Kungani amaklayenti e-OpenVPN ehluleka ukufinyelela izikhethi ze-IPsec zesango
I-ping evela esangweni ifakazela ukuhamba okunye. Landelela ichibi lamaklayenti ngomzila ophushiwe, izikhethi ze-IPsec, uchungechunge lokudlulisa kanye nomzila wempendulo.
Thumela i-ping esangweni iye kusibungu esingemva komhubhe we-IPsec okude futhi siphendula ngokuhlanzekile, ngakho umhubhe ubonakala uphilile futhi ithikithi liqhubeka. Bese iklayenti elixhunyiwe lizama leso sibungu futhi akukho okubuyayo. Leyo ping ayikaze ibe ubufakazi bokuhamba kweklayenti, ngoba yaphuma nekheli lomthombo lesango ngokwalo futhi yahambisana nesinye isikhethi se-IPsec. Ukuqonda ukuthi kungani lezi zimo ezimbili zehluka yikhona okuyisigaba esikhulu sokulungisa.
I-ping yesango ihlola ukuhamba iklayenti lakho elingakaze likusebenzise
Ikheli lomthombo liyona into enquma ukuthi iyiphi inqubomgomo esebenzayo. Iphakethe elidalwe esangweni liphuma nekheli elivela ku-LAN yasendaweni noma endaweni yokugcina yomhubhe, futhi inqubomgomo ehambisana nalo yayibhalelwe lelo cala ngqo. Iphakethe leklayenti lifika kusixhumi se-OpenVPN likanye nekheli elivela echibini lamaklayenti, okuyisikhethi esihluke ngokuphelele.
Yingakho ukwehluleka kubonakala njengenkinga yomzila kanti empeleni kuyinkinga yobubanzi benqubomgomo. Ukufinyeleleka kusukela esangweni kufakazela ukuthi umlingani uyasebenza nokuthi iziphakamiso zaxoxwa, futhi akufakazeli lutho mayelana nokuthi ichibi liyavikeleka yini.
Phusha isiqalo sokude esidingwa uhlelo ngempela
Thatha ipheya eliyisibonelo 10.8.0.0/24 lamaklayenti axhunyiwe kanye ne-172.30.239.0/25 yenethiwekhi ekude evikelwe. Lokho iklayenti elikudingayo umzila oya kuleso siqalo sesibili, hhayi oya ku-LAN yesango futhi hhayi kwenye ikheli lomhubhe. Umzila ophushwe echibini uyona nto eyenza iklayenti linikeze lokho kuhamba esangweni. Ngaphandle kwawo iphakethe alisoze lifinyelele esinqumweni senqubomgomo osilungisayo.
Kuseva ye-Community eyamukela imizila ephushiwe, umyalo uthatha imaski yangempela: push "route 172.30.239.0 255.255.255.128". I-Access Server ihlela leyo ndawo ngendlela efanayo ngezilungiselelo zenethiwekhi yangasese noma imithetho yokufinyelela yenguqulo efakiwe, kukhethwa imodi ehambisayo noma ehumushiwe ngamabomu. Ukuhlela amaketanga e-firewall akhiwe esikhundleni sesilungiselelo somnikazi iyona ndlela yokwenza ukusethwa okusebenzayo kungaphinde kukhiqizwe.
Ngemva kokuxhuma, funda ithebula lomzila leklayenti hhayi inhloso yeseva. Umzila ohlanganisa ichibi kuphela usho ukuthi ukushushiswa akuzange kufike, futhi umzila ozenzakalelayo ngomhubhe ubanzi kunalesi sidingo futhi uzokumangaza kamuva. Hlola imaski nesiqalo, ngoba u-/25 ophushwe njengo-/24 uthumela ukuhamba kwamakheli angomakhelwane emzileni ongakwazi ukukuthwala. Bese uqinisekisa ukuthi iklayenti likhethe isixhumi somhubhe saleyo ndawo.
