Okukodwa phezulu, uziro uxhumanisa: umugqa waleyo strongSwan ubala ini

Funda umugqa wesimo othi Security Associations (1 up, 0 connecting) futhi ubonakala njengombiko wethumbu elilodwa elisebenzayo. Amasubnethi amabili adlulisa ithrafikhi kuwo ngasikhathi sinye, ngakho inombolo ibonakala njengokuqamba amanga. Ayiqambi amanga; ibala izinhlangano ze-IKE, futhi enye yazo ingahlalisa izingane eziningi. Funda izinhlu ngaphambi kokuthinta isiphakamiso noma umzila.

Kungani isihloko nethrafikhi kungavumelani

Umphumela wakudala we-stroke ubiza inani lawo lonke ngokuthi izinhlangano zokuphepha futhi ulithola kumphathi wezinhlangano ze-IKE. Yonke inhlangano ye-IKE esunguliwe inengeza eyodwa, kungakhathaliseki ukuthi zingaki CHILD SA ezingaphansi kwayo. Umzali oyedwa we-IKEv2 uvamise ukuthwala izingane eziningi, eyodwa ngayinye ipheya lezihlungi zethrafikhi, futhi izihlungi ezivunyelweni zengane zingakhava ikheli elingaphezu kwelilodwa noma isiqalo. Ngakho inani lamakheli ekucushweni kwakho alinobudlelwano obuqinile nenombolo esesihlokweni.

Umphumela wesimanje kwesinye isikhathi ukhombisa isamba esikhundleni segama lakudala elithi “up”, futhi i-daemon elawulwa yi-swanctl ayiqhutshwa nhlobo yizilungiselelo zakudala ze-stroke. Ungacabangi ukuthi igama noma umthetho wokubala uyafana phakathi kwezinguqulo.

Qhathanisa izinhlu ezintathu ngaphambi kokushintsha noma yini

Qala ngalokho okulayishiwe, bese kuba yilokho okuvunyelwene ngakho, bese kuba yilokho okunyathelisa amaphakethe ngempela. Le mibuzo emithathu ehlukene futhi ngamunye unomyalo wawo.

swanctl --list-conns
swanctl --list-sas

Eyokuqala ibala izincazelo zokuxhumana i-daemon eyamukele. Eyesibili ibala izinhlangano ze-IKE esunguliwe nezingane zazo, futhi yilapho kuvela khona ukulandelana kwangempela. Incazelo ekhona efayeleni kodwa engekho ohlwini lokuqala ayikaze ilayishwe, futhi noma ngabe zingaki izimo zokuphinda zomsunguli ngeke zikulungise lokho. Uma ugijima ngokunye isixhumi esibonakalayo sakudala, ipheya elilinganayo ngu-ipsec statusall kanye nohlu olufanayo lwe-swanctl, kuye ngokuthi iyiphi ipulagi ephethe ukucushwa. Ungahlanganisi amathuluzi phakathi kwama-daemon amabili kusibungazo esisodwa futhi ungalindeli impendulo eyodwa ehambisanayo.

swanctl --list-sas --raw | head -40
ip -s xfrm state

Ifomu eluhlaza ligcina izihlonzi nezihlungi zibonakala ukuze kuqhathaniswe, futhi uhlu lwesimo se-kernel lukhombisa lokho isitaki esikholwa ukuthi ukufakile. Uma i-daemon ne-kernel zingavumelani, kungenzeka i-daemon yaqalwa kabusha izungeze ingane ekhona noma into ye-kernel yasuswa ngaphansi kwayo.

Funda ukulandelana, hhayi isamba

Umzali osunguliwe oyisibonelo onezingane ezimbili ubonakala njengenodi eyodwa enezingane ezimbili ngaphansi kwayo, ngayinye imakwe ngesimo sayo nangendlela yayo. Khipha umphumela wangempela futhi uzibale izingane ngokwakho esikhundleni sokufunda isifinyezo umuntu asinamathisele kusuka kudashbhodi.

swanctl --list-sas
swanctl --list-conns --raw | grep -A4 'accounting'

Umzali oyedwa onezingane ezimbili ezifakiwe uyithumbu elinempilo lamasubnethi amabili. Umzali oyedwa onengane eyodwa efakiwe nengane eyodwa engekho yisimo esihlukile, futhi izihlungi zengane elahlekile yizo okumele ziqhathaniswe nesiphakamiso sohlangothi olukude. Ngesikhathi sokuvuselela ukhiye, ingane endala nomlandeli wayo kungase kubonakale ndawonye isikhathi esifushane. Gcina isitembu sesikhathi kanye nesithombe, ngoba ukubala okuthathwe phakathi nokuvuselela kubonakala njengokuphindaphinda kanti okwathathwa ngemuva kubonakala njengokulahleka.

Kulayishiwe, kufakiwe futhi ithrafikhi iyadlula

Ingane esesimweni esifakiwe inamapharamitha avunyelwene nokufakwa ku-kernel. Kodwa akusho ukuthi yathwala iphakethe: izihlungi zingaba zincane kunethrafikhi oyilindele, futhi umzila ungathumela leyo thrafikhi kwenye indawo ngaphambi kokuba ithumbu liyibone. Thumela ukugeleza okuhambisana nezihlungi ezivunyelwene kusuka kusibungazo esigunyaziwe, bese ufunda izibali zengane esikhundleni sesihloko. Isibali esihlala kuziro ngenkathi wenza ithrafikhi ehambisanayo sikhomba ekuhambiseni noma kunqubomgomo, hhayi ku-IKE.

swanctl --initiate --child accounting
swanctl --list-sas --raw | grep -E 'bytes|packets'

Ukuqala ingane enegama kuyisenzo sangamabomu esinomphumela obonakalayo, futhi sihlukanisa “uxhumano alunzi ngoba akekho ocela” kusuka ku-“uxhumano alukwazi ukukhuphuka”. Inqubomgomo yocingo oludingekayo iziphatha njengamacala okuqala, ngakho funda isilungiselelo sokuqala soxhumano ngaphambi kokusibiza ngokuthi iphutha.

Lapho ukubala kungamanga ngempela

Uma incazelo ingekho kuhlu olulayishiwe, bheka ukulayishwa kokucushwa nokuthi iyiphi inguqulo ye-daemon egijimayo. Uma ilayishiwe kodwa ingavumelani nhlobo, qhathanisa iziphakamiso, umongo wokuqinisekisa kanye nezihlungi nozakwabo, ingane eyodwa ngesikhathi. Shintsha into eyodwa ngomzamo ngamunye futhi ubhale isihlonzi osishintshile. Ukubuyisela isiphakamiso emuva kulula uma wazi ukuthi esiphi; kuwukuqagela ngemva kwezinguquko ezintathu ezingakaze zihlukaniswe.

Qala ngokulungisa ukufundwa okungalungile. Imibiko eminingi mayelana nethumbu lesibili “elilahlekile” igcina ngokuba nezingane ezimbili ezifakiwe ngaphansi komzali oyedwa, futhi into okuwukuphela kwayo eyake yaphuka kwakuwumugqa wesifinyezo abantu ababethemba kuwo esikhundleni sokulandelana.