Iyiphi ikheli lomthombo i-NGINX ezoyibhala kumklami we-VPN?

Nquma ukuthi i-NGINX ibona ini eduze kwe-OpenVPN kusibungu esisodwa: ikheli langaphakathi lomhubhe, ikheli lokuphuma lomphakathi noma i-peer edlulisiwe, kuye ngomzila othathiwe.

Amakheli amathathu amaklayenti avela ekuhlelweni kwe-NGINX ne-OpenVPN kusibungu esifanayo, elilodwa lomzila ngamunye isicelo esingawuthatha. Isiphequluli esifinyelela ikheli lomhubhe, isiphequluli esifinyelela ikheli lomphakathi kanye nohlelo oluphuma ngomzila we-inthanethi wesango konke kubonakala kuhlukile kusokhethi elalelayo. Nquma ukuthi uwubheka muphi umzila ngaphambi kokuhumusha umugqa wencwadi yokubhalisa. Isinqumo sincike endaweni umklami ayisebenzisile, ekuhlukeni akwenzayo ngokwephuzu le-VPN langaphandle, nasekutheni ngabe kukhona okuhumusha iphakethe endleleni.

Nquma ngedawo okuyiwe kulo, hhayi ngokuthi ungubani umsebenzisi

Qala ngekheli isicelo esithunyelwe kulo, ngoba yilolo kheli elikhetha umzila. Isicelo esiya ekhelini lomhubhe wesibungu sifika kusixhumanisi somhubhe ngokuba ikheli langaphakathi lomklami libe umthombo. Isicelo esiya ekhelini lomphakathi wesibungu ngokuvamile sifika kusixhumanisi esibheke ku-inthanethi nelikheli lomphakathi lomklami, ngisho nalapho ikhompyutha ephathekayo efanayo inomhubhe omisiwe ngaleso sikhathi. Ngakho-ke ukuba yilungu leqoqo le-VPN kuyisici somzila wephakethe, akusiso isici esilandela umsebenzisi.

Path the request tookSource the site normally records
Client reaches the site at its tunnel address, 10.24.0.1Client inner address, 10.24.0.20
Client reaches another internet site through the gatewayGateway public egress address, 192.0.2.44
Client reaches the gateway's public address through the endpoint exceptionClient's own public access address

Yilo mugqa wesithathu okufanele uhlolwe kuqala lapho umsebenzisi we-VPN evela encwadini yokubhalisa nekheli elingahlangene ngalutho nomhubhe. Kubuye kuchaze ukuthi kungani abasebenzisi ababili bephrofayela efanayo bangakhiqiza okubhaliwe okuhlukile: amanethiwekhi abo okungena ahlukile, futhi akukho lutho emhubheni olubhala phezu kwalokho.

Kungani iphuzu langaphandle lidala umzila wesibili womphakathi

Umklami kumele afinyelele ikheli lomphakathi lesango ukuze amise umhubhe, ngakho umzila oya kulelo kheli kumele ube khona ngaphandle komhubhe. Lapho umklami eqondisa konke ukuhamba kwedatha ngaphakathi, ukusetshenziswa okunengqondo kugcina umzila wesibungu ocacile oya ekhelini lomphakathi leseva ukuze kugwenywe umhubhe oncike kuwo uqobo. Lokho kuhluka akukhethi ngezinsizakalo, ngakho noma isiphi isicelo esiya kulelo kheli lomphakathi liyayilandela, kuhlanganise nesicelo sesiphequluli esiya kusizindalwazi esibungazwe esangweni.

Lona umshini ongemuva kwemibiko edidayo eminingi kulesi sifunda, futhi uncike ekusetshenzisweni komklami hhayi kweseva. Ngakho abaklami ababili abanophrofayela ofanayo bangaziphatha ngendlela ehlukile. Ukususa lokho kuhluka ukuze »kulungiswe« incwadi yokubhalisa kuwisa nomhubhe kanye nayo, ngakho gcina kona futhi uklame uzungeze kona.

