Kungani i-L2TP/IPsec idinga i-UDP 1701 kanye ne-IPsec

Izindonga zomlilo ezivumela i-IKE ne-ESP kodwa ezingavumeli i-UDP 1701 zephula ukuxhumana kwe-L2TP ngendlela ebukeka njengenkinga yobufakazi bokuqinisekisa. Isizathu siwukuthi i-L2TP iwuhlelo lwesibili oluhamba ngaphakathi kolokuqala. I-IPsec ithwala futhi iqinisekise ukushintshana, kanti i-L2TP yenza umbozo wayo phezu kwe-UDP 1701, okuyinto isitaki sendawo kusafanele ukuyiletha. Ukwazi ukuthi ikhanda ngalinye lepakethe livela kuphi kuchaza ukuthi iyiphi idivayisi edinga umthetho upi.

Izinhlelo Ezimbili, Amasethi Amabili Emibobo

Ukuxhumana kwe-L2TP/IPsec kusebenzisa i-IKE phezu kwe-UDP 500, ukudlula kwe-NAT phezu kwe-UDP 4500 lapho kukhona ukuhumusha, kanye ne-ESP njengohlelo lwe-IP 50 lapho kungekho khona. I-L2TP ngokwayo iwuhlelo lomhubo phezu kwe-UDP 1701, futhi isebenza ngemva kokuba i-IPsec iqinisekisile umlingani. Lezi zingxenye ezimbili zihluleka ngendlela ehlukile, futhi imigqa yelogi ebika ngazo ivela ezingxenyeni ezehlukene. Isethi yemithetho evikela ingxenye yokuqala kuphela ikhiqiza ukuxhumana okuxoxisana bese kufa esigabeni somhubo.

Izinombolo zemibobo zichaza izindawo zokugcina zokuthutha, kanti i-ESP akuyona imbobo nhlobo. Yingakho isixhumi esibonakalayo somlilo esihlinzeka ngemithetho ye-TCP ne-UDP kuphela singakwazi ukuveza umgomo ophelele we-IPsec. Uhlelo 50 kufanele luvunyelwe njengohlelo, futhi umthetho okhuluma nge-UDP kuphela awusoze wafanisa nalo.

Umbozo Luchaza Umbobo

Emtambweni, ukuxhumana kwe-L2TP/IPsec ngokuvamile kukhombisa i-IKE phezu kwe-500 ne-ESP eboyoziwe phezu kwe-4500. Ikhanda lepakethe le-UDP 1701 lihlala ngaphakathi komthwalo ovikelwe, yingakho ukubamba amapakethe kusixhumi sangaphandle kungalibonisi. Umsingathi wendawo kusafanele ulethe leyo datha ku-daemon ye-L2TP, futhi ukulethwa kwenzeka ngemva kokukhipha umbozo. Ngakho umthetho we-1701 ungowomlilo wendawo yokugcina ngokwayo ngisho nalapho kungekho sikhungo siphakathi esike sibona leyo mbobo.

Ukulandelana kokucubungula kuchaza iningi lokudideka. Uma isitaki sisebenzisa umgomo we-IPsec ngaphambi kwesihlungi semsingathi, ipakethe le-L2TP elikhishiwe embozweni lifaniswa njenge-UDP 1701; uma ukulandelana kuhlanekezelwe, imibobo yangaphandle iyona isethi yemithetho eyibonayo. Zombili lezi zimo zikhona empilweni, yingakho isethi yemithetho efanayo ibonakala isebenza kusixhumi esisodwa bese ihluleka kwesinye.

Hlola Indlela Ngokulandelana

Qala ngokubamba amapakethe kusixhumi sangaphandle bese uqinisekisa ukuthi i-IKE ne-ESP eboyoziwe zihamba ngazo zombili izinhlangothi. Bese uhlola izibali zomlilo wendawo ngethrafikhi ekhishiwe embozweni. Ukulandelana kubalulekile, ngoba ukubamba okungabonisi lutho nhlobo kusho ukuthi inkinga ingaphezulu komsingathi.

sudo tcpdump -ni eth0 'udp port 500 or udp port 4500'
sudo nft list ruleset | grep -i -A2 1701
sudo ss -lunp | grep 1701

Ukubamba kuqinisekisa ingxenye yokuqala yokushintshana futhi kukhombisa ukuthi umlingani uyaphendula yini. Uhlu lwemithetho lukhombisa ukuthi umthetho we-1701 ukhona yini nokuthi utholakala kuphi uma kuqhathaniswa nanoma yimuphi umgomo wokulahla. Uhlu lwamasokhethi luqinisekisa ukuthi i-daemon ye-L2TP iboshiwe futhi ilalele, okususa isevisi engakaze iqale. Funda kukho kokuthathu ngaphambi kokushintsha umthetho, ngoba umlaleli ongekho nembobo ehlungiwe kuletha izikhalo ezifanayo kubasebenzisi.

Okungeke Kuboniswe Ukuhlola Kombobo

Ukuhlola kwe-UDP 1701 okuvela ngaphandle kuyiseva ebekwe kahle ngokuvamile akubiki lutho, futhi yilowo umphumela olindelekile. Umbobo awudalulwanga ku-inthanethi; kufinyelelwa kuwo ngemva kokuba i-IPsec iqinisekisile umlingani kuphela. Ukuthatha umphumela ovaliwe njengephutha kuholela ekuvuleni umbobo okufanele uhlale uvaliwe. Ukuhlola akukwazi ukubona ngaphakathi komhubo njengoba nje kungakwazi ukubona ithrafikhi yohlelo lokusebenza.

Esikhundleni salokho, hlola ngeklayenti langempela, bese ufunda isigaba esifinyelela kuso. Uma ukuxhumana kuxoxisana bese kuma, i-daemon ye-L2TP noma isihlungi sendawo kuyisoliswa; uma kungaxoxisani nhlobo, imibobo yangaphandle iyona. Lokho kwehlukanisa okukodwa kususa iningi lokuqagela ngokuthi imuphi umthetho okufanele wengezwe, futhi ukwendlalelwa kwezinhlelo kwenza kube okulindelekile esikhundleni sokumangaza.