Amsar VPN tsakanin wurare ba ta wucewa ta tunel
Amsar da ta tsallake tunel shawara ce ta turawa a gefen nesa. Duba teburin mai masauki, masu zaɓe da rp_filter, sannan zaɓi hanya ko NAT.
Na yi safiya a kan tunel da ya tashi da kyau kuma yana tafiyar da zirga-zirga a hanya ɗaya kawai: reshen yana iya isa uwar fayiloli a babban ofishi, kuma kowace haɗi da aka buɗe daga babban ofishi zuwa reshen tana mutuwa a SYN na farko. SA ɗin suna aiki, ƙididdigar tunel ɗin suna ƙaruwa, kuma musafaha ba shi ne matsalar ba. Amsar ana tura ta wani wuri da tunel ɗin bai rufe ba, kuma wannan zaɓi na gefen nesa ne. VPN tsakanin wurare yana ɗaukar fakiti ne kawai da mai masauki ya miƙa wa ƙofa, kuma kowane mai masauki yana yin wannan zaɓi daban, a kowace hanya, daga teburin hanyarsa.
Ana tura kowace hanya daban
IP ba ya riƙe wani tarihin alkiblar tattaunawa. Kowace na'ura da ke aika fakiti tana gudanar da bincikenta na mafi tsayin prefix, ta zaɓi tsalle ɗaya na gaba sannan ta manta da shawarar. Buƙata da amsa fakiti biyu ne marasa alaƙa waɗanda kwatsam suke cikin haɗi ɗaya, kuma tunel ɗin tsalle ɗaya ne da kowane ɗayansu zai iya amfani da shi ko a'a. Babu wani abu a cikin musayar IKE da ke koya wa uwar nesa yadda za ta isa subnet ɗinka; tattaunawar tana yarda ne kawai da waɗanne prefixes za a iya ɓoye su.
Wannan yarjejeniya ita ce ƙofa ta biyu. A strongSwan masu zaɓen zirga-zirga su ne leftsubnet da rightsubnet, kuma fakitin da tushensa ko inda aka nufa ya faɗi waje da ma'auratan da aka tattauna ba a ɓoye shi, ko teburin hanya ya ce me. Prefix da ake turawa cikin tunel amma ya ɓace daga masu zaɓe ɓoyayyiyar gazawa ce ta gefe ɗaya: hanyar tana kama da daidai, fakitin har yanzu yana fita a fili ko a jefar da shi, kuma log ɗin charon ne kawai ke kuka.
Uwar nesa ba ta san kome ba game da tunel ɗinka
A cikin LAN na nesa amsar fakiti ce ta yau da kullum da aka aika zuwa abokin cinikinka. Uwar da aka nufa ba ta ganin wani kan IPsec kuma ba ta da dalilin fifita ƙofar VPN; tana neman prefix ɗinka, ba ta samun wani abu da ya fi takamaimai fiye da hanyarta ta asali sannan ta bi ta. Idan ta asali tana nuni ga babbar firewall, firewall ɗin yana da hanyar komawa cikin tunel ko ba shi da ita. Idan ba shi da ita, za ka sami jefar da ba a ji ba, ICMP unreachable, ko amsar da ta fita ta interface ɗin da ke fuskantar intanet sannan ta mutu.
Wata interface ta biyu ta isa ta karya wannan ko da hanya tana nan. NAS mai hanyar sarrafawa a wani VLAN, uwar da ke da uplink na ajiya, ƙa'idar manufa da ke aika kewayon tushe zuwa tebur na biyu: kowane ɗayan waɗannan zai iya kama amsar. A Linux, ip rule show da ip route show table all suna bayyana ƙa'idoji da tebura da lissafin asali ke ɓoyewa.
Karanta shawarar a kan na'urar da ke aika amsar
Tambayi kernel kafin ka canza kome, kuma ba shi adireshin tushe, domin ƙa'idojin da suka dogara da tushe suna canza amsar.
ip route get 10.10.5.10 from 10.20.30.15
ip rule show
ip route show table all
ss -tn state established "( sport = :445 )"Fitowa tana ambaton interface ɗin fita da tsalle na gaba. Idan interface ɗin ba shine wanda ke fuskantar ƙofar VPN ba, ka sami lahani, kuma aikin da ya rage shine zaɓar inda hanyar ta kamata ta kasance. Ping daga ƙofar yana tabbatar da kaɗan a nan: yana amsa da adireshin da uwar nesa za ta iya gane shi, ba adireshin kwamfutar tafi-da-gidanka ba.
