Amaphothi e-UDP aqinisiwe angadlula ukudluliswa kwamaphothi, kodwa akuwona wonke ama-NAT

Amaroutha amabili asekhaya, ayikho iphothi edlulisiwe, kanye ne-VPN ngezinye izikhathi exhumayo noma kunjalo. I-UDP ikuvumela lokho, ngoba i-firewall izokwamukela iphakethe engalifanisa nokugeleza osekuqalisiwe umshini. Leli yisu elinemibandela, hhayi isici, futhi imibandela kulula ukuyisho uma wazi ukuthi i-firewall iqhathanisa ini. Yikho futhi okuyisizathu sokuthi amaphrofayili afanayo aziphatha ngendlela ehlukile kumanethiwekhi ahlukile.

Ukuqhathanisa okwenziwa yi-firewall

Idatha-gramu ngayinye ephumayo yakha umugqa wesikhashana: ikheli lomthombo, iphothi lomthombo, ikheli lendawo okuyiwa kuyo, iphothi lendawo okuyiwa kuyo. Noma yini efikayo futhi ehambisana nomugqa ithathwa njengempendulo futhi iyavunyelwa ukuba idlule. Imithetho yokungena ayinandawo kulokhu.

Ngakho umbuzo awukho wokuthi i-firewall iyayivumela yini inkampani yangaphandle ukuba ingene. Umbuzo ngowokuthi iphakethe lale nkampani libukeka njengempendulo umugqa elindele yona. Shintsha inkambu eyodwa yaleyo tuple enezingxenye ezine futhi iphakethe liba ngumfokazi. Yikho ukuhlelwa okusebenzayo kungase kwephuke uma kuphela inombolo yephothi eshintshayo, futhi yikho iphothi elifanayo lingase lisebenze kumroutha owodwa futhi lihluleke kwelilandelayo.

Qinisa iphothi lomthombo lendawo, futhi leyo nombolo izovela ezinhlangothini zombili zokushintshana. Yiyo yonke indlela yokusebenza, futhi ichaza ukuthi kungani isu linobuthakathaka hhayi imfihlo.

Ukuqinisa iphothi elilodwa ekugcineni ngakunye

Iphothi le-UDP elizenzakalelayo le-OpenVPN ngu-1194, futhi lport libeka iphothi lomthombo elisuka kulo. Qinisa kokubili okulinganayo futhi i-tuple ephumayo yomuntu ngamunye izokhomba ephothini elilalele elinye:

# peer A
lport 1194
remote 198.51.100.20 1194
# peer B
lport 1194
remote 203.0.113.10 1194

Lokhu kusebenza kuphela uma kungekho mrouta phakathi kwabo obhala kabusha iphothi lomthombo. Uma amaphakethe evela ekubanjweni kodwa kungekho tunneli ephakamayo, ukubhala kabusha kungumsolwa wokuqala.

Lapho i-tuple iyeka ukuvumelana

I-NAT ekhombisa ngedestinasi yenza ukuthi i-peer ngayinye ithole iphothi langaphandle elihlukile. Ikheli i-peer yakho eyatshelwa ukuba isebenzise alilo ikheli elifinyelela kuyo, ngakho iphakethe elingenayo alihambisani nalutho futhi lilahlwa buthule.

Ukuhumusha kwezinga lomhlinzeki, i-NAT enezendlalelo kanye nokwenza iphothi ngokungahleliwe konke kuphetha ngendlela efanayo. Kanjalo nanoma yiliphi ibhokisi eliphakathi elibhala kabusha amaphothi kodwa lishiye amakheli.

Izokuthutha kwemifudlana kubi kakhulu. Ukuxhawula kwe-TCP kulandelelwa isinyathelo ngesinyathelo, ngakho i-VPN esekelwe ku-TCP ayikwazi ukubhobozwa ngale ndlela nhlobo futhi idinga isilaleli endaweni ethile endleleni.

Ngokuvamile uhlangothi olulodwa luyahluleka kuqala

Ngokomkhuba amanethiwekhi amabili awavamile ukuziphatha ngendlela efanayo. Iroutha elilodwa linganikeza ukubonisa okulindelekile kuyilapho elinye linikeza amaphothi ngedestinasi, futhi umphumela uwukuhlelwa okusebenza phakathi kwamakhaya amabili kodwa kuhluleke kusuka kunethiwekhi yeselula. Imibiko ephikisanayo ivamise ukuchaza amapheya amabili ahlukene amaroutha. Akekho umbhali onephutha, futhi akukho mphumela ongajwayelekile.

Thola ukuthi yiluphi uhlangothi olulahle iphakethe ngaphambi kokuthinta amaphrofayili. Ukubanja ezakupheleni zombili kuyaxazulula lokho emzamweni owodwa: amadatha-gramu ashiya u-A angafiki ku-B abonisa ukuthi ukugceleza kwabhalwa kabusha endleleni, kuyilapho amadatha-gramu afika ku-B ngaphandle kwempendulo ebuya abonisa ukuthi i-firewall ayiwamukelanga njengahlobene.

Ama-peer amabili anamakheli e-IPv6 omphakathi ayagwema inkinga yonke. Ngaphandle kokuhumusha akukho okungafaniswa, ngakho umthetho we-firewall oqoka amapeer wanele futhi umklamo uyeka ukuncika ekuziphatheni kweroutha.

Nini okufanele uyeke ukuzama

Umhambukeli onekheli lomphakathi yimpendulo ethembekile. Angaqeda i-tunnel kuwo womabili amapeer, noma amane nje asize ukuthola ikheli langaphandle lamanje lomunye nomunye, futhi zombili izinhlelo ziyasebenza noma ngabe ama-NAT enza ini. Isendlalelo esiphathwayo sinikeza ukuxhumanisa okufanayo uma inqubomgomo ikuvumela.

Akukho kulokhu okudinga i-firewall evaliwe. Ukucisha isivikelo ukuze unqobe ukuxhumana okuqondile kulahla isizathu esenza umzamo oqondile uhehe, futhi kushiya umshini uvulekile isikhathi sonke sokuhlola.

Zama ukuhlelwa okuqondile kuqala, bese ubhala lokho okubonile. Ukuziphatha kwe-NAT kanye nokubanja okukubonisile kungcono kunepheya lamaphothi owagcina ulisebenzisile, ngoba inethiwekhi elandelayo izohluka. I-ncwadi ye-OpenVPN 2.6 ibhala lport kanye nezinketho ze-remote okuncike kuzo lokhu.