{"id":30229,"date":"2019-10-31T21:34:23","date_gmt":"2019-10-31T18:34:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vpn-dlya-mobilnyh-ustrojstv-na-urovne-seti\/"},"modified":"2019-10-31T21:34:23","modified_gmt":"2019-10-31T18:34:23","slug":"vpn-dlya-mobilnyh-ustrojstv-na-urovne-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/vpn-dlya-mobilnyh-ustrojstv-na-urovne-seti","title":{"rendered":"VPN pro mobiln\u00ed za\u0159\u00edzen\u00ed na \u00farovni s\u00edt\u011b","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Na \u010desk\u00e9m internetu je st\u00e1le p\u0159ekvapiv\u011b m\u00e1lo materi\u00e1lu o tak star\u00e9 a jednoduch\u00e9, ale pohodln\u00e9 a bezpe\u010dn\u00e9 technologii, jako je mobiln\u00ed VPN (virtu\u00e1ln\u00ed priv\u00e1tn\u00ed s\u00ed\u0165), kter\u00e1 je obzvl\u00e1\u0161\u0165 aktu\u00e1ln\u00ed v souvislosti s rozvojem Internetu v\u011bc\u00ed. V tomto \u010dl\u00e1nku pop\u00ed\u0161u, jak a pro\u010d m\u016f\u017eete nastavit p\u0159\u00edstup do va\u0161\u00ed priv\u00e1tn\u00ed s\u00edt\u011b pro jak\u00e9koli za\u0159\u00edzen\u00ed se SIM kartou bez nutnosti instalace speci\u00e1ln\u00edho softwaru.
\n\"VPN
\n<\/a><\/noindex><\/p>\n

\u00dakoly a omezen\u00ed<\/h2>\n

\nNejprve odpov\u00edm na ot\u00e1zku \u201epro\u010d?\u201c. VPN jako technologie se pou\u017e\u00edv\u00e1 k \u0159e\u0161en\u00ed r\u016fzn\u00fdch s\u00ed\u0165ov\u00fdch \u00fakol\u016f, kter\u00e9 maj\u00ed spole\u010dn\u00fd znak \u2014 izolovan\u00fd p\u0159enos dat mezi dv\u011bma za\u0159\u00edzen\u00edmi p\u0159es velk\u00e9 mno\u017estv\u00ed mezi\u010dl\u00e1nkov\u00fdch uzl\u016f. Na z\u00e1klad\u011b toho se ji\u017e buduj\u00ed slo\u017eit\u011bj\u0161\u00ed \u0159e\u0161en\u00ed a \u0159e\u0161\u00ed se tyto r\u016fzn\u00e9 \u00fakoly. V b\u011b\u017en\u00e9m, v\u0161em zn\u00e1m\u00e9m p\u0159\u00edpad\u011b se pro budov\u00e1n\u00ed VPN pou\u017e\u00edv\u00e1 s\u00ed\u0165 oper\u00e1tora pevn\u00e9 linky (pro ty, kdo maj\u00ed z\u00e1jem o detaily, je vynikaj\u00edc\u00ed materi\u00e1l<\/a><\/noindex>) nebo mno\u017estv\u00ed r\u016fzn\u00fdch s\u00ed\u0165ov\u00fdch protokol\u016f (GRE, IPSec, L2TP a dal\u0161\u00ed \u2014 stejn\u00fd autor o tom<\/a><\/noindex>) a programov\u00fdch produkt\u016f, kter\u00e9 s nimi pracuj\u00ed (Cisco AnyConnect, OpenVPN, TOR \u2014 to u\u017e sami v\u00edte), ale jejich pou\u017eit\u00ed na konkr\u00e9tn\u00edm koncov\u00e9m za\u0159\u00edzen\u00ed okam\u017eit\u011b vy\u017eaduje splnit n\u011bkolik po\u017eadavk\u016f, jejich\u017e nespln\u011bn\u00ed vede k ur\u010dit\u00fdm omezen\u00edm.<\/p>\n

