I-L2TP ngaphandle kwe-IPsec ku-Linux: xl2tpd, pppd ne-NAT

I-L2TP elula iyi-PPP engaphakathi kwemvilophu, futhi akukho okunye. Ithwala amafreyimu akho; ayiwafihli futhi ayifakazisi ukuthi ubani uhlezi kolunye uhlangothi, yingakho cishe konke ukusetshenziswa kubeka i-IPsec ngaphansi kwayo. Izizathu eziqondile zokusebenzisa inguqulo engenalutho zisekhona: ibhentshi yaselabhorethri, isinyathelo sokufuduka, noma isixhumanisi esivele singaphakathi komunye umzila ovikelwe.

Uma uqhubeka, bhala leso sexwayiso kunothi lomklamo futhi usishiye lapho. Okulandelayo yindlela yokusebenza engiyisebenzisayo kumahostela omndeni wakwa-Debian ne-RHEL: iyiphi ifayela eliphethe ini, i-MTU evimbela ukumiswa okujwayelekile, nemithetho yokudlulisela eyenza umhubhe ube nenzuzo.

Amafayela amathathu ahlukanisa umsebenzi

I-xl2tpd iphelisa ukuxhumana kokulawula futhi inikeza iseshini ngayinye kwi-daemon ye-PPP, ngakho ukulungiselelwa kusakazeke kuzinhlelo ezimbili ezingalokothi zifunde amafayela zomunye nomunye. Isilaleli sihlala ku-/etc/xl2tpd/xl2tpd.conf, ngaphakathi kwesigaba se-[lns default] esibiza ichibi lamakheli nge-ip range, uhlangothi lweseva nge-local ip, nokunikezela ku-PPP nge-pppoptfile. Vula i-require authentication = yes, shiya i-length bit ne-flow bit zivuliwe, futhi khetha ichibi okungekho okunye kuhostela okulisebenzisayo.

Inqubomgomo ye-PPP ingeyefayela elibizwa yilowo mkhetho, ngokuvamile i-/etc/ppp/options.xl2tpd: i-auth, ukwenqaba kwe-pap, chap ne-mschap, i-require-mschap-v2, i-MTU ne-MRU engu-1460, nekheli le-DNS iklayenti elingafinyelela kulo ngemuva kokuphakama kwesixhumanisi. Ubufakazi buphinde bube yifayela lesithathu, i-/etc/ppp/chap-secrets, lapho inkambu yesibili kufanele ihambisane negama lesigaba se-LNS futhi inkambu yesine ingagxilisa ikheli elithile elivela echibini.

Kungani umhubhe uxhuma bese umisa

Ifreyimu ye-Ethernet yamabhayithi angu-1500 ayingeni emzileni osevele usebenzisa amabhayithi kumakhanda awo. Ikhanda le-IPv4 langaphandle lithatha ama-20, i-UDP ithatha ama-8, nekhanda le-L2TP cishe ama-12, okushiya ama-1460 e-PPP nomthwalo wayo. Ukumemezela leyo nombolo encane ku-PPP yikho okuvimbela amaphakethe amakhulu ekuhlukaneni noma ekuwisweni buthule endaweni ethile phakathi.

Isibonakaliso umhubhe obonakala uphilile kuze kufike ukugcwala kwangempela: ama-ping nemilayezo yokulawula ayadlula, ukukopisha ifayela kuyamisa, akukho okuchaza lokho kuchibhali. Yehlisa i-MTU ne-MRU ndawonye ezinhlangothini zombili. Ukulungisa iklayenti kuphela ngokuvamile kuguqula ukumiswa okuqinile kube ukumiswa ngezikhathi ezithile, okunzima ukuxilonga.

Itheku elilodwa lithwala izingxoxo ezimbili

I-UDP 1701 ilele ngaphansi kwezingxenye zombili zeprotocol, futhi leli qiniso elilodwa liqamula imithetho ye-firewall eminingi kunanoma yisiphi esinye isigaba sesilungiselelo. Kuqala kufika isicelo sokuqala kokuxhumana kokulawula nesimpendulo saso; isicelo seseshini nokuqinisekisa okulandela akusimisi lutho ngaphezu kombhangqwana wezikhombisi. Bese i-PPP ithatha izintambo: ukulawula kwesixhumanisi, bese ubuqiniso, bese iprotocol yokulawula i-IP ukuze kuvunyelwane ngamakheli. Isigaba ngasinye sinamagama aso kuchibhali, futhi asikho esizimemezela njengokwehluleka kwe-L2TP.

