I-Check Point VPN ku-Linux: i-SNX akusiyo into yokulanda nokufaka

Ufuna iklayenti le-Check Point le-Linux, futhi awutholi khasi lokulanda elinesifaki. Lokho kungabi khona akusona isikhala ekupakisheni. Iklayenti lokufinyelela kude le-Check Point ku-Linux yi-SSL Network Extender, i-SNX, futhi isango likunikeza yona ngemva kokuthi uqinisekise ubuntu bakho kusiphequluli. Uma lokho kuhlezi kahle, ukudideka okusele kuba nomqondo, kuhlanganise nokuthi kungani cishe konke okubhalwe ngakho kuneminyaka.

Inganekwane: kuneklayenti oyilanda bese uyifaka

Lokho kulindela kuvela kuwo wonke omunye umhlinzeki. I-OpenVPN, i-WireGuard kanye namaklayenti amaningi ezentengiselwano bashicilela iphakheji noma isitoreji, futhi ukuyifaka yisinqumo sasekhaya osithatha wedwa. I-Check Point ayisebenzi kanjalo ku-Linux. Asikho isifaki esizimele kokulandwayo okusemthethweni kwezinguqulo zamanje zesango, ngakho ukuyifuna kuletha kuphela imicu emidala yamafemula neziphathimandlela zezinhlangano zesithathu.

Lezo zibonakhulu zimbi kakhulu kunokungabi nasizakalo, ngoba ukwakhiwa kufanele kuhambisane nesango elikunikezayo.

Iyini ngempela i-SNX, futhi ivelaphi

I-SNX iyiklayenti lomugqa womyalo okwalo ifayela kanambambili yi-snx, futhi ifakwa ngesikhathi osiqalayo kusiphequluli ngokumelene nesango. Ngokomlando i-Java applet yayilandela futhi iyifake ngemva kokuba wamukele isicelo. Indlela yashintsha phakathi neminyaka, umthombo awukashintshi. Isango linikeza ukwakhiwa okuhambisana nalo ngokwalo, yingakho izinguqulo zeklayenti nesango zihamba ndawonye, futhi yingakho iklayenti elikotshwe kusuka ephakhejini elidala lisebenza kuphela ngesikhathi isango lisakhuluma nalo.

Lokhu futhi kusho ukuthi isango kufanele lilungele ngaphambi kokuba noma yimuphi umsebenzi eklayentini ube nomqondo. I-Mobile Access Software Blade kufanele inikezwe ilayisense futhi ihlelwe, ngoba ngaphandle kwayo asikho isango lokufaka. Akukho mzamo ohlangothini lweklayenti okwakha isikhathi sokuhlangana nesango elingakunikezi.

Khombisa iklayenti esangweni nomsebenzisi wakho, futhi ufunde ukuthi libika ini:

snx -s vpn.example.com -u your.name

Umkhawulo ukusekelwa kwezabelo, hhayi isifaki

Uhlu lwezabelo ezisekelwayo lomhlinzeki lwe-SNX lufushane futhi ludala. Emqulwini oshicilelwe lugcina cishe e-Ubuntu 17.04, kanye nezinguqulo ezimbalwa ze-openSUSE, i-Fedora ne-RHEL zangaleso sikhathi, futhi lusabala i-Ubuntu 12.10. Lokho kutshela ukuthi uhlu luguga kanjani, hhayi ukuthi umshini wakho udinga ini. Isabelo samanje asikho kulo ngokuphelele.

Linde ukungahambisani kwemitapo yesikhwama ngaphambi kokulinda umhubhe osebenzayo. Ezintathu ezijwayelekile yimitapo yesikhwama engu-32-bit engekho kusistimu engu-64-bit, inguqulo ye-OpenSSL iklayenti elingakaze lixhunywe kuyo, kanye nemojuli ye-kernel iklayenti elizama ukuyakhayo. Funda izimpawu ezingekho esikhundleni sokuqagela amaphakheji:

ldd $(command -v snx) | grep "not found"

Bese ubheka i-athikili yokusekelwa yenguqulo yesango oxhumana nayo ngempela. Uhlu oluseblogi akusona isitatimende sokuhambisana, futhi isabelo esisha akusho iklayenti elisha.

Imininingwane ye-X11 eyenza umsebenzi ngaphandle kwesikrini ube nokwenzeka

I-SNX idinga imitapo ye-X11 kodwa ayidingi iseva ye-X ehambayo. Lowo mehluko uyiwona wonke umehluko phakathi kweklayenti elisebenza nge-SSH kumthwali ongenasikrini nesele elibonakala likhwele ngaphandle kokuphuma. Faka iphakheji yemitapo enikezwa isabelo sakho, hhayi inqwaba ekhotshelwe kolunye uguqulo, futhi sebenzisa iklayenti esikhathini esidinga umhubhe.

Ngemva kokuxhumana,funda isixhumanisi nemizila ngaphambi kokuthemba noma yikuphi kwako kokubili:

ip -brief addr show
ip route show

I-SNX yakha isixhumanisi somhubhe futhi ifake imizila echazwa isango. Leyo mizila iyisinqumo sesango hhayi esakho, ngakho isiqalo esingekho siyinkinga yephrofayela ohlangothini lwesango hhayi iphutha eklayentini. Hlola ne-DNS ngasikhathi sinye, ngoba amaphrofayela e-split-tunnel avame ukusunduza isisombululi obungasilindele.

Lapho i-SNX iyimpendulo engalungile ngokuphelele

Amasango e-Check Point angaphinda aqede ukuxhumana kwe-IPsec ne-L2TPkusuka eklayentini kuya esizeni, futhi lokho kusebenza ne-strongSwan, i-Libreswan noma isengezo se-L2TP se-NetworkManager. Lokho kuwukuhlelwa kwesango, hhayi iqhinga leklayenti. Uma isango lishicilela kuphela isango le-Mobile Access,iklayenti le-IPsec alinakho okungaxoxiswana ngakho, futhi ilogi ibonisa isikhathi sokuphela esikhundleni sokwehluleka kokuqinisekisa. Buza ukuthi imaphi amablade okufinyelela kude anikwe amandla ngaphambi kokufaka enye into.

Yonke imikhawulo lapha isehlangothini lwesango: iblade, ilayisense, ukwakhiwa kweklayenti nephrofayela yemizila. I-CLI isebenze iminyaka. Okwephukayo umcabango wokuthi ukusekelwa kwe-Linux kusho iphakheji oyiphethe futhi oyilawulayo.