FortiClient cikakken tunnel: yi wa yankin ofis ne kawai hanya

Tunnel yana tashi, alamar tana juya kore, kuma cibiyar sadarwar gida ta ɓace: firintoci, NAS da na'urar sarrafa hanyar ofis duk sun daina amsawa. FortiClient yana yin abin da bayanin martaba ya nema. Ƙofar ta tura hanyar da ba a bayyana ba, abokin ciniki ya shigar da ita, kuma kowane fakiti yanzu yana da hanya zuwa cikin tunnel. Gyaran shine gyaran teburin hanya tare da gyaran DNS a bayansa, kuma tsarin waɗannan gyare-gyaren shine ke yanke shawarar ko injin zai ƙarasa mafi kyau ko mafi muni.

Abin da abokin ciniki ya shigar, da kuma dalilin da yasa LAN ta ɓace

Fara da karanta teburin maimakon fuskar abokin ciniki. A macOS netstat -rn yana buga dukan teburin kuma route -n get default yana ambaton fuskar da awo da ke cin nasara a yanzu; a Linux ma'auratan sune ip route show da ip route get 8.8.8.8. Dukansu suna amsa tambaya ɗaya: wace shigarwa za ta ɗauki fakitin da bai dace da wani abu mafi takamaiman ba.

Sunan na'urar tunnel ba a kayyade ba. Bayanin martabar IKEv2 a macOS yawanci yana nuna utun tare da lamba, abokin ciniki na SSL VPN yana nuna ppp0, kuma OpenVPN yana nuna tun0. Hanyoyi biyu na asali kuma na iya kasancewa a lokaci ɗaya da ma'auni daban-daban, kuma shigarwar abokin ciniki na iya ɗaukar ragamar bayan sake haɗawa maimakon lokacin da ta bayyana. Shi ya sa dubban tebur biyu da aka ɗauka da minti biyar tsakaninsu na iya ba da labarai daban-daban.

Dalilin da yasa hanyar tunnel ta asali dole ta fara tafiya

Kernel yana zaɓar mafi tsayin prefix da ya dace, kuma idan hanyoyi da yawa suna da takamaiman daidai yana zaɓar wanda ke da mafi ƙarancin awo. Don haka abokin ciniki da ya shigar da 0.0.0.0/0 da mafi kyawun awo yana cin kowace manufa ba tare da share ainihin hanyar asali ba, kuma shi ya sa hanyar jiki har yanzu tana cikin teburin kuma har yanzu tana bayanin katsewar. Cire hanyar tunnel ta asali da farko yana dawo da halin da ya gabata. Bayan haka ne kawai hanyar prefix ta cikin tunnel ke yin abin da marubucin ta ya yi niyya.

Ƙara prefixes kafin wannan matakin shine kuskuren da ke samar da injin da ke aiki rabi. Traffic na sabon prefix yana bin tunnel, kuma duk abin da ba a jera ba yana bin hanyar tunnel ta asali kuma, don haka babu abin da ke ganin ya lalace har sai wani ya buɗe sabis da babu wanda ya ƙara. Share, mayar, sannan ƙara, kuma yanayin tsaka-tsaki yana kasancewa mai iya tsammani.

Tsari a macOS da Linux

A macOS tsarin yana share hanyar tunnel ta asali, yana mayar da hanyar asali ta jiki kuma yana aika prefix ɗaya na ofis zuwa cikin tunnel. Maye gurbin sunayen fuska na misali a nan da waɗanda ke cikin teburinka.

sudo route delete -net default -interface utun4
sudo route add -net 0.0.0.0 -interface en0
sudo route add -net 10.20.0.0 -netmask 255.255.0.0 -interface utun4

A Linux wannan tsari yana amfani da wani kayan aiki, tare da ƙofar LAN don hanyar asali da na'urar tunnel don prefix na ofis. Tsohon umarnin route har yanzu yana karɓar tsohon tsari, amma ip route shine siffar da ta dace da takardun yanzu.

sudo ip route del default dev tun0
sudo ip route add default via 192.168.50.1
sudo ip route add 10.20.0.0/16 dev tun0

Lokacin da hanya ke buƙatar tsalle na gaba maimakon na'ura, ɗauki peer daga fitowar abokin ciniki. Yin hasashe yana haifar da ɗaya daga cikin kuskure biyu, kuma suna da ma'ana daban: ƙofar da ba daidai ba tana ba da network unreachable nan take, yayin da manufar tunnel mara kyau tana ba da ƙarewar lokaci. Karanta wanda ka samu kafin ka sake canza umarnin.

