Kungani i-VPN yakho iwa lapho i-Wi-Fi ishintsha noma i-Ethernet ixhunyiwe
I-SSID entsha, ukuzulazula phakathi kwezindawo zokufinyelela kanye nekhebula elixhunyiwe kudabula umhubhe ezindaweni ezintathu ezihlukene. Hlola ikheli lomthombo, bese kuba umzila, bese kuba iphrothokholi.
Izinto ezimbili zibikwa njengokwehluleka okukodwa: ikhompyutha isihambile yaya kwenye inethiwekhi ye-Wi-Fi, noma ikhebula lixhunywe ngenkathi i-Wi-Fi isasebenza. Iklayenti lisathi lixhunyiwe, isithonjana sibukeka siphilile, futhi umhubhe awuthwali lutho. Ngaphansi, izingcezu ezintathu zomumo kuphela ezinganyakaza - uxhumano, ikheli lendawo, nomzila wokuzenzakalela - futhi ukuthi iyiphi enyakazile yikho okunquma ukuthi umhubhe uzozilungisa wona noma udinga ukuxhumeka kabusha. Ngizihlola ngalolo hlelo, ngoba ukushintsha izilungiselelo ze-akhawunti akukaze kulungise noyedwa wazo.
Uxhumano, ikheli nomzila kunyakaza ngokuzimela
Ukuzulazula phakathi kwezindawo zokufinyelela kunethiwekhi efanayo ngokuvamile isenzakalo se-L2. Umsakazo uphinde uhlangane, isixhumi siyagcina ikheli laso nesango, futhi akukho lutho umhubhe othembele kulo olushintshayo, yingakho ukuhamba kwi-ofisi enkulu ngezinye izikhathi kudlula ngaphandle kokuqashelwa. Ukujoyina enye i-SSID akusikho lokho: isixhumi esidala singawa, i-DHCP inikeza ikheli elisha, isango elisha nezixazululi ezintsha, futhi ukugeleza kwangaphandle umhubhe owawukusebenzisa akusekho.
I-Ethernet yengeza indlela yesithathu. I-Wi-Fi ayiwi nakanye, ngakho asikho isenzakalo soxhumano esenzekayo, kodwa isixhumi esinointambo sivela sineso ikheli futhi ngokuvamile sinqoba umzila wokuzenzakalela ngemethrikhi. Umhubhe uqhubeka endleleni engasathandwa, noma iklayenti ligcina isokhethi yalo inamathele kunethiwekhi engenantambo eyawaqala kuyo. Kusuka kusiphequluli zombili zibukeka zifana: amakhasi ayama ngesikhathi ikhebula lihlala.
Ngakho umbuzo wokuqala akusiko ukuthi i-Wi-Fi ishintshile yini. Ukuthi ikheli oxhumene nalo, noma umzila oya endaweni yokugcina, ushintshile ngesikhathi umhubhe usebenza yini.
Isokhethi yangaphandle inamathele ekhelini elisanda kunyamalala
Wonke umhubhe ukugeleza kwangaphandle: ikheli lendawo kanye nechweba likhuluma nekheli leseva nechweba laso. Ku-Linux lokho yisokhethi ye-UDP eboshelwe emthonjeni wakudala; lapho isixhumi esiphethe ikheli sisuswa, ukuthumela kuyehluleka nge-EADDRNOTAVAIL noma kuphume ngesixhumi esisha ngomthombo iseva engakaze isibone.
Uhlangothi olukude lugcina ukunamathisela kwalo. I-SA ye-IKEv2 engenayo i-MOBIKE ibonakala ngababili bamakheli, futhi OpenVPN isikhathi sifakwe kukheli lozakwabo elisifundile, futhi imephu ye-NAT ingeyekheli langasese, ichweba nekheli lomphakathi eliyidalile. Hamba ngemuva kwenye i-NAT futhi wonke impendulo iya emephini engasekho. Akukho lutho kumshini wakho olulungiselwe ngokungalungile; uhlamvu lwesihlanu lukhomba kunethiwekhi oyishiyile.
