Iphakethe le-VPN linamasheke amangaki? Kuncike

Isimangalo sokuthi iphakethe le-VPN lithwala amasheke amabili ngqo sizwakala sihle futhi sivame ukungalungi ngokwanele ukuthi kufanele sihlaziywe. Inombolo incike ekutheni yiziphi izinguqulo ze-IP ezivelayo, iyiphi iphrothokholi yokuthutha ethwalwayo kanye nokuthi umhubhe usebenzisa iphi ifomethi yokuvikela. Isheke lekhanda, isheke lezinga eliphezulu kanye nomthegi wobuqotho we-cryptographic kuyizindlela ezintathu ezinobubanzi obuthathu. Ukuzibala kuqala ngokumaka ukuthi ngayinye ihlanganisa ini.

Hlola ukuthi yiziphi izinguqulo ze-IP ezingempela ezisocingweni

Amakhanda e-IPv4 athwala isheke lekhanda lamabhithi angu-16, kanti amakhanda e-IPv6 awathwali lutho olunjalo. Leli qiniso elilodwa lishintsha inombolo kumhubhe ngamunye, ngoba ukugoqa i-IPv4 ngaphakathi kwe-IPv6 kanye ne-IPv6 ngaphakathi kwe-IPv4 kukhiqiza imibhalo ehlukile. Umhubhe ungathwala imindeni yomibili ngasikhathi sinye, futhi lapho uhlangothi olulodwa lungaqukatha inkambu engekho kolunye. Setha izinguqulo ngaphambi kokubala noma yini.

Bhala ukuhlelwa njengohlu lwamakhanda hhayi njengesithombe. Ukulandelana kubalulekile lapho kufundwa ukuthwebula, futhi ukuba khona noma ukungabi khona kwensimu yesheke kuyinto yokuqala okufanele imakwe.

outer IPv6 | ESP | inner IPv6 | UDP | application data
outer IPv4 | ESP | inner IPv4 | TCP | application data

Umugqa wokuqala awunawo isheke lekhanda le-IP noma kuphi emakhandeni awo e-IP, kuyilapho owesibili unamabili lapho womabili amakhanda engama-IPv4. Ubuchwepheshe obufanayo bomhubhe, inombolo ehlukile, futhi awukho umugqa oyifomethi egcwele yocingo.

Hlola ukuthi isheke ngayinye ihlanganisa ini

Ububanzi yingxenye abantu abayeqayo, futhi yiyo eyenza inombolo ibe nencazelo. Isheke lekhanda le-IPv4 livikela ikhanda futhi akukho okunye, ngakho akusho lutho mayelana nomthwalo ongemuva kwalo. Isheke le-UDP phezu kwe-IPv6 lihlanganisa i-pseudo-header kanye nekhanda le-UDP nomthwalo, okusho ukuthi lifinyelela ngaphakathi kwephakethe elithwalwayo lapho idathagramu isemhubheni. I-TCP inesheke layo elincike ngendlela efanayo ku-pseudo-header. Lezi yizindawo ezintathu ezehlukene nakuba zontathu zibizwa ngokuthi amasheke.

I-RFC 791 ichaza ukuhlolwa kwekhanda le-IPv4 nokubalwa kwalo kabusha kuwo wonke umgxumela, futhi i-RFC 8200 ichaza ukuphathwa kwezinga eliphezulu phezu kwe-IPv6 kuhlanganise ne-pseudo-header. Akukho mbhalo othi iphakethe le-VPN linombolo engaguquki yamasheke, ngoba awukho ochaza umhubhe.

tshark -r capture.pcap -Y "ip.proto == 50" -V | grep -i checksum

Hlola ukuvikela kobuqotho ngokwahlukile

Ubuqotho be-ESP ukuvikela kwe-cryptographic okunobubanzi baso kanye nokumelwa okuncike ku-algorithm. Akusilo isheke le-IP noma le-UDP ngaphansi kwegama elinye, futhi ubude baso buyehluka ngokohlelo olukhethiwe. Ukuhlolwa kobuqotho kuhlanganisa ingxenye ethile yephakethe, okungase kubandakanye ikhanda le-ESP kanye nengxenye yomthwalo kuye ngemodi esetshenziswayo. Ukulibala njengensimu yesheke enobubanzi obaziwayo yilapho iningi lezi zincazelo liwa khona.

Funda uhlelo olukhethiwe ngaphambi kokubala amabhayithi, futhi chaza umphumela njengokuvikela kobuqotho hhayi njengesheke elinelinye ilebuli. Isihumushi sizokutshela igama lensimu uma ubuza.

tshark -r capture.pcap -Y esp -V | grep -iE "integrity|icv"

Hlola iphoyinti lokubuka ngaphambi kokubala

Ukuthwebula kusixhumi sangaphakathi nokuthwebula ocingweni kungakhombisa izingqimba ezihluke ngokuphelele. Kusixhumi sangaphakathi umhubhe usuvele ukhutshiwe, ngakho ubona iphakethe elithwalwayo futhi awuboni nekhanda elilodwa langaphandle. Ocingweni ubona amakhanda angaphandle kanye nomthwalo oshifriwe ongakwazi ukuwufunda. Akukho ukubuka okungalungile, futhi akuzona izibukeli zento eyodwa. Isho ukuthi ukuthwebula kwenziwe kuphi ngaphambi kokucaphuna noma iyiphi inombolo.

sudo tcpdump -ni eth0 -vv -c 5 esp
sudo tcpdump -ni tun0 -vv -c 5

Umyalo wokuqala ukhombisa iphakethe langaphandle kanye ne-trailer yalo yobuqotho, kanti owesibili ukhombisa iphakethe elithwalwayo kanye nesheke lalo lokuthutha. Ukuhlanganisa izinombolo ezivela kukho kokubili ukuthwebula akubali lutho kabili, kodwa kuchaza iphakethe elifanayo kabili.

Qhathanisa inombolo nokuthwebula kwangempela

Hlukanisa iphakethe elilodwa ngokuphelele futhi umake yonke inkambu isihumushi esiyibiza ngokuthi isheke noma inani lobuqotho. Bese uqhathanisa umaka ngamunye nokuhlelwa okuwubhalile, futhi ususe leyo engokwengqimba ongeyona oyibalayo ngempela. Inombolo ehlala kuleyo msebenzi iyavikeleka, kanti inombolo ecashunwe enkumbulweni ayinjalo.

Phinda okwesiqondiso sempendulo, ngoba umhubhe othwala imindeni yomibili ungahluka ngesiqondiso nangokugeleza. Bese usho inombolo kanye nobubanzi bayo, isibonelo amasheke amathathu ale phakethe langaphakathi kuleli phoyinti lokubuka, hhayi njengesici samaphakethe e-VPN ngokujwayelekile.

tshark -r capture.pcap -T fields -e ip.checksum -e udp.checksum -e tcp.checksum