Tunnel ɗin VPN ba ya haɗuwa har abada: inda fakiti suke tsayawa a zahiri

Abokin ciniki yana ci gaba da sake gwadawa, log ɗin yana tsayawa kafin musayar hannu ta cika, kuma uwar garken ba ta rubuta komai kwata-kwata. Wannan tsarin yana karkatar da hankali daga bayanan shiga zuwa hanyar: wani abu tsakanin ɓangarorin biyu ya ƙi ɗaukar ƙa'idar da tunnel ɗin ke buƙata. Ƙayyade inda fakiti suke tsayawa kafin ka taɓa kowane ɗaya daga cikin saitin biyu, domin ƙa'idar da aka tace da kalmar sirri mara kyau suna haifar da kuskure ɗaya mai daɗi a yawancin abokan ciniki. An jera gwaje-gwajen bisa kuɗi, mafi arha da farko.

Tabbatar da inda zirga-zirgar ke tsayawa

Ɗauki hoto a lokaci ɗaya a kan hanyar fita ta abokin ciniki da kuma a uwar garken. Kwatanta abin da ya fita da abin da ya iso, ka lura a wace hanya ake ganin bambancin.

Babu komai a uwar garken yana nufin hanya ko NAT na farko yana watsi da zirga-zirga, yayin da isowa ba tare da amsa ba tana nuni ga bangon wuta a uwar garken ko hanyar dawowa da babu ita. Na'urar da ke ƙarshe da tunnels akai-akai ba ta riƙe log mai amfani, don haka ɗaukar hoton ya zama rikodin. Rubuta tashar manufa da lambar ƙa'ida, domin duka gazawar biyu suna bayyana ɗaya a cikin taga abokin ciniki.

PPTP yana mutuwa ba tare da ƙa'ida ta 47 ba

PPTP yana ɗaukar sarrafawa a kan TCP 1723 da bayanansa a cikin GRE, wanda shine ƙa'idar IP ta 47 ba lambar tasha ba. Tura 1723 kawai yana haifar da sakamakon da aka saba: haɗin yana tabbatar da kansa sannan ya yi shiru, domin babu wata ƙa'ida ga ƙa'idar da ke ɗaukar kaya. Abokin ciniki ba zai iya bambanta hakan da kalmar sirri da aka ƙi ba, shi ya sa dole ɗaukar hoton ya zo kafin gyare-gyaren saiti.

Wucewa tana gudana a kishiyar hanya daga tura mai shigowa, kuma firmware yana amfani da lakabi ɗaya ga duka biyu sau da yawa isa ya rikitar da kowa. A kan abokin ciniki na Linux bangon wuta na gida zai iya watsi da GRE tun kafin na'urar ta shiga, don haka ƙa'ida ta 47 tana buƙatar nata dokar kuma dole a loda mataimakin conntrack. ufw na Ubuntu yana riƙe waɗannan dokoki a cikin fayil ɗin before, domin dokokin allow na yau da kullum ba za su iya bayyana lambar ƙa'ida ba. Bayan haka sake loda bangon wuta maimakon sake kunna na'urar.

# /etc/ufw/before.rules, inside *filter
-A ufw-before-input -p gre -j ACCEPT
sudo ufw allow 1723/tcp
sudo modprobe nf_conntrack_pptp
sudo conntrack -L | grep gre

L2TP da IPsec a bayan NAT biyu

L2TP cikin IPsec yana buƙatar UDP 500 don musayar maɓalli, UDP 4500 da zarar an gano NAT, da ESP a matsayin ƙa'ida ta 50. Kowane ɗayansu ana tace shi daban, don haka dokar da ta ba da izinin ɗaya ba ta tabbatar da komai game da sauran biyun. Na'urori biyu a jere suna fassara kowane fakiti sau biyu, kuma ƙarshen ɓangarorin ba su yarda da abin da aka tattauna ba.

Haɗa modem na waje a matsayin gada, ko kashe NAT a na'urar ciki, domin adireshin jama'a ya isa na'urar da ke ƙarshe da tunnel ɗin. Inda babu ɗaya daga cikinsu, dole a fara tunnel ɗin daga cikin iyakar NAT biyu, ba a ƙarasa shi a can ba.

Cibiyoyin sadarwa da rabon adireshi

Adireshin WAN cikin 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 ko 100.64.0.0/10 yana nufin na'urar ba ta da adireshin jama'a kuma babu turawa mai shigowa daga intanet da zai isa gare ta. NAT na matakin cibiyar sadarwa kuma yana tace ƙa'idodin da ba ya tsammani, kuma GRE ya zama abin da ake yawan rasa a kan hanyoyin wayar hannu. Kwatanta adireshin WAN a kan na'urar kanta, ba adireshin da wani shafi ke bayarwa ga abokin ciniki da ke bayanta ba.

Gudanar da wannan na'urar a kan layin waya yana raba binciken cibiyar sadarwa da kuskuren saiti a gwaji ɗaya. Inda cibiyar sadarwa ta ƙi ƙa'idar, zaɓuɓɓukan da suka rage su ne wata hanya ta dabam a kan 443 ko tunnel da aka fara daga ciki.

Karanta jerin masu sauraro kafin ka rufe tashoshi

Binciken tashoshi mai tsoratarwa galibi shine kawai tsarin fasalin da ake bayarwa a kunne. Ɗauki lissafin masu sauraro, haɗa kowane socket da wani fasali, sannan kashe fasalin maimakon toshe tashar, domin ra'ayoyin biyu kada su rabu.

ss -lntup
systemctl list-units --type=service --state=running | grep -i vpn
nc -vz 203.0.113.10 1723
nc -vzu 203.0.113.10 4500

Tsoffin saitin SoftEther misali ne mai kyau: TCP 443, 992 da 5555, tare da fasalulluka na L2TP/IPsec da tunnel na DNS suna ƙara nasu sockets. Kashe waɗannan fasalulluka yana cire masu sauraro maimakon ɓoye su, kuma gwajin daga wata na'ura ta waje yana gaya maka ko cibiyar sadarwa tana barin tashar ta wuce kwata-kwata. Mai sauraro da ke amsa a gida zai iya kasancewa a rufe a sama, don haka kwatanta adireshin WAN na na'urar da abin da wata sabis ta waje ke bayarwa.