Funda umumo ngaphambi kokwenza ithiyori:
ss -unpkubonisa ikheli lendawo nechweba isokhethi ngayinye yomhubhe elikugcinile ngempela.ip route get 203.0.113.10iphrinta ikheli lomthombo nedivayisi i-kernel engayisebenzisa endaweni yokugcina manje.wg show wg0 endpoints,swanctl --list-sasnoma ilogi yeklayenti ibonisa ikheli lozakwabo uhlangothi olukude olucabanga ukuthi lukhuluma naye.
Uma ikheli lesokhethi nokusesha komzila kungavumelani, utholile ukuqhekeka, futhi akukho shintsho lwezifakazelo oluzokuthinta.
Yini eyenziwa yiphi iphrothokholi ngekheli elisha lomthombo
Amaklayenti amunca ushintsho ngezinga elihlukile, futhi ithebula iyilo engiliqhathanisa nokulungiselelwa kweklayenti esikhundleni sokucabanga kusukela ekuziphatheni kokuxhumeka kabusha.
| Tunnel | Recovery behaviour | Failure signature |
|---|---|---|
| WireGuard | Updates the peer endpoint when an authenticated packet arrives from a new address; no handshake needed if traffic continues. | Handshake current, no return traffic; wg show still lists the old endpoint. |
| IKEv2/IPsec | MOBIKE (RFC 4555) moves the SA to the new address; without it the responder discards packets from an unknown source. | DPD or keepalive timeouts, then a full rekey or a dead SA. |
| OpenVPN over UDP | --float accepts a packet from a new source mid-session; otherwise the session stays tied to the original peer address. | Idle until ping-restart fires, then a visible reconnect. |
| OpenVPN over TCP | The tunnel is a byte stream, so a changed source address breaks it outright. | Immediate reset and a new connection attempt. |
Umthetho wokuzulazula we-WireGuard usebenza ohlangothini olulodwa kuphela: iklayenti kumele lithumele kuqala kusukela ekhelini elisha. Isokhethi esisaboshelwe kusixhumi esidala asikwenzi lokho nakanye, yingakho umhubhe ungabonakala uphila ngesikhathi isibali sokuxhawula sisikhulisa iminyaka. incazelo yephrothokholi icacisa ngokunemba umbandela wokubuyekezwa kwendawo yokugcina, futhi kufanelekile ukuyifunda ngaphambi kokushintsha ukulungiselelwa.
I-MOBIKE iyaxoxwa, ayicatshangwa. Uma iseva ingayinikezi, iklayenti kumele lakhe kabusha, futhi lokho kuyiqiniso olikuqinisekisa kuhlu lwe-SA noma ilogi, hhayi okukhipha kusondo elijikelezayo.
Umzila unqunywa ukubaluleka komzila, hhayi isithonjana se-Wi-Fi
Uma zombili izixhumi ziphakeme, i-kernel ikhetha ngemethrikhi nobude besiqalo. ip route show default ibala abazongenela, futhi ip route get 203.0.113.10 ixazulula isinqumo sangempela, kufaka nekheli lomthombo. Umzila wokuzenzakalela onentambo kumethrikhi engu-100 nongantambo kokungu-600 kusho ukuthi indawo yokugcina iyasuka ngesikhathi ikhebula lihlala, kuyilapho uhlelo ngalunye olwavula isokhethi ngaphambili lugcina umthombo walo wakudala.
I-Windows yenza okufanayo ngemethrikhi yezixhumi ezenzakalelayo, ethonywa ijubane lokuxhumana. Get-NetRoute -DestinationPrefix 0.0.0.0/0 ihlela abazongenela, futhi Find-NetRoute -RemoteIPAddress 203.0.113.10 ibuyisela isixhumi nomthombo okuyikho isitaki esingakukhetha. Iklayenti elibophela isokhethi yalo yangaphandle kusixhumi esisodwa liyaqhubeka nokulisebenzisa ngemva kokuba imethrikhi iphendukile; lokho kuyisinqumo sokubopha, hhayi iphutha lokuhlela umzila.
