Me ya sa IKEv2 a Android ke gazawa a tashar UDP da ba ta da misali

Ƙofar tana amsa IKEv2 a UDP 4443 saboda wani dalili, bayanan martaba na da fili mai suna Server, kuna rubuta sunan uwar gida da tashar, sai wayar ta ba da rahoton cewa ba za ta iya isa uwar garke ba ko kuma ba za ta iya warware adireshin ba. Babu abin da ake toshewa. Tabbataccen fom na Android yana tsammanin uwar gida, haka ma a Windows. Tasha ta musamman ikon abokin ciniki ne kafin ya zama saitin uwar garke, kuma wasu abokan ciniki ne kawai ke barin ka bayyana ta. Bi sassan uku bisa tsari: abin da abokin ciniki zai iya faɗa, abin da uwar garke ke saurare, da ko ɓangarorin biyu suna tsara fakiti iri ɗaya.

Abin da wayar ta aika a zahiri

Za a warware zaren host:port a fili da aka yi don suna a matsayin suna. Mai warwarewa ba ya mayar da komai don vpn.example.net:4443, kuma kuskuren da kuke gani gazawar warware suna ne ko rashin isa, ba lokaci ya ƙare a tasha ba. Wannan bambanci yana da muhimmanci, domin sake gwadawa da gajeren suna ko wata hanyar sadarwa ba zai taɓa gyara zaren da fom ɗin ba zai iya nazari ba.

Tabbataccen bayanan martaba na IKEv2 a Android, kamar ginanniyar abokin ciniki na VPN na Windows, an kafa shi akan daidaitattun tashoshin IKE. Babu ɗayansu da ke nuna filin tasha, kuma babu wani gyaran bayanan martaba da zai ƙara ɗaya. Idan mai sauraron mai aiki da gaske yana kan 4443, ginannen abokin ciniki shine kayan aiki mara kyau, ba wanda aka saita ba daidai ba.

Yi amfani da abokin ciniki da ke nuna tashar

Abokin ciniki na strongSwan na Android yana rubuta tashar uwar garke da za a iya daidaita a cikin manyan saitin bayanan martaba, shi ya sa yake fitowa a kusan kowace hanyar da ke aiki don wannan tsari. Wannan goyon baya na wancan abokin ciniki ne: wata manhajar IKEv2, ko reshen mai sayarwa na wannan manhaja, mai yiwuwa ba zai nuna wannan fili ba ko da yake daemon ɗin strongSwan na tushe yana goyon bayan sa.

Nemi dukkan saitin a lokaci ɗaya daga mai aiki: sunan ƙofa, tashar UDP, hanyar tabbatarwa, da asalin uwar garke da abokin ciniki zai yi tsammani. Tasha ta musamman ba dalili ba ce don kashe duba takardar shaida ko canza ka'idoji. Shigar da tashar a inda abokin ciniki da aka shigar yake tsammani, kuma idan wannan abokin ciniki ba shi da irin wannan fili, amsar wani abokin ciniki da aka amince da shi ne, ba wata hanya da aka yi hasashe ba.

Uwar garke na da tashoshi biyu, kuma duka biyun dole su yi daidai

IKE yana farawa a UDP 500, kuma hanyar NAT takan motsa IKE da ESP da aka nada zuwa UDP 4500. Waɗannan saiti ne daban a cikin strongSwan, don haka uwar garken da aka motsa zuwa tasha ɗaya ta musamman dole ya canza duka biyun zuwa ƙimar ɗaya:

plugins {
  socket-default {
    port = 4443
    port_nat_t = 4443
  }
}

Da tasha ɗaya don ayyukan biyu, daemon ɗin dole ya bambance IKE da ESP-cikin-UDP a kan soket ɗaya, abin da yake yi ta alamar byte huɗu da ba ESP ba wadda ke gaban saƙon IKE. Shi ya sa abokin ciniki ba zai iya yin shawarwari a tashar ta musamman sannan ya ci gaba a shiru a 4500 ba, kuma shi ya sa jimlar “kawai canza tashar” ke ɓoye buƙatar tsarin fakiti.

Tura gaba ba mai sauraro ba ne

Tura 4443 zuwa wani mai sauraron IKE na yau da kullum shine yanayin gazawar da ke kama da nasara. Musanya ta farko ta iso, uwar garke ta amsa, sannan haɗin yana tsayawa ko ya sake ƙirƙirar maɓallai zuwa wofi, domin amsar tana fita daga wata tasha kuma zirga-zirgar da aka nade daga baya ba ta taɓa dacewa da yanayin da ɓangarorin biyu suka ƙirƙira ba. Ƙa'idar da ke sake rubuta tashar manufa ba tare da motsa mai sauraro ba tana haifar da daidai wannan sakamakon buɗaɗɗe rabi.

Hanyar kuma dole ta ƙyale UDP daga ƙarshen zuwa ƙarshe. Wucewar TCP 443 ta hanyar otal ko cibiyar sadarwar mai aiki ba ta faɗi komai game da IKEv2 a tashar UDP ba, ko da lambar ɗaya ce. Inda kawai TCP 443 aka yarda, tashar UDP ta musamman ba ta mai da IKEv2 HTTPS ba, kuma amsar da ta dace na iya zama wata hanyar shiga maimakon wani gwajin tasha.

Raba matakan uku lokacin gwaji

Yi rikodin a uwar garke yayin da abokin ciniki ke ƙoƙari sau ɗaya. Buƙatar da ba ta taɓa zuwa ba tambaya ce ta ƙarshen hanya ko fuska; buƙatar da ta zo ba tare da amsa ba tambaya ce ta mai sauraro ko manufa; amsar da shiru ya biyo baya ita ce tambayar tsarin fakiti ko asali.

tcpdump -ni eth0 -vv udp port 4443

Sannan karanta saƙon abokin ciniki maimakon juyi mai juyawa. Kuskuren shawara yana nufin algorithms ɗin ba su dace ba, gazawar tabbatarwa tana nufin asali ko takardun shaida ba su dace ba, kuma maimaita aikawa ba tare da amsa ba yana nufin babu abin da ke amsawa a wannan tashar. Gwada mataki ɗaya a lokaci ɗaya kuma canza fili ɗaya tsakanin yunƙuri; takardun strongSwan kan hanyar NAT sun bayyana alamar da halin tashar da rikodin ke nuna maka.