Isiphepho sokuxhumana kabusha esigabeni: imikhawulo yokwamukela ye-strongSwan

Buka igatsha liphindela emuva ngemuva kokuhluleka kwesixhumanisi futhi isango libona into engakaze ibonakale ngosuku olujwayelekile: amashumi amalaptop afika ngesikhathi esisodwa evela ekhelini elilodwa lomphakathi. Ngayinye iyithuluzi elisemthethweni futhi ngayinye iqala ukushintshana kwe-IKE okungakaqedi. Ukuthi leso siqhumane siyophumelela yini kuncike emikhawulweni engenawo nxano nokuthi iseva ingathwala abasebenzi abangaki. Isiqhumane sifushane, futhi yiwona kanye umthwalo indlela yokwamukela eyakhelwa ukuwubekezelela.

Landela ilaptop eyodwa lapho ibuyela kunethiwekhi

Iklayenti lithumela isicelo sokuqala bese lilinda, futhi kuze kuqedwe ukushintshana isango ligcina isimo sokwamukela salowo mzamo. Amanye amathuluzi ngemuva kwekheli elifanayo afika ngesikhathi eyokuqala isalindile, futhi ayokota emuva komkhawulo obala amakheli esikhundleni sabasebenzisi. Ngaphandle, uphawu ngukuthi abasebenzisi abambalwa bayaxhuma kanti iqembu elikhulu liphelelwa yisikhathi.

Akukho lutho kulolo landelano okuyiphutha. Indlela yokwamukela yenza lokho eyayilungiselelwe ukukwenza.

Bala umsebenzi ovulekile kancane njengomthombo wawo

I-strongSwan ihlukanisa izinhlobo ezimbili: izinhlangano ezisungulwe ngokuphelele, kanye nemizamo esaxhumanayo noma elindele ukucutshungulwa. Umkhawulo wokuvimba usebenza kuzinhlangano ezivulekile kancane ezabelwe ikheli elilodwa lozakwethu, kanti imikhawulo yamakhukhi isebenza emhlabeni wonke nangekheli ngalinye. Lezo zibali zivikela i-daemon ekugcwaleni ngumsebenzi ongaqinisekisiwe, okuyisimo saso kanye sesiphepho sokuxhumana kabusha. Akukho lutho lwaleso simo olubonakala kuhlu lwamathaneli asunguliwe.

Ukuzifunda njengomkhawulo waphezulu wamaseshini abasebenzi iyiphutha eliholela ekukhuphuleni konke ngesikhathi esisodwa. Iseva ethwala amathaneli asunguliwe angamakhulu amane ayikwazi ngokuzenzakalela ukumunca amaphakethe okuqala angamakhulu amane ngesikhathi esisodwa, ngoba izindleko ezimbili ziwela ezindaweni ezihlukene.

Ukubambezeleka kokuqinisekisa kunquma ukuthi umzamo ngamunye uhlala isikhathi esingakanani ezibalweni ezivulekile kancane. I-backend ephendula kancane iguqula isiqhumane esifushane sibe umugqa omude ngisho noma izinga lokufika lilula.

swanctl --stats
swanctl --list-sas | grep -c ESTABLISHED

Funda izilungiselelo zokwamukela ngaphambi kokuzishintsha

Thola amanani i-daemon esebenzayo ewathutha ngempela ngaphambi kokwakha umbono ngayo. Ukucushwa kuvame ukuhlukaniswa phakathi kwefayela eliyinhloko nedirekhthri yezicucu ze-plugin ngayinye, ngakho inani olibeka endaweni eyodwa lingabhalwa phezulu kwenye. Ukusesha ngezansi kubonisa wonke amafayela akhuluma ngalezi zilungiselelo.

Bese unquma ukuthi iyiphi inombolo encane kakhulu. Uma ikheli elilodwa limele ihhovisi lonke ngokomthetho, umkhawulo wokuvimba ngekheli ngalinye yiwo nani okufanele uqukuthe lokho kugxilisa. Umkhawulo wamakhukhi womhlaba wonke uvikela i-daemon emfuleni ebanzi futhi akufanele wehliswe ngoba isayithi eyodwa ixhumana kabusha. Qhathanisa lelo nani ngekheli ngalinye nesayithi enkulu kakhulu onayo ngempela.

Shiya indlela yamakhukhi ivuliwe. Amakhukhi aphoqa iklayenti ukuthi likhombise ukuthi lingamukela ekhelini elilishoyo ngaphambi kokuba i-daemon isebenzise umsebenzi wangempela ekushintsheni, futhi ukuwavala akuwona ukuphuculwa komthamo okungathathi hlangothi. Khuphula umkhawulo kuphela lapho kunesilinganiso sokufika esikalwe kanye nesabelomali sokuqinisekisa esimemezelwe ngemuva kwaso.

grep -rn -E 'block_threshold|cookie_threshold' /etc/strongswan.conf /etc/strongswan.d/
swanctl --stats | grep -i half

Hlela ukubuya, hhayi isimo esizinzile kuphela

Umgomo wokutholakala obala amaseshini asunguliwe kuphela uchaza intambama ethule, hhayi ukululama. Kunalokho buza ukuthi isibalo sabantu esihlosiwe sibuya kanjani ngemuva komcimbi wenethiwekhi owabiwe, nokuthi ingabe indlela yokwamukela ingasifaka leso simo.

Ukusabalalisa ukuxhumana kabusha phezu komkhumbi olawulwayo kuvame ukushibha kakhulu kunokwandisa imikhawulo, ngoba kususa isiqhumane sokwenziwa esikhundleni sokukhokhela sona unomphela. Qapha isimo esivulekile kancane nezehlakalo zokwamukela eceleni kokusungulwa okuphumelelayo, futhi thatha isibalo esikhulayo sezinto ezivulekile kancane nemiphumela elinganayo njengesixwayiso sangaphambi kwesikhathi, hhayi into emangazayo.

Isithenjwa somthengisi salezi zilungiselelo yi-idokhumenti ye-strongswan.conf, ebala izibali kanye nokukhishwa okwethula umkhawulo wamakhukhi ngekheli ngalinye. Funda isigaba senguqulo yakho efakiwe hhayi ikhasi elisha kakhulu, ngoba izinto ezingokwenziwa zihamba phakathi kokukhishwa.