OpenVPN ne-HTTPS embobeni 443: umlaleli ungokabani?
I-TCP ne-UDP 443 zingamasokhethi ahlukene. Ukwabelana ngomlaleli owodwa we-TCP kudinga umnikazi, futhi ukwabelana ngembobo ye-OpenVPN kuyisivumelwano esincane, hhayi iqhinga le-proxy.
Amasevisi amabili angaphendula womabili embobeni 443 ngaphandle kokuncintisana, ngoba umlaleli unqunywa ukuthuthwa, ikheli kanye nembobo ndawonye, hhayi ngenombolo kuphela. Beka iseva yewebhu ne-OpenVPN kumshini owodwa, futhi umbuzo owodwa ofanele ukuphendulwa kuqala ukuthi yisiphi isokhethi inqubo ngayinye eyicela kuyo inkaba. Bhala lolo hlu ngaphambi kokuhlela ukucushwa, futhi iningi lamaphutha «ikheli selisetshenziswa» lizozichaza wona. Konke ngemuva kohlu ukukhetha phakathi komlaleli we-UDP, isokhethi le-TCP elabiwe, noma ingxenye yangaphambili eqondisa ngephrothokholi.
Qala ngesokhethi inqubo ngayinye eyicelayo
I-bind iphumelela noma yehluleka kuleso sithathu, ngakho amademoni amabili ashayisana kuphela lapho izingxenye zontathu zihlangana khona. Yingakho iwebhusayithi ku-TCP 443 ihlala kanye nomlaleli we-OpenVPN ku-UDP 443 ngokungapheli, futhi yingakho ukuhambisa okunye kwazo kwikheli lesibili lendawo kumhosti ofanayo nakho kuqeda ingxabano. Funda abalaleli abaphilayo, hhayi amafayela okwakufanele bawadale, ngoba i-include endala noma ifayela le-unit elikhohliwe liphila isikhathi eside kunokuhlela okukhumbulayo.
| Line in the listener list | What it establishes | What to do next |
|---|---|---|
| One udp row and one tcp row, each on 443 | Separate transport sockets, nothing contested | Point the VPN profile at udp and stop editing |
| A single tcp address and port listed by two processes | A real bind collision between two daemons | Move one service, or put a dispatcher in front of both |
| A proxy process owns the socket, no vpn process | The proxy accepts and has to hand off correctly | Check that its backend speaks the protocol it forwards |
Gijima nge-ss -lntup njenge-root bese ufunda wonke umugqa okhuluma ngo-443, kuhlanganise nokufakwa kwe-IPv6. Ngokuvamile umlaleli we-v6 we-wildcard wamukela nokuthuthwa kwe-v4, futhi yileyo ndlela umlaleli oyikhohliwe eqhubeka nokubamba imbobo ngemuva kokushintsha ifayela obucabanga ukuthi liyimbangela. Uma igama lenqubo likumangaza, nciphisa okukhishiwe nge-ss -lntup 'sport = :443' ngaphambi kokuthinta noma yini.
Shintshela ithumbu ku-UDP lapho inethiwekhi ivuma
Umlaleli we-UDP ugwema ukungqubuzana ngokuphelele futhi ngokuvamile uyisixazululo esifushane kakhulu, ngoba asikho isokhethi elabiwe futhi akukho umkhiqizo owengeziwe ongena endleleni. Kodwa akumahhala. Amanye amanethiwekhi amakhasimende alahla i-UDP 443 ngaphandle kokuthumela i-reset, ngakho ithumbu liyeka ukusungulwa esikhundleni sokuhluleka ku-bind, futhi umsebenzisi ubika ukuthi i-VPN ivaliwe ngaphandle kwephutha lokulifunda. Umlaleli we-UDP futhi uyasinda ekusungulweni kabusha kwengqimba yewebhu, okubalulekile emshinini owethulwa kabusha kaningi. Hlola kusuka kunethiwekhi lapho abasebenzisi bakhona, ngoba i-shell kuseva ibonisa kuphela ukuthi iseva iyafinyelela kuyo ngokwayo.
Shintsha ukuthuthwa kukho kokubili ukucushwa kweseva nephrofayili yeklayenti ngasikhathi sinye. Iphrofayili esacela i-TCP izojikeleza emijikelezweni yokuxhuma kabusha ibheke kumlaleli we-UDP kuphela, futhi lokho kubonakala njengokonakala kwenethiwekhi kuze kube uqhathanisa amafayela amabili.
