Kungani isilinganiso se-Wi-Fi se-router yakho singabikezeli umfudlana we-VPN

I-router enebheji ye-Wi-Fi engu-3,000 Mbps isengathutha ithrafikhi ebethelwe ngesilinganiso esincane sale nombolo, futhi azikho zombili lezi zinombolo ezingathembekile. Isilinganiso somsakazo sichaza ukuguqulwa okungcono kakhulu komxhumo ongenantambo okusekelwa yi-chipset; inombolo ye-VPN ichaza ukuthi idivayisi eyodwa ingazicindezela ngokushesha kangakanani amaphakethe abethelwe nge-CPU ye-router futhi iphume esifundeni sakho sokufinyelela. Lezi zingqimba ezihlukene, osayizi bamaphakethe abehlukene kanye nezindlela zokulinganisa ezihlukene. Thatha inombolo esebhokisini njengomkhawulo ongenamuntu owufinyelelayo, hhayi njengesibikezelo sejubane lomhubhe wakho.

Isinyathelo 1: Dweba imephu yezingqimba ezine ezikhawulela inombolo

Cishe zonke izikhalazo nge-router ehamba kancane engisebenze nazo ziwela kwelinye lamazinga amane: umxhumo ongenantambo, ijubane lokufinyelela kwe-WAN, indlela yokudlulisa (NAT, i-firewall, ukulandelela kokuxhumana) noma indlela yokubethela ye-VPN. Ziyanqwabelana, futhi izinga elihamba kancane kakhulu liyona enquma umphumela. Ijubane le-Wi-Fi elikhangisiwe likhuluma ngezinga lokuqala kuphela, futhi likhuluma ngalo ngomusa.

Le nombolo ivela ezinaneni zemisakazo ephindwe ngobubanzi besiteshi futhi iphindwe ngokuguqulwa okuphezulu kakhulu i-chipset engakwazi ukuxoxisana ngakho. Umsakazo ongu-2x2 ku-5 GHz ku-80 MHz une-1024-QAM ukhangiswa eduze kwe-1,200 Mbps, kodwa i-Wi-Fi iyindawo eyabiwe enezingxenye ezimbili: amaklayenti ayashintshana, ukuthunyelwa kabusha nethrafikhi yokuphatha kushisa isikhathi somoya, futhi i-TCP yengeza umthwalo wayo. Iklayenti elixoxisana ngejubane eliphezulu ngaphansi kwezimo ezinhle kakhulu livamise ukulinganisa ngaphansi kakhulu kwengxenye yalo, futhi ngisho nangaphansi uma amanethiwekhi angomakhelwane evela.

Uma ithebula likhomba emsakazweni, qala ngokulungisa uhlangothi olungenantambo: ibhendi, ububanzi besiteshi, ibanga. Uma likhomba ngaphansi komsakazo, izinyathelo ezine ezilandelayo zibalulekile, futhi akukho nani lokuthenga kwama-antenna elizokushintsha lokho.

Isinyathelo 2: Thatha umugqa oyisisekelo onentambo ngaphambi kokuthinta umsakazo

Beka i-laptop ku-Ethernet bese ulinganisa kuqala indlela ngaphandle komhubhe, ngoba lokho kukunikeza isihlukanisi. Gijimisa ithuluzi lomfudlana ohlangothini oludingayo, ku-VPS noma kuseva yasekhaya eqeda i-VPN, bese ukhomba iklayenti ekhelini layo lomphakathi ukuze ithrafikhi idlule ku-router yakho nasesifundeni sakho sokufinyelela.

# on the far host (VPN endpoint)
iperf3 -s

# wired client, direct to the endpoint's public address
iperf3 -c 203.0.113.10 -t 30

# same client, four parallel streams
iperf3 -c 203.0.113.10 -t 30 -P 4

Izinombolo ezimbili ezivela kulelo qoqo ziphendula imibuzo ehlukene. Umfudlana owodwa ukhombisa umkhawulo wokuxhumana ngakunye, kufaka phakathi ukuziphatha kwewindi le-TCP kananye nokubunjwa komfudlana ngamunye endleleni. Imifudlana emine ikhombisa ukuthi umxhumo unawo yini umthamo ongawusebenzisi, ngoba imifudlana ehambisanayo ingagcwalisa ipayipi umfudlana owodwa ongakwazi ukuligcwalisa.

Kugcine ngokuthembeka: isishingishane esifanayo, isikhathi sosuku nobude besikhathi, futhi akukho okunye okusakazayo ekhaya. Ukudluliswa okukhulu kwemizuzwana engamashumi amathathu iyiyunithi efanele lapha, futhi i-RFC 6349, uhlaka lokuhlola umfudlana we-TCP, lakhiwe phezu kwalokho kucabanga, ngoba ukuqhuma okufushane nezicelo ezincane kwenza umxhumo ubonakale unguwo ongcono. Bhala phansi umugqa oyisisekelo ngaphambi kokushintsha noma yini.

Isinyathelo 3: Gijimisa lokho kuhlola ngomhubhe

Manje kuphindise kukheli lomhubhe lwendlela yokugcina, ngayo lelo klayenti, ubude besikhathi nenani lemifudlana, umhubhe uvulekile futhi akukho enye ithrafikhi. Isilinganiso phakathi kwemiphumela emibili sitshela ukuthi ukubethela nokufaka kusongweni kubiza malini kuleyo hardwear; inombolo ephelele isitshela ukuthi kwanele yini lowo msebenzi.

