I-L2TP/IPsec nge-NAT: yini ephuka ngempela futhi kungani

Isimangalo sokuthi i-NAT yephula i-L2TP/IPsec siyiqiniso engxenyeni, ngakho asilusizo. Ukuhunyushwa kwamakheli kuyinto evamile, i-NAT traversal ikhona ukuze iphile kukho, futhi izigidi zamaklayenti zixhuma nsuku zonke zisuka ngemuva kwerutha. Okwephukayo yisigaba esithile sokushintshana okuthile: i-IKE ayitholi mpendulo neze, umhubhe ogqunyiwe uyaphonswa umthetho ovumela iphrothokholi eyodwa kuphela, noma ukumephwa kokuhunyusha kuphelelwa yisikhathi ngenkathi umhubhe ungenzi lutho. Uma usazi ukuthi usesigabeni sini, ukulungisa ngokuvamile kuwumthetho owodwa noma i-keepalive, hhayi ukuklama i-VPN entsha.

Inganekwane iwumbuzo ongafanele

Umbuzo owusizo awuwona «ingabe i-NAT iyephula lokhu» kodwa «iyiphi ingxenye yokushintshana ehunyushwayo, futhi idivayisi ehunyushayo yenza ini ngayo». I-L2TP/IPsec iyiphrothokholi enezingqimba: i-IKE iyaxoxa, i-ESP iyavikela, futhi L2TP ithwala i-PPP ngaphakathi kwalokho kuvikelwa. Ukuhunyushwa kwamakheli kuthinta isixhumanisi ngasinye ngendlela ehlukile, futhi izimpawu zokwehluleka zingahlukaniswa uma ubheka isigaba sezingxoxo hhayi iwindi lephutha.

Irutha eliphequlula iwebhu ngempumelelo lifakazela kuphela ukuthi i-TCP enokuhunyushwa kwephothi lomthombo iyasebenza. Alisho lutho nge-UDP 500, i-UDP 4500 noma iphrothokholi 50, futhi lokhu kusetshenziswa kuncike kulezo zinto ezintathu.

Isigaba 1: i-IKE kufanele ithole impendulo

Ukushintshana kokuqala kuya kumdidiyeli ku-UDP 500. Uma kungekho mpendulo ebuyayo, akukho okunye okubalulekile: ukhiye owabiwe ngaphambili, isiphakamiso kanye nobufakazi kuhlala kungafundwanga. Bheka isicelo nempendulo esikhundleni sokuqagela esikhathini sokuphela seklayenti:

sudo tcpdump -n -i any 'udp port 500 or udp port 4500 or proto 50'
swanctl --list-sas

Isicelo esingenampendulo ngokuvamile sisho ukuthi i-firewall noma umhlinzeki ongenhla uphonsa iphakethe, hhayi ukuthi iseva ilinqabile. Impendulo enomthwalo wokwazisa okubiza isiphakamiso noma inkinga yesitifiketi isho ukuthi amaphakethe afikile futhi izingxoxo zehlulekile ngokuqukethwe, okuwukulungisa okuhluke ngokuphelele.

Uma izinhlangothi zombili zingemuva kokuhunyushwa, umqalisi kufanele afinyelele umdidiyeli kuphela, ngakho ukusetshenziswa okuningi ohlangothini lweklayenti kusebenza kusukela esigabeni 1. Ukusingathwa ohlangothini lweseva yilapho inkinga yokungena iqala khona, futhi yingakho lezi zimo ezimbili akufanele zixoxwe njengesisodwa.

Isigaba 2: ukugqunywa kushintsha lokho okubonwa yi-firewall

I-ESP iyiphrothokholi ye-IP, hhayi iphothi le-TCP noma le-UDP, futhi ukuhunyushwa kwamakheli kwephothi okuvamile akunayo inkambu yephothi okufanele kubhalwe kabusha. Yingakho i-NAT traversal ihambisa umthwalo ovikelwe ingene ku-UDP 4500: ukugqunywa kunikeza idivayisi ehunyushayo into eyaziyo ukuyihumusha. Uma lokho kwenzeka, umthetho we-firewall obhalelwe i-UDP 500 kuphela uzovumela izingxoxo futhi uphonse umhubhe, okukhipha umphumela odidayo lapho ilogi ibonisa isigaba 1 esiphumelele futhi kungekho thrafikhi.

Ukushintshana kwe-IKE ngokwako nakho kungaya ku-UDP 4500 ngemuva kokutholwa kwe-NAT, okumangaza labo abavumele u-500 kuphela. Vumela zombili izingosi kuzo zombili izinhlangothi emzileni, futhi khumbula ukuthi i-firewall enesimo igcina ukugeleza kuphela uma ibona ithrafikhi.

