I-ESP iyi-IP protocol 50, hhayi i-TCP port 50: yini okufanele ivunyelwe
Izinombolo ze-protocol nezinombolo zamaport ziyizikhala zamagama ezihlukene. Umthetho we-TCP port 50 awuvumeli lutho, futhi i-NAT traversal ihambisa i-ESP ku-UDP 4500.
Amafomu e-firewall abuza i-TCP port, futhi okubhaliwe okusobala ngu-50. Lokho okubhaliwe akuvumeli lutho, ngoba i-ESP iyi-IP protocol inombolo 50 futhi izinombolo ze-protocol awezona amaport. Izikhala zamagama ezimbili zabelana ngezinombolo eziphelele ezincane futhi akukho okunye, futhi iphutha alibonakali kuze kuqede i-IKE futhi ukuthwala okulindile kungafiki.
Izikhala zamagama ezimbili ezabelana ngezinombolo ezincane
Isihloko se-IP sithwala inkambu ye-protocol ebiza okulandelayo: 6 ye-TCP, 17 ye-UDP, 1 ye-ICMP, 50 ye-ESP, 51 ye-AH. Isihloko se-TCP noma se-UDP sithwala izinombolo zamaport, ezikhetha inqubo kusibungu sokufika. I-protocol 50 ne-TCP port 50 amanani angenabo ubudlelwano, kodwa ibhokisi lengxoxo lingawenza abonakale eshintshekayo.
Yingakho umthetho wokudlulisa amaport awukwazi ukuveza i-ESP yemvelo. Awekho amaport okufika e-ESP okufanele adluliswe, futhi idivayisi eqonda kuphela imithetho yamaport ayinaso isilulumagama sale phakethe. Umthetho ofanele ubiza i-IP protocol. Noma iyiphi ingxoxo yamaport iyithuluzi elingalungile yalelo phakethe.
Ukudideka kunengxenye yesibili. Uma iphakethe lifihliwe, konke okungaphakathi kulo akubonakali, kuhlanganise nesihloko se-TCP soxhumano lwangempela. I-firewall ehlola amaport kulelo phakethe ibheka isihloko sangaphandle, esingenavo amaport okuhlolwa esimweni semvelo.
I-ESP yemvelo, bese kuba okunye okugoqiwe
I-ESP yemvelo ithwalwa ngqo njenge-IP protocol, okungcono futhi okunzima ngokulinganayo. Kungalunga ngoba akukho sihloko esengeziwe, futhi kunzima ngoba idivayisi ehumusha amakheli namaport ayikwazi ukuyilandela. I-NAT traversal ikhona ukuxazulula lokho, ngokugoqa iphakethe le-ESP ngaphakathi kwe-UDP ukuze umhumushi abe namaport okubhala kabusha.
| Form on the wire | How it is identified | What the firewall must permit |
|---|---|---|
| IKE negotiation | UDP with a destination port | UDP 500, and 4500 once traversal is detected |
| Native ESP | IP protocol 50 in the outer header | The protocol itself, with no port to name |
| ESP inside UDP | UDP 4500 carrying an ESP payload | The UDP port pair, which translation devices can track |
Lezi zinhlobo ezimbili ziyizindlela ezihlukene zokusabalalisa umzila wedatha ofanayo, hhayi izingqimba zomunye. Ukuvumela i-ESP yemvelo akuvumeli uhlobo olugoqiwe, futhi ukuvumela i-UDP 4500 akuvumeli ukuthwala kwemvelo, ngakho iqoqo lemithetho kufanele lihambisane nokwabiwa hhayi ukumboza kokubili ngengozi.
Ukuthola kubalulekile nalapha. Amaphoyinti okugcina anquma phakathi kwezinhlobo ngesikhathi sezingxoxo, futhi ukushintsha kuvame ukwenzeka lapho kutholakala i-NAT phakathi kwabo. Ngakho umzila oshintshayo ngemva kokumiswa komhubhe ungahambisa ukuthwala endaweni yamagama imithetho yakho engakaze iyivale.
Funda ukuthi uxhumano lusebenzisa luphi uhlobo ngempela
Buza iphoyinti lokugcina esikhundleni sokuqagela kusuka ku-firewall. Ku-Linux okubhaliwe kwesimo kubika ukuthi inhlangano isebenzisa ukughoqwa kwe-UDP yini nokuthi imaphi amaport ahilelekile. Ukubanjwa kwamaphakethe kuphendula umbuzo ofanayo kusuka ocingweni, futhi kokubili kuyashesha kunokufunda iqoqo lemithetho nokuthemba.
ip xfrm state | grep -A3 encap
tcpdump -ni any 'ip proto 50 or udp port 4500'Umyalo wokuqala ubonisa uhlobo lokughoqa uma i-NAT traversal isetshenziswa futhi akukho lutho uma ingasetshenziswa. Owesibili ubonisa ukuthi yiluphi uhlobo kwezimbili olweqa ngempela isixhumanisi, futhi lokho kuqeda izingxoxo mayelana nokucushwa okubonakala kulungile ephepheni.
Ubufakazi obuphikisayo bungengxenyeni efanayo. Umthetho obika ukungafani kweziro ubiza ukuthi iphakethe alizange lifinyelele kuwo, futhi lowo umbuzo womzila noma wesikhethi, hhayi we-firewall.
Bese uqinisekisa umzila wokulawula ngokwehlukile. I-IKE inamaport ayo namarekhodi ayo, futhi izingxoxo eziphothulile ngaphandle kwedatha yikho kanye ukuhlukanisa okukhulunywa ngakho kulesi sihloko.
Bhala umthetho endaweni efanele yamagama
Umthetho we-protocol nomthetho weport yimiyalo ehlukene, ngakho ithuluzi kufanele liveze lokho okuqondayo. Ku-nftables ukufana kwe-protocol kucacile, futhi okunye okugoqiwe kuthola umthetho wakho we-UDP. Gcina imithetho emibili eduze ukuze ipheya libonakale ekubuyekezweni.
nft add rule inet filter input ip protocol esp accept
nft add rule inet filter input udp dport { 500, 4500 } acceptUngakhulisi noma yimuphi umthetho ukuze unxephezele ukuxilongwa okungalungile. Ukuvumela konke kwe-protocol ye-ESP kuzo zonke izixhumanisi, noma imvume ye-UDP kusuka noma kuphi kuya noma kuphi, ilungisa uphawu futhi isusa ukulawula obukade uzama ukukusetha. Ukugeleza okuncane okusekelwayo cishe njalo kwanele uma uhlobo lwaziwa.
Ekugcineni, gcina izingqimba ziqondile uma umhubhe usebenza kodwa uhlelo lokusebenza lungasebenzi. Amaphakethe afika esangweni asadinga ukudluliswa, umzila wokubuya kanye nomgomo owamukelayo, futhi akukho kulokhu okuchazwa umthetho we-ESP. Iport engekho ichaza ukwehluleka okuthile, hhayi konke ukwehluleka kwe-IPsec. Gcina ukulungisa umthetho nokuhlola umzila njengeziphetho ezimbili ezihlukene.
Bhala phansi uhlobo olubonile, umthetho we-protocol owengezile kanye nesibali osibonile ngemva kwalokho. Imigqa emithathu, futhi umuntu olandelayo angahlukanisa iphutha lendawo yamagama nephutha lomzila ngomzuzu owodwa esikhundleni sentambama.