Ingabe i-ISP ivimbela i-UDP, noma uhlelo lokusebenza olungaphakathi komhubhe?

Othile ubika ukuthi i-VPN „ivimbela i-UDP“, futhi lo musho ufihla izimangalo ezimbili ezihluke ngokuphelele. Esinye siphathelene nokuthunyelwa okubonakala kungumnotho wokufinyelela, esinye siphathelene namaphakethe ohlelo ngemva kokuba ekhululiwe ngaphakathi komhubhe. Umhubhe ofihliwe ungasungulwa kusukela ngaphandle ngaphandle kokhiye, futhi uhlelo lwangaphakathi lwe-UDP lungahluleka ngezizathu ezingahlobene nakho konke nokuhlunga. Nquma ukuthi isiphi isimangalo osihlolayo ngaphambi kokuqoqa ubufakazi.

Izihloko ezimbili, igama elilodwa

Ekufakweni kwe-IPsec okune-NAT-traversal, iphakethe langaphandle liyi-UDP elibhalwe phakathi kwamaphoyinti amabili okugcina e-VPN, ngokuvamile esiteshini 4500. Ngaphakathi kulo, umthwalo ofihliwe uthwala konke okudluliswa umhubhe, futhi lokho ngokwako kungaba i-TCP noma i-UDP. Ngakho igama elithi UDP livela kabili, linencazelo nokubonakala okuhlukile.

Inethiwekhi ephakathi ibona isihloko sangaphandle futhi ayiboni lutho lwangaphakathi. Ingavumela, yakhe noma ilahle ukugeleza kwangaphandle, futhi ayidingi ukukhulula lutho ukuze yenze lokho. Lokho kungalingani kuyisizathu sonke sokudidaniswa kwezimangalo ezimbili: igama elilodwa lichaza lokho okuhlungwa inethiwekhi nalokho okuthunyelwa uhlelo. Bhala isigaba eduze kwegama ngaso sonke isikhathi lapho urekhoda okutholakele, futhi ukudideka kuyanyamalala ikakhulukazi.

Isihloko sangaphakathi sibonakala kuphela endaweni yokugcina yokwamukela, ngemva kokukhululwa. Kusukela lapho iphakethe lidluliswa njengamanye, ngokuya ngemizila, inqubomgomo nokuhlunga kwendawo yokugcina uqobo. Lezi yizinqumo ezihlukene ezenziwa amadivaysi ahlukene.

Lokho inethiwekhi isengakubona

Ukufihla kufihla umthwalo nesihloko sokuthunyelwa sangaphakathi, hhayi iqiniso lokuthi ukugeleza kukhona. Amakheli ezindawo zokugcina, iziteshi, ubukhulu bamaphakethe nesikhathi kuhlala kubonakala, futhi lokho kwanele ukuhlukanisa ithrafikhi ngendlela yokuqagela noma ukuvimba indawo ethile.

sudo tcpdump -ni eth0 'udp port 4500'
sudo tcpdump -ni tun0 'udp port 5201'

Ukubamba kokuqala kukhombisa ukugeleza kwangaphandle kusixhumanisi esibonakalayo, futhi okwesibili kukhombisa ukugeleza kwangaphakathi kusixhumanisi somhubhe. Ukusebenzisa kokubili ngasikhathi sinye kuphendula umbuzo ngqo: uma ukugeleza kwangaphandle kukhona futhi okwangaphakathi kungekho, uhlelo aluzange luthumele lutho emhubheni. Uma kokubili kukhona futhi akukho okubuyayo, inkinga ingaphesheya komhubhe, endaweni okuyiwa kuyo noma endleleni yokubuya.

RFC 3948 ichaza ukugoqwa kwe-UDP kwangaphandle, futhi isimiso se-ESP sichaza ukuhlelwa okuvikelwe ngaphakathi kwayo. Akukho neminye yemibhalo emibili eqinisekisa ukuthi inethiwekhi yokufinyelela izodlulisa ukugeleza kwangaphandle, yingakho ukuhlola ukufinyeleleka kwe-tuple yangaphandle kufanele kwenziwe ngaphambi kwanoma iyiphi ithiyori mayelana nokwangaphakathi. I-tuple yangaphandle evinjiwe ikhiqiza umhubhe ongakhi qede, hhayi umhubhe okhiqizayo bese ulahlekelwa uhlelo olulodwa.

