I-IPsec yokudlula kurutha yasekhaya: yenzani ngempela

Izishintshi zokudlula zerutha ziyimvume yokudlulisela yedivayisi engemuva kwazo, hhayi izinsizakalo ze-VPN. Azibhalisi irutha njengeklayenti, azigcini ubufakazi futhi azicindezeli yonke idivayisi endlini ngomnyango wokuphuma okude. Ezikwenzayo ukwakha indlela iphrothokholi eyodwa ewela ngayo ukuhunyushwa kwamakheli nezihlungi. Uma lokho sekucacile, isishintshi silula ukusihlola futhi silula ukusishiya sicishiwe.

Okwenziwa yirutha ngempela

Irutha lihlala phakathi kweklayenti nozakwethu we-IPsec futhi lidlulisela amaphakethe elingakaze lakhelwe ukuwaqonda. Abakhiqizi basebenzisa le ntambo ngezindlela ezintathu okungenani: umsizi wephrothokholi olandelela noma obhala kabusha isimo, ukukhishwa kwesihlungi okumisa ukulahla i-ESP, noma imodi yokuhambisana yamaklayenti amadala. Ilebula kusixhumi esibonakalayo sewebhu akuvamile ukusho ukuthi iyiphi kwezintathu onayo. Imibhalo ye-firmware noma ukuthwebula amaphakethe kuphela okuzokusho lokho.

Umsizi angenza izinto zibe zimbi kakhulu. Usizo olubhalelwe ukugeleza okudala ngezinye izikhathi luphazamisa iklayenti esivele isebenza ngokuhunyushwa ngendlela efanele. Uma iklayenti yesimanje isebenza ngokukhetha kuvaliwe, ukuyishiya ivaliwe iwukuhleleka okungcono.

Ukudlula akunikezi irutha izikhiye zabakwethu. Lisabona amakheli angaphandle namachweba, futhi lisasebenzisa inqubomgomo yalo yokudlulisela kuwona.

I-NAT ne-NAT-T zinquma indlela

I-IPsec ayakhelwanga ukuba idlule ekuhunyushweni kwamakheli, ngakho amazinga engeza isembozo. I-NAT traversal ifaka i-ESP ngaphakathi kwe-UDP, okuvumela ithebula le-NAT elivamile ukuthwala ukugeleza, futhi izingxoxo ziyavumelana ngalokho kushintsha phakathi kwe-IKE (RFC 3948). I-IKE ngokwayo isebenzisa i-UDP 500, kuyilapho indlela emboziwe ivamise ukusebenzisa i-UDP 4500.

Yingakho umthetho we-firewall ovumela kuphela iphrothokholi 50 awanele endleleni ehumushiwe. Ukuvimba i-4500 kwephula icala okhona ngayo isembozo, futhi ukuvimba i-500 kumisa izingxoxo ngaphambi kokuba kwenziwe umhubhe. Zombili izinhlangothi zibalulekile, ngoba irutha elilandelela isimo ngokuvamile livumela impendulo kuphela ngemva kokubona isicelo. Ukufinyelela ichweba akufani nokuqeda ubuqinisekiso, futhi akufani nokudlulisela ithrafikhi evikelwe.

Amalungiselelo amadala ahluka ngokwanele kangangokuthi incwadi eyenzelwe wona ingadukisa. Uma iklayenti inikeza zombili izimo, hlola leyo edokhumentwa nguzakwethu wakho hhayi leyo enemiphumela eminingi yosesho.

Thola isigaba esihlulekayo

Ihlukanise inkinga ibe yizingxoxo, ubuqinisekiso, ukuvikela ingane nokudlulisela ngaphakathi, bese uqoqa ubufakazi besigaba esisodwa ngesikhathi. Ukuqala kabusha okushintsha umphumela okwesikhashana kufakazela kuphela ukuthi kwakukhona isimo esithile.

sudo tcpdump -ni any 'udp port 500 or udp port 4500'
ip xfrm state list
ip xfrm policy list

Ukuthwebula kubonisa ukuthi ukushintshana kufinyelela yini kuzakwethu nokuthi izimpendulo ziyabuya yini, okuhlukanisa inkinga yesihlungi nenkinga yobufakazi. Uhlu lwesimo lubonisa ukuhlobana kokuphepha okusunguliwe, ngakho uhlu olungenalutho ngemva komzamo lukhomba ezingxoxweni hhayi ekuqondiseni. Uhlu lwenqubomgomo lubonisa ukuthi iziphi izikhethi ezifakiwe, futhi yilapho okuhlosiwe okungaphandle kwenethiwekhi encane kukhishwa khona. Funda kokubili okuphumayo kwe-xfrm ngaphambi kokuthinta irutha, ngoba kuchaza lokho umsingathi akukholelwayo hhayi lokho irutha elikuvumelayo.

Uma amaphakethe ephuma futhi kungabuyi lutho, hambisa ukuthwebula ohlangothini lwe-WAN lwerutha. Ukuqhathanisa kokubili ukuthwebula kuthola indawo yokulahla ngaphandle kokuqagela.

Cisha ongakudingi

I-laptop eyodwa esebenzayo ayifakazeli ukuthi irutha lisebenzela amaklayenti amaningi ngesikhathi esisodwa. Iklayenti ngayinye yakha isimo sayo sokuhunyushwa nezingxoxo zayo, futhi abanye abasizi balandelela ukugeleza okukodwa kuphela. Hlola inani lamaseshini angasikhathi esisodwa owadingayo ngempela, kusuka kunethiwekhi ozisebenzisayo ngempela. Uma iklayenti lesibili lihluleka kuyilapho elokuqala lichuma, yilokho okutholakele, hhayi umhubhe ongazinzile.

Shiya ukukhetha kuvuliwe kuphela uma ukuthwebula kubonisa ukuthi kudingeka. Bhala inguqulo ye-firmware eceleni komphumela, ngoba lezi zimo ziyashintsha phakathi kokukhishwa. Umgomo umhubhe weklayenti oyiqinisekisile, hhayi isishintshi osivule ngethemba.