Jawaabta VPN-ka goob-ilaa-goob ma maraan tunnel-ka
Jawaabta tunnel-ka dhaafta waa go’aan hoggaamineed oo dhanka fog. Hubi shaxda martigeliyaha, xulayaasha iyo rp_filter, ka dib dooro waddo ama NAT.
Subax ayaan ku qaatay tunnel si nadiif ah u soo baxay oo taraafikada u raray hal jiho oo keliya: laantu waxay gaari kartay server-ka faylasha ee xarunta, iyo xiriir kasta oo laga furay xarunta oo galay laanta waxa uu ku dhintay SYN-kii ugu horreeyay. SA-yadu way shaqeynayeen, tiriyayaasha tunnel-ka way kordhayeen, gacan-qabsiguna waligiis ma ahayn dhibaatada. Jawaabta waxaa loo hoggaaminayay meel tunnel-ku aanu daboolin, go’aankaasna waxaa leh dhanka fog. VPN-ka goob-ilaa-goob wuxuu qaadaa oo keliya baakadaha martigeliyuhu u dhiibo gateway-ga, martigeliye kastaana go’aankaas gooni ahaan ayuu u qaataa, jiho kasta, isagoo ka eegaya shaxdiisa hoggaaminta.
Labada jiho gooni ahaan ayaa loo hoggaamiyaa
IP ma hayo wax xusuus ah oo ku saabsan jihada wada-hadalka. Martigeliye kasta oo baakad diraa wuxuu sameeyaa raadintiisa prefix-ka ugu dheer, wuxuu dooranayaa hal bood oo xiga oo wuu illoobaa go’aanka. Codsiga iyo jawaabtu waa laba baakad oo aan xiriir la lahayn oo si kadis ah isku xiriir uga tirsan, tunnel-kuna waa hal bood oo mid kasta oo iyaga ka mid ah u isticmaali karo ama aan u isticmaali karin. Waxba ku jira isdhaafsiga IKE ma barayaa server-ka fog sida loo gaaro subnet-kaaga; wada-hadalku wuxuu kaliya ku heshiiyaa prefix-yada la sireyn karo.
Heshiiskaas waa iridda labaad. strongSwan xulayaasha taraafikadu waa leftsubnet iyo rightsubnet, baakadka ay isha ama meesha loo socdo ka baxdo lammaanaha la heshiiyay lama sireeyo, waxa kasta oo shaxda hoggaamintu tidhaahdo. Prefix-ka tunnel-ka loo hoggaamiyo laakiin xulayaasha ka maqan waa guuldarro hal-jiho ah oo aamusan: wadadu waxay u muuqataa sax, baakadka wali si cad ayuu u baxaa ama waa la tuuraa, oo kaliya diiwaanka charon ayaa cabanaya.
Martigeliyaha fog waxba kama oga tunnel-kaaga
Gudaha LAN-ka fog jawaabtu waa baakad caadi ah oo loo diray macmiilkaaga. Martigeliyaha loo socdo ma arko cinwaan IPsec mana hayo sabab uu ku doorbido gateway-ga VPN; wuxuu raadiyaa prefix-kaaga, wax ka gaar ah wadada caadiga ah ma helo oo wuu raacaa. Haddii tan caadiga ahi u tilmaanto dab-damis xudun ah, dab-damiskaa wuxuu leeyahay waddo ku noqota tunnel-ka ama ma leh. Marka aanu lahayn, waxaad helaysaa tuurid aamusan, ICMP unreachable, ama jawaab ka baxda interface-ka dhanka internetka oo dhinta.
Interface labaad ku filan yahay inuu tan jebiyo xitaa marka waddo jirto. NAS leh xiriir maamul oo VLAN kale ku yaal, server leh uplink kayd ah, qaanuun siyaasadeed oo hal xad isha u dira shax labaad: mid kasta oo kuwan ka mid ah wuu qaban karaa jawaabta. Linux, ip rule show iyo ip route show table all waxay muujiyaan qaanuunno iyo shaxyo ay liiska caadiga ahi qariyo.
Akhri go’aanka mashiinka dira jawaabta
Weydii kernel-ka ka hor inta aadan wax beddelin, oo sii cinwaanka isha, sababtoo ah qaanuunnada ku xiran isha ayaa beddela jawaabta.
ip route get 10.10.5.10 from 10.20.30.15
ip rule show
ip route show table all
ss -tn state established "( sport = :445 )"Wax-soo-saarku wuxuu sheegaa interface-ka baxa iyo boodka xiga. Haddii interface-ku aanu ahayn kan u jeeda gateway-ga VPN, waad heshay cilladda, shaqada hadhana waa inaad doorato halka waddadu ku habboon tahay. Ping laga sameeyo gateway-ga halkan wax yar buu caddeeyaa: wuxuu ku jawaabaa cinwaan martigeliyaha fog meelayn karo, ma aha cinwaanka laptop-kaaga.
