Ukuvimba i-IPsec ngaphandle kokwephula i-Wi-Fi Calling yefoni

Isicelo sihlala sifika ngendlela efanayo: vala i-IPsec emaphethelweni ngoba ithwala imigudu engeke yagunyazwa muntu, futhi isikhalazo sokuqala sivela kumuntu ofoni yakhe iyeke ukushaya nge-Wi-Fi. Womabili amaqiniso ayiqiniso ngasikhathi sinye, futhi alikho elilungisa ukushiya ukulawula. I-firewall idinga ukukhishwa kwesevisi okunesici esiqanjwe ngegama, umthombo obekiwe, izindawo ezibhaliwe kanye nomnikazi. Izinyathelo ezinhlanu zikwenza kube umthetho umuntu ongaziwa angawubuyekeza ngonyaka ozayo.

Qamba isevisi ngaphambi kokuba uqambe i-protocol

Ucingo lwetafula kusevisi ye-SIP kanye nohlelo olwenza i-Wi-Fi Calling yomhlinzeki akwabelani iphrofayela yokuxhumana eyodwa, futhi i-VoIP njengegama le-firewall ayikuchazi noma yikuphi kwalokhu. Idatha yezimbobo nezindawo kufanele ivele kumthengisi noma kumhlinzeki ophethe isevisi, hhayi ohlwini lwezimbobo olukhunjulwayo olungekolunye uhlelo lwezingcingo. Lona umehluko phakathi komthetho ovikela isici nomthetho ovikela igama.

Incwadi ka-Apple yezimbobo zesevisi ibala i-UDP 500 ne-4500 ye-Wi-Fi Calling, okuyiyona pheyana ewukuphela kwayo evinjwa ukuvinjwa kwe-IPsec okubanzi. Bhala igama lesici kurekhodi loshintsho eduze kwalezo zimbobo. Faka inguqulo noma usuku lwencwadi oyisebenzisile, ngoba amathebula abathengisi ayahlelwa. Umthetho oqamba isevisi ekhona ngayo ungabuyekezwa; lowo oqamba isigaba se-protocol awukwazi.

Bhala ukukhishwa njengesivumelwano, hhayi umusa

Ukukhishwa kusho isici esivunyelwe, izigaba zamadivayisi ezisisebenzisayo, ukuthutha okudingekayo kanye nezindawo ezibhalwa uhlangothi olunesibopho. Futhi kuthwala umnikazi nosuku lokubuyekeza, ngoba iziphetho zomhlinzeki nezibonelo zamadivayisi ziyashintsha ngaphandle kokwazisa ithimba le-firewall. Nikeza ukubuyekeza kumuntu hhayi egameni lethimba elizophila isikhathi eside kunethimba. Gcina amazwi eqondile ngokwanele ukuthi umuntu ongaziwa akwazi ukukhipha umthetho kusukela kurekhodi kuphela.

Faka ukukhishwa emjikelezweni ofanayo nawo wonke umgomo womphetho, ukuze umhlinzeki ohambisa indawo noma iqembu elishintsha isibonelo sedivayisi kutholakale ekubuyekezweni hhayi ekuphazamisekeni okulandelayo. Vala umjikelezo nalowo obike izingcingo eziphukile, ngoba nguye yedwa ongaqinisekisa ukulungiswa ngaphandle kokuvula kabusha umgudu obekufanele uvalwe ukuvinjwa. Nalokho kuqinisekisa kufanele kube kurekhodi, nosuku.

Imvume ehlala njalo enelebula lokulungisa ifoni yesikhashana ayinakuvikelwa emva kweminyaka emibili. Imvume eboshelwe kusevisi ekhonjiwe inesiphetho esivuselelwa ngamabomu.

Beka umkhawulo emthonjeni ngobuqotho

Ukukhawulela ukukhishwa kusigaba samadivayisi aphethwe kunamandla kakhulu kunokuvula i-protocol kuyo yonke ikhompyutha yomuntu esakhiweni. Uma inethiwekhi ingasikhonji leso sigaba, bhala lokho esikhundleni sokusikisela ukuthi umthetho uyawazi amadivayisi. Umphumela omuhle oshibhile kakhulu ukusebenzisa kabusha umngcele osekhona kakade ngesinye isizathu, ukuze ukukhishwa kuzuze ifa lokulawula esikhundleni sokuzakhela okusha. Ukuhlunga ngekheli akuwona ubuqiniso bedivayisi, futhi irekhodi loshintsho akufanele likhombise okuphambene.

Ikheli lomthombo noma ikheli lehadiwe akuwona ubufakazi bedivayisi ebonakalayo. Ukuthi elinye lawo linencazelo yini kuncike ngokuphelele kwezinye izilawuli ngaphakathi kwaleso sigaba. Uma impikiswano yomthetho isekelwe ekhelini le-MAC, hlola ukuthi yini evimbela umsebenzisi ukulishintsha ngaphambi kokuba umthetho ukhishwe.

Amukela lokho umthetho wezimbobo ongakusho

Izimbobo zikhomba iziphetho zokuthutha, hhayi inhloso yebhizinisi. Uma isevisi yezingcingo evunyelwe kanye nomgudu ongavunyelwe kokubili kuhamba nge-UDP 4500 eyodwa, awukho umthetho osekelwe ezimbobeni ohlukanisa kokubili. Umthetho othi uyakwenza lokho ubukeka unembile kodwa awunjalo, okuyinto embi kunomthetho ovuma ukuma kwawo. Lona umkhawulo wendlela yokusebenza, hhayi iphutha lomuntu oyibhalile.

Shono lokho eduze komthetho, futhi hlanganisa ukukhishwa nanoma yikuphi ukuphoqelela inethiwekhi enakho, njengokuphathwa kwamadivayisi noma uhlu lwezindawo ezivunyelwe. Bese uveza ukukhishwa ngobubanzi obuncane kakhulu okukuvumela ithuluzi, isibonelo ngemithetho ye-nftables eqamba isigaba kanye nepheya lezimbobo bese ibeka ukwenqaba okuvamile ngemuva kwazo:

nft add rule inet edge forward ip saddr 10.40.0.0/24 udp dport { 500, 4500 } counter accept
nft add rule inet edge forward udp dport { 500, 4500 } counter drop

I-nftables ihlola ngokulandelana futhi iyama ekufaneni kokuqala, ngakho imvume enomkhawulo kufanele ibe ngaphezu kokwenqaba okuvamile. Shintsha lezi ezimbili futhi ukukhishwa ngeke kwenza lutho buthule.

Qinisekisa isici nokwenqaba

Gijima ubuqiniso obuvunyelwe ocingweni olujwayelekile lwe-Wi-Fi, kusukela esigabeni sedivayisi okhona ngaso ukukhishwa, futhi uqinisekise ukuthi iklayenti elikhishiwe lisahluleka. Ungalokothi futhi ngaphansi kwanoma yiziphi izimo usebenzise izingcingo eziphuthumayo njengecala lokuhlola. Bese uhlola umthetho okhishiwe, ngoba isibali esigxile kuziro siwubufakazi obushesha kakhulu bokuthi ukukhishwa akuzange kufane nanini:

nft -a list chain inet edge forward

Faka ekuhlolweni ukuxhuma kabusha noma ushintsho lwenethiwekhi, futhi kuphindele kusukela ekuqaleni okubandayo lapho ifoni ijoyina inethiwekhi khona hhayi ukuthi isixhunyiwe kakade. Uma isibali sinyakaza kuyilapho izingcingo zisahluleka, inkinga isiphumile ku-firewall futhi ingeyohlu lwezindawo lomhlinzeki.