I-Android yenza ukwehlukana kubonakale: i-ConnectivityManager ibika amanethiwekhi atholakalayo nokuzenzakalela okuhlukile, futhi uhlelo lwe-VPN olubophela isokhethi entweni ye-Network lugcina lokho kubopha kuze kube yilapho liphinda libopha. Ku-macOS, scutil --nwi iphrinta isixhumi esiyinhloko nokulandelana okungasetshenziswa uhlelo.
I-DNS, i-MTU ne-IPv6 kunyakaza nokuxhumana
Ukuxhumana okusha kuletha izixazululi ezintsha. Nge-systemd-resolved, i-DNS ingeyokuxhumana ngakunye, resolvectl status ibonisa ukuthi yikuphi ukuxhumana okuphendula igama, futhi inethiwekhi yezivakashi enikeza isixazululi sayo ingashiya i-DNS ephushwe umhubhe ingasetshenziswa kuze kube yilapho ukuxhumana kuthandwa futhi. Ingosi ebamba yenza kube kubi kakhulu: isicelo sokuqala se-HTTPS siphendulwa yingosi esikhundleni sendawo yokugcina, futhi iklayenti libhalisa iseva efile.
I-MTU yomzila nayo iyashintsha. I-Ethernet ne-Wi-Fi ngokuvamile zithwala ama-byte angu-1500, i-PPPoE angu-1492, futhi izixhumanisi zeselula ngokuvamile zingaphansi. Umhubhe odla ifa le-MTU encane uyabambelela kumaphakethe amakhulu ngenkathi izicelo ezincane zidlula, futhi lokho kufundwa njengokuxhumana okuphukile kancane. ping -M do -s 1472 203.0.113.10 ithumela iphakethe lamabyte angu-1500 ne-DF isethiwe; ukuthula kusho ukuthi umzila mncane kunalokho obukucabanga.
I-IPv6 ingolunye uhlangothi. Inethiwekhi enikeza isiqalo esisha ishintsha umthombo okungasetshenziswa yiklayenti elinezitaki ezimbili, futhi umhubhe we-v4 kuphela ushiya i-v6 ngaphandle kuze kufike inqubomgomo. ip -6 route show default futhi ip -6 addr show ziphendula ukuthi ukuxhumana okusha kunomzila we-v6 noma cha.
Phinda wenze ushintsho esikhundleni sokuluchaza
Khetha isicelo esisodwa esingenabungozi bese wenza imiyalo emithathu efanayo kuzinhlangothi zombili zoshintsho: ip -br addr, ip route show default, ip route get 203.0.113.10. Bese ubheka ukuthi umhubhe usakhipha amaphakethe yini - tcpdump -ni any udp port 51820 kwe-WireGuard lokhu, ichweba elifanele kukho konke okunye. Amaphakethe aphuma emthonjeni wakudala asho inkinga yokubopha. Amaphakethe avela emthonjeni omusha ngaphandle kwempendulo asho uhlangothi olukude noma i-NAT ephakathi.
Qaphela ukuthi yisiphi isenzakalo esahambisana nokwehluleka kokuqala: uxhumano luwa, ikheli liyashintsha, noma umzila wokuzenzakalela uyashintsha. Lezi zikhomba kubantu abahlukene abaphethe - iklayenti okumele liboshwe kabusha, ikheli okumele litholwe kabusha, noma umzila ongokwefayela lokulungiselela hhayi umthetho waphakade wokudlula.
Ngaphambi kokuthi uthi kulungisiwe, qinisekisa ukuthi ibhlokhi yokugcwala okuqondile isagciniwe phakathi nesikhala futhi amagama axazululwa ngokuxhumana okusha. Uma iklayenti lisabambelele endaweni yokugcina endala ngemva kokushintsha, lungisa kuqala ukulungiselelwa kokuzulazula noma kwe-float. Uma kuzulazula ngendlela efanele futhi kungatholi mpendulo, bheka ubunikazi bozakwabo kuseva ne-NAT esemzileni, futhi gcina zombili izimo zenethiwekhi embikweni ukuze umuntu olandelayo akwazi ukuziqhathanisa.