I-VPN yegatsha ku-4G: gcina ubunikazi buzinzile lapho i-IP ihamba

Qala egatsheni ngokwalo, ekhasini lesimo se-WAN se-4G router. Uma ikheli olibonayo likusilinganiso sangasese somhlinzeki hhayi esivamile, akukho ukudluliswa kwephothi kulelo bhokisi okuyovumela i-hub ukuthi ishaye ingene, futhi umhubhe kufanele wakhiwe uphume egatsheni. Lowo mbono owodwa unquma umklamo. Umsebenzi osele ukwenza isiqiniseko sokuthi i-hub ibona igatsha ngento engcono kunelebheli elishintsha njalo ngemva kwamahora ambalwa.

Umhubhe kufanele uqale kuphi

Hlola ikheli ngokuqhathanisa nesikhala sekheli esabiwe esisetshenziswa abahlinzeki be-NAT yabo, 100.64.0.0/10, kanye nesilinganiso sangasese esivamile. Ukubona okunye kwalokho kuxhumano lweselula ngokuvamile kusho ukuthi i-NAT yezinga lomhlinzeki iphakathi kwegatsha ne-inthanethi, futhi ukuxhumana okungena akutholakali nganoma iyiphi intengo igatsha elingayikhokha. Uma ikheli le-WAN lingelebantfu kodwa liyashintsha, unenye inkinga elula.

I-DNS eguqukayo isiza kuphela esimweni sesibili. Inikeza ikheli lombuso elishintshayo igama elizinzile lokushayela, futhi ayikwazi ukwakha imephu umhlinzeki angakaze ayinikeze. Kusafanele ukuyilungiselela isimo sombuso, ngoba isusa isinyathelo esisodwa sesandla ekubhaleni kabusha izinombolo. Engafanele ibe yikho impendulo yegatsha umhlinzeki angakaze alenze lafinyeleleka.

Hlukanisa ikheli olishayelayo nobunikazi obuqhathanisayo

I-hub idinga into ezinzile okutholakala ngayo, ikheli eliqinile eligunyaziwe noma igama lomsingathi elinakekelwayo. Igatsha lidinga indlela ezinzile yokwaziwa, futhi ku-IKEv2 lokho kuwumthwalo wobunikazi eliwethulayo phakathi nokuqinisekiswa, ngaphandle kwalokho kukheli lomthombo amaphakethe alo akwenzayo ukuwuthwala. Umucu ofana no-@branch-a.vpn.example usebenza njengalobo bunikazi ngisho noma ikheli leselula lishintsha njalo ngehora.

Lowo mucu uqhathaniswa nenqubomgomo, awuxazululwa nge-DNS, ngakho ungakulindeli ukubhekwa ngesikhathi kusungulwa umhubhe. Ukulungiselelwa kwe-hub kufanele kushiwo ngokucacile ubunikazi obulindelekile, futhi ngokuqinisekiswa kwesitifiketi ubunikazi kufanele futhi buhambisane nalokho isitifiketi esikushoyo ngempela.

Ukwamukela noma yibuphi ubunikazi ngoba ikheli lomthombo libonakala lithembekile yimo yokwehluleka okufanele igwenywe. Ohlangothini lokuphendula lokho kusho ukwamukela noma yimuphi umlingani, ngekhadi lasendle lobunikazi nesicimamlilo esabiwe, okuginisekisa umucu hhayi idivayisi.

Bhala uhlangothi lwe-hub njengomlingani oqanjwe ngegama

Ngamagama e-strongSwan uhlangothi lokuphendula luwukuxhumana okune-right=%any, okwamukela umlingani kunoma yikuphi ikheli lomthombo, kanye ne-[email protected], okuphina ukuthi lowo mlingani kufanele azibize ngokuthi ungubani. Engeza rightsubnet=10.20.0.0/16 kuma-LAN egatsha, auto=add ukuze ukuxhumana kulayishwe ngaphandle kokushayelwa, dpd_delay=30s ukuze kuphile, kanye ne-mobike=yes ukuze ushintsho lwekheli lumuncwe esikhundleni sokuthathwa njengomlingani omusha.

Abanye abakhiqizi baveza lezo zinto ngaphansi kwamanye amagama, ngokuvamile uhlobo lomlingani oguqukayo noma wehhovisi legatsha elinensimu yobunikazi nensimu yesubneti evikelwe. Gcwalisa kokubili; ibhokisi lokumaka eliguqukayo elijwayelekile akulona icebo lokuhambisana.

Gcina igatsha lingumqali

Egatsheni kusebenza isithombe sesibuko: left=%defaultroute ukuze ikheli leselula lendawo lisetshenziswe njengoba linjalo manje, [email protected] ukuze kwethulwe ubunikazi, right=hub.example.com ngegama le-hub elizinzile, kanye ne-auto=start ukuze umhubhe ukhuphuke ngaphandle komuntu. Uma ukuxhumana kweselula kuxhuma futhi, igatsha liqala futhi futhi i-hub iqhathanisa ubunikazi obufanayo nento efanayo yenqubomgomo.

Vumela i-IKE ku-UDP 500, ukunqamula kwe-NAT ku-UDP 4500, kanye ne-ESP ehlanganisiwe elandelayo, kuzo zombili izinhlangothi. Bese uzishiye zivunyelwe: umthetho ovuleka kuphela ngezikhathi zomsebenzi uzobonakala njengomhubhe ophazamisekayo.

Hlola ushintsho lwekheli, hhayi kuphela ukubambana kwesandla kokuqala

Khuphula umhubhe, kuqinisekise, bese uphoqa igatsha ukuthi liye kukheli olusha ngokuvula nokuvala idatha yeselula noma imodi yendiza umzuzu owodwa. Buka uhlu lwezinhlangano zokuphepha ku-hub futhi uhlole ukuthi ikheli lomlingani lishintshile kuyilapho ubunikazi bungashintshanga. Umhubhe osebenza kuphela kuze kufike ukwabiwa kabusha kokuqala komhlinzeki awukahlolwa nhlobo.

Bese uhlola amasubneti avikelwe ngokwehlukana. I-SA esunguliwe ithi abalingani baqinisekisiwe; ayisho ukuthi i-hub inomzila oya ku-LAN yegatsha noma ukuthi igatsha lamukela ithrafikhi evela ohlangothini lwe-hub. Funda ithebula lokuhamba kanye nenqubomgomo yodonga lomlilo ngokwehlukana, bese uthumela i-ping kusuka kumsingathi hhayi kusuka kusango, ngoba isango iyidivayisi engameleli kakhulu kunoma iyiphi inethiwekhi.

Ubunikazi obuzinzile busishintsha igatsha libe into yenqubomgomo i-hub engayiqamba ngegama. Akwenzi ikheli le-NAT lomhlinzeki lifinyeleleke, futhi akunikezi yona ngokwayo ingxenye esele yenhlangano ukufinyelela egatsheni.