Umthetho we-IPsec ugwinya ithrafikhi yakho yasendaweni: indlela yokubona

Iprinter etafuleni iyeka ukuphendula ngesikhathi umhubhe ukhuphuka, futhi akukho lutho ekuhlelweni komhubhe okhuluma ngeprinter. Ngokuvamile okwenzekile ukuthi ububanzi obuvikelwe babhalwa bubanzi ngokwanele ukuba buhlanganise neprinter, ngakho umshini manje uzama ukubethela ithrafikhi obekufanele ihlale kusegimenti yasendaweni. Ukufunda umthetho ofakiwe kuchaza lokhu kubanjwa; ukunciphisa kwawo endaweni efanele kugcina ithrafikhi ekude ivikelwe. Uhambo olusuka esicelweni esihlulekile luye kumthetho ohambisanayo luthatha imizuzu embalwa.

Landela ukugeleza ngaphambi kokushintsha isikhethi

Qala esicelweni esihlulekile bese ubhala amanani amane: ikheli lomthombo elisetshenziswa umshini, indawo ekholekile, umzila okhethwa yi-kernel kanye nomthetho ohambisana naleyo mbhangqwana.

Lawu maqiniso amane anquma ukuthi ukubanjwa kwenzelwe noma ngengozi. Indawo ewela ngaphakathi kwesikhethi esikude ivikelwe ngokwakhiwa, noma ukwakhiwa kwakungalungile. Indawo engaphandle kwaleso sikhethi kodwa ibanjwa isho ukuthi kuhambisana okunye, futhi ukushintsha isikhethi ngeke kusize. Zombili lezi zimo zivamile, futhi umyalo owodwa uyazihlukanisa.

Yenza lokhu ngaphambi kokuhlela noma yini, ngoba icala elithakazelisayo i-subnet yasendaweni edlula ububanzi bangasese obuvikelwa uxhumano. Ama-prefix ajwayelekile njenge-192.168.0.0/16 avela kumanethiwekhi amaningi, futhi isikhethi esibhalelwe esinye sazo singamboza eyakho buthule.

Izinhlobo ezintathu zasendaweni eziziphatha ngendlela ehlukile

Indawo eyabelwe le host, indawo ekulona lelo xhumano kanye nendawo engemuva kwesinye isixhumi ziyizimo ezintathu ezihlukile. I-kernel iphatha ngayinye ngendlela ehlukile lapho inquma ukuthi ithrafikhi idinga ukuvikelwa.

Ithrafikhi ekhiqizwa yi-gateway uqobo ayifani nethrafikhi edluliselwa kusuka kuklayenti. Umthetho obonakala ulungile wethrafikhi edluliselwe ungabamba iseshini yokuphatha ye-gateway uqobo, futhi yileyo ndlela umqondisi alahlekelwa ukufinyelela ngesikhathi elungisa umhubhe.

Umkhuba owusizo ukusho igama lecala ngokuzwakalayo: ingabe leli phakethe livela kimi, liya kuxhumano lwami, noma lidlula kimi? Impendulo ngayinye ikhomba endaweni ehlukile yokunciphisa. Ukubhala phansi icala kuvimbela nomuntu olandelayo ukuba enze umsebenzi ofanayo futhi.

Lapho ububanzi obuvikelwe buyindawo yonke yangasese, zontathu izimo zingawela kuyo ngasikhathi sinye, futhi uphawu luba umshini ongafinyeleli lutho ngaphandle kwephoyinti lokugcina lomhubhe.

Funda umthetho ofakiwe, hhayi ifayela

Amafayela wokuhlela achaza inhloso; i-kernel igcina imithetho ehambisana ngempela. Khombisa kokubili futhi uthatha ukungafani njengokutholakele kokuqala.

Le miyalo ikhombisa umzila okhethiwe wendawo kanye nemithetho efakiwe ohlangothini ngalunye:

ip route get 192.168.50.20
ip xfrm policy list
sudo swanctl --list-conns

Umzila ukutshela ukuthi iphakethe lizosebenzisa isiphi isixhumi. Uhlu lwemithetho lukutshela ukuthi ngemuva kwalokho kusetshenziswa ithempulethi kulelo phakethe yini, futhi uhlu lwezixhumano lukhombisa ukuthi i-daemon icabanga ukuthi ifake ziphi izikhethi. Uma indawo ivela kusikhethi esikude, utholile ukubanjwa ngaphandle kokuqagela.

Nciphisa isikhethi noma weqa indawo

Kunokulungiswa okubili okusekelwayo futhi kuphendula imibuzo ehlukile. Ukunciphisa isikhethi kusho ukuthi lolu xhumano luvikela ububanzi obuncane kuphela, okulungile lapho ububanzi obukhulu kwakuyiphutha. Ukwengeza ukuweqa kusho ukuthi le ndawo ethile akumele neze ivikelwe, okulungile lapho ububanzi obuvikelwe bubanzi ngempela futhi indawo eyodwa iwukuhlukile.

Khetha eyokuqala lapho unakho, ngoba isikhethi esincane kulula ukusicabanga futhi siyabonakala encazelweni yoxhumano. Khetha eyesibili lapho ububanzi obukhulu bunenhloso futhi okuhlukile kuyi-host eyodwa noma i-subnet ongayisho ngegama.

Kokubili kungokokuhlela okungumnikazi woxhumano. Umthetho wesikhathi sokusebenza owengezwe ngesandla uyanyamalala ekuxhumaneni okulandelayo, futhi iphutha liyabuya ngesikhathi lapho kungekho noyedwa okhumbula ikhambi lesikhashana.

Okuhlukile okuqinile ekufakweni kabusha

Ngemva koshintsho, phinda isicelo esinobungozi esifanayo futhi ubheke izibali ezifanayo. Indawo yasendaweni kufanele iphendule, futhi indawo ekude ehlosiwe kufanele isakhombisa ithrafikhi ebethelwe.

Lezi zivivinyo ezimbili ziqinisekisa ukuthi okuhlukile kwasinda futhi ukuvikela akuzange:

ip xfrm policy list | grep -c out
ping -c 3 192.168.50.20

Bese unqamula futhi uxhume kabusha umhubhe ngamabomu, futhi uphinde kokubili. Okuhlukile okusebenza ngaphambi kokuxhumana kabusha futhi kwehluleka ngemuva kwakho kwasetshenziswa kungqimba engalungile, futhi yiyo le ndlela evame kakhulu yokubuya kwale nkinga.