Kungani i-VPN ibamba ekudluliseni okukhulu kodwa hhayi kokuncane

Ikhasi liyalayisha, i-ping iyaphumelela, kodwa ikhophi yefayela ihlala ihamba inganqamuki endaweni efanayo ngaso sonke isikhathi. Lelo phethini likhomba kusayizi wephakethe hhayi kububanzi bebanda noma emininingwaneni yokungena. I-encapsulation yengeza amabhayithi kuphakethe ngalunye, ngakho umthwalo owawungena endleleni yasekuqaleni ungadlula umkhawulo uma usudlula kuthaneli. Kulezi zingxoxo izinombolo ezintathu ezihlukene zibizwa nge-MTU, futhi ukuzixuba kuholela ekusethweni okulungisa uhlelo lokusebenza olulodwa futhi kwephule olunye.

Izinombolo ezintathu abantu abazibiza nge-MTU

I-MTU yesixhumi ingumkhawulo obekiwe wephakethe kulolo xhumano. I-MTU yendlela ingumkhawulo omncane kulo lonke uhambo, futhi iyatholakala hhayi ukubekwa. I-TCP MSS ingusayizi womthwalo okhuluma umlingani ukuthi angawuthola, futhi isuselwa kwezinye ezimbili, akuwona umkhawulo womzimba ohlukile.

Ithaneli linombono wangaphakathi kanye nombono wangaphandle. Iphakethe langaphandle lithwala elihlanganisiwe kanye namakhanda adingeka kuphrothokholi, ngakho usayizi wangaphakathi osebenzisekayo mncane kunalokho okuvunyelwa indlela yangaphandle. Indlela eya kuseva ye-VPN nayo ihlukile kundlela yeseva eya endaweni ekuyiwa kuyo.

Ukutholakala kwe-MTU yendlela kuvumela umthumeli ukuthi azi usayizi osebenzayo, kodwa kuncike ekutheni impendulo iyafika. Uma idivayisi ephakathi nendawo ihlunga imilayezo ye-ICMP efanele, umthumeli uyaqhubeka nokuthumela amaphakethe angaqedi, futhi lokho kuyigodi elimnyama elijwayelekile. Isibonakaliso sicaca uma usazi: ukuxhawulana kuyaphumelela, umthwalo wokuqala wosayizi ogcwele uyanyamalala, futhi ekugcineni ukuxhumana kuyaphinda kusethwe noma kubambe. Akukho lutho kulogi yohlelo olubonakala njengenkinga yenethiwekhi.

Hlola indlela ngomthwalo owulawulayo

Ukuhlolwa ubufakazi mayelana nomzila owodwa nosayizi oyedwa, hhayi isetho esinconywayo. Sebenzisa isibungu esiphendulayo, futhi shintsha usayizi womthwalo kuphela.

ping -M do -s 1372 -c 2 203.0.113.20
ping -4 -f -l 1372 vpn.example

Umyalo wokuqala uthumela ukuhlolwa kwe-Linux nge-fragmentation evaliwe kanye nomthwalo wamabhayithi angu-1372, kanti owesibili wenza okufanayo ku-Windows lapho umthwalo usetwa khona nge--l. Impendulo isho ukuthi lowo sayizi weqa indlela. Umlayezo wokuthi kudingeka i-fragmentation unolwazi, kanti isikhathi sokuphela asicaci ngoba isibungu noma idivayisi ephakathi nendawo ingase ijule i-ICMP nje.

Yehlisa usayizi ngezinyathelo ezimbalwa esikhundleni sokusesha kabili kuze kufike kubhayithi. Uzama ukuthola ukuthi ukhona yini umthamo wosayizi, hhayi ukushicilela inombolo kunethiwekhi ngayinye. Inombolo oyitholayo isebenza kule ndlela, kule phrothokholi kanye nalo mkhakha wamakheli.

I-IPv4 ne-IPv6 zihlukanisa ngezindlela ezihlukene, ngakho umphumela womkhakha owodwa awusho lutho ngomunye. Hlola umkhakha ohlelo olusebenzisa wona ngempela.

Ukunciphisa kwe-MSS kusiza i-TCP kuphela

Ku-TCP umthwalo osebenzayo uxoxwa ngesikhathi sokuxhawulana, futhi umzila osendleleni ungaphinda ubhale lelo nani phansi ukuze zombili iziphetho zithumele izingxenye ezincane. Yilokho okukwenziwa ukunciphisa kwe-MSS, futhi kusebenza ngaphandle kokuthinta iklayenti nhlobo.

iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
ip link show tun0

Umgomo wokuqala unciphisa i-MSS emenyezelwe kwaze kwaba yi-MTU yendlela yokuxhawulana kwe-TCP okudluliswayo, kanti owesibili ukhombisa i-MTU yesixhumi sethaneli uqobo ukuze uyiqhathanise nalokho okuvunyelwa indlela. Ukunciphisa kuyisilungiso esingangeni kakhulu kuhlelo lwe-TCP olubamba ngemuva kokuxhawulana.

Ku-UDP akwenzi lutho. Iklayenti lezwi noma lomdlalo elithumela amadathagram amakhulu lizolishaya indiva isetho se-MSS ngokuphelele, ngoba akukho kuxhawulana okuzophinda kubhalwe. Uma uhlelo olwehlulwayo kungu-UDP, bheka izinketho zosayizi wephakethe zeklayenti uqobo. Amaphrothokholi amabili ehluleka ngezindlela ezihlukene futhi alungiswa ngamathuluzi ahlukene, yingakho iphrothokholi kufanele ibe emshweni wokuqala wethikithi.

OpenVPN iveza izinketho ezifana ne-tun-mtu, i-mssfix nezilungiselelo ezihlobene ne-fragmentation, futhi ukuziphatha kwazo kuncike kunguqulo nasekutheni isiteshi sedatha siyi-AEAD. Funda incwadi yokuqondisa yenguqulo esetshenziswayo, futhi shintsha inketho eyodwa ngesikhathi.

Shintsha isetho esisodwa esisekelwayo bese uphinda kokubili ukugijima

Gcina iphrofayili yasekuqaleni, shintsha inani elilodwa elisekelwayo, futhi phinda kokubili isicelo esincane esasebenza nokudlulisa okukhulu okwehlulekile. Uma kushintsha okukhulu kuphela, ubulandela usayizi. Uma kushintsha kokubili, kukhona okunye okwanyakaza kanye nakho.

Inani eliphansi linganciphisa isibonakaliso kodwa lengeze umthwalo ongeziwe, ngakho inombolo encane kakhulu ayiyona inhloso. Inhloso usayizi indlela ewuthwalayo ngokuthembekile ngokumosha okuncane kakhulu. Bhala inani, indlela nenguqulo yeklayenti ethikithini, ngoba ukusebenzisa inombolo efanayo kwenye indawo ukuqagela.

Uma iphrofayili efanayo isebenza isuka kwenye inethiwekhi ethembekile, gcina lowo mehluko ekuxilongweni esikhundleni sokumemezela ukuthi iklayenti selilungisiwe. Ukuguquguqukayo okwashintsha yindlela, futhi indlela iyona eyalinganiswa ukuhlolwa.