Prvn\u00ed v\u00e1\u017en\u00e9 omezen\u00ed \u2014 za\u0159\u00edzen\u00ed mus\u00ed na hardwarov\u00e9 a softwarov\u00e9 \u00farovni um\u011bt pracovat alespo\u0148 s jedn\u00edm z t\u011bchto protokol\u016f. To se v\u011bt\u0161inou ur\u010duje podle softwaru, kter\u00fd lze snadno naj\u00edt pro notebook nebo smartphone, ale existuj\u00ed p\u0159\u00edpady, kdy \u00fakol stoj\u00ed p\u0159ed p\u0159\u00edli\u0161 jednoduch\u00fdm za\u0159\u00edzen\u00edm z hlediska hardwaru, nebo jeho software m\u00e1 omezen\u00ed: vodom\u011br chce pou\u017e\u00edvat VPN k p\u0159enosu sv\u00e9ho ne\u0161\u0165astn\u00e9ho bajtu ukazatele jednou m\u011bs\u00ed\u010dn\u011b, ne m\u00e9n\u011b, ne\u017e chcete pou\u017e\u00edvat VPN pro \u00fapravu sv\u00e9ho profilu na LinkedIn.<\/p>\n

Dal\u0161\u00edm d\u016fle\u017eit\u00fdm omezen\u00edm je nutnost konfigurace. Funguje jak pro \u201ehloup\u00e1\u201c za\u0159\u00edzen\u00ed z prvn\u00edho bodu, tak pro klasick\u00e9 smartphony a po\u010d\u00edta\u010de, kter\u00fdm nen\u00ed p\u0159edchoz\u00ed omezen\u00ed zn\u00e1mo. A pokud s prvn\u00edmi je to relativn\u011b jednoduch\u00e9 a z\u00e1vis\u00ed to na mno\u017estv\u00ed \u010dasu str\u00e1ven\u00e9ho konfigurac\u00ed, u druh\u00fdch existuj\u00ed varianty. \u010casto organizace vyu\u017e\u00edvaj\u00ed VPN pro zaji\u0161t\u011bn\u00ed bezpe\u010dnosti, aby ochr\u00e1nily slu\u017eebn\u00ed koncov\u00e9 za\u0159\u00edzen\u00ed p\u0159ed p\u0159\u00edstupem do ve\u0159ejn\u00e9 s\u00edt\u011b bez \u0159\u00e1dn\u00e9 firemn\u00ed ochrany nebo p\u0159ed p\u0159enosem slu\u017eebn\u00edch dat po ve\u0159ejn\u00fdch kan\u00e1lech. Kone\u010dn\u00ed u\u017eivatel\u00e9 mohou z n\u011bjak\u00fdch d\u016fvod\u016f VPN vypnout nebo zapomenout zapnout, v d\u016fsledku \u010deho\u017e se mnoh\u00e9 bezpe\u010dnostn\u00ed syst\u00e9my spole\u010dnosti mohou ocitnout \u201emimo hru.\u201c<\/p>\n

Ob\u011b tato omezen\u00ed se snadno odstran\u00ed, pokud je p\u0159\u00edstup k VPN zaji\u0161t\u011bn na s\u00ed\u0165ov\u00e9 \u00farovni. V p\u0159\u00edpad\u011b mobiln\u00edho p\u0159ipojen\u00ed to m\u016f\u017ee b\u00fdt realizov\u00e1no pomoc\u00ed \u201emobiln\u00edho VPN\u201c. Za\u0159\u00edzen\u00ed jak\u00e9koliv slo\u017eitosti schopn\u00e9 p\u0159en\u00e1\u0161et data, je bude p\u0159en\u00e1\u0161et do spr\u00e1vn\u00e9 s\u00edt\u011b. Nez\u00e1le\u017e\u00ed na tom, jak\u00e1 nastaven\u00ed jsou nastavena na za\u0159\u00edzen\u00ed, p\u0159i spr\u00e1vn\u011b nakonfigurovan\u00e9 s\u00edti je v ka\u017ed\u00e9m p\u0159\u00edpad\u011b p\u0159enese tam, kam je t\u0159eba, a nikam jinam. <\/p>\n

A jako p\u0159\u00edjemn\u00fd bonus, za\u0159\u00edzen\u00ed bude dost\u00e1vat adresu z vnit\u0159n\u00ed s\u00edt\u011b, kter\u00e1 m\u016f\u017ee b\u00fdt konfigurov\u00e1na vzd\u00e1len\u011b, a p\u0159\u00edstup k n\u00ed bude mo\u017en\u00e9 z\u00edskat pouze zevnit\u0159 t\u00e9to s\u00edt\u011b (nebo fyzicky). Pro ur\u010ditou t\u0159\u00eddu za\u0159\u00edzen\u00ed je to velmi d\u016fle\u017eit\u00e9.<\/p>\n