A Windows makamantan su sune Find-NetRoute -RemoteIPAddress 10.10.5.10 don shawara da Get-NetRoute don tebur. Hanyar da aka ƙara da New-NetRoute wadda ke ɗauke da ma'aunin da ya fi na asali girma tana yin rashin nasara cikin shiru, don haka karanta ginshiƙin ma'auni, ba shigarwar ba. Sannan tabbatar da fakiti: tcpdump -ni any "host 10.10.5.10 and tcp port 445" a interface ɗin LAN na nesa yana nuna buƙatar, kuma wannan tacewa a gefen tunel yana nuna ko amsa ta dawo. Buƙatar da ake gani ba tare da amsa ba tana nufin an tura amsar wani wuri ko an jefar da ita; amsa a kan interface ɗin da ba daidai ba tana ba ka mai laifi kafin ka taɓa hanya.
Lokacin da ƙofar uwar ba ita ce ƙarshen VPN ba
Wurare da yawa suna sanya firewall tsakanin uwaye da mai tattarawa. Wannan firewall yana tura amsar gaba, don haka yana buƙatar hanya don prefix ɗin abokin cinikinka da ke nuni ga ƙofar VPN, da manufar turawa a duk bangarorin biyu. Na'urori masu riƙe yanayi suna ƙara muni: buƙatar ta ratsa firewall ɗin daga uwar LAN da ta yarda, amsar yanzu tana zuwa daga wata alkibla, kuma shigarwar bin diddigin haɗi ba ta dace kuma, don haka ana jefar da fakitin a matsayin mara inganci maimakon a hana shi. Shi ya sa log ɗin manufa yake kama da fanko yayin da zirga-zirga ke ɓacewa.
Ƙofar tana da nata tacewa ta biyu. Tacewar hanyar baya ta Linux tana jefar da fakiti waɗanda ba za a iya isa tushensu ta interface ɗin da suka shigo ba, kuma wannan shine ainihin sifar hanyar dawowa marar daidaito ta halal. jagorar turawa ta strongSwan tana buƙatar net.ipv4.ip_forward da net.ipv4.conf.all.rp_filter a sassauta saboda wannan dalili. Ƙaƙƙarfan ƙima ta 1 a kowace ƙofa tana karya hanya daidai cikin shiru, kuma nstat -az yana nuna jefarwar idan ka san inda za ka duba.
| Symptom | Where the reply is most likely lost |
|---|---|
| Gateway ping works, LAN host silent | Source address the far host cannot place in its table |
| SYN arrives, no SYN-ACK, tunnel counters flat | No route to the client prefix on the far host or its gateway |
| Reply counted on the internet-facing interface | Default route or policy rule on the far host |
| Firewall reports invalid state | Asymmetric path through a stateful device |
| Worked until a link failed over | New path is asymmetric, or rp_filter now rejects it |
Yi hanya ko fassara, sannan tabbatar a duka bangarorin biyu
Gyaran biyu ba daidai suke ba. Ƙara hanya yana barin adireshin abokin ciniki lafiya, don haka ƙa'idojin tushe, log ɗin dubawa da manhajojin da ke rubuta mai kira suna ci gaba da aiki; farashin shine kowane tsalle da ke yanke shawara yana buƙatar hanyar, wato wurare da yawa na yin kuskure. Ɓoye adireshi a ƙofar nesa yana rage hanyar dawowa zuwa tsalle ɗaya, domin amsar yanzu an aika ta zuwa ga ƙofar kanta, kuma yana ɓoye wane abokin ciniki ya yi me.
iptables -t nat -A POSTROUTING -o eth1 -s 10.20.30.0/24 -j MASQUERADEZaɓe shi da gangan: da zarar abokan ciniki sun bayyana a matsayin adireshin ƙofar, ACL ɗin tushe sun daina bambanta su, kuma dole conntrack ya riƙe taswirar domin a sake rubuta amsar cikin tunel. Idan masu zaɓe har yanzu suna cire prefix ɗin abokin ciniki, NAT ba ya canza kome, domin buƙatar ba ta taɓa shiga tunel ba.
Kafin ka kira shi an gyara, tabbatar da abubuwa huɗu a jere: hanyar a kan uwar da ke aika amsar, hanyar a kan kowane tsalle da ke tura ta, masu zaɓen da suka rufe duka prefixes ɗin, da rikodin da ke nuna amsar tana shiga tunel da tushen da kake tsammani. Sannan sake gwajin daga wancan wurin. Wucewar gefe ɗaya tsarin buɗaɗɗe rabi ne, kuma gefe na biyu yawanci yana gazawa saboda wani dalili dabam da wanda ka gyara yanzu.