I-NAS ayifinyeleleki nge-VPN: ikheli, indlela yokubuya noma isevisi?
Ithuneli yangasese idinga umzila oya ku-NAS, indlela yempendulo kanye nesevisi evunyelwe. Nquma ukuthi iyiphi kwabathathu ehlulekile ngaphambi kokushintsha imininingwane yokungena.
Amathuneli ayaphakama, amaklayenti athola ikheli, kanti i-NAS ayiphenduli nhlobo. Lolu phawu olulodwa luhlanganisa iziphambeko ezintathu ezingahlobene, futhi ukulandelana okuzihlola ngakho kuthonya isikhathi sokulungisa. Ukwabiwa kwamakheli kuqala, ngoba i-subnet enqamulelayo ingathumela isicelo sakho kudivayisi ongayazi. Indlela yokubuya ilandela, ngoba isicelo esifika ngaphandle kwempendulo sibukeka sifana nesevisi evaliwe. Isevisi nemvume kuba ngemuva, futhi kuphela ngemva kokuqinisekiswa kwezimbili zokuqala.
Iziphambeko ezintathu ezifundwa njengezingafinyeleleki
Ukukhethwa kwekheli, ukuhlelwa kwendlela yokubuya kanye nokugunyazwa kwesevisi kukhiqiza umlayezo ofanayo obonakalayo: akukho okwenzekayo. Zinobufakazi, abaqondisi kanye nezilungiso ezihlukene, ngakho ukuzihlukanisa kuwumsebenzi wonke. I-ping ehlulekile iqinisekisa okuncane ngokwayo, futhi ukwenqatshwa kwe-TCP okuphumelelayo empeleni kuyizindaba ezinhle.
| Observation | Most likely conclusion |
|---|---|
| Route to the NAS address leaves the wrong interface | Overlapping or missing private route |
| Request visible on the server, no reply seen | Return path, gateway forwarding or translation |
| TCP connection refused rather than dropped | Reachable host, service not listening or filtered |
| TCP works, login or file access fails | Share permission, account or protocol version |
Funda ithebula njengokulandelana kokuhlolwa hhayi njengohlu lwezimbangela. Umugqa ngamunye ukhawulela olandelayo, ngoba ukwenqatshwa sekuvele kufakazela ukuthi ukwabiwa kwamakheli nendlela yokubuya ziyasebenza. Ukuchitha imizuzu engamashumi amabili ngaphakathi kwemithetho ye-firewall ngaphambi kokuhlola ukuthi yikuphi ukuxhumana okukhethwe umzila kuyindlela evame kakhulu yokulahlekelwa yintambama. Sebenza kusuka phezulu kuye phansi futhi ume emugqeni wokuqala ofanayo.
Umb Bandela wokuqala: ingabe lelo kheli liyidivayisi efanele?
Bhala i-subnet ye-NAS kanye nebanga i-VPN elinikeza amaklayenti, bese uqhathanisa kokubili nenethiwekhi ikhompyutha yakho ephathekayo ekulo manje. Kulo mhlahlandlela i-NAS ise-10.40.7.25 futhi ichibi le-VPN yi-10.40.9.0/24, amabanga amabili ahlukene angasese ngaphakathi kohlelo olulodwa lwendawo; umndeni osebenzisa i-192.168.0.0/24 noma i-10.0.0.0/24 unethuba elikhulu kakhulu lokushayisana nelinye lawo.
Lapho inethiwekhi yendawo kanye nenethiwekhi ye-NAS zinqamulana, iklayenti lithumela leyo traffic kugethiwe yalo futhi lingafinyelela idivayisi engahlobene enekheli elifanayo ngengozi. Qinisekisa indlela ngaphambi kokuthayipha imininingwane yokungena kunoma yini ephendulayo.
ip -4 route get 10.40.7.25
traceroute -n -m 5 10.40.7.25Umyalo wokuqala usho ukuxhumana kanye negethiwe umgogodla ongakusebenzisa, kanti owesibili ukhombisa amahop okuqala aphendula ngempela. Uma kokubili kungavumelani, kholwa uphenyo, ngoba yilona mzila umkhwenyana ozowuthatha. Uhlu lwamahop oluma ihop elilodwa ngaphambi kwe-NAS nalo luwukutholakala hhayi ukwehluleka. Uphenyo oluxazululeka ku-adaptha yomzimba esikhundleni sethuneli luqeda uphenyo kuleli phuzu.