Jak to funguje<\/h2>\n

<\/p>\n

PS Core<\/h3>\n

\nNa prvn\u00ed pohled se m\u016f\u017ee zd\u00e1t, \u017ee VPN je klasick\u00e1 slu\u017eba v\u0161ech telekomunika\u010dn\u00edch oper\u00e1tor\u016f pro B2B segment, a pro\u010d se tedy na to soust\u0159edit? V\u0161e spo\u010d\u00edv\u00e1 v tom, jak je uspo\u0159\u00e1d\u00e1na s\u00ed\u0165 p\u0159enosu dat pro za\u0159\u00edzen\u00ed p\u0159ipojen\u00e1 p\u0159es GPRS, HSPA, LTE nebo jinou technologii mobiln\u00edho p\u0159ipojen\u00ed. Chyb\u00ed zde b\u011b\u017en\u011b zn\u00e1m\u00e9 vlan pro v\u0161echny s\u00ed\u0165ov\u00e9 administr\u00e1tory, chyb\u00ed switche, dokonce ani rout\u00e9ry v obvykl\u00e9m smyslu neexistuj\u00ed. M\u00edsto toho zde m\u00e1me s\u00ed\u0165 radiov\u00e9ho p\u0159\u00edstupu (RAN) a paketov\u00e9 j\u00e1dro (PS Core). <\/p>\n

\"VPN
\nZjednodu\u0161en\u00e1 sch\u00e9ma paketov\u00e9 s\u00edt\u011b mobiln\u00edho oper\u00e1tora. Lehce se li\u0161\u00ed pro LTE, ale celkov\u00fd smysl z\u016fst\u00e1v\u00e1 stejn\u00fd.<\/i><\/p>\n

Obecn\u011b plat\u00ed, \u017ee ka\u017ed\u00e9 za\u0159\u00edzen\u00ed se SIM kartou, registrovan\u00e9 v paketov\u00e9 s\u00edti (kter\u00e9 pro\u0161lo procedurou GPRS attach nebo obdobnou), p\u0159ed zah\u00e1jen\u00edm p\u0159enosu dat mus\u00ed iniciovat vytvo\u0159en\u00ed datov\u00e9 p\u0159enosov\u00e9 relace (PDP context) na j\u00e1drov\u00e9m routeru paketov\u00e9 s\u00edt\u011b, GGSN. Detaily a \u00fa\u010del t\u011bchto proces\u016f jsou velmi dob\u0159e pops\u00e1ny zde. tomto \u010dl\u00e1nku<\/a><\/noindex>Co je pro n\u00e1s d\u016fle\u017eit\u00e9: p\u0159i iniciaci relace je v \u017e\u00e1dosti k GGSN mimo jin\u00e9 uvedeno n\u011bkolik parametr\u016f, kter\u00e9 mnoz\u00ed vid\u011bli na sv\u00fdch telefonech nebo se s nimi setkali p\u0159i nastaven\u00ed, nap\u0159\u00edklad u USB modem\u016f. Jsou to t\u0159i pole: APN, u\u017eivatelsk\u00e9 jm\u00e9no a heslo. APN (Access Point Name) je velmi d\u016fle\u017eit\u00e1 entita v logice fungov\u00e1n\u00ed GGSN: v z\u00e1vislosti na tom, z jak\u00e9 APN byla relace iniciov\u00e1na, GGSN jedn\u00e1 r\u016fzn\u011b. V d\u016fsledku \u00fasp\u011b\u0161n\u00e9ho zpracov\u00e1n\u00ed \u017e\u00e1dosti u\u017eivatele by GGSN m\u011bl aktivovat datovou relaci a ozn\u00e1mit za\u0159\u00edzen\u00ed jej\u00ed parametry, zejm\u00e9na p\u0159id\u011blenou IP adresu a adresy DNS. Zde existuje \u0159ada velmi d\u016fle\u017eit\u00fdch zvl\u00e1\u0161tnost\u00ed:<\/p>\n