strongSwan ESP-in-UDP: yayin da babu NAT da za a gano

Gano NAT yana amsa tambaya ɗaya: shin adireshin ko tashoshin sun canza a hanya? Ba ya amsa ko bangon wuta yana barin ka'idar IP 50. Ƙofofin rukunin da ba su da wata fassara za su iya kasancewa a bayan manufar da ke watsar da native ESP, kuma wannan buƙatar dole ne a saita ta maimakon gano ta. Hanyar ita ce ESP-in-UDP, kuma shawara ce ba madadin da ke fitowa da kansa ba.

Gano lissafi ne a kan adireshi, ba gwajin bangon wuta ba

IKEv2 yana ɗaukar kayan aikin gano NAT waɗanda ke ɗauke da hashes na adireshin da tashoshin tushe da manufa. Kowane ɓangare yana kwatanta abin da ya karɓa da abin da yake gani a gida, kuma rashin daidaituwa yana gaya masa cewa wani abu ya fassara fakitin. Babu wani abu a wannan musayar da yake gwada ko na'urar sarrafawa a tsakiya tana aika ka'idar 50.

Ya kamata a faɗi sakamakon a aikace a sarari. Ramin da ya yi aiki da native ESP ba zai gano sabon bangon wuta mai ƙuntata da kansa ba, kuma ƙoƙarinsa na gaba zai kasa a matakin bayanai yayin da IKE ke ci gaba da yin nasara. Za ka ga ƙungiyoyin tsaro na IKE da aka kafa da babu zirga-zirgar da aka kare, wanda ke kama da kuskuren hanya har sai ka kama a waya.

Don haka ɓoyewa dukiya ce ta haɗin da ka saita, ba sakamakon da ɓangarorin ke tattaunawa daga halin cibiyar sadarwa ba.

Yadda encap ke canza musayar

A cikin ingantaccen tsarin strongSwan da ake gudanarwa ta swanctl.conf, saitin encap = yes a kan haɗin yana shafar musayar gano NAT domin duka ɓangarorin su yi amfani da ɓoyewar UDP don ESP. Fakitin da aka kare sai su yi tafiya cikin UDP, yawanci a tasha 4500, kuma dole ne duka ƙarshen biyu su amince da wannan tsari.

connections {
    site {
        encap = yes
        # existing approved peer, authentication and child settings
    }
}

Wannan guntun yana cikin ainihin ma'anar haɗi kuma ba cikakken bayanin rukuni ba ne. Ka riƙe adireshin abokan haɗi, tabbatarwa da masu zaɓen zirga-zirgar child da kake yi yanzu; maɓallin da aka ƙara kaɗai yana canza yadda ake naɗe bayanan da aka kare, ba abin da yake karewa ba.

Jagorar strongSwan kan NAT-traversal tana bayanin wannan hali, gami da hulɗa da tashar da ke iyo lokacin da ake amfani da MOBIKE.

Yi amfani da saitin da ya dace da backend ɗinka

strongSwan yana da backend ɗin saiti biyu, kuma maɓallin ya bambanta tsakaninsu. swanctl.conf haɗi yana ɗaukar encap, yayin da tsohon ipsec.conf haɗi yana ɗaukar forceencaps. Saka kalmar maɓalli ta backend ɗaya cikin ɗayan yana haifar da saitin da ke lodawa ba tare da ƙorafi ba kuma ba ya canza kome, wanda ya fi kuskure muni.

Duba wane daemon ke gudana da gaske kafin ka gyara kome. A yawancin rarraba duka fayilolin biyu suna wanzu saboda ɗaya ragowar ƙaura ce ta baya, kuma mai aiki shine wanda sashin sabis ɗin ke farawa. Karanta wannan sashin maimakon yin hasashe daga tambarin lokacin fayil. Dubawa na daƙiƙa biyar a nan yana hana sa'o'i na gwada saitin da babu abin da ya loda.

Aiwatar da canjin ta hannun mai haɗin kuma sake kafa ƙungiyar a cikin taga da aka sarrafa. Child da aka riga aka shigar yana riƙe ɓoyewarsa ta yanzu har sai an maye gurbinsa, don haka gyaran fayil kawai ba ya tabbatar da cewa ana amfani da sabon tsari.

Tabbatar da bayanan da aka naɗe, ba tashar kawai ba

Ka kama a ƙofa yayin da zirga-zirgar da aka kare ke gudana, sannan ka kwatanta wannan da ra'ayin strongSwan kansa:

$ sudo tcpdump -ni eth0 'udp port 4500' -c 20
$ sudo swanctl --list-sas --ike site
$ sudo ip xfrm state list

Native ESP yana bayyana a matsayin ka'idar IP 50 kuma ba ya kama da UDP ko kaɗan. Naɗaɗɗen ESP yana bayyana a matsayin datagrams na UDP a 4500 waɗanda kayan aikinsu ba IKE ba ne. Zirga-zirgar IKE a wannan tasha ba hujja ba ce ta ɓoyewa, saboda MOBIKE na iya motsa IKE zuwa can yayin da hanyar bayanai ta kasance native, don haka karanta kayan aikin, ba lambar tasha ba.

Ka tuna da MTU na hanya. Rufin yana ƙara ƙarin kuɗi, kuma hanyar da ta ɗauki native ESP na iya buƙatar gyare-gyare idan fakitin suka girma. Dole ne maganin ICMP da ake buƙata ya kasance wani ɓangare na ƙira; ɓoyewa ba ya kawar da wannan dogaro.

Karɓi canjin lokacin da sabon zirga-zirgar aikace-aikace a cikin ramin ya bayyana a cikin kamawa a matsayin naɗaɗɗen ESP a duka ƙarshen biyu, kuma lokacin da sabis ɗin ciki da hanyar dawowarsa ke aiki. Duk abin da bai kai haka ba saitin ne da ke kama da daidai a cikin fayil.