Umsebenzisi we-MikroTik VPN ufinyelela kude kakhulu: khawulela kusibungu esisodwa kanye nechweba elilodwa

Ithumela liyaphakama, ukungena kuyaphumelela, futhi yonke into esebenza kunethiwekhi iyaphendula. Lokhu akuyona i-VPN ephukile; le yi-VPN engenalo uhlelo lwemvume. I-RouterOS iqinisekisa i-akhawunti bese ihambisa amaphakethe ayo njengakabonke, ngakho udonga lomlilo kufanele lunikeze umkhawulo. Ukwengeza lowo mkhawulo ngaphandle kokuphula ukungena yiwo wonke umsebenzi.

Ukuqinisekisa kuphela lapho imvume iqala khona

Uma isikhathi se-PPP sesiphakamile, amaphakethe eklayenti angena ochungechungeni lwe-forward njengethrafikhi evela kunoma yikuphi okunye ukuxhumana. Uma inqubomgomo ye-forward yerutha ivumela kakhulu, umeluleki uzuza leyo mvume lapho engena. I-akhawunti ayikaze ithwale ububanzi, ngakho akukho okungashintshwa ku-akhawunti. Iqoqo lemithetho labhalelwa abasebenzi futhi isikhathi esisha sajoyina nje.

Hlola ukuthi isicelo siphathelene naluphi uhambo ngaphambi kokubhala noma yini. Ithrafikhi eya ezintweni ezingemuva kwerutha idlula ku-forward, kuyilapho ithrafikhi eya kurutha ngokwalo, kufaka winbox ne-SSH, idlula ku-input. Ububanzi obuhlanganisa i-forward kuphela bushia idivayisi ivulekile kuklayenti elifanayo.

Womabili amaketanga adinga isinqumo, noma isinqumo siwukushiya i-input ivaliwe. Lokho kukhetha kungokwesicelo sokufinyelela, hhayi umcabango wamuva.

Xhuma isikhathi kuhlu olunegama

Iphrofayela ye-PPP ingafaka ikheli elilinikezayo ohlwini lwamakheli olunegama lapho isikhathi siqala. Lokho kuguqula ikheli lethumela lesikhashana libe yinto udonga lomlilo olungayiqhathanisa ngegama, futhi ukufakwa kuyanyamalala lapho isikhathi siphela. I-akhawunti bese izuza ububanzi kwiphrofayela yayo hhayi kumthetho obhala ikheli ngokuqinile.

Dala iphrofayela kuqala, bese uxhuma i-secret kuyo ngokusobala. I-secret esakhomba kwiphrofayela ezenzakalelayo iphinda ikhiqize inkinga yasekuqaleni.

Qamba iphrofayela nohlu ukuze imisebenzi yabo icace, futhi ubhale imibono kukho kokubili ngereferensi yesicelo. Iphrofayela eyodwa ingasebenza abantu abaningi abanobubanzi obufanayo, kuyilapho uhlu lusabona isikhathi ngasinye esiphilayo. Lokhu kushibhile ukubuyekeza kunomthetho ngomuntu ngamunye.

/ppp profile add name=scoped-consultant remote-address=consultant-pool address-list=vpn-scoped-clients
/ppp secret add name=consultant password=... service=ovpn profile=scoped-consultant

Bhala insizakalo evunyelwe ohlwini olulodwa

Faka iseva evunyelwe ohlwini lwayo lwamakheli esikhundleni sokushumeka ikheli kumthetho wokuhlunga. Uhlu lungacwaningwa, lunwetshwe futhi lubhalelwe imibono, futhi umthetho olusebenzisayo awushintshi lapho iseva ishukuma. Ukufakwa okukodwa kubonakala kuyisandla lapho into yesibili ifika, okuvame ukwenzeka.

Qhathanisa uhlu lapho ikheli lishintsha noma lihlukaniswe ngumthwalo, futhi uqhathanise ikheli ngqo lapho ligcinwe futhi lizinze. Zombili izinqumo zifundeka kahle uma umbono ubala insizakalo nomnikazi.

Khawulela iphrothokholi nechweba kanye nesibungu. I-accept yesibungu esingenamkhawulo wechweba ivula yonke insizakalo esetshenziswa yileso sibungu, okubanzi kunalokho okuhlosiwe izicelo eziningi zokufinyelela. Ichweba liyingxenye yemvume, hhayi imininingwane engezwa kamuva.

/ip firewall address-list add list=vpn-targets address=10.0.0.10 comment="consultant RDP target"

Hlela ukugxuma ngaphambi kwanoma yikuphi ukwamukela okubanzi

Umthetho wokugxuma uthumela ithrafikhi edluliswayo isuka ohlwini olukhawulelwe iye ochungechungeni oluyimfihlo lapho inqubomgomo yonke ingena emigqeni emithathu. Umthetho wokuqala wamukela indawo efunwayo nechweba elivunyelwe, futhi owokugcina ujikijela konke okunye. Ukugxuma kufanele kube phezu kwanoma yikuphi ukwamukela okubanzi ku-forward, ngoba ukwamukela kwangaphambilini kusho ukuthi ukugxuma akukaze kusebenze. Gcina i-accept ye-established ne-related ngaphambi kokugxuma ukuze ithrafikhi ebuyayo isahamba.

Hlola ukuthi awukho umthetho we-fasttrack ongadlulisa le thrafikhi ngaphesheya kochungechunge olukhawulelwe. I-fasttrack idlula yonke indlela yokuhlunga esele, futhi isikhathi esikhawulelwe esifakwe i-fasttrack asikho nhlobo esikhawulelwe.

Phinda isinqumo ochungechungeni lwe-input uma izinsizakalo zerutha ngokwalo kufanele zingafinyeleleki. Ububanzi obuvimba ithrafikhi edluliswayo futhi bushia i-winbox ivulekile buqediwe uhhafu kuphela.

/ip firewall filter
add chain=forward action=jump jump-target=scoped-vpn src-address-list=vpn-scoped-clients
add chain=scoped-vpn action=accept protocol=tcp dst-address-list=vpn-targets dst-port=3389
add chain=scoped-vpn action=drop

Qinisekisa ngezibali kanye nobulungu bohlu

Kusuka kuklayenti, hlola insizakalo evunyelwe kanye nolunye okufanele lwehluleke, bese ufunda izibalo zemithetho kurutha. Izibali ze-accept ne-drop zikhombisa ukuthi yiluphi uhambo amaphakethe ngamanye athathe, okuyinto iklayenti elingakwazi ukuyibona. Qinisekisa futhi ukuthi ikheli lesikhathi esiphilayo lavela ohlwini olukhawulelwe.

Uhlu olungenalutho lusho ukuthi i-akhawunti ikwiphrofayela enye noma iphrofayela ilahlekelwe isilungiselelo sayo sohlu lwamakheli. Isibali se-drop esikhuphukayo ngenkathi insizakalo evunyelwe yehluleka sisho ukuthi indawo noma ichweba akuhambisani nalokho okuthunyelwa yiklayenti.

Hlola leyo nsizakalo efanayo ngegama nangekheli ngaphambi kokuphetha noma yini. Ukwehluleka kokuxazululwa kwegama kubonakala kuklayenti kufana ncamashí nechweba elivinjwe. Bese ubhala iphrofayela, zombili izinhlu kanye nensizakalo eyodwa evunyelwe kusicelo sokufinyelela ukuze ukubuyekezwa okulandelayo kuqhathanise esikhundleni sokwakha kabusha.

/ip firewall filter print stats where chain=scoped-vpn
/ip firewall address-list print where list=vpn-scoped-clients