Vumela inqubo ye-VPN ukuba ibe ngumnikazi we-TCP 443 bese udlulisela okunye
I-Community OpenVPN kumodi yeseva ye-TCP ifunda amabhayithi okuqala okuxhumana okungenayo bese idlulisela noma yini engeyona iphrothokholi yayo ku-backend ye-HTTPS, futhi i-port-share iyilokho okwenzelwe. I-backend iyiseva yewebhu evamile ene-TLS evuliwe, eqanjwa ngehosti nangembobo kuleyo directive, hhayi nge-URL.
port-share 10.0.0.5 8080
Emshinini lapho iwebhusayithi inekheli lesibili eliyimfihlo, lowo mugqa uthumela ukuthuthwa okungeyona i-VPN ku-10.0.0.5:8080, ngakho ihosti yengqondo ye-HTTPS kufanele iboshelwe lapho futhi udonga lomlilo kufanele luvumele ukugxuma kwasekhaya. Iseva yewebhu kufanele iqede i-TLS ngokwayo, ngoba amabhayithi afikayo ayiwukuxhawula kwasekuqaleni kwesiphequluli futhi akukho lutho phakathi okuwususile. Qondisa i-directive kumlaleli we-HTTP ojwayelekile futhi isiphequluli sizothola iphutha lendlela engavumelekile, elifundwa njengewebhusayithi ephukile hhayi njenge-backend ebekwe endaweni engafanele. I-directive ikhona kuphela kumodi yeseva ye-TCP, futhi umlaleli we-UDP akanakho ukugeleza okufanele kuhlolwe.
Njengoba inqubo ye-VPN yamukela ukuxhumana konke, uhlelo lokusebenza lwewebhu lubona isicelo esidlulisiwe sifika kusuka kwelinye lamakheli omshini uqobo hhayi kusuka kusivakashi. Konke okudinga ikheli langempela leklayenti kuncike ekusekelweni kwephrothokholi ye-PROXY ku-backend noma engxenyeni yangaphambili eyengezayo. Ukuhambisa i-backend kwikheli lesibili lendawo akubuyisi ikheli lesivakashi; kushintsha kuphela ukuthi iwebhusayithi irekhoda liphi lamakheli omshini. Bhala lowo mkhawulo kumanothi okuthunyelwa ngaphambi kokuba umbiko wokuhlaziya uphakamise umbuzo.
I-proxy ephambene iyithuluzi elingalungile; umgwaqo wengqimba yesine awuyona
I-proxy ephambene ye-HTTP iqeda i-TLS ukuze ikwazi ukufunda izicelo, okusho ukuthi ayikwazi ukudlulisa ukugeleza kwe-OpenVPN kungathintwanga. Umgwaqo wengqimba yesine odlulisela nge-SNI noma ngokuhlolwa kwephakethe lokuqala ungama ngaphambi kwakho kokubili, inqobo nje uma ungaqedi isikhathi sokusebenza i-VPN encike kuso. Amadivayisi amabili abukeka afana kumdwebo futhi aziphatha ngokuhluke ngokuphelele kusokhethi.
I-Access Server yezentengiselwano iza nezilungiselelo zayo zokwabelana ngembobo, futhi lezo azihambisani ngqo ne-directive yomphakathi. Khomba umkhiqizo nenguqulo ngaphambi kokujwayeza umhlahlandlela obhalelwe enye. Isilungiselelo esikopishiwe esishaywa indiva buthule sibi kakhulu kunokungabi naso, ngoba uhlu lwabalaleli lusabonakala lukholeka ngemuva kwalokho.
Hlola iwebhusayithi nethumbu njengezindlela ezimbili ezihlukene
Layisha iwebhusayithi bese uxhuma ithumbu, bese ufunda uhlu lwabalaleli futhi ukuze ubone ukuthi iyiphi inqubo engumnikazi we-443 manje. Ikhasi elilayishwayo alifakazeli lutho nge-VPN, futhi ithumbu elixhumayo alifakazeli lutho ngewebhusayithi, nakuba zombili zisebenzisa inombolo efanayo. Imiyalo emithathu engezansi ihlola isokhethi elabiwe, indlela yewebhu kanye nensizakalo ye-VPN ngalolo hlelo.
ss -lntup 'sport = :443' curl -sI https://vpn.example.com/ | head -n 1 journalctl -u openvpn-server@server -n 20
Qhathanisa ikheli leklayenti kumbhalo wokufinyelela we-backend nelelo kumbhalo we-VPN ngesikhathi esifanayo. Uma iwebhusayithi irekhoda isivakashi ngasinye njengomshini uqobo, ukudlulisela kuyasebenza kepha ukuphathwa kwekheli akusebenzi. Uma yomibili imibhalo ithule, ingxenye yangaphambili ayikaze iyihambise ukuxhumana. Noma kungaba yini, uhlu lwabalaleli lunquma ukuthi ubani owamukela isokhethi, futhi lelo yiqiniso okufanele liqinisekiswe ngaphambi kokushintsha elinye ifayela.
Shiya lelo balazwe labalaleli eduze kokucushwa ukuze umuntu olandelayo othinta i-443 azi ukuthi iyiphi inqubo eyamukelayo nokuthi enye iphrothokholi yaya kuphi. Qinisekisa ubunikazi ngemuva koshintsho esikhundleni sokuthemba lokho okwakuhloswe ukuhlela.