Itunesi eliphelele le-FortiClient: hambisa kuphela isixhumanisi sasehhovisi

Itunesi iyenyuka, isithonjana siba luhlaza futhi inethiwekhi yasendaweni iyanyamalala: amaphrinta, i-NAS kanye nomhambisi wasehhovisi konke kuyeka ukuphendula. I-FortiClient yenza lokho okuceliwe iphrofayili. Isango lihambise umzila wokuzenzakalela, iklayenti liwufakile, futhi manje yonke iphakethe inendlela yokungena etunesini. Ukulungisa ukushintshwa kwethebula lemizila kanye nokushintshwa kwe-DNS ngemuva kwayo, futhi ukulandelana kwalokho kushintsha kuyona kunquma ukuthi umshini uzophetha kangcono noma kabi.

Iklayenti lifake ini, futhi kungani i-LAN yanyamalala

Qala ngokufunda ithebula esikhundleni sesixhumi esibonakalayo seklayenti. Ku-macOS netstat -rn iphrinta ithebula lonke futhi route -n get default isho isixhumi kanye nemethrikhi enqobayo manje; ku-Linux ipheya ip route show kanye ip route get 8.8.8.8. Zombili ziphendula umbuzo owodwa: yiluphi uhlu oluzothwala iphakethe elingafani nanoma yini eqondile kakhulu.

Igama ledivayisi yetunesi aliqinile. Iphrofayili ye-IKEv2 ku-macOS ngokuvamile ikhombisa utun ngenombolo, iklayenti le-SSL VPN likhombisa ppp0, futhi i-OpenVPN ikhombisa tun0. Imizila emibili yokuzenzakalela nayo ingaba khona ngesikhathi esisodwa ngamamethrikhi ahlukene, futhi umhlahlandlela weklayenti ungase athathe izintambo kuphela ngemva kokuxhuma kabusha hhayi ngaso isikhathi sokubonakala. Yingakho izingxenye ezimbili zethebula ezithathwe ngemizuzu emihlanu zihlukene zingaxoxa izindaba ezihlukene.

Kungani umzila wokuzenzakalela wetunesi kufanele uhambe kuqala

I-kernel ikhetha isanduleli esihambisana kakhulu futhi uma imizila eminingi icacile ngokulinganayo ikhetha lowo onemethrikhi ephansi kakhulu. Ngakho iklayenti elifaka 0.0.0.0/0 ngemethrikhi engcono linqoba yonke indawo ngaphandle kokususa umzila wokuzenzakalela wangempela, futhi yingakho umzila womzimba usakhona ethebuleni futhi usachaza ukuphazamiseka. Ukususa umzila wokuzenzakalela wetunesi kuqala kubuyisela ukuziphatha kwangaphambili. Kuphela ngemva kwalokho umzila wesanduleli odlula etunesini wenza lokho okwakuhloswe umbhali wawo.

Ukungeza izanduleli ngaphambi kwalelo nyathelo yiphutha elikhiqiza umshini osebenza uhhafu. Ithrafikhi yesanduleli esisha ilandela itunesi, futhi konke okungekho ohlwini kulandela umzila wokuzenzakalela wetunesi, ngakho akukho okubonakala kuphukile kuze kube umuntu evula isevisi okungekho muntu owengeza yona. Susa, buyisela, bese wengeza, futhi isimo esiphakathi sihlala silindelekile.

Ukulandelana ku-macOS naku-Linux

Ku-macOS ukulandelana kususa umzila wokuzenzakalela wetunesi, kubuyisela umzila wokuzenzakalelayo womzimba futhi kuthumela isanduleli esisodwa sasehhovisi sibuyela etunesini. Shintsha amagama esixhumi ayizibonelo lapha nalawo asethebuleni lakho.

sudo route delete -net default -interface utun4
sudo route add -net 0.0.0.0 -interface en0
sudo route add -net 10.20.0.0 -netmask 255.255.0.0 -interface utun4

Ku-Linux ukulandelana okufanayo kusebenzisa ithuluzi elihlukile: isango le-LAN kumzila wokuzenzakalela kanye nedivayisi yetunesi esanduleleni sasehhovisi. Umyalo wakudala route usawamukela isintaksi yakudala, kodwa ip route iwuhlobo oluhambisana nemibhalo yamanje.

sudo ip route del default dev tun0
sudo ip route add default via 192.168.50.1
sudo ip route add 10.20.0.0/16 dev tun0

Lapho umzila udinga ukugxuma okulandelayo esikhundleni sedivayisi, thatha i-peer kokuphuma kweklayenti. Ukuqagela kuveza elinye lamaphutha amabili, futhi asho izinto ezihlukene: isango elingalungile linikeza i-network unreachable ngokushesha, kuyilapho umgomo wetunesi ongalungile unikeza isikhathi sokuphela. Funda ukuthi yikuphi okutholile ngaphambi kokushintsha umyalo futhi.

