Fanisa iklayenti le-VPN le-Linux neprotocol yomshini wakudala

Imindeni emine yeprotocol ihlanganisa cishe yonke into esesebhente, futhi ngayinye yehluleka ngendlela ehlukile ku-Linux. Izimbobo ezishicilelwe kanye neziphakamiso ezilungiselelwe zohlangothi olukude zinquma iphakethe lakho, hhayi ukusatshalaliswa okwenzeka ukuthi ukusebenzisa. Ukufaka lokho okushiwo ukuthunyelwe kwenkundla bese uhlela kuze kuxhume okuthile yindlela okulahleka ngayo intambama. Funda into, faka okwesibili, qinisekisa okwesithathu.

Qopha lokho okushicilelwe wuhlangothi olukude

Bhala iprotocol, izimbobo kanye nokuqinisekisa okulindelwe yinto ngaphambi kokuvula umphathi wamaphakethe. Imindeni emine ihlanganisa iningi lemishini endala, futhi ithebula elingezansi yisona sinqumo sonke kusikrini esisodwa.

Incwadi kanye nemithetho yodonga lomlilo yento uqobo ithembeke kakhulu kunegama leprotocol ekhasini layo lokungena. Into ekhangisa nge-IPsec ingase ikhulume i-IKEv1 kuphela, futhi ukukhishwa kwefirmware okungekho muntu okusebenzisile kungase kube yikho okwengeza i-IKEv2 ekugcineni. Qinisekisa indlela yedatha kanye nembobo yokuhlela, ngoba yilapho kwehluka khona imishini endala namanehithiwekhi esimanjemanje. Ukwenza iphutha kulesi sinyathelo kusho ukulungisa iklayenti lakho ngokumelene nesici umhlangothi wesibili ongakaze ube nayo.

PPTP: fakazela i-GRE ngaphambi kokuhlela i-pppd

I-PPTP ku-Linux akuyona idemoni oyisebenzisayo kodwa ukubiza kwe-pppd, futhi imingcele yokuxhuma ihlala kufayela le-peer elinegama elilifunda i-pppd lapho ibizwa. Ukusatshalaliswa kusayifaka, nakuba ubuthakathaka obaziwayo beprotocol kuyenza ingafaneleki kunoma yini ebucayi, ngakho yigcine ngokuqinile kumshini onganikeli okunye. Bheka i-GRE ngesikhathi iklayenti lixoxa, ngokubamba okufushane esikhundleni sokuqagela. Ukuhluleka okuchitha isikhathi esiningi akukhona ukuqinisekisa kodwa indlela yedatha engekho.

pppd call branch-office
tcpdump -ni any proto gre -c 5

Uma ukuhlela kuphela futhi isixhumanisi singakaze sithwale ithrafikhi, solwa indlela ye-GRE ngaphambi kokuthinta ubufakazi. Amaqembu ezokuphepha efu adinga umthetho ocacile weprotocol 47, futhi amanye amanethiwekhi ayivimbela ngokuphelele ngaphandle kwephutha elibonakalayo. Hlola kusukela kunethiwekhi ozoyisebenzisa ngempela, hhayi endaweni yokucwaninga evumela konke.

L2TP/IPsec: isiphakamiso esisodwa esifanele sihlula imizamo eyishumi

Funda ilogi yedemoni esikhundleni sengxoxo yedeskithophu, ngoba ingxoxo ihlanganisa ukwehluleka okuningana okuhlukene kube umlayezo owodwa. Iphutha le-NO_PROPOSAL_CHOSEN lingelesigaba sokuqala: iklayenti lanikeza ukubethela, i-hash noma iqembu le-Diffie-Hellman iseva engeke ilamukele. Bhala uhlu lwalokho okusekelwa yinto bese ubhala isiphakamiso esisodwa esifanele, ngoba inhlanganisela engahleliwe ivamise ukunikeza lelo phutha ngokunensa. Kudeskithophu iklayenti elisebenzayo i-plugin ye-NetworkManager L2TP ene-strongSwan noma i-Libreswan ngaphansi.

