Hanyar XFRM ta haɗiye IKE da ESP: riƙe hanyar waje

An kare zirga-zirgar, tunel ɗin yana aiki, sannan ya mutu a sabuntawar maɓalli ta gaba. Hanyar da aka saba ta hanyar XFRM ta bayyana zirga-zirgar da kuke so a kare. Ta kuma haɗiye fakitiɗin da ake buƙata don ci gaba da kare shi.

Wuraren biyu da abin ya shafa ba su da musanya. Dole hanyar sadarwa ta faɗi haka a fili.

Inda neman abokin haɗi yake zuwa a zahiri

Rubuta dokokin da ke aiki, teburin da ke ɗauke da hanyar XFRM da adireshin jama'a na abokin haɗi. Sannan ka duba hanyar da haɗin waje zai bi tare da ainihin tushensa da alamarsa. Wurin gama gari ba ya gaya maka komai game da wannan hanyar sarrafawa. Ainihin tushe da alama ne kawai ke ba da amsa mai amfani.

Haɗin farko mai nasara ma ba ya tabbatar da komai. Rashin yakan bayyana bayan shigar da hanyar ya canza amsar. Farawa na yin nasara, sannan sabuntawa ta farko ba ta yin nasara.

ip rule show
ip route show table 220
ip -4 route get 198.51.100.44 from 10.40.0.2
ip xfrm policy list

Idan neman abokin haɗi ya ƙare cikin XFRM, ana tura fakitiɗin waje cikin tunel ɗin da suke ginawa. Wannan ita ce madauki, ana iya gani da umarni ɗaya.

Zaɓuɓɓukan keɓewa a ƙofar zamani

Dokar strongSwan game da VPN da ya dogara da hanyoyi ta bayyana amsoshi biyu masu amfani. Ɗaya yana yi wa IKE da ESP alama don kada dokar da ke nuni ga teburin XFRM ta same su. Ɗayan yana barin hanyar abokin haɗi ko keɓewa da neman zai iya isa gareta.

Ɗauki wanda tsarin dokokinka zai iya bayyanawa ba tare da illa ba. Alama tana da tsabta idan sauran tsarin suna amfani da alamomi tuni. Tana da haɗari idan maƙullin guda ɗaya yana nufin wani abu dabam a wata dokar. Duk nau'ikan fakiti biyu suna buƙatar maganin ko ta yaya.

Yin wa IKE kawai alama yana barin fakitiɗin bayanai a kan hanyar da aka kama. Wannan yana samar da tunel da ke yin musafaha sannan ba ya ɗaukar komai.

Alamar ita ce bit ɗaya a cikin fwmark na fakiti wanda babu wani abu a ƙofar da ke da'awarta: 0x1 tare da maƙulli 0x1 shine zaɓin da aka saba, kuma dole a saita shi a wurare biyu don keɓewar ta yi aiki. Charon yana buƙatarsa a kan soket ɗin IKE, kuma saitunan alamar shigowa da fita na haɗin ɗa suna buƙatar wannan ƙimar don fakitiɗin da aka lulluɓe su ma su fita da alama. Maƙulli na 0x1 maimakon 0xffffffff yana barin sauran bit ɗin a buɗe, wanda ke da muhimmanci idan wani tsarin ƙasa yana yi wa fakiti alama a kan wannan na'ura. Idan an saita duka biyu, ana rubuta dokar a matsayin keɓewa, don haka fakitiɗin da ke da alama suna tsallake teburin da ke ɗauke da hanyar XFRM kuma suna faɗowa cikin babban teburin:

ip rule add not fwmark 0x1/0x1 lookup 220 pref 1000
ip -4 route get 198.51.100.44 from 10.40.0.2 mark 0x1

Sannan ka karanta amsar tare da alamar da aka yi amfani da ita. Ba tare da ita ba kana duba hanyar da zirga-zirgar da aka kare ke bi, wanda shine akasin tambayar wannan sashe.

Abin da shigarwa ta atomatik ke tsammani game da ginin

Shigar da hanyar ta atomatik don XFRM ya dogara da sigar strongSwan da tsarin sa. ID na XFRM, manufar da aka shigar da haɗin dole duk su nuna abubuwan da aka nufa. Rashin daidaito yana bayyana a matsayin hanyar da ke nuni a hankali zuwa wani wuri na gaske.

Kwafin lambar tebur ko maƙullin alama daga wata ƙofa shine yadda rikice-rikice ke farawa. Farko duba abin da ke amfani da shi tuni. Rikici yana shafar zirga-zirga fiye da tunel ɗin da kuke so a canza, kuma alamar cutar ba safai take nuni ga kwafin ba.

Canje-canjen adireshin abokin haɗi suna cikin ƙira. Hanyar na'ura don adireshin jiya ba shirin dawo da ƙarshen ba ne, yayin da alama ke tsira daga wannan canjin.

Kula da sabuntawa ta farko

Duba hanyar waje bayan an shigar da hanyoyin da aka kare, ba kafin haka ba. Sannan ka kula da sabuntawa ta gaba da musayar aikace-aikace ɗaya. Rashin yakan bayyana a wannan canjin ba a farkon ba.

ip -4 route get 198.51.100.44
sudo swanctl --list-sas
sudo tcpdump -ni any 'udp port 500 or esp'

Cire hanyar da aka kare na ɗan lokaci yakan dawo da haɗin. Wannan sakamakon bincike ne, ba na ƙarshe ba.

Manufar ita ce rarrabuwa mai tsayawa tsakanin zirga-zirgar ciki da fakitiɗin waje da ke ɗauke da ita. Rubuta hanyar da aka zaɓa da teburinta ko alamarta cikin bayanan ƙofar. In ba haka ba, mutumin da zai taɓa dokokin zai sake dawo da madauki.