Kungani uhlelo olulodwa lwe-UDP luhluleka ngaphakathi komhubhe osebenzayo

Umhubhe othwala uhlelo lwewebhu kodwa hhayi uhlelo lwe-UDP unezincazelo ezimbalwa ezinengqondo, futhi ukuhlungwa kweprotocol yangaphakathi yi-ISP akusona sokuqala. Okuvame kakhulu ukumboza: izinhlelo ezimbili azingeni ndawonye emhubheni owodwa, ngoba indlela eya endaweni ye-UDP ayikho noma imithetho yomhubhe ohlukanisiwe yeklayenti iyayikhipha.

Okwesibili indawo yokugcina. Iseva ye-VPN evumela uhlu lweprotocol, udonga lomlilo endaweni okuyiwa kuyo, noma isevisi engakaze ilalele esiteshini esilindelekile, konke kuzokhiqiza ukuphela kwesikhathi okubonakala kufana nokuvinjelwa kwenethiwekhi.

Okwesithathu ubukhulu bephakethe. Izinhlelo ze-UDP zivame ukuthumela amadathagram amakhulu kunaleso isicelo sewebhu, futhi ukugoqwa kunciphisa i-MTU esetshenziswayo, ngakho ngemva kokuxhawulisana okuphumelelayo kungalandela ukuthula kumthwalo wokuqala ogcwele. Leli phedi lilula ukulibala njengokuvinjelwa, ngoba amaphakethe amancane ayadlula kanti amakhulu ayanyamalala. Ukuhlolwa kwe-MTU okusheshayo kuyixazulula ngaphansi komzuzu owodwa, futhi impendulo ivamise ukuba umthwalo omncane noma i-MSS elungisiwe, hhayi isihlungi senethiwekhi.

ping -M do -s 1400 -c 2 10.60.0.20
iperf3 -u -c 10.60.0.20 -p 5201 -b 1M -t 5

Umyalo wokuqala uhlola ukuthi iphakethe elikhulu liyadlula yini endleleni lapho ukwahlukanisa kucishiwe, okudalula ngokushesha inkinga ye-MTU. Owesibili uthumela ukugeleza kwe-UDP okuncane okulinganiselwe futhi ubika ukulahleka ne-jitter. Ukugeleza okuqala bese kuma kukhombisa ubukhulu, hhayi ukuvinjelwa.

Bika isigaba, hhayi iprotocol

Bhala okutholakele ngolunye lwezimo ezintathu: ukulethwa kwangaphandle kwehlulekile, ukudluliswa kwangaphakathi kwehlulekile, noma uhlelo lwehlulekile. Ngakunye kunomnikazi ohlukile, futhi ukuzixuba kuthumela ithikithi eqenjini elingalungile.

Ukushintsha isiteshi sasendaweni akukwazi ukudala isilaleli esifanayo ekugcineni okude, ngakho isisombululo sasohlangothini lweklayenti esibonakala sisiza ngokuvamile singubufakazi bokuthi indawo yokuqala eyayihlosiwe yayingalungile. Ngokufanayo, iphrofayela elihlukile elinikeziwe likhombisa okuthile mayelana nokufinyeleleka futhi alikho lutho mayelana nokuthi uhlelo luhlelwe ngendlela efanele yini.

Hlukanisa umbono ocatshangelwayo kokubonwayo. Ukuhlaziywa kwethrafikhi kungaphakamisa ukuthi ukugeleza kuyini ngaphandle kokukukhulula, futhi lokho kuwukutholakele okuwusizo, kodwa akusona isimangalo esifanayo nokufunda isihloko sangaphakathi. Chaza ukuthi yikuphi kokubili onakho ngempela.