Funda isokhethi, ithebula kanye nefomethi yencwadi yokubhalisa ndawonye

Ukuqaphela okuthathu kunquma ukuthi uwubheka muphi umzila: lapho isokhethi ilalela khona, yisiphi isixhumanisi esiphendula indawo okuyiwe kuyo, nokuthi yini efomethi yencwadi yokubhalisa eyibhala ngempela. Uma umlaleli eboshelwe ekhelini lomhubhe kuphela, isicelo somphakathi asikwazi ukusifinyelela nhlobo, okukhipha imigqa emibili ngokushesha. Uma ukusesha komklami kubuyisela idivayisi yomhubhe, isicelo safika sinomthombo wangaphakathi futhi incwadi yokubhalisa kufanele ikubonise lokho.

ss -lntp 'sport = :443'
ip route get 10.24.0.20
ip route get 192.0.2.44

Bese ufunda ifomethi hhayi umugqa. Inkambu ephekwa isihloko esidlulisiwe ibhala isimangalo, hhayi i-peer yesokhethi, futhi isimangalo sibalulekile kuphela lapho i-peer eseduze iwummeleli othembekile. Ukubhala womabili amanani encwadini yokubhalisa kuqeda izingxabano zakamuva, ngoba i-peer eseduze nekheli elishintshiwe kungamaqiniso ahlukile futhi yinye kuphela yawo eyavela kunethiwekhi.

log_format tunneled '$remote_addr $realip_remote_addr $request $status';
grep -n 'log_format' /etc/nginx/nginx.conf

Khetha iphuzu lokungena olifunayo bese wenza i-DNS ivumelane

Uma isizindalwazi kufanele sibe ngomhubhe kuphela, sinikeze igama elixazululeka ekhelini lomhubhe kubaklami be-VPN bese uphoqelela inqubomgomo kusokhethi elalelayo. Impendulo ye-DNS ehlukanisiwe ebuyisela i-10.24.0.1 egameni langaphakathi iyisinqumo somzila esigqoke izingubo zemininingwane yokuxazulula amagama. Uma isizindalwazi kufanele futhi sibe somphakathi, gcina amagama amabili noma izimbobo ezimbili bese uvumela incwadi yokubhalisa ikutshele ukuthi yikuphi okwakhonza isicelo.

Imithetho yokuvumela ilandela umqondo ofanayo. Ukuvumela iqoqo lomhubhe akugunyazi isicelo somphakathi, futhi ngeke kugcwalise ikheli langaphakathi kuxhumano olwafika nge-inthanethi. Ukuhlanganisa zombili izindawo zokungena ngaphansi kwegama elilodwa kwenza umthombo obhaliwe ube umphumela oseceleni womzila womklami esikhundleni sokukhetha kokuklama.

Qinisekisa umzila, bese kuba yinqubomgomo

Qinisekisa umzila ngokuthwebula esangweni kanye nesicelo osilawulayo. Ukuthwebula kudivayisi yomhubhe nokunye kusixhumanisi somphakathi kukhombisa ukuthi yikuphi okwathwala amabhayithi, futhi ukulandelana kwamaphakethe kukutshela ukuthi ngabe kwenzeka ukuhumusha phakathi kwawo.

tcpdump -ni tun0 port 443 -c 5
tcpdump -ni eth0 port 443 -c 5

Bese uqinisekisa ukufinyelela kuzinhlangothi zombili: iphuzu lokungena elinegama elihlosiwe liyasebenza kumklami ohlosiwe, futhi umzila womphakathi ongagunyaziwe wenqatshwa esikhundleni sokuthi ube nje yinde. Isizindalwazi esijwayelekile se-IP-echo sifakazela okuthile ngokuphuma kwesango ku-inthanethi futhi akufakazeli lutho ngalesi sizindalwazi kusibungu esifanayo. Lapho ikhasi ne-WebSocket bengavumelani, qhathanisa ama-URL abo, imindeni yamakheli kanye nezimpendulo ze-DNS ngaphambi kokuthinta ukuhlelwa kweseva.

Izihloko ezihlobene