I-L2TP/IPsec ixhuma kunethiwekhi eyodwa bese iphelelwa yisikhathi kwenye

I-laptop efanayo, iphrofayela efanayo nephasiwedi efanayo ziyasebenza esakhiweni esisodwa futhi zehluleke kwesinye. Lokho kuqhathanisa ubufakazi obusizo kakhulu kuthikithi, futhi ngokuvamile kuyinto yokuqala elahlwayo. Phakathi kwamanethiwekhi amabili okufinyelela, ukushintshana kudlula ekuhumusheni kwamakheli ahlukile, izihlungi ezihlukile kanye nabasizi be-router abahlukile. Ukugcina iklayenti lingashintshiwe nokushintsha inethiwekhi kuphela kuyindlela yokuthola ukuthi yikuphi kwalokhu okubalulekile.

Beka iklayenti ngaphambi kokuqhathanisa amanethiwekhi

Ungashintshi lutho kudivayisi uze ube nerekhodi yecala elisebenzayo: inguqulo yeklayenti, okuqukethwe kwephrofayela, igama leseva kanye nesikhathi sokuxhumana okuphumelelayo. Bese uphinda ukwehluleka kunethiwekhi yesibili phakathi neseshini efanayo, ukuze isimo seklayenti sifane ngangokunokwenzeka. Iphrofayela ehlelwe phakathi kwemizamo emibili iyawuchitha wonke umqhathaniso. Umgomo uwukuhluka okukodwa, futhi lokho kuhluka yinethiwekhi.

Qinisekisa kuqala ukufinyelela okuvamile kwe-inthanethi kunethiwekhi ehlulekayo, kuhlanganise ne-portal yezivakashi uma ikhona. I-portal engakaze yagcwaliseka ikhiqiza isikhathi sokulinda esibonakala sifana ncamashi nomhubhe ohlungiwe, futhi lokho kuhlola kuthatha umzuzu.

Izigaba ezine, imilayezo emine ehlukile yephutha

Ukuxhumana kwe-L2TP/IPsec kudlula ezigabeni ezine, futhi RFC 3193 ichaza ukuhlelwa okubopha ezimbili zokuqala. Ukuxoxisana kwe-IKE yindawo lapho indlela ehlungiwe ikhiqiza khona isikhathi sokulinda esithule. Ukuqinisekiswa kwe-IPsec yindawo lapho ukungafani kwesitifiketi noma ukhiye owabiwe ngaphambili kukhiqiza khona ukwenqatshwa okucacile esikhundleni salokho. Ukusethwa komhubhe we-L2TP yindawo lapho inhlangano yezokuphepha esivele isungulwe isengase ingaholeli ndawo, futhi ukungena kwe-PPP yindawo lapho imininingwane yokungena engalungile ekugcineni ikhiqiza ukwehluleka okubonakalayo. Funda ilogi yesigaba esama, hhayi umugqa wokugcina ophrintiwe.

journalctl -u strongswan --since '-5 min' | tail -20
journalctl -u xl2tpd --since '-5 min' | tail -20
ip -4 route get 198.51.100.10

Ilogi ye-strongSwan ibonisa ukuthi ukushintshana kwe-IKE kufinyelele isiphakamiso yini nokuthi uzakwabo uphendule nhlobo yini, okuhlukanisa ukufinyeleleka kusuka kunqubomgomo. Ilogi ye-xl2tpd ithatha indawo lapho i-IPsec iphela khona, ngakho inhlangano yezokuphepha esunguliwe engenalutho kuleyo logi ikhomba esigabeni se-L2TP. Umbuzo wendlela uqinisekisa ukuthi iklayenti lithumela kukheli leseva olicabangayo, okubamba impendulo ye-DNS ephelelwe yisikhathi eyazuzwa kunethiwekhi yangaphambilini. Ngokuhlangene, imiphumela emithathu isho isigaba esikhundleni sophawu.

Qhathanisa ukujula kwe-NAT nokuziphatha kosizo

Ukunqamula kwe-NAT kuhambisa ithrafikhi evikelwe ku-UDP encapsulation lapho ukuhumusha kutholakala, ngakho izinombolo zembobo ezithwala iseshini esebenzayo zingahluka kulezo ezisemfanekisweni omile. Ukuvumela iphakethe elilodwa lokusetha akufakazi lutho mayelana nokunye ukushintshana, futhi ukuskena kwembobo kwangaphandle akukwazi ukukutshela ukuthi uzakwabo uphatha kanjani ithrafikhi eqinisekisiwe evumelekile. Isendlalelo sesibili sokuhumusha sishintsha isithombe futhi, ngoba ukumephwa manje kukhona kabili futhi kuphelelwa yisikhathi ngezinhlelo ezimbili ezihlukile. Ukuhumusha kwezinga lomhlinzeki kuxhumano lweselula yisizathu esivamile sokuthi iphrofayela yasehhovisi esebenzayo yehluleke ku-hotspot yefoni.

Abasizi be-router bayahluka njengamanethiwekhi. Amanye ama-firmware ayabamba futhi abhale kabusha ukushintshana, amanye ayayeka nje ukuyilahla, kanti amanye asebenzisa isilungiselelo kumodi endala kuphela. Funda incazelo ye-firmware uqobo yebhokisi lokukhetha, futhi lapho kukhona imodi yokuhambisana, yihlole njengoshintsho olulodwa olwenziwe ngamabomu esikhundleni sokuthathu ngasikhathi sinye.

Iklayenti eliphumayo, iseva engenayo: izinkinga ezimbili ezihlukile

Iklayenti eliphumayo nesiseva esingenayo zidinga ukufinyeleleka okuhlukile phezulu, futhi isici sokudlula esisiza esokuqala asenzi lutho kuleso sesibili. I-router yasekhaya evumela i-laptop ukuthi ifinyelele isango elikude ayizamukeli ngalokho ukuxhumana okungenayo okuya kuseva engemuva kwayo. Ukudidanisa lokhu okubili kukuthumela ukufuna ukudluliselwa kwezimbobo okwakungakaze kube yinkinga. Shono ukuthi idivayisi ehlulekayo idlala iphi indima ngaphambi kokuqhathanisa noma yini.

Ngemva koshintsho olusekelwayo, phinda ukuxhumana okufanayo futhi urekhode isigaba ekufinyelele. Gcina ndawonye iphrofayela esebenzayo kanye nenothi mayelana nenethiwekhi ehlulekayo, futhi ungaphindi usethe imininingwane yokungena noma ufake kabusha iklayenti, ngoba lokho kulahla ubufakazi umqhathaniso owakhiwe phezu kwabo.