelela umlaleli echwebeni langaphandle. Umthwali usebenza lapho ukuxhawula kwezandla kuqedwa kuphrothokholi evunyelwe inethiwekhi yakho yokufinyelela.
Imikhuba emibili igcina ikhasi lithembekile. Bhala usuku kanye nenguqulo yeklayenti eduze komphumela ngamunye, ngoba zihamba zombili izinqubomgomo zomnikezeli namavelu okuzenzakalelayo eklayenti. Bese ucela imephu encane kakhulu esebenzela ukugeleza, ngoba isicelo sokuvula konke ngokuvamile sithola ukunqatshwa noma ukudayiswa okwengeziwe esikhundleni sempendulo yezobuchwepheshe.