Yenza izikhethi zihlanganise ichibi lamaklayenti
Ngokufinyelela okuhambisayo okugcina amakheli amaklayenti, inqubomgomo ye-IPsec kufanele ivikele ukuhamba phakathi kwechibi nesiqalo sokude. Izikhethi ezibhalelwe i-LAN yesango ngokwalo zivumela i-ping bese zilahla isicelo seklayenti, futhi yikho kanye ukungalingani okuqale lolu phenyo.
Hlola inqubomgomo okwaxoxwa ngayo kanye neziphakamiso ezilungisiwe, isibonelo nge-ipsec statusall ku-strongSwan noma umyalo wesimo olinganayo wokuqalisa kwakho. Ku-IPsec esekwe kunqubomgomo umzila ojwayelekile ungakhomba kusixhumi somzimba kuyilapho ukuhamba okuhambisanayo kusabhalwe ngokufihla, ngakho ukungabikho kwedivayisi yomhubhe akufakazeli lutho. Qhathanisa amapheya ezikhethi nechibi nesiqalo osibhalile.
I-NAT yomthombo ejwayelekile esangweni nayo ingephula ukuhambisana. Uma umthetho we-masquerade ubhala kabusha umthombo weklayenti ngaphambi kokuhlolwa kwenqubomgomo, iphakethe alisabonakali njengesikhethi osibhalile. Lesi ngesinye sezizathu zokuthi umthetho obanzi we-masquerade uyisilungiso esibi se-VPN yesibili: ushintsha ukuthi iyiphi inqubomgomo esebenzayo nokuthi iyiphi ikheli eliqoshwa uhlangothi olukude. Khipha ukuhamba ohlose ukukuhambisa, noma kuhumushe ngamabomu bese uvuselela izikhethi.
Khetha ukuhambisa noma ukuhumusha ngamabomu
Ukuhambisa kugcina ikheli leklayenti libonakala ohlangothini olukude, ngakho amalogi akude nemithetho ngomthombo ngamunye kuhlala kunengqondo, futhi kudinga ukuthi isango elikude lazi umzila wokubuyela echibini. Ukuhumusha kufihla ichibi ngemuva kwekheli elilodwa, okususa inkinga yomzila wokubuya futhi kucekela phansi ubunikazi beklayenti ngalinye.
Khetha umklamo owodwa bese uwubhala phansi, ngoba yomibili idinga izikhethi ezihlukile nokuhleleka kwe-firewall okuhlukile. I-masquerade esetshenziswe ingxenye ihla phakathi kwazo futhi ayenelisi neyodwa. Ukukhetha okubhaliwe yikho futhi okwenza unjiniyela olandelayo ahlukanise iphutha nesinqumo esenziwe ngamabomu.
Vala umjikelezo ekudlulisweni nasempendulweni
Isango kufanele lidlulise iphrothokholi nendawo ohlose ukuba yiyo, okusho ukuthi ukudlulisa kwe-IP kuvuliwe futhi kunochungechunge lokudlulisa oluvumela ipheya. Bese uhlangothi olukude kufanele lubuyisele izimpendulo ngomzila we-IPsec, futhi leso yisinqumo somzila esangweni labo hhayi esakho. Zombili izingxenye ziwukuhleleka okuvamile, futhi zombili zilula ukuzishiya zingaphelele. Zihlole ngokwehlukana ukuze umthetho wokudlulisa ongekho ungathathwa njengomhubhe ophukile.
Qinisekisa ngesicelo esisodwa sangempela esivela eklayentini siya kuhlelo, ubuke sisuka kusixhumi se-OpenVPN, isinqumo se-IPsec kanye nomlingani okude. Hlola impendulo njengokuqapha okuhlukile, ngoba isicelo esifikayo nempendulo engasoze ibuye zibukeka zifana endaweni yeklayenti. Isicelo esisodwa esilandelelwe sibaluleke ukwedlula nanoma yiluphi inani lama-ping avela esangweni.
Gcina imvume yendawo incane ngenkathi uhlola, futhi uqinisekise ukuthi iklayenti elingenalo umthetho alikwazi ukufinyelela isevisi. Umzila ofakiwe kanye nokuhlanganiswa okusunguliwe akufani nokufinyelela okuvunyelwe.