VPN site-ka-site ama gelitaan fog: mid kastaa muxuu isku xiraa
Mid wuxuu isku xiraa albaabada, kan kalena wuxuu isku xiraa aaladaha. Isbarbardhig doorashooyinka taraafikada iyo waddooyinka, qorsheeyo cinwaannada, kadibna tijaabi gudbinta iyo siyaasadda host dhab ah.
Labada naqshadoodba waxaa loo yaqaan VPN waxayna xalliyaan dhibaatooyin kala duwan. Tunnel-ka site-ka-site wuxuu isku xiraa laba albaab, sidaas darteed host kasta oo ka dambeeya wuxuu gaari karaa cinwaannada la ogolaaday dhinaca kale isagoo aan waxba rakibin. Tunnel-ka gelitaanka fog wuxuu aaladaha gaarka ah ku xiraa shabakad, hal macmiil mar. Isbarbardhiggani waa muhiim maxaa yeelay badi khaladaadka geynta waxay ka yimaadaan in mid la habeeyo iyadoo la filayo dhaqanka kan kale, calaamadduna badanaa waa waqti-dhaaf ku yimaada adeeg uu tunnel-ku dhab ahaan gaaray.
Laba naqshad, laba xad
| Site-to-site | Remote access | |
|---|---|---|
| Endpoints | two gateways | a gateway and each client |
| Who configures | network owners | each user or an MDM |
| Scope of reach | whatever the gateways route | whatever the client is granted |
| Broadcast discovery | not carried | not carried |
Midkoodna ma ballaadhiyo domain-ka baahinta LAN. Aaladaha dhinaca fog kama soo baxaan liiska ogaanshaha maxalliga ah, oo taas filashadeeda waa malaha ugu horreeya ee laga tagayo. Magacyada DNS-ka gaarka ah ee aad si ula kac ah u daabacdo ayaa ka saadaalin kara mid kasta oo borotokool ogaansho ah, wayna ku sii noolaadaan beddelka bixiye.
Qaado 10.10.0.0/24 hal site iyo 10.20.0.0/24 site kale. Albaabka A wuxuu u baahan yahay waddo ama doorasho taraafik oo u dira horgalaha 10.20.0.0/24 tunnel-ka, albaabka B-na wuxuu u baahan yahay sawirkiisa muraayad ah. Kadib host-yada labada dhinac waxay isticmaalaan isku-xirka IP caadiga ah oo waligood ma ogaadaan in tunnel jiro. Muuqaalladaas la arki karin waa sifada, waana sababta guuldarrooyinku ugu muujiyaan sida khaladaadka shabakada caadiga ah ee aan ahayn khaladaadka tunnel-ka.
Ku salaysan siyaasad iyo ku salaysan waddo isku mid ma aha
Geynta IPsec ee ku salaysan siyaasad, doorashooyinka taraafikada ee la wadaagay waxay si sax ah u qeexaan lammaanaha isha iyo meesha la galo ee la ilaaliyo. Haddii subnet cusub ka soo baxo dambe albaab oo aanay doorasho ku habboonayn, tunnel-ku wuu sii shaqeeyaa subnet-ka cusub-na si fudud lama qaado. Naqshad ku salaysan waddo, interface ayaa qaata taraafikada oo shaxda waddooyinka ayaa go'aan qaadata, taas oo ka dhigaysa ku darista horgale beddel waddo ee aan ahayn gorgortan cusub oo tunnel-ka.
StrongSwan wuxuu si toos ah u muujiyaa labada aragti, akhrintooda wadajirka ahna waa habka aad ku ogaato nooca aad dhab ahaan geynay.
swanctl --list-sas
ip xfrm policy
ip -4 route show table all | grep -E '10\.(10|20)\.'Liiska doorasho ee ka maqan horgalaha aad u baahan tahay wuxuu sharraxaa guuldarrada iyada oo aan wax qabasho baakad ah la sameyn, waddona tilmaamaysa interface khaldan waxay sharraxaysaa guuldarrada muraayadda ee jidka soo noqoshada. Akhri labadaba ka hor inta aadan wax dib u gorgortamin, maxaa yeelay cusboonaysiinta fure ma darayso doorasho aad waligaa habayn.