Umb Bandela wesibili: ingabe impendulo iyabuya?
Iklayenti lidinga umzila oya ku-NAS, futhi inethiwekhi ye-NAS idinga indlela yokubuya eya echibini le-VPN. Ukudluliswa kwegethiwe, imithetho ye-firewall kanye nokuhunyushwa ngamabomu kwakheli ngakunye kuthonya lolo mbhangqwana. Amanothi e-strongSwan mayelana nokudlulisa zichaza izinketho zomzila wokubuya nokuhunyushwa kwe-subnet yangasese ngemuva kwegethiwe.
Lapho isicelo sifika futhi impendulo iphuma ngelinye igethiwe, akukho shintsho lwe-DNS olulungisa lokho kungalingani. Ukuthwebula kuzo zombili izinhlangothi kukunquma ngomzamo owodwa, futhi kukhombisa nokuthi ukuhunyushwa kwabhala kabusha umthombo i-NAS eyaphendula kuwo yini. Umphathi unomthwalo womngcele lowo: vumela kuphela izevisi ezidingekayo kanye nebanga lamaklayenti e-VPN, futhi bhala ukuthi kukhethwe ukuhlelwa komzila noma ukuhunyushwa.
Umb Bandela wesithathu: ingabe isevisi ikhona futhi ivunyelwe?
Ikhasi lokuphatha kanye nesevisi yokwabelana ngamafayela kungamaphoyinti okuphela ahlukene emshinini owodwa, futhi elinye lingamukela ukuxhumana ngenkathi elinye livinjwa i-firewall yomsingathi, ukucushwa kwesevisi noma imvume yokwabelana. Idivayisi ephendula ngokwenqaba isivele yafakazela izimbili zokuqala, okunciphisa kakhulu eyesithathu.
Hlola nge-akhawunti edinga amafayela ngempela, hhayi nge-akhawunti yomphathi esetshenziswe ngesikhathi sokufaka, ngoba amalungelo okuphatha awakwazi ukulungisa umzila ongekho futhi umzila awukwazi ukunikeza imvume yokwabelana. Amagama nawo ayingxenye yalokhu: igama le-NAS elitholakala ekhaya livame ukuncika ku-multicast yendawo okungayithwali ithuneli elihlelwe, ngakho zama igama lomsingathi langasese elibhalwe umkhiqizi noma ikheli ngokwalo ukwehlukanisa ukuqamba namagama nokufinyelela.
Hlola ngaphandle kwenethiwekhi ye-NAS, bese unweba kancane kancane
Ukuhlolwa okwenziwe ku-LAN efanayo kufihla yonke ingxenye engaphelele yomzila okude, yingakho umzamo wokuqala ophumelelayo okude ufanele inothi kurekhodi lezinguquko. Gijimisa izahluko kusuka kuklayenti elifinyelela i-NAS ngethuneli kuphela, futhi gcina umbhalo wangempela wephutha womzamo ngamunye.
nc -vz 10.40.7.25 445
smbclient -L 10.40.7.25 -U guestLapho umzila usebenza, dlulisa ifayela elingenabungozi futhi uqinisekise ukuziphatha kokufunda noma kokubhala okudingayo ngempela. Uma ukudluliswa okukhulu kuma ngenkathi okuncane kuphumelela, inkinga esele ukusingathwa kosayizi wephakethe noma ukuzinza kokuxhumana, hhayi ukwabiwa kwamakheli.
Ungashicileli amachweba okwabelana ngamafayela noma okuphatha ku-inthanethi ukuze ugweme isiphambeko esingachazwanga. Lungisa umzila wangasese, gcina isofthiwe ye-NAS isekelwe, futhi uhlole ukubuyiselwa kwakho konke okugcina ngekhophi kusetshenziswa yona ngaphambi kokuthembela kulelo khophi.