Lapho ubuka khona ithrafikhi yeklayenti ye-OpenVPN esangweni

Ufuna ukwazi ukuthi iyiphi imikhamo ekufinyelela kuyo iklayenti elixhunyiwe, ngakho uvula i-shell kuseva ye-VPN bese uthayipha ss. Akukho lutho olusizayo olubonakalayo, futhi isiphetho sokuthi umhubhe uphukile siza kalula kakhulu. Isango le-OpenVPN elihambisa ngezindlela lidlulisa amaphakethe eklayenti; aliqedi ukuxhumana kwabo kwe-TCP futhi alinamasokhethi abo. Ubufakazi buhlala kwenye indawo, futhi ukuthi kuphi kuncike ekutheni ithrafikhi iphathwa kanjani uma isiphumile emhubheni.

Nquma ukuthi ubuka luphi uhlelo

Izinhlobo ezimbili ezivamile zinikeza ubufakazi obuhluke ngokuphelele. Isango elihambisa ngezindlela liyakhipha ukugqunywa, lidlulise futhi mhlawumbe lenze i-NAT yomthombo, ngakho ukuxhumana kweklayenti kuqhubeka kukhona kusuka ekugcineni kuya ekugcineni ngaphandle kwesokhethi lendawo.

I-proxy iqeda ithrafikhi: yamukela ukuxhumana, bese ivula ukuxhumana kwayo okuphezulu. Kulolo hlelo kukhona ukuxhumana okubili kwesicelo esisodwa, futhi ukuhlobana phakathi kwako kukhona kuphela emarekhodini e-proxy ngokwayo. Ukwazi ukuthi yikuphi kulokhu okubili osikuthumile kunquma ukuthi kufanele ufunde isimo sokugeleza se-kernel noma amalogi ohlelo.

Iningi lokudideka livela ekuqageleni. Qinisekisa uhlobo ngaphambi kokukhetha ithuluzi. Qala ngokufunda ukulungiselelwa kweseva ukuthola umyalo we-proxy, ngoba ukuba khona kwawo kushintsha sonke isinyathelo esilandelayo. Ngaphandle kwawo indlela yamaphakethe iwukuhambisa ngezindlela, futhi isimo sokugeleza se-kernel siwubufakazi bakho.

Qala ngokuxhumanisa ikheli neseseshini

Qala esimweni samaseshini eseva bese uhlonza ikheli langaphakathi lamanje leklayenti. Amakheli echibi asetshenziswa kabusha, ngakho ikheli lodwa liwukuqashwa, akusiyena umuntu.

Qopha isikhathi kanye nobuwena obuqinisekisiwe ndawonye, futhi uqaphele ukuthi ingabe i-LAN yonke icashile ngemuva kwaleyo klayenti. Uma uhlangothi olukude luhambisa ngezindlela isubneti, amakheli angaphakathi owabonayo angaba ngamahost okuqala noma ahunyushiwe.

ip -4 addr show dev tun0
journalctl -u [email protected] --since '-10 min' | tail -n 40

Lolo mbhangqwana uphendula imibuzo emibili ngasikhathi sinye: iyiphi i-prefix esetshenziswa isixhumi somhubhe, futhi iyiphi iseshini eyayisebenza phakathi nesikhathi osikhathazayo. Yenza lokhu ngaphambi kokuhumusha noma yikuphi ukufakwa kokugeleza, ngoba i-tuple ekholelekayo exhunywe eseshini engalungile imbi kakhulu kunokungabi nabufakazi nhlobo.

Funda ithebula lokugeleza esangweni elihambisa ngezindlela

Uma ikheli nesikhathi sekutholakele, uhlu lokufunda kuphela lokuxhumana okulandelelwayo lubonisa ukuthi isango lidlulisela ini kulo. Hlunga ngomthombo wokuqala ukuze ungafundi lonke ithebula.

sudo conntrack -L -p tcp -f ipv4 --orig-src 10.8.0.37

Ukufakwa ngakunye kuphethe ama-tuple amabili, okuqala nempendulo, okuyizindlela ezimbili zokugeleza okukodwa hhayi izinhlelo ezimbili. Emkhondweni we-NAT yomthombo i-tuple yokuqala igcina ikheli lomhubhe kuyilapho uhlangothi lwempendulo lukhombisa ikheli lesango elihunyushiwe, futhi yikho kanye okwenza umphumela ubonakale ungalungile ekuqaleni.

Thatha uhlu njengesimo esiphilayo hhayi umlando. Ukugeleza okufushane kungenzeka sekuphelelwe yisikhathi, ithrafikhi engalandelelwanga ayivelanga nakanye, futhi indawo yamagama yenethiwekhi ehlukile ikhombisa ithebula elihlukile. Incwadi yereferensi ye-conntrack ichaza izihlungi kanye nomphumela wezinhlangothi ezimbili.

Ukubanjwa okukodwa okulinganiselwe kokuqinisekisa ukufunda

Uma isixhumi somhubhe sibonakala lapho ubuka khona, ukubanjwa okukodwa okulinganiselwe kunquma ukuthi amaphakethe owasihlonza yiwo yini asentanjeni. Gcina isihlungi sincane nomkhawulo wamaphakethe mncane.

sudo tcpdump -ni tun0 -nn -c 50 'host 10.8.0.37 and tcp'

Qhathanisa izigxivizo zesikhathi, iphrothokholi namachweba nokufakwa kokugeleza kanye nesicelo osenze njengesivivinyo. Ukubanjwa okuthathwe ngemuva kwe-NAT kukhombisa kuphela ikheli lomphakathi lesango, kuyilapho uhlangothi lomhubhe lungase lukhombise elaklayenti, futhi lowo mehluko uwulwazi hhayi ukungqubuzana.

Uma isixhumi singaboni lutho, hlola indlela yedatha ngaphambi kokuphetha ngokuthi iklayenti alisebenzi: ithrafikhi yeklayenti-kuya-kwelinye kanye neminye imikhondo yokwehlisa ayidluli lapho ubuka khona.

Amalogi e-proxy, kanye nemikhawulo yalokho okubonile

Uma i-proxy isemkhondweni, amasokhethi ayo aphezulu abonakala kuthebula lamasokhethi kodwa awahlangani ngakunye namaklayenti e-VPN, ikakhulukazi ngokuqoqa noma ngokuphindaphinda. Sebenzisa ilogi yemisebenzi elungiselelwe ye-proxy ukuhlobanisa ubuwena beklayenti, indawo, isigxivizo sesikhathi kanye nanoma yisiphi isihlonzi sesicelo esisibhalayo.

Hlola ukulungiselelwa kokuloga kohlelo olufakiwe esikhundleni sokucabanga ukuthi sonke isicelo silogwa ngokuzenzakalela.

Ekugcineni, yiba nembe kakhulu mayelana nobubanzi. Ikheli lendawo nembobo kuyimethadatha, akusiyo i-URL futhi akusiyo okuqukethwe kwekhasi, ngoba iseshini ye-HTTPS yangaphakathi igcina ukuvikelwa kwayo kungakhathaliseki umhubhe. Bika okubonelayo, kusuka kuyiphi indawo yokubuka, futhi ngesiphi isikhathi.