Amachibi e-VPN anezitezi ezimbili: ukubhekana nemindeni yomibili ku-strongSwan

Isango linganikeza umsebenzisi ohambayo kokubili ikheli le-virtual le-IPv4 ne-IPv6 ngesikhathi esisodwa, kuyilapho ithubhu langaphandle lisahamba phezu kwe-IPv4. Lezi yizinqumo ezizimele, futhi ukuzithatha njengokukodwa yikhona okwenza izinhlelo zezitezi ezimbili zivame ukuwa. Imindeni yangaphakathi yeklayenti, amaprefikhi avikelwe engafinyelela kuwo, kanye nokuthutha okuthwala i-encapsulation kuyizinketho ezintathu ezihlukene.

Iningi lokudideka livela ekusebenziseni igama elithi izitezi ezimbili kumklamo onezitezi ezimbili endaweni eyodwa kuphela. Isevisi ingaba nezitezi ezimbili ngaphakathi, ibe nesitezi esisodwa ekhelini layo langaphandle, futhi isebenze kahle kakhulu kumaklayenti. Engakwazi ukukwenza ukusebenza ngengozi.

Imindeni emibili ngaphakathi, indlela eyodwa ngaphandle

Ukuxhumana kwangaphandle yi-IKE phezu kwe-UDP, futhi kudinga umndeni owodwa wekheli ofinyelelekayo kusuka noma kuphi lapho iklayenti likhona. Ikheli langaphakathi le-IPv6 alidingi umhlinzeki one-IPv6, ngoba iphakethe langaphakathi umthwalo ongaphakathi kwelangaphandle. Ukusetshenziswa okuningi okusebenzayo kuthwala amaprefikhi e-IPv6 ngoxhumano oluphezulu olune-IPv4 kuphela.

Okukhawulelwa ngempela yindlela yangaphandle ukufinyeleleka nokudlula kwe-NAT. Uma isango limemezela ikheli le-IPv4 kuphela, iklayenti kwinethiwekhi ene-IPv6 kuphela ngeke likwazi ukuxhuma nhlobo, noma ngabe ngamachibi amangaki owawahlela. Nquma umndeni wangaphandle ngokusekelwe enanini lamaklayenti akho, hhayi ohlelweni lwamakheli angaphakathi.

Nikeza iklayenti ikheli kumndeni ngamunye

Ukucela imindeni yomibili kuyisitatimende somugqa owodwa ohlangothini lweklayenti, inqobo nje uma isango linokuthile okuzokwabiwa. Amachibi anamagama agcina imithombo ihlukile kunethiwekhi zesevisi, futhi lesi sici yisona esenza imithetho ye-firewall ifundeke ngisho ngemuva kwezinyanga eziyisithupha.

pools {
  pool4 { addrs = 10.90.0.0/24 }
  pool6 { addrs = fd42:90::/64 }
}
connections {
  private-access {
    version = 2
    pools = pool4, pool6
    local  { auth = pubkey  certs = gateway.pem  id = vpn.example.com }
    remote { auth = pubkey  cacerts = ca.pem  vips = 0.0.0.0, :: }
    children {
      private { local_ts = 10.60.0.0/16, fd42:60::/48  remote_ts = dynamic }
    }
  }
}

Inani vips licela ikheli kumndeni ngamunye, futhi uhlu lwamachibi lunquma ukuthi lawo makheli avela kuphi. Imibhalo ye-strongSwan mayelana ne-IP engokoqobo ihlanganisa izicelo eziningi nokwabiwa kwamachibi, kuhlanganise nephuzu lokuthi iklayenti elicela ikheli elithile liveza kuphela intando okungenziwa umphenduli ukuyichitha. Ungakhi umthetho wokufinyelela ocabanga ukuthi iklayenti lihlala lithola inani elifanayo.

Khiqiza iprefikhi yakho yendawo eyingqayizivele esikhundleni sokukopisha isibonelo. Izinhlangano ezimbili ezizo zombili fd42::/16 zisebenzise zizothola ukungqubuzana ngokokuqala lapho zixhumana, futhi ukuxilonga lokho akumnandi.