Buka izibali ngesikhathi ukudluliswa kuqhubeka. Ku-WireGuard, i-wg show ibika amabhayithi adlulisiwe kumlingani ngamunye; ku-OpenVPN, ifayela lesimo elibhalwa ngezikhathi linikeza umbono ofanayo.

watch -n 1 'wg show wg0 transfer'
# OpenVPN: add --status /run/openvpn/server.status 10 to the server config
tail -f /run/openvpn/server.status

Uma inombolo yomhubhe iseduze nomugqa oyisisekelo onentambo, i-VPN ayisona isithiyo sakho futhi ungayeka ukuyisola. Uma kuyingxenye nje yomugqa oyisisekelo, ukulahleka kwenzeke ngaphakathi kwendlela yokubethela nokudlulisa ye-router, futhi isinyathelo esilandelayo sisho ukuthi iyiphi ingxenye.

Isixwayiso esisodwa: uma i-IP yokuphuma isishintshile, ezinye izinsizakalo zokuhlola ijubane zikhetha buthule iseva ehlukene yokulinganisa, ngakho ekugcineni uqhathanisa izindawo ezimbili ezihlukene. Faka ngokwakho ikheli leseva.

Isinyathelo 4: Funda i-CPU njengendlela, hhayi njengesilinganiso

I-router ekhombisa amaphesenti angu-30 e-CPU iyonke isengagcwaliseka: umsebenzi womhubhe owodwa uvamise ukuwela kukho okukodwa, kulayini owodwa wokuphazamiseka noma kumucu owodwa we-kernel, ngakho isilinganiso sifihla umkhawulo. Buka izinombolo zekhodi ngayinye neze-softirq esikhundleni somlinganisi wedashibhodi.

mpstat -P ALL 1
top -H -p $(pgrep -f 'openvpn')
grep -o -m1 aes /proc/cpuinfo

Izinto ezintathu zibalulekile kuleso siphumlile. Ikhodi eyodwa eboshwe eduze kwamaphesenti angu-100 kanti ezinye azisebenzi ikhombisa umkhawulo wokuxhumana ngakunye. I-%soft esindayo noma i-ksoftirqd ematasa ku-CPU eyodwa ikhomba ekucutshungulweni kwamaphakethe ohlangothini lokwamukela okungasakazeki emigqeni. Futhi ukungabikho kwefulegi le-aes kusho ukuthi i-CPU ayinayo imiyalo ye-AES, ngakho ukubethela okulinganayo kusebenza kusoftware futhi kubiza kakhulu iphakethe ngalinye.

Ukuqaliswa nakho kubalulekile. Isibonelo se-OpenVPN sendabuko endaweni yomsebenzisi sicubungula amaphakethe omhubhe owodwa ikakhulukazi endaweni eyodwa, ngakho ibhokisi elisheshayo elinamakhodi amaningi lingaziphatha njengelikhodi elilodwa kulo mhubhe. I-WireGuard ku-kernel isabalalisa umsebenzi kuma-CPU, futhi ukwehliswa kwesiteshi sedatha se-OpenVPN nakho kuhambisa ukuphathwa kwamaphakethe ku-kernel, kodwa kuphela kuma-build namapulatifomu akusekelayo. Isimangalo sokusheshiswa kwe-hardwear ekhasini lokumaketha akusona ubufakazi bokuthi indlela yekhodi oyigijimisayo iyisebenzisa.

Isinyathelo 5: Nquma ukuthi yini ozoyishintsha, ngalolo hlelo

Hla ngokulandelana kwalo hlu bese uma kumugqa wokuqala oyiqiniso, ngoba ukushintsha noma yini engaphansi kwawo akukuyisisi inombolo.

1. Umfudlana oqondile onentambo uphansi kwalokho okukhokhelayo: khuluma nomhlinzeki, ngoba umhubhe awukwazi ukwakha umthamo ongawanikezwa yisifunda sokufinyelela. 2. Okwentambo ngqo kulungile kodwa ikhodi eyodwa iyaboshwa ngesikhathi sokuhlolwa komhubhe: indlela yokubethela ye-router iwumkhawulo. 3. I-CPU ayisebenzi kodwa umhubhe uhamba kancane: hlola i-MTU nokuhlukaniswa, bese umthamo wendlela yokugcina ekude uqobo. 4. Amaklayenti e-Wi-Fi kuphela ahamba kancane: shintsha ibhendi noma ububanzi besiteshi, futhi wamukele ukuthi ijubane elikhangisiwe lalingeyona inombolo ye-VPN.

Uma i-router iwumkhawulo ngempela, izinketho ezithembekile idivayisi enemiyalo ye-AES nendlela yokudlulisa eshesha kakhulu, umhubhe ohlangothini lwe-kernel njenge-WireGuard esikhundleni salowo osendaweni yomsebenzisi, noma ukuhambisa iklayenti kudivayisi uqobo ukuze i-router iyeke ukubethela. Ukucisha ukubethela okuqinisekisiwe ukuze uwine ukuhlolwa kokuqhathanisa akusona esinye sazo; kushintshanisa impahla yokuphepha ngenombolo engasazohambisana nebhokisi.

Ngaphambi kokuthenga noma yini, phinda ugijimise izinyathelo 2 no-3 kudivayisi entsha ngaseseva nangobude besikhathi obufanayo, bese uqhathanisa izilinganiso, hhayi iziqongo.