Umucu wesiphakamiso osho into eyodwa ku-plugin yedeskithophu ungase usho okunye kudemoni okunikezwa umsebenzi, ngakho gcina isintaksi ifanele isigaba osihlelayo. Uma into iphinda ifune imfihlo yomhubhe, leso yisigaba esihlukile kukhiye we-IPsec. Qinisekisa ukuthi yikuphi kwalaba ababili okubuzwa yisixhumanisi ngaphambi kokubhala noma yini kuso.

I-IKEv1 enolaka ne-XAuth, kanye nesimo sezingangeni

Indawo yokugcina yesitayela se-FortiGate ivamise ukufuna imodi enolaka ne-XAuth kanye nekheli lemode elilungiselelwe, okungenzeka ukuthi i-plugin yezithombe ingakubonisi nhlobo. Idemoni lendabuko iyakwazi lokho, futhi ibhulokhi engezansi iwukuma kwalokho kulungiselelwa, hhayi ifayela eliphelele. Bheka imibhalo yamanje yomkhiqizi ngamavelu esiphakamiso.

conn branch
    keyexchange=ikev1
    aggressive=yes
    leftauth=psk
    leftauth2=xauth
    leftsourceip=%config
    right=203.0.113.10

Izinguqulo ezindala ze-strongSwan zazisebenzisa i-xauth=client lapho inguqulo 5 isebenzisa i-leftauth2=xauth, ngakho ucezu olukotshiwe lungase luhluleke ngesintaksi kuphela. Ngezingango ze-TLS, i-openconnect ekhuluma iprotocol ye-AnyConnect ibhekana ne-Cisco kanye neningi lemikhiqizo eqanjwe kabusha, futhi idinga idivayisi ye-TUN kanye namalungelo okuyilungiselela. Dlulisa ikheli lesingangazo ngqo njengoba isiphequluli sikubonisa, kuhlanganise nanoma iyiphi indlela elindelwe yinto, bese uhlola ikheli elinikeziwe ngaphambi kokuhlola noma yini ngemuva kwalo. Ukudala isixhumanisi kusengaphambili kususa isigaba esisodwa sezimanga ngesikhathi sokuhlela.

sudo ip tuntap add dev tun0 mode tun
sudo openconnect --protocol=anyconnect vpn.example.com

Xhuma, bese uqinisekisa ngokulandelana okungaguquki

Sebenzisa umphathi we-VPN oyedwa njalo, ngoba iphrofayela ye-NetworkManager kanye nedemoni eliqalwe ngesandla zizolwela imizila ne-DNS. Yehlisa iphrofayela ngaphambi kokuhlola ukuxhuma kwesandla, futhi uqinisekise ukuthi asikho isixhumanisi somhubhe esidala esisele. Bese uqinisekisa ngokulandelana lokhu: ikheli lomhubhe, umzila oya endaweni eyodwa yangaphakathi oyidingayo, ukuxazululwa kwamagama, futhi ekugcineni isicelo sangempela. Isithonjana esiluhlaza siqinisekisa ukuqinisekisa futhi akukho okunye.

ip -4 addr show tun0
ip route get 10.20.30.10
getent hosts app.internal

Uma isinyathelo sihluleka, ma lapho esikhundleni sokuhlola esilandelayo, ngoba ukwehluleka kwe-DNS ngaphansi komzila ophukile akukufundisi lutho. Gcina ikhophi yephrofayela esebenzayo ngaphambi kokuhlola, ngoba ifayela lokuxhuma elisusiwe lilahleka kalula futhi kunzima ukulakha kabusha. Gcina amavelu esiphakamiso kundatshana efanayo nemodeli yento kanye nenguqulo yefirmware, ngoba lowo mbhalo yiwo umehluko phakathi kokufuduka kanye neprojekthi yezinto zakudala lapho ibhokisi lishintshwa.