Lapho i-NAT ngaphakathi kwe-VPN yendawo-kuyendawo ifaneleka khona

Ukuhumusha kungasindisa isimaphambili esigqagqene noma indlela yokubuya yohlangothi olulodwa, kodwa kushintsha amakheli wonke umgomo owabonayo. Klama ukumaka ngokucacile.

Womabili amasayithi asebenzisa ibanga elifanayo langasese, futhi umhubhe uyaphakama kuyilapho kungekho lutho olusizayo oludlulayo. Ukuhumusha yimpendulo evamile, futhi iyimpendulo yangempela: ukwethula ibanga elihlukile ohlangothini olukude kungaxazulula ukugqagqana noma indlela yokubuya okunye ukuxhumana okungeke ikwazi ukuyihambisa. Ingxenye eshiywayo ukuthi ukuhumusha kushintsha amakheli wonke isinqumo esilandelayo esiwabonayo. Kubheke njengesinqumo somklamo esibhalisiwe esinokumaka okubhaliwe, hhayi njengomthetho owengezwa kuze kuphumelele i-ping.

Nquma ukuthi yiliphi ikheli elibhalwa kabusha

Ukuhumusha komthombo kushintsha lokho insizakalo ekude namalogi ayo akubona njengeklayenti, ngakho isiphathi segatsha siba ikheli lesango lapho sifika. Ukuhumusha kwendawo noma kwesimaphambili kusethula ikheli elihlukile lomthombo okude. Okunye ukusetshenziswa kudinga ukuhumusha okuhambisanayo kuzinhlangothi zombili ukuze kuhlukaniswe izinkundla ezimbili ezifanayo, futhi kule nhlanganisela kuqala ukudideka okuningi.

Bhala umthombo ngaphambi kokuhumusha, indawo ngendlela uhlelo oluyibiza ngayo, kanye nombhangqwana wamakheli isango ngalinye elihambisana nawo. Amakholomu amathathu anele, futhi ikholomu yesithathu yileyo abantu abayishiyayo.

Ukuhleleka kwezinketho nakho kubalulekile. Ukukhetha nokuhumusha komgomo we-IPsec kwenzeka ezigabeni ezichaziwe, ngakho isikhethi esibhalelwe amakheli angaphambi kokuhumusha singase singalokothi sihambisane nephakethe esigabeni obucabanga ngaso. Hlola umgomo ofakiwe hhayi lowo obuhlosile ukuwufaka, ngoba womabili ahluka khona lapho umthetho wamukelwa ingxenye eyodwa futhi unganakwa enye:

ip xfrm policy show
ip xfrm state show
nft list ruleset | grep -A4 nat

Landela umthwalo nendlela yokubuya

Iseva ebhala umthombo ohumushiwe esikhundleni sesiphathi segatsha ngasinye izophula noma yimuphi umthetho noma umbiko oxhumene nekheli langempela. Ngaphambi kokushintsha ukumaka, thola ukuthi kukhona yini phansi okuthatha isinqumo kuleyo nkambu: izinhlu zokufinyelela, imibiko yocwaningo, imikhawulo yesivinini, ukuhlolwa kwelayisense. Ngakunye kwalokhu yindawo lapho ukuhumusha kuvela khona kamuva njengokwehluleka okungachazwanga.

Amaphrothokholi athwala amakheli ngaphakathi komthwalo wawo adinga ukuhlelwa okwehlukile, ngoba ukubhala kabusha isihloko sangaphandle akuthinti isikhombo sangaphakathi. I-FTP esebenzayo, i-SIP kanye neminye imikhiqizo yokufinyelela kude yizimo zakudala, futhi umklamo ongazinaki uzosebenza kuthrafikhi yewebhu wehluleke kuhlelo olwalubalulekile.

Ithrafikhi yokubuya incike ekumakeni okunesimo. Ukwehluleka kwesango kungalahlekelwa yileso simo, ukuhamba kwezindlela okungalingani kungakudlula, futhi ukuqala kabusha kungakusula ngenkathi amaseshini ehlala evulekile ohlangothini olukude. Yingakho isicelo esifika endaweni nomhlangano oqedwayo kuyimiphumela emibili ehlukene yokwamukela.

Kala lokhu ngokuqhathanisa nokubala kabusha isayithi

Ukubala kabusha isayithi elilodwa eliphikisanayo kususa ngokuphelele ukumaka futhi kushiya uhlelo lwamakheli olungafundwa ngaphandle kwamathabuli okuhumusha. Kubiza kakhulu ekusebenzeni: amarekhodi e-DNS, izabelo eziqinile, imithetho yocingo kanye nawo wonke amakheli abhaliwe kumele ashintshe ndawonye. Izindleko zifika kanye, kuwindi elihleliwe, nesimo sokugcina esicacile. Okukuthengayo yikhono lokufunda ukubanjwa kwamaphakethe eminyakeni eminingi kamuva ngaphandle kwethebula lokusesha.

Ukuhumusha kugwema ukushintshwa kwendawo okuningi futhi kwakha ukumaka okumele kugcinwe ku-DNS, emibhalweni nasekuxazululeni izinkinga kuze kube phakade. Izindleko zifika ngokuqhubekayo, ngesimo sawo wonke unjiniyela wesikhathi esizayo okumele afunde ukuthi isimaphambili esisodwa ngaphakathi komhubhe sisho okunye.

Kuxhumano lwesikhashana noma inethiwekhi yozakwethu ongayilawuliyo, izindleko eziqhubekayo ngokuvamile ziyafaneleka. Emasayithini amabili okuwumphakathi wakho futhi ozoba owakho iminyaka, ukubala kabusha ngokuvamile yisinqumo esishibhe kakhulu uma ukufuduka kubalwa ngobuqotho.

Fakazela izinhlangothi zombili ngomhlangano wangempela

Hlola umhlangano wohlelo esikhundleni somcwaningi oyedwa. Isicelo se-echo esiphumelelayo sifakazela ukuthi uhlangothi olulodwa lwephrothokholi luyasebenza, futhi luhambisana ngokuphelele nendlela yokubuya ehlulekayo kunoma yini enesimo. Sebenzisa insizakalo eyakhuthaza umklamo, futhi funda ilogi yayo ekugcineni okukude ukuze ubone ukuthi iyiphi ikheli lomthombo eliyirekhodile.

tcpdump -ni any host 10.40.9.20 and port 443
conntrack -L | grep 10.40.9.20
ip route get 10.40.9.20

Bese uqinisekisa ukuthi yizinsizakalo ezihlosiwe kuphela ezifinyeleleka ngokumaka. Ukuhumusha kushintsha ukukhetha kwamakheli futhi akwenzi lutho ekugunyaziseni, ngakho umgomo wocingo usanquma ukuthi yini evunyelwe. Umklamo othembela isimaphambili esihunyushiwe esingacacile njengokulawula ukufinyelela awunakho nhlobo ukulawula ukufinyelela.

Rekhoda ukumaka, umhlangano ohloliwe kanye namakheli abonwe uhlangothi ngalunye. Umuntu olandelayo ozolungisa lo mhubhe udinga lawo maqiniso amathathu ukudlula ifayela lokumisa.

Izihloko ezihlobene