Qorshee cinwaannada ka hor tunnel-ka
Xadka is-dul-saaran waa khaladka naqshadeynta ee aan lagu hagaajin karin habayn. Haddii labada site isticmaalaan 192.168.1.0/24, host u baahan 192.168.1.50 wuxuu leeyahay laba musharrax oo aan lahayn hab uu ku doorto. Tunnel-ku wuu xaqiijin doonaa, ururrada amniga waa la dhisi doonaa, go'aanka waddona wuxuu ahaan doonaa mid khaldan ama mugdi ah si kastaba.
Dooro mid ka mid ah saddex xulasho oo daacad ah: dib u nambaree hal site, turjun xadka is-dul-saaran albaabka si dhinac kastaa u arko horgale gaar ah, ama ka tag waddo toos ah host-yadaas oo ku daabac adeegga si kale. Mid kastaa wuxuu leeyahay kharash, kan ugu horreeyaana badanaa waa kan ugu jaban muddo laba sano ah. Go'aan ka gaar ka hor inta tunnel-ku jirin, maxaa yeelay hadhow isbeddelku wuxuu taabanayaa aalad kasta oo cinwaankii hore leh.
Xalliso su'aasha MTU goor hore sidoo kale. Tunnel-ku wuxuu yareeyaa culayska faa'iidada leh, naqshad ku tiirsan kala-baxna wuu u dhaqmaa si ka duwan mid albaabada ku dhejiya MSS.
Gudbinta iyo siyaasaddu waxay ka baxsan yihiin tunnel-ka
Albaabku waa inuu diyaar u yahay inuu baakadaha u gudbiyo inta u dhaxaysa interface tunnel-ka iyo interface LAN, labada jiho-na waxay u baahan yihiin siyaasad ogolaata adeegga. Linux gudaheeda kuwani waa laba goobo oo kala duwan, lagu daro xeerarka firewall-ka ee go'aamiya haddii socodka la gudbiyay la ogolaaday ama aan la ogolayn.
sysctl -w net.ipv4.ip_forward=1
iptables -A FORWARD -s 10.20.0.0/24 -d 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -s 10.10.0.0/24 -d 10.20.0.0/24 -j ACCEPTHost-ka qaata wuxuu ku darayaa lakab saddexaad: firewall-kiisa wali waa inuu aqbalaa macmiil ka imanaya subnet-ka fog. Adeegaha faylka ee kaliya ogolaada /24 maxalliga ah wuxuu diidi doonaa taraafikada laga soo gudbiyay 10.20.0.7, si kasta oo tunnel-ku u muuqdo mid caafimaad qaba, diidmadaasna waa sahlan tahay in loo akhriyo guuldarro waddo.
Ka tijaabi host, ma aha albaabka
Ping uu albaabka laftiisu diro wuxuu raaci karaa cinwaan isha iyo siyaasad ka duwan taraafikada isticmaalaha ee la gudbiyay. Taas ayaa ka dhigaysa tijaabo daciif ah iyo mararka qaarkood mid marin-habaabin leh: way guulaysataa marka barnaamijku guuldarraysto, ama way guuldarraystaa marka barnaamijku shaqeeyo.
ip route get 10.10.0.5 from 10.20.0.7
ping -I 10.20.0.7 10.10.0.5
curl -sv --max-time 5 http://files.10-10.internal/ -o /dev/nullIsticmaal host dhab ah, cinwaan isha dhab ah iyo borotokoolka dhabta ah ee barnaamijku isticmaalo. Kadib akhri jidka soo noqoshada si gaar ah, maxaa yeelay jiho hore oo shaqaysa oo aan lahayn waddo soo noqosho waxay soo saartaa waqti-dhaaf u eg adeeg la xannibay.
Dooro naqshadda iyadoo lagu saleynayo su'aasha aad ka jawaabto: ma isku xiraysaa shabakado mise waxaad aqbalaa aalado? Wax kasta oo kale, oo ay ku jirto bixiyaha aad habayso, waxay ka timaadaa jawaabtaas.