Kungani i-proxy ye-Cloudflare ingeke ikwazi ukuthwala i-OpenVPN egameni elilodwa

Umshini owodwa usebenzisa iwebhusayithi kanye neseva ye-OpenVPN, futhi isilingo siwukukhomba igama elilodwa lomsingathi kuyo bese uvumela ifu eliwolintshi ukuthi lilungise ithrafikhi. I-proxy ilungisa i-HTTP ne-HTTPS. Ayilungisi isikhathi se-OpenVPN, noma ngabe yiluphi ukhwelo isikhathi sisebenzisa. Amagama amabili, elinye eliqondile nelinye ngokusebenzisa i-proxy, awabizi lutho futhi asusa lonke ikilasi lokudideka.

Amagama amabili, izindlela ezimbili zokuthutha

Nikeza iwebhusayithi irekhodi elenziwe nge-proxy ukuze ithrafikhi yayo ye-HTTP ne-HTTPS idlule ku-Cloudflare. Nikeza i-VPN irekhodi le-DNS kuphela elixazulula ngqo emnyangweni womphakathi we-VPN, futhi uvumele iklayenti ukuthi lisebenzise ukhwelo lwe-UDP noma i-TCP elilungiselelwe lona.

Womabili amagama angaphelela emshinini owodwa womthombo. Umehluko ukuthi kwenzekani phakathi kweklayenti nalowo mshini, futhi lowo mehluko uyinjongo yokuhlukanisa.

Isithenjwa samakhwelo enethiwekhi se-Cloudflare sibala ukuthi yimaphi amakhwelo i-proxy ye-webhi evamile eyamukelayo. Lolo hlu luthinta i-HTTP ne-HTTPS kulawo makhwelo, hhayi izivumelwano ezingafanele ezingase zabelane ngenombolo eyodwa.

Ikhwelo akulona isivumelwano

Ukuhambisa OpenVPN ku-TCP 443 akukwenzi kube yi-HTTPS. I-proxy isalindele isicelo se-HTTP ekuqaleni kokuxhumana, futhi iklayenti le-OpenVPN lithumela umyalezo wokulawula webhanari esikhundleni salokho. Ukuxhumana kwehluleka ngendlela ebukeka njengokuvinjwa kwenethiwekhi ngoba akukho lutho olusizayo olufinyelela ilogi.

Uma isidingo ngempela siwukubeka umkhiqizo we-Cloudflare endleleni yedatha ye-VPN, hlola lowo obhala ukusekelwa kwesivumelwano osidingayo. Ungacabangi ukuthi ifu eliwolintshi liwumhubhe ojwayelekile we-TCP noma i-UDP, ngoba liyi-proxy ephambene yethrafikhi yewebhu enomsebenzi othile.

Irekhodi le-DNS kuphela liyimpendulo eyisicefe esebenzayo, futhi iyona okufanele ixhashazwe kuqala.

Umshini owodwa usadinga abalaleli ababili

Amagama ahlukanisiwe awavumeli izinqubo ezimbili ukuthi zibopha ikheli, ukhwelo nendlela yokuthutha efanayo ngasikhathi sinye. Uma iseva yewebhu isivele ibambe i-TCP 443 kuwo wonke amakheli, isibonelo se-OpenVPN asikwazi ukuyithatha futhi ngaphandle kwelungiselelo lamabomu.

Bopha umlaleli we-VPN kukhwelo olunye, noma ekhelini elilodwa, noma beka i-multiplexer ebhaliwe phambili futhi wamukele izindleko zokusebenza ezihambisana nakho. Ngakunye kwalokhu kukhetha kufanele kubonakale emithethweni yodonga lomlilo, ngoba umlaleli ongeke wabhalwa muntu yiwona olahleka ngesikhathi sehlakalo. Bhala ukubopha okukhethiwe encwadini yokusebenza efanayo echaza umhubhe. Khona-ke umuntu olandelayo ngeke aphinde awuthole futhi ngehora lesibili ebusuku.

Izitifiketi zilandela ukuxhumana ezikuvikelayo

Ukuxhumana kwe-TLS kwesiphequluli kuya ku-Cloudflare nokuxhumana kwe-Cloudflare kumthombo wakho kuyizihlobo ezimbili ezihlukene ezinamajweli amabili ahlukene. Isiphequluli sibona isitifiketi somphetho. Umthombo wethula isitifiketi saso ku-Cloudflare, futhi isitifiketi se-Cloudflare Origin CA senzelwe ngqo leso sihlobo sesibili.

Leso sitifiketi somthombo sithenjwa yi-Cloudflare kumodi ye-Full (strict) futhi akusona isitifiketi sesiphequluli esithenjwayo ngokujwayelekile. Uma othile evakashela ngqo igama lomsingathi le-DNS kuphela futhi ethola isexwayiso, lowo umphumela owawulindelekile wendlela yokuthemba eshintshile, hhayi ubufakazi bokuthi ukubethela kumile.

Ngakho-ke iwebhusayithi evakashelwa ngqo idinga uchungechunge lwamajweli oluthenjwa yiziphequluli zayo. Lokho kungaba khona kanye nesayithi elenziwe nge-proxy umthombo walo ongakhelwanga ukuthi uvakashelwe nhlobo.

I-OpenVPN ithwala ubunikazi besiseva sayo kanye nokuqinisekiswa kweklayenti, nomgwamanda wayo wamajweli kanye nokuvikelwa kwayo kweshanneli lokulawula. Isikhiya kuwebhusayithi asihlinzeki lutho kwalokho, futhi izinqubo ezimbili zokulungiselela kufanele zihlale zihlukene.

Ukuvezwa kulandela igama

Irekhodi le-VPN le-DNS kuphela lishicilela ikheli elikhomba kulo. Uma lelo kheli kuwumthombo wewebhu futhi, umthombo awufihliwe, futhi ukuchaza njengofihliwe ngenxa yokuthi elinye igama lenziwe nge-proxy kuyiphutha elihlala lize kube kunothile ohlola ngalo.

Nquma ukuthi iziphi izicelo zewebhu ezingafinyelela umthombo ngqo futhi kuqinisekise lokho emthonjeni, bese uvumela umlaleli we-VPN ngemibandela yawo. Amakhasi okuphatha, ukulandwa kwamaphrofayili nomlaleli wedatha kungaba nezidingo ezintathu ezihlukene zokuvezwa ngisho lapho iphakethe elilodwa lihlinzeka zontathu.

Gcina izixhumanisi ezikhiqiziwe egameni lewebhu lomphakathi nasesimweni se-HTTPS, futhi gcina amaphrofayili eklayenti egameni le-VPN ngesivumelwano nokhwelo kwangempela. Akukho nhlangano kulezi zimbili okufanele incike ekuguquleni isilungiselelo se-proxy kolunye ngesikhathi sokusebenza okujwayelekile.

Ukulandelana komsebenzi: igama elenziwe nge-proxy lesayithi, igama le-DNS kuphela le-VPN, abalaleli abahlukene, isitifiketi kusihlobo ngasinye, bese kuba ukuhlolwa okukodwa okufakazela ukuthi igama ngalinye lifinyelela kuphela insizakalo okufanele liyifinyelele.