Iyini ithumbu le-VPN, futhi ukuvikelwa kuphela kuphi
Ithumbu libeka umkhwama wesibili kumaphakethe akhethiwe phezu kwesixhumanisi owawunaso kakade. Landela isicelo esisodwa futhi ubone ukuthi iyiphi ikheli isayithi eliyiqopha ngempela.
Iklayenti lithi lixhunyiwe, ingidi ivaliwe, futhi isayithi isaqopha ikheli lefulethi lakho. Akukho okwehlulekile. Ithumbu alishintshi i-Wi-Fi noma isixhumanisi sakho seselula; libeka umkhwama wesibili kumaphakethe athile futhi lithumele lowo mkhwama ngomrete wamanje owawunayo kakade. Ukuqonda iqhinga ikakhulukazi ukulandela isicelo esisodwa nokuqaphela lapho umkhwama uvulwa khona, ngoba cishe zonke izimpawu ezididayo, kusukela ekheli lasekhaya eliphumayo kuya ekulondolozweni kwe-download enkulu, zivela kulo mkhawulo.
Imikhwama emibili, isixhumanisi esisodwa somzimba
I-laptop yakho igcina isixhumanisi sayo esijwayelekile kwi-router, futhi i-router igcina isixhumanisi sayo esijwayelekile kumhlinzeki. Akukho okushintshayo kuleyo ndlela lapho ithumbu likhula. Okushintshayo ukuthi amaphakethe akhethiwe anikezwa i-interface ebonakalayo, asongwe ngaphakathi kwephakethe elisha elibhekiswe kumlingani we-VPN, futhi athunyelwe njengokuhamba okujwayelekile ngaphezu kwesixhumanisi somzimba.
Umkhawulo wokwamukela i-divayisi evula umkhwama futhi idlulisele iphakethe lokuqala ngasendaweni yalo. Phakathi kwemikhawulo emibili, umbukeli ubona isihloko sangaphandle futhi akaboni lutho mayelana nangaphakathi, ngaphandle uma iphrothokholi iyifihla, okuyinto ama-iphrothokholi amaningi abasebenzisi abayenzayo futhi ubuchwepheshe obujwayelekile abukudingi.
Yingakho i-interface ebonakalayo ikhona futhi iyakhohlisa ngesikhathi esisodwa. Ikhona njengento ye-kernel enekheli neyunithi ephezulu yokudlulisa, futhi uhlelo lokusebenza luqondisa ukuhamba phakathi kwayo njenganoma iyiphi enye i-interface. Akulona intambo, futhi ukuba khona kwayo kufakazela kuphela ukuthi ingxenye itholiwe. Ukuthi isiphequluli sakho siyisebenzisa yini kunqunywa imizila, hhayi ukuthi i-interface ivuliwe.
Buka isicelo esisodwa senza uhambo
Khetha indawo oya kuyo futhi ubuze i-kernel ukuthi iyiphi i-interface ezoyisebenzisa. Lomyalo owodwa unquma izingxabano eziningi mayelana nokuthi ithumbu lenza okuthile yini:
ip route get 203.0.113.7
ip -brief addr show
ip -4 addr show dev wg0Uma umphumela womzila usho i-interface yethumbu, iphakethe lizosongwa. Uma usho i-interface yomzimba, ngeke lisongwe, futhi ukuqala kabusha ikliyenti noma kangaki akukushintshi lokho. Umyalo wesibili ukhombisa zombili i-interface eceleni komunye, futhi yileyo ndlela oqaphela ngayo ithumbu elakheka ngaphandle kwekheli noma ngekheli lomndeni ongafanele.
Bese ubheka ukugxuma kokuqala ngaphakathi komkhwama, futhi ukuqhathanise nokugxuma kokuqala kwangaphandle:
traceroute -n -m 3 203.0.113.7
sudo tcpdump -ni wg0 -c 5Ngaphakathi kwethumbu ukugxuma kokuqala ikheli langaphakathi lomlingani, hhayi i-router yakho. Ukuthwebula kwi-interface yethumbu kukhombisa amaphakethe angaphakathi, yilokho ukuhamba okucatshangwa uhlelo lokusebenza ukuthi kuyakuthumela. Ukuthwebula ngesikhathi esifanayo kwi-interface yomzimba kukhombisa amaphakethe angaphandle, futhi kokubili ndawonye kuwubufakazi obucace kakhulu bokuthi ithumbu lenzani ngempela.