Prefixes, mai warwarewa da DMZ da ke zama duhu

Prefix ɗaya ba kasafai yake rufe aikin ba. Sabar aikace-aikace, hanyoyin sadarwar gudanarwa, DMZ da sabar DNS da kansu na iya kasancewa kowanne a wani yanki daban, don haka jera kowane yanki da za ka iya ambata kafin ka fara kuma gwada bincike kusa da kowane ping. Manufar da aka gano a tsakiyar gwajin ita ce wadda ake mantawa a cikin rikodin canje-canje. Hanyar da ke amsa da adireshi amma ta kasa da suna yawanci matsalar mai warwarewa ce sanye da rigar turawa.

Mai warwarewa shawara ce daban. Lokacin da bayanin martaba ya tura sabar DNS na ciki, cire hanyar asali na iya barin waɗannan adiresoshin ba za a iya isa ba don sunaye na jama'a ko kuma a isa su ta tunnel kawai, kuma kowanne yanayi yana haifar da sakamako marasa cikawa masu ruɗani. Yi wa adiresoshin mai warwarewa hanya ta cikin tunnel, ko saita warwarewa ta kowane yanki domin binciken jama'a ya yi amfani da mai warwarewa na gida.

Abokin ciniki na SSL na Linux yana da gazawar da ta shafi wani fili da ya kamata a sani: tunnel yana haɗawa, LAN na ofis yana amsawa, kuma yanki ɗaya na DMZ yana zama duhu. Abin da ya ɓace shine hanya don wannan yanki ta ƙofar tunnel, kuma ƙofar ta bambanta tsakanin injuna, don haka adireshin da aka yi wa hard-coding shine yadda kwamfutar tafi-da-gidanka ta gaba ke karyewa. Fitar da ita daga yanayin abokin ciniki kuma ka riƙe umarnin yana rubuta kansa:

PEER=$(ip -4 addr show dev ppp0 | awk '/peer/ {print $4}' | cut -d/ -f1)
sudo ip route add 192.168.30.0/24 via "$PEER"

Karanta ƙididdiga biyun kafin ka gudanar da shi. peer shine ƙarshen nesa na tunnel na aya-zuwa-aya, kuma shine adireshin da hanyar DMZ ke buƙata; a cikin tunnel mai turawa makamancin shine fuskar ko ƙofar da abokin ciniki ke bayar da rahoto. Idan babu ɗayan da ya bayyana, abokin ciniki ba ya cikin yanayin da ka ɗauka.

Bayan haɗin gaba, da kuma lokacin da za a daina yin wannan a gida

FortiClient yana sake haɗawa bayan barci ko canjin cibiyar sadarwa kuma yana sake shigar da abin da bayanin martaba ya kayyade. Don haka hanyoyin hannu suna rayuwa ne kawai har zuwa haɗin gaba, kuma wannan shine ainihin lokacin da gwaji ɗaya mai nasara zai iya kama da gyara. Hanyar da ke ɓacewa cikin dare halin da ake tsammani ne, ba sabon lahani ba.

Akwai amsoshi biyu masu dorewa. Rubutun da ke sake gudanar da gyaran bayan kowace haɗin yana aiki ne na wucin gadi wanda zai iya rayuwa fiye da marubucinsa, yayin da bayani na tunnel ɗin da aka raba daga mai kula da ƙofa shine ainihin gyaran, domin a lokacin abokin ciniki yana shigar da yankunan da aikin ke buƙata kawai. Nemi na biyu kuma yi amfani da na farko kawai yayin jira. Duba manufar da ka amince da ita kafin raba cikakken tunnel a gida, domin cibiyar sadarwar nesa na iya dogaro da ganin dukan traffic ɗinka.

Jerin dubawa gajere ne: karanta teburin, share hanyar tunnel ta asali, mayar da hanyar LAN ta asali, ƙara kowane prefix, gyara warwarewa daban, kuma yi tsammanin hanyoyin za su dawo yayin sake haɗawa.