Windows, u-dhigyadu waa Find-NetRoute -RemoteIPAddress 10.10.5.10 go’aanka iyo Get-NetRoute shaxda. Waddo lagu daray New-NetRoute oo sita mitirik ka sarreeya tan caadiga ah aamusan bay u guuldareysataa, marka akhri tiirka mitirikada, ma aha gelinta. Kadib ku xaqiiji baakadaha: tcpdump -ni any "host 10.10.5.10 and tcp port 445" interface-ka LAN-ka fog wuxuu muujiyaa codsiga, isla filtarkuna dhanka tunnel-ka wuxuu muujiyaa haddii jawaab soo noqotay. Codsiga la arko jawaab la’aan macnaheedu waa jawaabta meel kale loo hoggaamiyay ama la tuuray; jawaab ku timid interface khaldan waxay ku siinaysaa dambiilaha ka hor inta aadan taaban waddo.
Marka gateway-ga server-ku aanu ahayn dhammaadka VPN
Goobo badan waxay dab-damis dhex dhigaan server-yada iyo ururiyaha. Dab-damiskaas wuxuu gudbiyaa jawaabta, marka wuxuu u baahan yahay waddo prefix-ka macmiilkaaga u jeeda gateway-ga VPN, iyo siyaasad gudbin labada jiho. Aaladaha xaaladda hayaa way ka sii daraa: codsigu wuxuu ka gudbay dab-damiska martigeliye LAN ah oo uu oggolaaday, jawaabtu hadda waxay ka timaaddaa jiho kale, gelinta dabagalka xiriirku mar dambe ma qabanayo, marka baakadka waa la tuuraa isagoo aan ansax ahayn halkii la diidi lahaa. Taas ayaa sababta diiwaanka siyaasadu u muuqdo mid madhan inta taraafikadu lumayo.
Gateway-ga wuxuu leeyahay filtarkiisa labaad. Filtarka waddada rogan ee Linux wuxuu tuuraa baakadaha ishuna aan laga gaari karin interface-kii ay ku soo galeen, taasna waa saxan qaabka waddo-noqod aan simanayn oo sharci ah. hagaha gudbinta strongSwan wuxuu sababtaas u dalbanayaa net.ipv4.ip_forward iyo net.ipv4.conf.all.rp_filter dabacsan. Qiimaha adag ee 1 gateway kasta wuxuu aamusan u jebiyaa waddo sax ah, nstat -az-na wuxuu muujiyaa tuurista haddii aad taqaan meesha aad eegto.
| Symptom | Where the reply is most likely lost |
|---|---|
| Gateway ping works, LAN host silent | Source address the far host cannot place in its table |
| SYN arrives, no SYN-ACK, tunnel counters flat | No route to the client prefix on the far host or its gateway |
| Reply counted on the internet-facing interface | Default route or policy rule on the far host |
| Firewall reports invalid state | Asymmetric path through a stateful device |
| Worked until a link failed over | New path is asymmetric, or rp_filter now rejects it |
Haggaami ama turjun, kadib xaqiiji labada jiho
Laba hagaajintu isku mid ma aha. Waddo ku dariddu waxay cinwaanka macmiilka ka dhigtaa mid aan la taaban, marka qaanuunnada isha ku saleysan, diiwaannada hubinta iyo barnaamijyada diiwaangeliya wacaaga way sii shaqeeyaan; qiimaha waa in bood kasta oo go’aanka qaata uu u baahan yahay waddada, taas oo ah meelo badan oo khalad lagu sameeyo. Qariska gateway-ga fog wuxuu waddada noqodka ku soo koobaa hal bood, sababtoo ah jawaabtu hadda waxay u jeeddaa gateway-ga laftiisa, wuxuuna qariyaa macmiilka wax qabtay.
iptables -t nat -A POSTROUTING -o eth1 -s 10.20.30.0/24 -j MASQUERADESi miyir leh u dooro: marka macmiilladu u muuqdaan cinwaanka gateway-ga, ACL-yada isha ku saleysan ma kala garto iyaga, conntrack-na waa inuu hayaa khariidaynta si jawaabta tunnel-ka loogu qoro. Haddii xulayaashu wali ka reebban prefix-ka macmiilka, NAT waxba ma beddelo, sababtoo ah codsigu waligiis ma gelin tunnel-ka.
Ka hor inta aadan sheegin in la hagaajiyay, xaqiiji afar shay si kala horreysa: waddada martigeliyaha dira jawaabta, waddada bood kasta oo gudbiya, xulayaasha daboola labada prefix, iyo duubid muujinaya jawaabta oo tunnel-ka gasha isha aad filayso. Kadib ku celi tijaabada goobta kale. Hal jiho oo gudubta waa naqshad badh-furan, jihada labaadna badanaa waxay ku guuldareysataa sabab ka duwan tii aad hadda hagaajisay.