Izanduleli, isixazululi kanye ne-DMZ ehlala isemnyameni

Isanduleli esisodwa akuvamisile ukumboza wonke umsebenzi. Amaseva ezinhlelo zokusebenza, amanethiwekhi okuphatha, i-DMZ kanye namaseva e-DNS ngokwawo kungenzeka ukuthi ngayinye isebangeni elihlukile, ngakho bhala wonke amabanga ongawasho ngaphambi kokuqala futhi uhlole ukusesha eduze kwayo yonke i-ping. Indawo etholakala phakathi nokuhlola yiyo ekhohliwe ebhukwini lezinguquko. Umzila ophendula ngamakheli kodwa wehluleke ngamagama ngokuvamile uyinkinga yesixazululi esigqoke izingubo zokuhambisa imizila.

Isixazululi yisinqumo esihlukile. Uma iphrofayili ithumele amaseva e-DNS angaphakathi, ukususa umzila wokuzenzakalela kungase kushiye lawo makheli engafinyeleleki emagameni omphakathi noma efinyeleleka kuphela ngetunesi, futhi zombili izimo ziveza imiphumela engaphelele edidayo. Hambisa amakheli esixazululi ngetunesi, noma lungiselela ukuxazululwa ngesizinda ngasinye ukuze ukusesha komphakathi kusebenzise isixazululi sasendaweni.

Iklayenti le-SSL ku-Linux linokwehluleka okuqondene nensimu okufanele kwaziwe: itunesi iyaxhumeka, i-LAN yasehhovisi iyaphendula, futhi ibanga elilodwa le-DMZ lihlala lisemnyameni. Ingxenye engekho umzila walelo banga odlula esangweni letunesi, futhi isango liyahluka phakathi kwemishini, ngakho ikheli elibhalwe ngokuqinile yiyo indlela ilaptop elandelayo ephuka ngayo. Yithole esimweni seklayenti futhi ugcine umyalo uzichaza wona:

PEER=$(ip -4 addr show dev ppp0 | awk '/peer/ {print $4}' | cut -d/ -f1)
sudo ip route add 192.168.30.0/24 via "$PEER"

Funda amanani amabili ngaphambi kokuwusebenzisa. I-peer iwumkhawulo okude wetunesi yephoyinti-kuya-phoyinti, futhi yilokho ikheli umzila we-DMZ okudingayo; etunesini ehambiswayo okulingana nakho yisixhumi noma isango elibikwa iklayenti. Uma kungabonakali nakunye kwazo, iklayenti alikho kwimodi oyicabangile.

Ngemva kokuxhuma okulandelayo, nokuthi uyeke nini ukwenza lokhu endaweni

I-FortiClient ixhuma kabusha ngemva kokulala noma ushintsho lwenethiwekhi futhi ifaka kabusha lokho okushiwo iphrofayili. Ngakho imizila yezandla iphila kuphela kuze kufike ukuxhuma okulandelayo, futhi yiso leso sikhathi lapho ukuhlola okukodwa okuphumelelayo kungabonakala njengokulungisa. Umzila onyamalala ebusuku ukuziphatha okulindelekile, hhayi iphutha elisha.

Kunzima izimpendulo ezimbili eziqinile. Iskripthi esiphinde sisebenzise ukulungisa ngemva kokuxhuma ngakunye siyindlela yokuzungeza engahle iphile isikhathi eside kunombhali wayo, kuyilapho iphrofayili yetunesi ehlukanisiwe evela kumphathi wesango iwukulungisa kwangempela, ngoba iklayenti libe selifaka kuphela amabanga adingwa umsebenzi. Cela eyesibili futhi usebenzise eyokuqala kuphela ngenkathi ulindile. Hlola futhi inqubomgomo oyivumile ngaphambi kokuhlukanisa itunesi ephelele endaweni, ngoba inethiwekhi ekude ingase incike ekuboneni ithrafikhi yakho yonke.

Uhlu lokuhlola lufushane: funda ithebula, susa umzila wokuzenzakalela wetunesi, buyisela umzila wokuzenzakalela we-LAN, engeza isanduleli ngasinye, lungisa ukuxazululwa ngokwehlukile, futhi ulindele ukuthi imizila ibuye lapho kuxhunywana kabusha.