Kungani ukuvimba amachweba e-VPN kungayeki amathuneli angagunyaziwe

Umthetho wodonga lomlilo wenqaba ithrafikhi ehambisana nawo. Awunqabi konke ukusetshenziswa koxhumano olukuvumelayo, futhi kulesikhala yilapho iningi lezinqubomgomo ezimelene namathuneli angagunyaziwe lihluleka khona. Ukuvimba amachweba ekhasimende elalidumile eminyakeni emihlanu edlule kushiya kungathintwanga konke okuhamba nge-443, futhi akusho lutho ngedivayisi ekwazi ukubhala kabusha imizila yayo. Akha ukulawula eduze kwegunya nezindawo, bese ufunda ukugeleza okukuvumelayo ngempela.

Kungani uhlu lwamachweba kungeyona inqubomgomo

Amachweba awumqondo wesendlalelo sokuthutha, futhi izinto eziningi zobuchwepheshe bamathuneli azimsebenzisi nhlobo. Ezinye zabelana ngamabomu ngechweba nethrafikhi evamile yewebhu, ngoba lelo chweba yilona eliqinisekisiwe ukuthi liyadlula. Ngakho-ke umthetho osuselwa echwebeni lomlando ubala izinto ezimbalwa zokusebenza esikhundleni sesigaba sokuziphatha. Futhi uguga kabi: ngesikhathi umhlinzeki eshintsha okumisiwe, uhlu luchaza okwedlule.

Okubi kakhulu, ukuvimba ngempumelelo kwechweba elilodwa kungafundwa njengobufakazi bokuthi yonke inkinga isixazululiwe, okubambezela ukulawula obekuzobaluleka.

Izinombolo zeprothokholi namachweba yizindawo zamagama ezihlukene

I-GRE inikezwe inombolo yeprothokholi ye-IP engu-47. Akuyona ichweba le-TCP 47 futhi akuyona ichweba le-UDP 47, futhi isihlungi esibhalelwe ichweba asiyithinti. I-ESP ne-AH zikuzinombolo zeprothokholi ezingu-50 no-51 ngempawu efanayo. Ithrafikhi ehlanganisiwe ingacasha ngaphakathi koxhumano olugunyaziwe, yingakho isigaba noma isiginesha kungasiza kodwa akukaze kuqinisekise inhloso yodwa. Ukwethemba nokuhlinzeka kungokomkhiqizo nohlobo oluthile, hhayi umqondo.

nft list ruleset | grep -nE 'gre|esp|ah|47|50|51'
cat /proc/net/protocols | head -20
ss -tn state established '( dport = :443 )'

Umyalo wokuqala ukhombisa lokho okubhalile ngempela; owesibili ukhombisa ithebula leprothokholi elaziwa isitaki; owesithathu ukhombisa ukuthi zingaki izeshini ezisebenzisa ichweba lewebhu njengamanje. Akukho kuzo okusho ukuthi lezo zeshini zenzelwe ini. Ukuqongelela kwe-TLS isinqumo esihlukile esinezindleko zaso zokwethemba, ubumfihlo nokuhambisana nekhasimende. Akusona isimo esidingekayo ukuze wenqabe indawo enegama, futhi akusona isiqinisekiso sokubona amathuneli.

Lawula igunya elinalo idivayisi

Idivayisi ekwazi ukushintsha ithebula layo lokuhamba nokuhlunga inamakhono angenawo uhlelo oluvamile. Ukuphathwa kokwamukelwa nokumiswa yikho okususa lelo khono, futhi kusebenza kungakhathaliseki ukuthi iyiphi ichweba amathuneli ayezoyisebenzisa.

Lokho kusho ukuthi okuxhunyiwe okugunyaziwe kuthola indima yako emenyezelwe esikhundleni semvume engapheli yokudlulisela ezinye izinto, futhi kusho ukuthi amalungelo okufaka nokuphatha inethiwekhi ayingxenye yenqubomgomo hhayi umcabango wakamuva.

Bheka ukugeleza okusele. Xhumanisa ubunikazi bedivayisi, indima eyabelwe kanye nemethadatha yokugeleza, futhi thatha ukuhlukaniswa njengobufakazi obunemikhawulo hhayi isinqumo.

conntrack -L | awk '{print $1, $4, $5}' | sort | uniq -c | sort -rn | head
ip -br addr show
ip route show default

Izeshini ebetshwe isikhathi eside noma inani elikhulu lamabhayithi akusona ubufakazi bokuxhaphaza: amakhophi okusekela, amathuluzi okusekela kanye nezixhumanisi phakathi kwezindawo zibukeka zifana. Gcina ukuqoqwa kukhawulelwe kuphenyo futhi gcina lokho okutholayo ngaphansi kwenqubo ekungokwayo.

Yenza okuhlukile kucace

Yonke indawo inezindawo okufanele zihlale zifinyeleleka ukuze kube nokubuyekezwa, ukuqinisekiswa kanye nokubuyiselwa. Zibhale phansi ngenhloso nomnikazi, futhi uzibuyekeze esikhundleni sokuzithola ngokwehluleka ngakunye.

Lapho ibhizinisi livumela ngempela isevisi yangaphandle ebanzi, hlunga igunya elinikezwa yileyo sevisi esikhundleni sokucabanga ukuthi ilebula lendawo lenza konke ukusetshenziswa kwamukeleke.

Okuhlukile okungabuyekezwanga kuwumgodi onenombolo yethikithi. Okuhlukile okunegama, isizathu nosuku lokubuyekeza kuyisinqumo.

Yamukela ngecebo elibhaliwe, hhayi ngesiqubulo

Ukwamukela kunezingxenye ezimbili: umsebenzi ogunyaziwe usaphumelela, futhi amacala athile anqatshiwe ehluleka esivivinyweni esigunyaziwe. Kokubili kufanele kubhalwe ngaphambi koshintsho futhi kuphindwe ngemuva kwaso.

Faka izinguquko zendawo yokugcina nenqubomgomo kulolo buyekezo, ngoba umzila owengezwe kukhompyutha ephathwayo ungachitha isihlungi ebesisebenza kahle emaphethelweni.

Umphumela uwumngcele wokuphuma ophethwe ngumnikazi onehlu elaziwayo lengozi esele. Ukusho ukuthi amachweba ambalwa avaliwe aqeda ukusetshenziswa kwe-VPN okungagunyaziwe akusiko lokho.