Abakhethi bachaza izindawo, hhayi imithombo

Abakhethi bengaphakathi be-SA yengane basho ukuthi yimaphi amanethiwekhi avikelwe angemuva kwesango, futhi abakhethi abakude bachaza ukuthi iklayenti lingasebenzisa ini njengomthombo. Ikheli lechibi le-virtual lingelohlangothi lomthombo lwalowo mgomo; ukulifaka ohlwini lwezindawo kuwukufunda okungalungile okuvamile kokucushwa.

Imindeni yomibili idinga izindlela zokubuya nokudluliswa okuvunyelwe esangweni. Ukwengeza iprefikhi kumkhethi ngaphandle kwendlela yokubuya eya echibini kukhiqiza ithubhu elisungulwayo, elidlulisa uhlangothi olulodwa lokuthutha bese lilahla impendulo buthule. Umkhethi umgomo, hhayi ukuhlela izindlela.

Gcina amachibi namaprefikhi esevisi ezingxenyeni ezihlukene zohlelo lwakho lwamakheli. Lapho zihlangana khona, indlela okufanele ifinyelele kusibungu esivikelwe ingase ihambisane nekheli lechibi bese ilahleka ethubhini.

I-DNS nendlela yempendulo zinquma ukuthi kubonakala sengathi kuqediwe yini

Izimpendulo zesixazululi azincikile ekuthutheni okusetshenziswa ukusifinyelela. Igama lingabuyisela irekhodi le-A, irekhodi le-AAAA noma kokubili, futhi iklayenti likhetha ngokuhambisana nemithetho yalo yokuthanda. Uma isevisi yangaphakathi ishicilela irekhodi le-AAAA kodwa akukho okuhambisa leyo prefikhi, amaklayenti kunethiwekhi zezitezi ezimbili azozama indlela ye-IPv6 kuqala futhi ahlale lapho ize ihluleke. Akukho okubonakala kungalungile ekucushweni kwethubhu ngesikhathi lokho kwenzeka.

Ngakho-ke nquma ngegama ngalinye ukuthi yimiphi imindeni okufanele isetshenziswe, bese uhlola ukuthi iprefikhi efanele isekumkhethi futhi inendlela yokubuya. Lesi isinqumo sesevisi ngayinye. Ukushicilela zombili izinhlobo zamarekhodi ngaphandle komehluko yiyo kanye indlela isevisi esebenza nge-IPv4 kuphela eqala ngayo ukuphelelwa yisikhathi kwabanye abasebenzisi bayo.

Qinisekisa imindeni yomibili ngaphambi kokuthi uthi kuqediwe

Ukucushwa okulayishwayo akulona ukucushwa okusebenzayo. Funda isimo esibikwa yi-daemon, qinisekisa ukwabiwa kwamachibi, bese ubheka izindlela iklayenti elizifake ngempela.

swanctl --list-sas
swanctl --list-pools
ip -6 addr show scope global
ip -6 route get fd42:60::10

Imiyalo emibili yokuqala ikhombisa ama-SA engane asunguliwe nokuthi yimaphi amachibi asenamakheli atholakalayo, ngakho uhlelo olusebenza kuklayenti lokuqala bese luhluleka kweleshumi luyabonakala. Emibili yokugcina ikhombisa ukuthi iklayenti lithole ikheli le-IPv6 lomhlaba wonke echibini yini nokuthi ukuthutha okuya kwiprefikhi evikelwe kuzoya kuphi ngempela. Qhathanisa ikheli elinikeziwe nechibi olilicushile, hhayi nekheli obukade ulindele. Uma umphenduli ekhethe elinye inani ngaphansi komgomo wakhe, izindlela nemithetho ye-firewall kusamele zihambisane nalokho akukhethile.

Bese uhlola isibungu esisodwa esivikelwe kumndeni ngamunye, futhi uhlole igama elixazululeka kukho kokubili. Ukuhlolwa komndeni owodwa akukutsheli lutho ngohlangothi lohlelo ongakaze uluziqise, futhi indlela engekho ivame ukuba kulolo hlangothi.