VPN goob-ilaa-goob ku salaysan waddooyin iyo mid ku salaysan siyaasad: maxaa ku kala duwan
IPsec ku salaysan siyaasad wuxuu taraafikada ku doortaa dooro; kan ku salaysan waddooyin wuxuu ku diraa interface tunnel. Labaduba waxay weli u baahan yihiin sharciyada firewall iyo waddo soo-celin.
Labada naqshad waxay ku ilaaliyaan isla taraafikada isla mishiinka IPsec, waxayna ku kala duwan yihiin waxa go'aamiya kee baakad ah inuu tunnel-ka galo. Xidhiidhka ku salaysan siyaasad, doorayaasha taraafikada ee la wada xaajooday ayaa qabta shaqadaas; kan ku salaysan waddooyinka, waddo u tilmaamaysa interface tunnel ayaa qabta. Labada in la isku qaldo waxay abuurtaa dunta taageero ee caanka ah oo tunnel-ku sheegto inuu taagan yahay halka barnaamijku aanu meelna gaarin. Farqiga ayaa ugu muhiimsan marka aad ku darto shabakad, kordhiso borotokool waddooyin, ama aad baarto waddo si aamusnaan ah uga baxda bixitaanka khaldan.
Laba siyaabood oo lagu go'aamiyo waxa tunnel-ka galaya
VPN ku salaysan siyaasad wuxuu dhisaa siyaasad amni oo u dhigma horgalayaasha isha iyo halka loo socdo, ka dibna wuxuu sireeyaa wax kasta oo ku habboon. Lammaanuhu waa inuu ka wada xaajoodaa doorayaal is waafaqsan, sidaas darteed baaxadda wax ku oolka ah waxay ugu dambayn noqotaa isgoyska waxa labada dhinacba soo bandhigeen. Wax ka baxsan isgoyskaas lama ilaalin, wax kastoo shaxda waddooyinku tidhaahdo.
VPN ku salaysan waddooyin wuxuu abuuraa interface matala tunnel-ka wuxuuna u oggolaanayaa shaxda waddooyinka inay taraafikada gudaha u diraan. IKE daemon weli wuxuu rakibaa xaaladda iyo siyaasadda interface kasta, waana faahfaahinta dadku seegaan marka ay go'aansadaan in waddooyinku beddeleen sireynta. Labada naqshadba waxay ku sireeyaan IPsec; kaliya habka doorashada ayaa ka duwan.
U akhri isbarbardhigga hoose sida urur calaamado guul-darro ah ee ma aha sida shax goleed, sababtoo ah tiirna keligiis ma guuleysto.
| Aspect | Policy-based | Route-based |
|---|---|---|
| What selects traffic | Negotiated selectors | A route into the tunnel interface |
| Adding a network | Edit selectors on both peers | Add a route, widen the selector once |
| Dynamic routing | Awkward to run over the tunnel | Runs over the interface directly |
| Typical failure | Tunnel up, host outside the selector | Tunnel up, no route or wrong source |
Ku salaysan siyaasad: doorashada waa heshiiska
Doorayaasha waa la wada xaajoodaa, ma aha oo kaliya in la habeeyo. Soo jeedi 10.10.0.0/16 dhinac iyo 10.10.1.0/24 dhinaca kale, markaas ururku wuxuu dabooli doonaa wixii ay wada xaajoodku ku soo dhammaatay halka martida kale oo dhan ay bannaanka ku sii tahay.
Akhri xaaladda la rakibay halkii aad akhrin lahayd faylka habaynta. Lammaanaha Linux, shaxaha kernel-ka laftiisu waa runta aasaasiga ah, waxayna muujiyaan waxa ka badbaaday wada xaajoodka. Siyaasad sheegta horgalayaasha saxda ah laakiin aan lahayn xaalad u dhigma waxay ka dhigan tahay in ururku uusan waligiis kicin. Xaalad la lammaaneysan siyaasad horgale khaldan waa dhibaatada lidka ah, waxayna abuurtaa tunnel u eg caafimaad halka hal subnetwork aanu meelna gaarin.
sudo ip xfrm state
sudo ip xfrm policy
sudo swanctl --list-sasIsbarbardhig labada soo-saaridood horgalayaasha aad u malaynayso inaad ilaalinayso. Isbarbardhiggaas keliya wuxuu xalliyaa inta badan warbixinnada tunnel shaqeeya oo leh server aan la gaari karin. Wuxuu kaloo tilmaamaa lammaanaha la beddelo, sababtoo ah ismaandhaafka badanaa waxaa la arkaa hal jiho oo keliya.
