Okubonakalayo nokungabonakali kwe-firewall yenkampani ngaphakathi kwe-VPN

I-laptop efanayo ifinyelela i-VPN isuka ekhaya kodwa ayikwazi ukuxhumana isuka ehhovisi, ngakho othile kufanele ukuthi ufunda ithrafikhi. Ukuvimba nokufunda kungamandla ahlukene, futhi owesibili kuphela odinga indawo emzileni kanye nesitifiketi iklayenti elinethemba kuso. Ibhokisi eliphakathi elilahla ukuxhawula kwakho alifundanga lutho mayelana nalokho obekuzothumela. Ukunquma ukuthi yikuphi kwalokhu okubili obhekene nakho wumsebenzi wonke.

Ukuvimba nokufunda kungamandla ahlukene

Ukwenqatshwa kushibhile futhi kunomsindo: isokhethi iyavuleka futhi akukho okuphendulayo, noma i-reset ifika ngokushesha. Akukho kulokhu okusho ukuhlolwa, ngoba awekho umthwalo owawela ucingo.

Ukufunda kudinga iphoyinti lokugcina eliqeda ukuvikelwa, elizibonakalisa ngesitifiketi futhi liqale uxhumano olusha phambili. Lelo phoyinti kufanele libe semzileni futhi lithembeke kuklayenti. I-firewall egqithisa amaphakethe kuphela ayinayo indawo noma imvume.

Okunikezwa ngumbhoshongo mahhala

Iphakethe ngalinye lomhubhe linengaphandle, futhi ingaphandle kufanele likwazi ukuhamba. Lokho kusho amakheli amabili, iphrothokholi eyodwa, imbobo eyodwa nobude, kanye nesikhathi nomthamo. Noma iyiphi i-router isivele isebenza ngaleyo migqa, futhi i-NAT ibhala kabusha ikheli nembobo ukuze ithebula layo lokuhlela lihlale lilingana. Umthwalo uhlala uvaliwe, ngakho ukubheka kuyama eqinisweni lokuthi kunomhubhe phakathi kwamakhastha amabili.

Igama lekhastha alikho phakathi kwazo. Amasayithi ayavuza ngeminye iminyango, futhi okubanzi kakhulu i-DNS: uma i-laptop isabuza isixazululi sendawo, amagama avela obala.

Isikhathi nomthamo kufanele kuhlonishwe ngaphandle kokweqisa. Amabhayithi ngomzuzu angakhombisa ukuthi ukudluliswa okukhulu kuqala ngo-14:20; awakwazi ukukhombisa ukuthi iyiphi ifayela ehambile. Lokho kuwukwembulwa kwangempela mayelana nokuziphatha, futhi kuyisigaba esihlukile ekufundeni okuqukethwe.

Ukungena phakathi kwe-TLS kudinga impande osevele uyithemba

Idivayisi yokuhlola ayiphuli i-TLS; iyiqeda. Iklayenti liphendulwa ngesitifiketi esivela empandeni ephethwe inhlangano, futhi uxhumano lwesibili luya endaweni yangempela. Iklayenti liyakwamukela lokhu ngoba leyo mpande isesitolo salo sokuthemba, yingakho i-laptop elawulwayo ingabonisi saxwayi. I-cryptography ayikaze yehlulwe; iphoyinti lokugcina lasuswa.

Yingakho leli lungiselelo lishiya ubufakazi. Umkhiphi ochungechungeni olwethulwe ungowenhlangano hhayi owe-CA yomphakathi, futhi iklayenti lingakubona lokho ngaphandle kwamathuluzi akhethekile. Uchungechunge olugcina empandeni yangaphakathi wuphawu lokungena phakathi, hhayi ukwehluleka.

Kungani itshaneli ye-VPN kungeyona iseshini ye-HTTPS

Itheshaneli yedatha ye-VPN ayiniki umhloli isisekelo esinjalo. I-IKEv2 ne-WireGuard ziqhuba ukuxhawula kwazo kanye nezinhlelo zokhiye, ngaphandle kwe-TLS okufanele iqedwe, kuyilapho OpenVPN iboleka i-TLS yetshaneli yayo yokulawula ngendlela eshintshiwe ngaphambi kokuvikela idatha ngendlela yayo. I-proxy eyakhelwe i-HTTPS ayiboni leso seshini njengento engayihlaziya.

Idivayisi engakwazi ukuhlaziya iseshini isengayilahla. Yingakho ukuvinjwa kwe-VPN ngokuvamile kubonakala njengokuphelelwa isikhathi hhayi njengesixwayiso sesitifiketi, futhi yingakho ukukhetha okukhethekile kungashintshi lutho.

Hlola kumshini wakho

Qala ngocungechunge olwethulwa isayithi. Imininingwane yesayithi kusiphequluli ikhombisa umkhiphi, futhi umugqa womyalo ubika okufanayo ngaphandle kwesifinyezo:

openssl s_client -connect example.com:443 -servername example.com

Bese uhlukanisa ukuxhawula okwenqatshiwe kuthrafikhi yangaphakathi ehlungiwe ngababali. Bhala imbobo yokuthutha ngaphambi komthetho wokulahla futhi uwafunde ngemuva komzamo:

iptables -I OUTPUT 1 -p udp --dport 1194 -j LOG --log-prefix ovpn-out
iptables -vnL OUTPUT --line-numbers

Awukho umugqa welogi kusokhethi yangaphandle kusho ukuthi ukuxhawula akuzange kuphume, ngakho umzila wenqaba umhubhe. Ukuxhawula okuqediwe kanti izindawo ezimbalwa kuphela zehluleka kusho ukuthi umhubhe uyasebenza futhi inqubomgomo yangaphakathi ayisebenzi. Akukho mphumela owawudinga ukufunda ibhayithi elilodwa lomthwalo.

Ukufunda okwenzeka ngempela kusezinhlangothini: umhubhe ohlukanisiwe unikeza i-HTTPS yangaphakathi ku-proxy yenkampani, futhi isihlanganisi esiphethwe umqashi sembula konke ekuphumeni. Noma yini oyitholayo, ungacishi ukuqinisekiswa kwesitifiketi ukuze uphoqelele uxhumano, ngoba lokho kuhlola yikho kuphela okuhlukanisa ukuhlola kumhlaseli.