MikroTik PPTP iyawa? Lungisa indlela eya kuseva

Iklayenti le-PPTP ku-RouterOS liyaxhuma, lihambise ithrafikhi encane, bese lithula, futhi ilogi ibukeka njengenkinga yobunikazi noma yeseva. Ngokuvamile akusiyo neyodwa yazo. Umhubhe uthwala amaphakethe awo okuthwala ngoba indlela eya kuseva ihambisana nayo nendlela umhubhe ayifakile. Uhlangothi olunye luyeka ukuzwa irutha futhi iseshini iyafa ngenkathi isixhumi sisathi sisebenza.

Ikhambi yindlela eyodwa, noma isilungiselelo esisodwa, esigcina iseva ifinyeleleka nge-WAN yangempela. Ukuthi iyiphi kuncike ekutheni irutha kufanele libe isango lomhubhe ophelele yini.

Uphawu: iyaxhuma, ihambisa ithrafikhi, iyafa

Iphethini iphinda izenzakale ekuxhumaneni ngakunye, futhi lona wuphawu lokuqala olusizo. Iphasiwedi enqatshiwe yehluleka ngaphambi kokuba isixhumi sikhuphuke, ukulungiselelwa kabi kwe-firewall ngokuvamile kuvimba uhlangothi olulodwa, kanti umjikelezo wendlela uvumela isixhumi ukuthi sizinze bese usicindezela. Bheka izibali: umhubhe ukhombisa ukuqhuma kwamaphakethe okuqala bese kungabi lutho, ngenkathi isixhumi se-WAN siqhubeka sithumela amakhophi afakwe ngaphakathi. Leli yirutha eliphindisela umphumela walo lingene kulo uqobo.

I-PPTP yenza lokhu kube lula ukuqalisa ngoba ukuthwala i-IP evamile eya ekhelini leseva, hhayi umhubhe ogxile ekupheleni kude kwesinye isethi engaphansi. Noma yini ephambukisa lelo kheli iphambukisa nokuthwala kanye nayo.

Kungani umhubhe ugwinya amaphakethe awo

Lapho iklayenti lixhuma, lifaka indlela okuyisango layo isixhumi somhubhe. Uma iphrofayili ifaka nendlela ezenzakalelayo, khona-ke yonke indawo engenakho ukufana okuqondile kakhulu, kuhlanganise nekheli lomphakathi leseva, ixazululwa iye emhubheni. Irutha lifaka iphakethe, likhehla iphakethe langaphandle liye kuseva, bese liphinda libheke indlela: indawo efanayo, okwezenzakalelayo okufanayo, umhubhe ofanayo. Kuye ngenguqulo, lokho kuphindaphinda kuyalahlwa, kufakwa emgqeni, noma kuphindwe kuze kube uhlangothi olunye lunikezela bese luhlukanisa iseshini.

Abakhiqizi bezinto ngokuvamile bangeza ngokuzenzakalela indlela yehosti yeserva yabo, khona kanye ukugwema lokhu. RouterOS akukucabangi lokho, ngakho umqhubi kufanele aveze okuhlukile noma agweme indlela ezenzakalelayo kusukela ekuqaleni.

Gxumisa ikheli leseva ku-WAN

Engeza indlela encane kakhulu: i-/32 yekheli lomphakathi leseva, nesango le-ISP njengengxenye elandelayo, kusixhumi esifinyelela i-inthanethi. I-/32 yehlula noma iyiphi indlela ezenzakalelayo ngobude be-prefix, futhi ibanga elincane liyahlula uma kunendlela enye yalelo prefix esivele ikhona. Bese uphinda uxhume futhi uqinisekise ukuthi indlela iyasebenza, hhayi nje ukuthi ikhona ohlwini.

/ip route add dst-address=198.51.100.10/32 gateway=192.0.2.1 distance=10

Uma isango le-ISP lifundwa nge-DHCP, sebenzisa ikheli lesango elafakwa yi-DHCP, noma bophela indlela kusixhumi uma inguqulo ikusekela. Isango elifakwe ngokuqinile eliyoshintsha kuleyo-lease elandelayo iwukwehluleka okubambezelekile. Hlola ikheli ngemva kokuxhuma kabusha kwe-WAN, ngoba yilapho kuvela khona isango elidala futhi umhubhe uqale ukuwa futhi.

Noma vimbela umhubhe ukuthi ungathathi okwezenzakalelayo

Igatsha elidinga i-LAN eyodwa ekude kufanele ligcine iphrofayili ye-PPTP kude ngokuphelele nendlela ezenzakalelayo. Vala leyo nketho kuphrofayili yeklayenti bese engeza indlela ethile ye-prefix ekude ngokusebenzisa isixhumi somhubhe. Ithrafikhi evamile ihlala ku-WAN, ukuthwala komhubhe uqobo kugcina indlela yako yemvelo, futhi ithebula lendlela liba lula ukulichaza. Lona umklamo ongcono wegatsha elidinga isethi engaphansi eyodwa, hhayi werutha okufanele libe ukuphuma kwesizinda.

Umhubhe ogcwele unezidingo zawo: ukuhlela indlela ngomgomo kwemithombo ekhethiwe, uhlelo lwethrafikhi ebuyayo, nesinqumo ngokwenzekayo lapho umhubhe uwa. Akukho nalokho okuxazululwa indlela yehosti, egcina kuphila ukuthwala kuphela.

Qinisekisa ngezingqimba, bese uvala imbobo yokuphatha

Hlola ngezingqimba: pinga ikheli lomphakathi leseva ngaphambi kokuxhuma, pinga isango elikude ngemva kokuxhuma, bese pinga ihosti kwi-LAN ekude. Engeza i-masquerade kusixhumi somhubhe uma amahosti angemuva kwerutha edinga ukuthi izimpendulo zibuye ngaso.

/ip firewall nat add chain=srcnat out-interface=pptp-out1 action=masquerade

Bese uqala kabusha irutha noma uphoqelele ukuxhuma kabusha kwe-WAN bese uphinda lawo ma-ping amathathu, ngoba indlela ekhona kuphela kusilungiselelo esisebenzayo ngeke isinde. Enye indawo lapho lokhu kuphuka khona isilungiselelo esithunyelwe kufayela lesipele futhi sabuyiselwa kamuva, ngoba indlela ingase ingekho ekuthunyelweni uma yengezwe ngesikhathi sokusebenza.

Ekugcineni, khawulela i-Winbox nokuphathwa kwewebhu kumakheli wemithombo aziwayo ngaphambi kokushicilela noma yiluphi ushintsho lwe-VPN noma lwendlela. Irutha eliqeda imihubhe liyimpokophelo yokuphatha, futhi i-port 80 evulekele umhlaba wonke iyisitholakele esikhulu kunendlela oyilungisile nje.