Ukwehluleka kokubhala i-GRE ku-pptpd akulona inkinga yephasiwedi

Ukwehluleka kokubhala i-GRE kulogi, futhi umgqigqo wokuqala ukusetha kabusha iphasiwedi yomsebenzisi. Lowo mgqigqo cishe uhlala ungalungile. Le miyalezo ichaza indlela yedatha, hhayi ukuhlolwa kobufakazi: iklayenti kungenzeka ukuthi lifakaze ngempumelelo futhi labe selimile esigabeni lapho libhalisa khona kunethiwekhi. Imiyalezo emibili ehlukene ikhomba izinto ezimbili ezingalungile, futhi akukho neyodwa exazululwa ngephasiwedi entsha.

Imiyalezo emibili, izinto ezimbili ezingalungile

Ukwehluleka kokufunda kusho ukuthi amaphakethe e-GRE awafiki neze ku-daemon, noma ayaphonswa phansi lapho engena. Uxhumano lokulawula lungabonakala luphelele futhi lunempilo ngenkathi kungenakho okudlula endleleni yedatha. Ukufakaza kuyinto kuphela ebonakale isebenza.

Ukwehluleka kokubhala ngokuvamile kusho ukuthi isikhathi sikhulume ngokuthile i-kernel noma iklayenti elingakwazi ukukusebenzisa. Isiteshi sokulawula saqedwa, futhi izinketho okwavunyelwana ngazo kulolo shintsho azihambisani nalokho amaphoyinti okugcina angakwenza ngempela. Lokho kuwukungezwani kokucushwa, hhayi isigameko sokufakaza.

Funda ukuthi yikuphi kulokhu okubili okuvelayo ngaphambi kokushintsha noma yini. Zikuholela ezigabeni ezihlukene, futhi ukuzithatha njengophawu olulodwa yikho okwenza iseva efanayo ilungiswe kabili ngezizathu ezingahlobene. Umugqa welogi ukuwukuhlola kwamahhala kuphela okuwutholayo.

Iphrothokholi 47 ayilona iphothi 47

I-PPTP isebenzisa i-TCP 1723 ukusetha ucingo kanye ne-GRE ukuthwala umthwalo. I-GRE iyipthrothokholi ye-IP 47, hhayi inombolo yephothi, ngakho umthetho we-firewall ovula iphothi 47 awuvumeli lutho olusizo.

Irotha esendleleni idinga isici se-passthrough se-PPTP noma imvume ecacile ye-GRE. Ngaphandle kwakho, ukuxhawulana kwe-TCP kuyaqedwa futhi umhubhe awuthwali phakethe neze, okukhiqiza kanye nokwehluleka kokufunda okungenhla. Imithetho yephothi 47 ku-firewall iyantambama emosha kakhulu kule phrothokholi.

Buka izinhlangothi zombili ngesikhathi esisodwa kuseva esikhundleni sokuqagela ukuthi yiluphi uhlangothi olahla ithrafikhi: tcpdump -ni any port 1723 or proto gre.

Uma u-1723 ekhombisa ukusethwa kocingo ngenkathi i-GRE ithule, ukuvinjelwa kungaphezu komphathi. Uma i-GRE ifika futhi i-daemon isehluleka, inkinga iyasekhaya futhi izinketho iyindawo elandelayo okufanele ibukwe.

Vumela i-GRE lapho umphathi edlulisela khona ngempela

Ukufaka umthetho we-forward we-GRE kuwukuhlola okunengqondo kumphathi odlulisela ithrafikhi yomhubhe, futhi akulona inqubomgomo. Umthetho wokuhlola owamukela konke kwephrothokholi eyodwa uwukuhlola, hhayi umklamo. Yeka uhlale isikhathi esanele ukuze ufunde okuthile, bese uwushintsha ngomthetho onomkhawulo.

Engeza umthetho we-input wamaphakethe aqondiswe kuseva ngokwayo, ngoba uchungechunge lwe-forward aluwaboni. Bese ubuka izibali zomthetho ngaphambi nangemva komzamo wokuxhumana, okukutshela ukuthi amaphakethe ayafika yini.

Yenza umthetho uhlale njalo ngensizakalo ye-firewall yokusabalalisa esikhundleni sokuphinda uyisebenzise ngemva kokuqala kabusha ngakunye. Kusiphathi se-nftables, fanisa i-ip protocol gre kukho kokubili uchungechunge lwe-input ne-forward.

Qinisekisa ukuthi imodyuli ye-ppp_generic nayo ilayishiwe, futhi hlola ukuthi ukulandelela ukuxhumana kuwulahla yini umkhombandlela wokubuya. Kokubili kukhiqiza ukwehluleka okubonakala njengenkinga ye-firewall kodwa akusiyo. Imodyuli ye-kernel engekho ibonakala ifana ncamashi nephrothokholi evinjiwe kuze kube uyahlola.

Fanisa izinketho neklayenti ona nalo ngempela

Isilungiso esivela komunye umbiko siku-/etc/ppp/pptpd-options, lapho iresiphi inqaba khona i-PAP, i-CHAP ne-MSCHAP, ibeka imibono emigqeni ye-require ehambisanayo futhi igcina i-MPPE enesimo. Leyo resiphi yabhalelwa ingxube eyodwa yamaklayenti, futhi ukukopisha ngokungaboni kuphula icala elivamile. Funda imigqa yokwenqaba njengesitatimende mayelana namaklayenti umbhali ayenawo, hhayi njengesincomo.

Iklayenti le-Windows ngokuvamile lidinga i-MS-CHAPv2 ne-MPPE-128. Gcina lezo zidingo futhi ususe kuphela izinketho iklayenti elingakwazi ngempela ukuxoxisana ngazo.

# keep encryption; drop only what this client cannot negotiate
refuse-pap
refuse-chap
refuse-mschap
mppe-stateful
require-mschap-v2
require-mppe-128

Ukucisha ukubethela ukuze uxhumano luphumelele kuwukwehlisa izinga, hhayi ukulungisa. Hlola uhlobo olunjalo kuxhumano lwaselebhu, bese ubuyisela ukubethela ngaphambi kokuba insizakalo ibhekane namaklayenti angempela. Uxhumano olusebenza ngokungaphephile lulubi kunalolo olwehluleka ngobuqotho.

Funda inombolo yephutha leklayenti

Ikhodi yezinombolo yeklayenti inciphisa isigaba ngokushesha kunelogi yeseva. Yifunde ngaphambi kokufunda noma yini enye. U-691 usho ukuthi ubufakazi benqatshiwe, u-721 usho ukuthi iseva ayikaze iphendule, futhi u-619 usho ukuthi uxhumano lwehlile. Amaminithi amabili nenombolo agcina ihora ngokucushwa.

Qhathanisa leyo khodi nelogi yeseva ngaphambi kokuhlela noma yini, futhi uhlole futhi neklayenti elifanayo ngemva kwakho konke ukushintsha. Uma kungenjalo ukwehluleka kwesibili kucasha ngemva kokuqala futhi isilungiso sibonakala singasebenzi.

Uma ukungena kuphumelela futhi kungekho thrafikhi ehambayo, i-GRE iseyisola. Leso yisikhathi sokubuyela ekuthwebuleni esikhundleni sokubuyela endaweni yokugcina ubufakazi.