Ku salaysan waddooyin: interface-ka waa heshiiska
Interface XFRM wuxuu tunnel-ka siiyaa magac iyo aqoonsi, taraafikaduna way gaartaa sababtoo ah shaxda waddooyinku sidaas tidhaahdaa. Horgalayaal badan oo fog ayaa markaas noqda dhibaato waddooyin halkii ay ahaan lahaayeen dhibaato dooro, borotokool waddooyinna wuu ku dhawaaqi karaa. Taasi waa faa'iidada dhabta ah, ma aha sireynta.
Interface-ku ma tirito baahida siyaasad. Daemon-ku wuxuu rakibaa sharciyada interface kasta oo ku xiran aqoonsiga interface-ka, sidaas darteed baakad yimaadda interface khaldan weli wuu guuldarraystaa. Cinwaanka isha oo lammaanuhu aanu aqbali doonin sidoo kale wuu guuldarraystaa, xitaa waddo fiican la socota. Ku salaysan waddooyin macneheedu waa in waddadu go'aamiso gelitaanka, ma aha in siyaasadu baaba'day.
sudo ip link add xfrm0 type xfrm dev eth0 if_id 42
sudo ip route add 10.20.0.0/16 dev xfrm0
ip -s link show xfrm0
ip route get 10.20.5.10La soco tiriyayaasha interface-ka marka waddadu meesha taal. Waddo jirta halka tiriyayaashu eber ku sii hayaan waxay ka dhigan tahay in waxba aan tunnel-ka lagu waafajin, taas oo badanaa tilmaamaysa xaalad maqan halkii ay ahayd waddo maqan.
Halka labada naqshad ay dhab ahaan ku kala tagaan
Ku darista shabakad waa imtixaanka ugu nadiifka ah ee ah kee qaab ugu habboon. Naqshad ku salaysan waddooyin waxay ku darsataa hal waddo oo ugu badnaan hal mar ballaarisa doorashada, halka naqshad ku salaysan siyaasad ay wax ka beddesho lammaanayaasha horgalayaasha labada dhinac oo dib u xaajooto. Laba subnetwork oo xasilloon ayaa beddelkaas ka dhigaya mid fudud, labaatanna waxay ka dhigaan mashruuc.
Midkoodna ma beddelo firewall, isbarbardhigyaduna badanaa way joogsadaan ka hor bartaas. Dooro ballaaran ama waddo ballaaran ayaa go'aamisa waxa la sireeyo, ma aha waxa la oggol yahay.
Dhaqanka MTU sidoo kale wuu kala duwan yahay. Duubista waxay yaraysaa culayska la isticmaali karo, interface ku salaysan waddooyinna wuxuu qaataa MTU u gaar ah, sidaas darteed MSS ku adkaynta labada irid waxay ka hortagtaa calaamadda godka madow halka jawaabaha yaryar yimaadaan kuwa waaweyna libdhadaan. Tunnelada ku salaysan siyaasad waxay la kulmaan isla darbiga dhinaca kale, sababtoo ah doorashadu waxba kama sheegto cabbirka baakadda. U dhig adkaynta si ula kac ah halkii aad lammaanaha eedayn lahayd.
U guurid iyada oo aan lumin waddada soo-celinta
Diiwaangeli lammaanayaasha horgalayaasha ee jira ka hor inta aadan wax beddelin, ka dib u rar hal waddo barnaamij oo u fiirso bilow ilaa dhammaad. Tunnel la dhisay ma aha tunnel wax gudbiya, farqiguna wuxuu ka muuqdaa jihada jawaabta.
Marka lammaanuhu xidhiidhmaan laakiin martida LAN aanay xidhiidhin, baar waddada soo-celinta iyo cinwaanka isha oo martida fog isticmaali doonto. Marti leh laba interface ayaa laga yaabaa inuu ka jawaabo mid khaldan, beddelka doorashaduna taas ma hagaajiyo. Qabo taraafikada labada daraf ka hor inta aadan wax ka beddelin algorithms.
ip route get 10.20.5.10
sudo tcpdump -ni any host 10.20.5.10 and icmp
sudo swanctl --list-connsHayso waddo maamul oo aan tunnel-ka ku tiirsanayn inta aad shaqaynayso. Dib u noqoshadu way fudud dahay marka gelitaanka iridka laftiisu aanu saaranayn xidhiidhka aad baarayso.