Amakheli amathathu, futhi isayithi ibona elilodwa kuphela
Abantu bayawadida njalo la, futhi ukudideka kukhiqiza imibiko yokuvuza engamanga. Lawa amasimu ahlukene ezinhlokweni ezihlukene aneminyaka yokuphila ehlukene.
| Address | Where it appears | Who can see it |
|---|---|---|
| Endpoint address | Outer header, the peer you connect to | Your access network and the path to it |
| Inner tunnel address | Inside the envelope, on the virtual interface | The peer, and anything the peer routes to |
| Exit address | Source of the packet that reaches the website | The website and its upstream |
Inombolo eseceleni kwesijikelezi esibonakalayo iwumugqa wesibili. Akulona ikheli eliqoshwa yisayithi, futhi ukulisho njenge-IP yakho yomphakathi kumane nje kuyiphutha. Ikheli elibonwa isayithi linikezwa ukuphuma, futhi ethumbini lenethiwekhi yangasese kungenzeka kungabi nakho ukuphuma komphakathi nhlobo, ngoba indawo yokugcina ingaphakathi kwenhlangano hhayi ku-inthanethi.
Ithumbu phakathi kwamasayithi iwuhlelo olufanayo olunamaphuzu okugcina ahlukene. Amarowutha amabili asonga ukuhamba phakathi kwamanethiwekhi, futhi akukho divayisi eyodwa enekliyenti efakiwe. Umkhwama uyafana ngomgomo, umngcele wokuphatha awufani.
Lapho umkhwama uvulwa khona, nokuthi yini esindayo
Ithumbu liphela kumlingani walo. Uma ukubethela kohlelo lokusebenza ngokwako kufinyelela kude, kuyasinda kulo mngcele, okuyisimo esijwayelekile ku-HTTPS: isikhathi sesiphequluli siphela kusayithi, ngakho ukuphuma kudlulisa umbhalo obethelwe ongakwazi ukuwufunda.
Akukho okunye okusindayo ngokuzenzakalela. Isicelo esingabethelwe siyafundeka lapho kuphuma khona njengoba besifundeka ku-Wi-Fi yekhefi, futhi ithumbu alifaki ukuvikelwa uhlelo lokusebenza olungakaze lube nakho. Ngokufanayo, imithetho yodonga lomlilo nenqubomgomo yokudlulisa yokuphuma inquma okuzolandela; ukuxhawulana okuphumelelayo kuyiqiniso mayelana nokuxhumana nomlingani, hhayi mayelana nohambo olusele.
Ukweqile kungomunye umphumela obonakalayo. Iphakethe ngalinye lithwala isihloko esengeziwe, futhi ukuthutha kwangaphandle kungangeza okwakho, ngakho umthwalo owusizo ngephakethe ngayinye uyancipha. Emzileni oneyunithi ephezulu yokudlulisa engaguquki, yikho kanye okwenza ithumbu lidlule i-ping futhi limise ukulayisha okukhulu.
Hlola umzila uhlelo lokusebenza oluhamba ngempela
Isinyathelo sokugcina ukuqinisekisa uhlelo lokusebenza oluthile, hhayi umshini jikelele. Xazulula indawo oya kuyo, bheka umzila walelo kheli, bese ubuka ukuxhumana ngenkathi kuvuliwe:
getent hosts example.com
ip route get "$(getent hosts example.com | awk '{print $1; exit}')"
ss -tnp state established '( dport = :443 )'Uma umzila usho ithumbu kodwa uhlu lwamasokhethi lukhombisa ukuxhumana nekheli lomthombo elivela ku-interface yomzimba, uhlelo lokusebenza luboshelwe kokuthile okuthile, noma elinye ithumbu lincintisana ngomzila ozenzakalelayo. Lona umbuzo wokuhlela imizila, futhi ungaphendulwa kusukela kule miphumela emithathu hhayi kusikrini sesimo sekliyenti.
Isakhiwo sokuphepha se-RFC 4301 sichaza inguqulo yezinga le-IP yalokhu kusonga kwe-IPsec, futhi umqondo ofanayo wezinga uyasebenza ku-WireGuard kanye ne-OpenVPN. Uma usukwazi ukukhomba iphakethe langaphakathi nephakethe langaphandle njengezinto ezihlukene, ukuziphatha kwethumbu okuningi kuyeka ukuba yimfihlakalo futhi kuba ithebula lemizila ongayifunda.