Iphothi ye-VPN ithule? Isilaleli, ikheli lokubopha noma i-firewall yomsingathi

I-VPN ayiphenduli lutho ephothini yayo, futhi izimbangela ezimbili ezingaba khona zidinga ukulungiswa okuphambene: kungenzeka akukho nqubo evule i-socket, noma i-socket ikhona futhi kukhona okuthile phakathi kwemishini okumisa amaphakethe. Umyalo owodwa unquma ingxenye yokuqala yalo mbuzo, yingakho uza ngaphambi kwanoma yisiphi isimiso se-firewall. Ukulandelana okungezansi kususa incazelo eyodwa ngesinyathelo esisodwa esikhundleni sokwengeza omunye umqondo. Ukuqagela phakathi kwalokhu kokubili yikho okuguqula ukuxilongwa kwemizuzu eyishumi kube ubusuku bonke.

Cabanga ukuthi ungangena kuseva nokuthi iklayenti iphrofayela yangempela hhayi isihloli. Zombili izimo zibalulekile, ngoba ukuhlola okujwayelekile akukwazi ukuphendula umbuzo oqondene neprotocol.

Ingabe i-socket ikhona nhlobo

Qala ngakho okushiwo yisevisi ngayo: ukuthi yavuka yini futhi, okusiza kakhulu, kwakuyini iphutha layo lokuqala lokusuka. Ukwehluleka kokuhlaziya, ukhiye ongekho noma iphutha lokubopha kuvimbela isilaleli ukuba sibe khona, futhi inqubo ingaphuma ithule kangangokuthi umugqa wesimo ufundeka ngendlela engacacile. Iyunithi ebika ukuthi iyasebenza ayisona ubufakazi ngokwayo, ngoba inqubo enkulu ingase ibe nokuphila ngenkathi ingxenye obekufanele ibophe iphothi isivele ishiyile.

systemctl status openvpn-server@server --no-pager
journalctl -u openvpn-server@server -n 30 --no-pager
ss -lunp

Uhlu lwama-socket yiqiniso okuncike kulo ukuxilongwa okusele. Funda ikholomu yekheli lasendaweni hhayi iphothi kuphela, ngoba kuleyo kholomu yilapho kubonakala khona ukubopha kwe-loopback nokubopha kungxenye engalungile. Isilaleli esikhona ku-127.0.0.1 sisebenza ngokuphelele futhi asibonakali kukhompyutha yakho ephathwayo.

I-socket iphendula kuluphi ikheli nakuphi umkhakha

Amaphutha amabili abukeka efana kusukela kuklayenti futhi achaza iningi lemibiko ethi "akufinyeleleki". Iseva eboshelwe ekhelini le-loopback ayikaze yamukele ithrafikhi evela komunye umshini, futhi iseva eboshelwe kuphela ekhelini le-IPv4 ayikaze iphendule iklayenti ecisha ikheli le-IPv6 lomsingathi ofanayo. Qhathanisa ikheli elisetafuleni lama-socket nekheli iklayenti elicisha ngempela, ngohlamvu ngohlamvu, ngaphambi kokucabanga noma yini ngenqubomgomo.

Ukukhawulela uhlu ephothini eyodwa kulusiza lihlale lifundeka lapho umsingathi eqhuba izinsizakalo eziningi. Isihlungi se-sport sithatha iphothi kanye nokuthutha ocwaninga ngakho:

ss -lun 'sport = :51820'
ss -ltnp 'sport = :1194'

Ikholomu yeprotocol ishintsha yonke impendulo

Itafula lama-socket likhomba ngeprotocol kanye nangephothi, futhi lezi zinto ezimbili ezizimele. Isevisi ephendula nge-TCP ku-1194 ayisho lutho mayelana nokuthi kukhona okulalelayo ku-UDP 1194, futhi iklayenti lizosebenzisa eyodwa yazo kuphela. Qinisekisa ukuthi isakhiwo seseva sikhetha okuphi ukuthutha nokuthi iphrofayela yeklayenti ithumela okuphi, bese ufuna lowo mugqa ngqo.

I-UDP inesinye isigwegwe: ukuhlola okungagunyaziwe akulona iphutha okufanele isevisi iphendule kulo. Ukuhlola okubika ukuthi iphothi ithule kukala ukuzibamba kwesevisi, hhayi ukutholakala kwayo, ngakho hlola neklayenti nephrofayela yangempela.

Umzamo owodwa, izindawo ezintathu zokubheka

Kusukela kuklayenti eligunyaziwe yenza umzamo owodwa ngqo futhi ubhale isikhathi kuze kufike kumzuzwana. Bese ufunda imithombo emithathu yaleso sikhathi: umthetho wenethiwekhi noma ikhonsoli yomhlinzeki, izinto zokubala noma i-log ye-firewall yomsingathi, kanye ne-log yesevisi uqobo. Ukukwenza kanye kuphela okwenza izindaba ezintathu ziqhathaniseke, futhi kushibhe ukwedlula ukuphinda umzamo okungekho muntu obhale uphawu lwaso lwesikhathi.

Imiphumela emibili ikhomba ezinhlangothini eziphambene. Uma kungekho phakethe elafika kumsingathi, indlela iyalilahla futhi isilaleli asinamsebenzi. Uma iphakethe lafika ku-socket futhi isevisi yalinqaba, indlela ilungile futhi impendulo iseprotocol, kucryptography noma emininingwaneni yokungena. Ukuvula iphothi kusevisi esivele yamukele ukuxhumana kwenza ukuxilongwa okulandelayo kube nzima, hhayi lula.

Qamba igxathu ngaphambi kokushintsha umthetho

Izingxoxo eziqalayo nokuqinisekisa okwehlulayo kuwukwehluleka okukodwa, kanti ithaneli elakheka ngenkathi ukudlulisela kumile kuwukwehluleka okuhluke ngokuphelele. Ukuqamba igxathu kuqala kugcina ukulungiswa kuncane: inkinga yemininingwane yokungena ayilungiswa umthetho we-firewall, futhi inkinga yendlela yedatha ayilungiswa ukuqalisa kabusha.

Sebenzisa ukuxilongwa okuncane kakhulu okuphendula umbuzo. Ukubuka amaphakethe kwesikhashana ephothini eyodwa, ngaphansi kokulawula komqondisi, kuyithuluzi elifanele; ukuvala yonke i-firewall akusilo, ngoba umphumela awusakwazi ukunxiswa kwabanye. Imibhalo ye-ss ihlanganisa izihlungi ezisetshenziswe ngenhla, futhi kuyisinyathelo sokuqala esishibhe kunanoma yikuphi ukubamba. Bhala ukuthi yiluphi ugatsha kwezimbili olufakazele, futhi isigameko esilandelayo sizoqala ngempendulo eyaziwayo.