Iphrothokholi 50 isabalulekile emizileni engenakho ukuhunyushwa, nasemizileni lapho ibhokisi eliphakathi lihlelelwe ukuyivumela. Uma uxilonga ngokukhipha, cisha umbono esikhundleni sokwengeza imithetho ngobuningi: vumela u-500, 4500 ne-ESP, qinisekisa ukuthi umhubhe uyaphakama, bese ususa lokho okwabonakala kungadingekile. Umthetho ongenakuchazwa muntu uwumthetho ongeke ususwe muntu uma usuba imbangela yokuphazamiseka okulandelayo. Bhala ukuncishiswa kurekhodi yezinguquko kanye nesigaba esikulungisile, ukuze unjiniyela olandelayo aqale ebufakazini bakho hhayi emthethweni ofanayo womunwe.

Isigaba 3: ukumephwa kuphela futhi umhubhe uyafa

Idivayisi ehunyushayo igcina isimo semigelezo eyidlulisayo, futhi leso simo sinenkathi yokuphila. Umhubhe we-L2TP/IPsec uthwala ithrafikhi encane uma kungekho muntu uwusebenzisayo, ngakho umhubhe ongenzi lutho ungaphila isikhathi eside kunokumephwa kwawo futhi uyeke ukwamukela ithrafikhi ebuyayo. Iklayenti lihlala liqiniseka ukuthi lixhunyiwe, iseva ayiboni lutho, futhi uphawu lokuqala ngokuvamile isikhathi sokuphela sohlelo hhayi iphutha le-VPN.

Ukutholwa kukazakwethu ofile kanye ne-keepalive ye-NAT kukhona ngenxa yalokhu, futhi zombili iziphetho kufanele zikulungele ukuzithumela. Uma iseva yakho ingemuva kokuhunyushwa, imfuneko ohlangothini lwe-Windows isilungiselelo serejista esibhalwe phansi esenza iseva icabange ukugqunywa kwe-UDP emaphaketheni ayo aphumayo; ngaphandle kwaso umdidiyeli uthumela i-ESP idivayisi ehunyushayo engakwazi ukuyimepha ibuyele emuva. Lena inqubo yokuhlelwa kweseva, hhayi yeklayenti.

Ukushintsha kwekheli le-WAN kuletha umphumela ofanayo ngakolunye uhlangothi: ukumephwa kwakhiwa kabusha kuzungeze ikheli elisha, futhi inhlangano yokuphepha endala isikhomba ku-tuple engasekho. Ukuziphatha kokuxhuma kabusha kungokwasekelwa kweklayenti, futhi yingakho «xhuma kabusha ngemuva kokuqalisa kabusha irutha» kusebenza kwiklayenti elilodwa futhi kwelinye kudinga iswishi yesandla.

Ukusingathwa ngemuva kwe-NAT yezinga lomhlinzeki kuyinkinga ehlukile

Uma ufuna ukusingatha iseva ye-L2TP/IPsec ekhaya futhi uyifinyelele kusuka ngaphandle, imfuneko ukufinyeleleka kokungena okungaceliwe, futhi lokho akuyona into enikezwa yi-NAT traversal. I-NAT yezinga lomhlinzeki phambi kwerutha yakho isho ukuthi ayikho iphothi ongayidlulisela elizokwenza ufinyeleleke, ngoba ikheli lomphakathi labelwe futhi ukumephwa kungokwaphuma kuphela.

Asikho isiqubeko se-IPsec pass-through esishintsha lokho, futhi akukho kulungiselelwa kweklayenti okunxephezela. Izimpendulo ezisekelwayo ikheli elifinyeleleka ngempela, indawo yokugcina esingathiwe, noma ukwakheka lapho wonke umhlanganyeli enza uxhumano oluphumayo. Incazelo yokugqunywa kwe-UDP ixazulula inkinga yokuhunyushwa kwemigelezo ekhona; ayidali indlela yokungena lapho umhlinzeki engayinikezi.

Ngakho qhathanisa amanethiwekhi esikhundleni sokuqagela. Yisa idivayisi nephrofayela efanayo kunethiwekhi elinye elivunyelwe futhi ubheke ukuthi yisiphi isigaba esihlulekayo lapho. Uma kusebenza kwenye indawo, umehluko usemzileni, futhi lokho kunciphisa ukusesha kube izigaba ezintathu ezingenhla hhayi konke ukulungiselelwa.