Umbuzo wesizindalwazi uyaxhuga phezu kwe-IPsec: ukuhlela kabusha kwe-UDP noma i-TCP?
Umbuzo oxhuga ngemva kwe-handshake ehlanzekile ukhomba ngaphakathi komzila we-tunnel. Izimo ezintathu zinquma ukuthi umzila ulungiswe noma kubuyelwe ku-TCP ku-443.
Umbuzo oxhuga ngemva kwe-handshake ye-TCP akusona inkinga yokuhlela imizila. Amaphutha omzila awaphumeleli i-handshake, ngakho isikhathi esisungulwayo bese sithula sikhomba ngaphakathi komzila: ukuhlola, i-MTU, noma indlela amaphakethe e-UDP e-tunnel afika ngayo. Isinqumo esiphambi kwakho ukuthi ulungisa lowo mzila noma uhambisa i-tunnel ku-TCP. Izimo ezintathu zinquma lokho, futhi akukho nesisodwa esimayelana nesizindalwazi.
Hlukanisa ukuxhuga ngaphambi kokusola i-tunnel
Imiphumela emine ibonakala ifana kumsebenzisi futhi isho izinto ezihluke ngokuphelele kunjiniyela.
| What the client sees | What it rules out |
|---|---|
| Connection refused | Nothing is listening on the address and port the client reached |
| Timeout before the handshake | A filter, a missing route, or the wrong address |
| Handshake completes, query hangs | The session exists, so look at inspection, MTU and packet order |
| Stalls that recover on retry | Often reordering, or a state table entry expiring |
Yimigqa emibili yokugcina kuphela eqinisekisa isikhathi ku-tunnel. Ukuxhumana okunqatshiwe nge-VPN ngokuvamile kuba isizindalwazi esilalela ku-loopback kuphela, okuyinkinga yomlaleli, futhi ukuphela kwesikhathi ngaphambi kwe-handshake kuyisihlungi noma umzila. Akukho kukho kokubili okuba ngcono ngokushintsha ukufakwa.
Bhala ukuhlukaniswa ethikithini kuqala. Lesi yisinyathelo esishibhe kakhulu futhi sisusa ingxenye enkulu yendawo yokusesha.
Izimo ezintathu ezinquma phakathi kwe-UDP ne-TCP
Ithrafikhi ye-IPsec efakiwe ihamba nge-UDP, futhi i-UDP inikeza umzila inkululeko yokuhlela kabusha nokulahla ngaphandle kokutshela muntu. Lapho ukuhlela kabusha kukhipha amaphakethe ngaphandle kwewindi lokuvimbela ukuphinda le-tunnel, ayalahlwa buthule futhi isikhathi se-TCP sangaphakathi silinda nje. Yiyo leyo indlela eyenza i-handshake iphumelele kanti umbuzo awubuyi neze.
Ukulungisa umzila noma ukubuyela ku-TCP kuncike ezintweni ezintathu. Okokuqala, ingabe kunokulahleka kwangempela kwamaphakethe emzileni, noma ukuhlela kabusha kuphela? Okwesibili, ingabe ungashintsha lapho ukuhlola kwenzeka khona, noma ukhiphe le-tunnel engxenyeni ehlela kabusha? Okwesithathu, ingabe umthwalo usizelela iphethini yokuxhuga, isibonelo amaseshini amaningi e-multiplex ahlanganyela isixhumanisi esisodwa?
Uma impendulo yokuqala iwukulahleka kanti eyesibili cha,i-TCP ku-443 iyisixazululo esisebenzayo. Uma impendulo yesibili ingu-yebo, lungisa umzila futhi ugcine i-UDP.
Funda irekhodi le-firewall, hhayi iphutha lohlelo
Uhlelo lubika ukuphela kwesikhathi, okungasho lutho ngesizathu. Ilogi ye-firewall ngokwayo yindawo lapho ukuphonswa noma ukuvinjwa kubonakala khona, ngakho hlunga ngamakheli esizindalwazi kanye nohlelo bese ufuna ukulahla kanye nokwamukela.Ama-blade okugwema izinsongo angalahla amaphakethe ngaphandle kokukhiqiza iphutha ezingeni lohlelo, futhi yiso leso simo sombuzo oxhugayo. Ukuthula kulogi nakho kuyidatha: kukhombisa into engabhalisi, njengokuhlela kabusha.
Hlola neqoqo. Iqoqo elilungiswe ngokungalungile lingagcina isikhathi kuthebula lezimo kumelungu oyedwa ngenkathi amaphakethe ehamba ngomzila welinye ilungu, ngakho izimpendulo zifika lapho kungekho simo khona. Lokho kuxhuga kubonakala kungahleliwe futhi akuhlobene nomthwalo.
Qhathanisa iziphetho zombili ngaphambi kokushintsha noma yini, futhi qhathanisa ukulandelana kokufika hhayi inani lamaphakethe:
tcpdump -ni any udp port 4500 -w /tmp/encap.pcap
tcpdump -ni any tcp port 5432 -w /tmp/inner.pcapI-TCP ku-443 ikubiza ini ngempela
Ukuhambisa i-tunnel ku-TCP kususa uphawu lokuhlela kabusha, ngoba ibhokisi eliphakathi manje libona ukugeleza okuhleliwe. Kodwa futhi kwakha i-TCP phezu kwe-TCP. Ukuxhumana kwangaphandle kuthumela futhi lokho ukuxhumana kwangaphakathi esekuthumele futhi, futhi ukulahleka okukodwa kungamisa wonke amaseshini e-multiplex ngasikhathi sinye. Emzileni ohlanzekile lokho akubonakali. Kokulahleka, ikhambi libi kakhulu kunophawu.
Ukushintshana kuyamukeleka lapho enye indlela ingukuntuleka kokuxhumana, futhi kufanele kubhalwe njengekhethelo elinomnini esikhundleni sokuthathwa njengokujwayelekile.
Rekhoda ukuthutha, imbobo, umbuzo oyisampula kanye nomphumela olinganisiwe, kanye nosuku. Ngaphandle kwalowo mrekhodi unjiniyela olandelayo uphinda ucwaningo, futhi ikhethelo liba umklamo buthule.
Gcina isinqumo sibuyekezeleka
Ukuxilongwa komzila kuguga ngokushesha. Ibhokisi eliphakathi liyashintshwa, ukulungiselelwa kwe-blade kuyashintsha, isixhumanisi sithuthukiswa, futhi isizathu se-TCP ku-443 siyanyamalala ngenkathi ukulungiselelwa kusala. Bika usuku lokubuyekeza ekhethelweni futhi usho isimo esingakuvumela ukuba ubuyele ku-UDP.
Hlola izinto zokuthutha zombili ngombuzo omncane nangesethi enkulu yemiphumela. Ukuhlela kabusha kubonakala njengokuxhuga okuncike kosayizi, kanti ukwehluleka komlaleli kumisa bobabili osayizi ngokulingana.