Ukufunda ukuthwebula ngqo ngalolo hlelo kukutshela ukuthi isiphi isigaba sehlulekile, futhi ukwehluleka kokuqinisekisa kwe-PPP ngeke kulungiswe ngokuhlela i-xl2tpd. Ichweba elabiwe lichaza okunye ukwehluleka okuvamile: umthetho ovumela kuphela amaphakethe okuqala okugeleza uvumela iseshini ukuba isungulwe bese uvimba ukudluliswa. Vumela i-1701 kuyo yonke ingxoxo, kuzo zombili izinhlangothi.

Ukwenza umhubhe ube wusizo: ukudlulisela ne-NAT

Iseshini ngokwayo ifinyelela kuphela kuseva. Ukufinyelela kweklayenti ku-inthanethi kudinga ukudlulisela, umthetho we-NAT walechibi kusixhumanisi esiphezulu, ne-DNS iklayenti elingayibuza ngempela ngemuva kokuphakama kwesixhumanisi. Ichibi kufanele futhi lihlale lingaphandle kwebanga le-LAN, ngaphandle kwalokho izimpendulo ezibhekiswe kumaklayenti zilethwa endaweni yazo esikhundleni sokuba ziphushwe zibuyele emhubheni.

Kuseva, vula ukudlulisela nge-sysctl -w net.ipv4.ip_forward=1, humusha ichibi nge-iptables -t nat -A POSTROUTING -s 10.44.0.0/24 -o eth0 -j MASQUERADE, bese wamukela ukugcwala komhubhe okuphumayo ngomthetho we-FORWARD we--i ppp0 -o eth0 nokugcwala okubuyayo ngomthetho wesibuko kanye ne--m state --state RELATED,ESTABLISHED. Yenza leyo mithetho ihlale ikhona phakathi kokuqalisa kabusha, ngoba iseva ebuya ngaphandle kwayo ibonakala ifana ncamashi nokulungiselelwa kwe-L2TP okugqekile.

Ukufinyelela kwi-LAN yeseva uqobo kuwumsebenzi ohlukile: engeza umzila wokubuyisa wechibi kumhleli we-LAN, noma i-proxy ARP kuseva. Ukufihla amaklayenti ngemuva kwe-NAT lapho okuthile ngaphakathi kwe-LAN kufanele kukhulume nawo ngqo kuhlela nje ingxoxo yesibili yokulungisa amaphutha kamuva.

Okungakwenzi isitaki esingenalutho, nokuthi ungakuqinisekisa kanjani

Akukho ngxenye yalesi sitaki efihla amafreyimu e-PPP, futhi akukho lutho kuso oluqinisekisa uhlangothi olukude njengeseva oyikhethile ngempela. I-MS-CHAPv2 ivikela ukushintshana kobufakazi kumlaleli obukayo kuphela, kodwa umhlaseli obekwe emzileni usengaphazamisa iseshini. Iklayenti lendabuko le-Windows linikeza i-L2TP kuphela kanye ne-IPsec, ngakho bala i-Linux, i-firmware yabahleli nezhikashicwe zomunye umuntu njengabambisani bakho. Thatha ukulungiselelwa okungenalutho njengesitebhisi sokuxilonga, hhayi njengendawo yokuma.

Qinisekisa ngohlelo olungaguquki: gijimisa i-xl2tpd -D phambi kwalokho, bheka umbhalo womlando wesigaba se-PPP, funda ikheli elinikeziwe ku-ip addr kuzo zombili izinhlangothi, bese uthwebula i-UDP 1701 ukuze uqinisekise ukuthi idatha igeleza ngemuva kokuphakama kweseshini. Uma zozine zihambisana kodwa ukugcwala kusahluleka, iphutha lisekuhambiseni umzila, ku-NAT noma ku-MTU, hhayi ku-L2TP uqobo.