Iyuphi ikheli elifakwa ku-DNS yesiseva esixhunywe nge-VPN?
Iseva esingathiwe inamakheli amathathu futhi awashintsheki. Khetha inani elidingwa yisevisi ngayinye, bese uqinisekisa ngaphandle komshini.
Iseva esingathiwe ene-VPN efakiwe igcina amakheli amathathu ekugcineni, futhi yilinye kuphela lawo elihambisana nendawo ngayinye ozoqalisa ukuyilungisa. Ukukopisha inombolo kusukela kupanele yomhlinzeki kwi-DNS, kusilaleli noma kuhlu lwemvume yiyo indlela okuguqulwa ngayo umhubhe osebenzayo ube yisevisi okungekho muntu ongayifinyelela. Lo mhlahlandlela uhlela umsebenzi ukuze ikheli ngalinye likhethwe ngenhloso eshiwo. Futhi ubala imiyalo eqinisekisa lokho okukushicilele ngempela.
Dweba amakheli amathathu ngaphambi kokushicilela noma yini
Wanikeze amagama ngomsebenzi wawo. Ikheli le-underlay yilona elisetshenziswa umshini ukufinyelela isiphetho se-VPN nge-inthanethi, futhi ngokuvamile liyimfihlo ngemuva kwe-NAT yomhlinzeki. Ikheli lomhubhe lihlala ngaphakathi kwe-VPN, linikezwa yiseva noma yiklayenti kuye ngomkhiqizo. Ukuphuma komphakathi yikho ikheli eliqoshwa iwebhusayithi ekude ngemuva kokuhumusha, futhi akudingeki libe khona kunoma iyiphi i-interface ongayibuza.
Iphaneli ekhombisa ikheli elilodwa lomphakathi komshini ikutshela okuncane kakhulu ngeminye imisebenzi emibili. Ukufinyeleleka kwe-underlay kuyisidingo, hhayi ukuthenga: ikhompyutha ephathekayo ngemuva kwerutha yasekhaya ingafinyelela isiphetho se-VPN esingathiwe ngaphandle kokuba nekheli le-IPv4 lomphakathi. Ongenakukwenza ukuqamba indlela yokungena ngokubhala igama elixazuluka libe yikheli okungekho muntu olidluliselayo.
Khetha ikheli ngokwesisevisi, hhayi ngokwelebula
Bhala phansi ukuthi iseva kufanele yenzani ngaphambi kokukhetha inombolo. Izingcingo ze-API eziphumayo zidinga ukuphuma okuzinzile uma uhlangothi olunye lugcina uhlu lwemvume. Ukufinyelela okuyimfihlo kudinga ikheli lomhubhe amaklayenti angahamba kuwo kanye nesilaleli esiboshelwe kulo. Ukusingathwa komphakathi kudinga imephu yokungena umhlinzeki ayinikezayo ngempela, futhi ikheli lokuphuma lilodwa alinikezi lokho.
Umshini owodwa ungasebenzela zonke izinhloso ezintathu futhi usasebenzisa amakheli amathathu ahlukene. Okwephukayo yisicabango sokuthi inani elilodwa lihlanganisa wonke:
| Requirement | Value that belongs there | What you see when the roles are swapped |
|---|---|---|
| Outbound allowlisting | Public exit | Requests reach the service but are rejected |
| Private client access | Tunnel address | Client connects, nothing answers |
| Inbound web service | Provider mapping | Name resolves, connection times out |
Umugqa wokungena yiwona abantu abaphikisana ngawo. Umbhalo okhomba ekhelini lokuphuma awudali silaleli, imbobo yodonga lomlilo noma imephu yembobo, futhi ukulinda akukushintshi lokho. Uma umhlinzeki ethengisa ikheli elikhethekile kanye nomthetho wokungena, leyo nqwaba iyikhono olithengile; ikheli ngokwalo akulona ilungelo.
Imiyalo ekhombisa ukuthi yiliphi ikheli eliphi
Funda umshini, hhayi iphaneli. Amagama e-interface ahlukene phakathi kwezinhlelo, ngakho hlanganisa amakheli namadivayisi esikhundleni sokwethemba ilebula.
Umgqa wokuqala ubala wonke amakheli e-IPv4 kanye nedivayisi yawo, kanti owesibili ubuza umgogodla ukuthi iyiphi idivayisi engayisebenzisa endaweni eyaziwayo yangaphandle:
ip -brief -4 addr show
ip -4 route get 198.51.100.10
curl -4 -s https://ifconfig.me
ss -lntp | grep -E ':(443|1194)'Uma usesho lwendlela luphendula ngentsha yomhubhe wokuhamba komphakathi, umhubhe wakho ogcwele uyasebenza. Ukuhlolwa kwesilaleli kubalulekile ngokulingana, ngoba inqubo eboshelwe ku-127.0.0.1 kuphela ayisoze yaphendula ekhelini lomhubhe, noma yiliphi igama olilishicilelayo.
Lishicilele, bese uqinisekisa ngaphandle
Shicilela kuphela inani elidingwa yisevisi hhayi okunye: umbhalo we-A noma we-AAAA wokusingatha, okufakiwe kuhlu lwemvume lwezingcingo eziphumayo, iphrofayili yeklayenti yokufinyelela okuyimfihlo. Bese uhlola endaweni ebalulekile, futhi lokho akusoze kube umshini osanda kuwuhlela.
Ukuhlola okubili kuhlanganisa okuningi, futhi kokubili kushibhile ngokwanele ukuhlala kuskripthi:
dig +short vpn.example.net A
curl -4 -sS -o /dev/null -w '%{http_code}\n' https://vpn.example.net/healthImpendulo ye-DNS ekhombisa ukuthi umbhalo wakho ukhona akubona ubufakazi bokuthi isicelo siyafika, futhi isicelo esisodwa esiphumelelayo sikhombisa kuphela ukuthi indlela eyodwa isebenza isuka kunethiwekhi eyodwa. Phinda ukuhlola kusuka kuxhumano lweselula uma uhlu lwemvume lubandakanyekile, ngoba ukuphuma okubonayo kungase kuncike emndenini wamakheli kanye nendlela ethathiwe. Bhala ukuthi yimuphi umndeni oqinisekisile; indlela ye-IPv4 esebenzayo ayisho lutho nge-IPv6.
Uma isevisi ingeyokungena, ikheli lokuphuma alanele
Ukufinyelela kokungena kudinga izinto ezine ezihambisanayo: igama noma ikheli iklayenti elingafinyelela kulo, indlela eletha iphakethe emshinini, isilaleli esilamukelayo, kanye nenqubomgomo engalilahli. I-VPN ishintsha into yesibili futhi ngezinye izikhathi eyokuqala, futhi ayenzi lutho entweni yesithathu neyesine. Uma umhubhe uyindlela yokuletha, amaklayenti axhuma ekhelini lomhubhe, hhayi ekuphumeni.
Bhala ukuthi iyiphi isevisi encike kweliphi ikheli, bese ubuyekeza leso sinoti ngaso sonke isikhathi uma umhlinzeki eshintsha imodeli yakhe yokuhamba. Iseva ephendula ngasese futhi ehluleka esidlangalaleni ngokuvamile ayiphukile; iphendula ngobunikazi obungalungile, futhi ukulungisa kuyisinqumo semephu hhayi ushintsho lodonga lomlilo.