Ping ma aha caddayn: tijaabi wadada u dhexeysa laba goobood

Tunelka wuu shaqeynayaa, gateway-yadu way is jawaabaan, haddana isticmaalayaasha hal goob ma furi karaan wadaagga faylka ee goobta kale. Qof wuxuu ping ka sameeyaa gateway-ga, jawaab buu helaa oo wuxuu ku dhawaaqaa in shabakaddu caafimaad qabto. Jawaabtaas waxay u dhex martay laba qalab oo aan waligood dhibaato ahayn. Tijaabo faa'iido leh waxay ka bilaabataa hostka adeegga u baahan, waxay isticmaashaa borotokoolka app-ku isticmaalo oo waxay soo celisaa xaaladda uu ku fashilmo. Wax kasta oo kale waa iftiin cagaar ah waddo aan cidna ku sugin.

Ka bilow macmiilka u baahan adeegga

Qor afar shay ka hor inta aadan wax tijaabin: cinwaanka macmiilka, cinwaanka meesha loo socdo, magaca hostka iyo port-ka app-ka. Kadib xaqiiji in adeeggu si maxalli ah uga shaqeeyo goobtiisa, host ku xiga. Iyada oo aan lahayn saldhiggan ma kala garan kartid tunel jabay iyo adeeg jabay, badhkana tiketkani waa kan labaad.

Isku day magaca hostka la diiwaangeliyay iyo, halka adeeggu u oggolaado, hubinta cinwaanka tooska ah ee isla port-ka. Raadinta magac fashilantay iyo cinwaan la xalliyay oo aan la gaari karin waxay kuu horseedaan waddooyin kala duwan. Haddii aad magaca hostka ku beddesho IP, ha damin hubinta aqoonsiga HTTPS si ay u shaqeyso; digniinta shahaadadu waa macluumaad, ma aha carqalad.

Raac wadada gees kasta

Akhri wadada uu macmiilku doorto, kadib wadada uu gateway-gu u doorto meeshaas, kadib tiriyeyaasha ama qabasho xaddidan gees kasta. Waxaad raadinaysaa laba xaqiiqo: in codsigu gaaray LAN-ka fog, iyo in jawaab soo noqotay. Tiriyeyaasha interface-ka waxay ku jiraan dhammaan qulqulka kale, sidaas darteed ku xiriir waqtiga saxda ah iyo lammaanaha cinwaanka halkii aad ka xiri lahayd qaabka garaafka. Qabasho laga sameeyay gees khaldan waa ka xun mid aan jirin, sababtoo ah waxay u eg tahay caddayn.

ip route get 10.10.0.5
sudo tcpdump -ni any host 10.10.0.5 and port 445
sudo tcpdump -ni any net 10.10.0.0/24 and net 10.20.0.0/24

Haddii codsigu ka soo muuqdo geeska fog oo aan jawaab ka dambeyn, dhibaatadu waxay ku taal dhinaca kale: firewall, waddo soo noqod oo maqan ama host aan aqbalin isha. Haddii codsigu waligiis soo muuqan, waddada maxalliga ah ama doorashooyinka tunelka ma qaadin, dhinaca kalena weli ma mudan baaritaan.

Isticmaal borotokoolka app-ku isticmaalo

ICMP waa baaritaan daciif ah. Waa la shaandheyn karaa, xawaare ahaan waa la xaddidi karaa ama siyaasad ka duwan adeegga ayaa loola macaamilayaa, taasoo ka dhigaysa guusha iyo guuldarrada labadaba mugdi. Tijaabi port-ka dhabta ah iyo, halka aad awoodo, gacan-qaadista borotokoolka dhabta ah.

nc -vz 10.10.0.5 445
curl -sv --max-time 5 https://files.corp.internal/ -o /dev/null
openssl s_client -connect 10.10.0.5:443 -servername files.corp.internal

Gacan-qaadis TCP oo dhammaatay waxay caddeynaysaa gaaritaanka iyo siyaasadda port-kaas. Ma caddeyneyso in app-ku shaqeeyo: xaqiijinta, soo gelinta ama wicitaan API gaar ah ayaa weli fashilmi kara. Tijaabi hawsha isticmaalayaashu dhab ahaan sameeyaan, adigoo isticmaalaya wax u dhigma oo aan waxyeello lahayn halkii aad si isdaba joog ah u gudbin lahayd macaamil dhab ah.

Soo celi xaaladda uu ku fashilmo

Fashilada kaliya ku muuqda wareejinta waaweyn waa dhibaato cabbir, ma aha xiriir. Dir baakad weyn oo leh bit don't-fragment oo daaran oo fiiri halka uu joogsado. Haddii codsi yar uu guuleysto oo mid weyn uu laalaado, MTU tunelka iyo maaraynta MSS ee gateway-yada ayaa ah tuhmanayaasha xiga.

ping -M do -s 1400 10.10.0.5
ping -M do -s 1472 10.10.0.5
curl -sS --max-time 30 -F file=@./sample.bin https://files.corp.internal/upload

Haddii kaliya hal subnet fashilmo, fiiri doorashooyinka taraafikada, ogeysiisyada waddada iyo gateway-ga soo noqodka subnetkaas. Haddii kaliya magaca hostku fashilmo, raac DNS, oo ay ku jirto xalliyaha uu macmiilku isticmaalay iyo in muuqaalka fog uu ka muuqdo goobtaas. Saddex fashil oo kala duwan, saddex hagaajin oo kala duwan, iyo tijaabada ping midkoodna ma kala saarto.

Hagaajinta kadib, ku celi isla tijaabada

Dib u socodsii isla macmiilka, meesha, port-ka iyo culayska. Kadib dib u xiriir ama tijaabi waddada beddelka haddii nashqaddu leedahay, sababtoo ah hagaajin kaliya shaqeysa inta nuqulka tunelka asalka ah uu nool yahay lama tijaabin. Ku hay tijaabada ku xiran isha dhabta ah, meesha dhabta ah iyo hawsha dhabta ah halkii ay ku xirnaan lahayd hal tilmaame cagaar ah oo dashboard-ka saaran.

Diiwaangeli afarta qiime ee saldhigga ah iyo natiijada. Warbixinta xigta ee isla calaamadda ayaa markaas ka bilaaban kartaa caddaymo halkii ay ka bilaaban lahayd ping.