Uxhumene ne-OpenVPN kodwa akukho ping noma ukwabelana nge-SMB? Hlola izango ezintathu

Ithuneli liyenyuka, iklayenti lithola ikheli, futhi akukho lutho ku-LAN ekude oluphendulayo. I-ping iyahluleka, ukwabelana akulivuli, futhi ilogi ye-VPN ibukeka ihlanzekile ngoba ngokombono wayo isikhathi sokuxhumana siphilile. Phakathi kwaleso sikhathi kanye nefayela kuseva kunezango ezintathu ezizimele: inqubomgomo yokudluliswa, amaphothi adingwa yisevisi, kanye negama owalithayipha esikhundleni sekheli.

Isango ngalinye lihluleka ngophawu oluhlukile, futhi elokuqala kuphela eliseva ye-VPN.

Ukudluliswa kuyinqubomgomo ochungechungeni lwe-FORWARD

Ukwamukelwa kwesilaleli se-OpenVPN kwenzeka ku-INPUT, yingakho ithuneli lingaxhuma ngenkathi iphakethe ngalinye elibheke ku-LAN lilahliwe. Ithrafikhi engena ku-tun0 futhi iphuma ngobuso be-LAN idlula ku-FORWARD, futhi umsingathi onenqubomgomo ye-DROP ezenzakalelayo lapho uyilahla buthule. Ngaphambi kokuthinta enye into, hlola i-sysctl kanye nochungechunge: sysctl net.ipv4.ip_forward futhi iptables -L FORWARD -v -n.

Vumela indlela oyifunayo kanye nezimpendulo ezihambisana nayo, isibonelo umthetho we-accept osuka kubuso bethuneli uya kubuso be-LAN kanye nomthetho we-stateful wethrafikhi ye-established ne-related. Uma i-LAN ingemuva komunye umzila, lowo mzila udinga indlela yokubuyela eqoqweni lamaklayenti noma i-source NAT kuseva ye-VPN. Qinisekisa leyondlela nge-ping eyodwa ngaphambi kokwengeza eminye imithetho, ngoba umthetho ongafinyeleleki awuvele neze kusibali.

I-SMB idinga iphothi elingaphezu kwelilodwa

Ukwabelana ngamafayela akusiyo ingxoxo eyodwa ye-TCP 445. Ukutholwa kusebenzisa i-UDP 137 no-138, izikhathi ze-NetBIOS ezindala zisebenzisa i-TCP 139, futhi izikhathi ze-SMB zesimanje zisebenzisa i-TCP 445. Umthetho ovula u-445 kuphela udala isimo esicasulayo lapho idrayivu emaphisiwe isebenza khona kodwa ukuphequlula inethiwekhi kungasebenzi, noma okuphambene nalokho.

Ukudluliswa okukhulu ngethuneli nakho kuhlangabezana nezinkinga ze-MSS ezibukeka njengokwabelana okugqekile. I-SYN ememezela usayizi ogcwele wesigaba se-LAN ilahlelwa yi-MTU encane yethuneli, futhi uxhumano luyalengela ngemva kokuxhawula. Ukucindezela i-MSS endleleni yokudluliswa, iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu, kuqeda lolo hlobo lokuma. Qinisekisa ngokukopisha amamegabhayithi ambalwa esikhundleni sohlu lwedayirekhithri, ngoba izimpendulo ezincane ziyadlula ngisho lapho ukudluliswa okukhulu kungadluli.

I-adaptha yethuneli ifika njengephrofayela entsha yenethiwekhi

I-Windows ihlukanisa i-adaptha ngayinye ngephrofayela yenethiwekhi, futhi i-adaptha entsha yethuneli ivamise ukuwela ku-Public, lapho imithetho yokwabelana ngamafayela nangamaphrinta ivinjiwe. Leso yisinqumo se-firewall yomsingathi kuseva yamafayela, hhayi inkinga yomzila kuseva ye-VPN. Shintsha isigaba ngamabomu usebenzisa Set-NetConnectionProfile -InterfaceAlias "Ethernet 3" -NetworkCategory Private ngemva kokuqinisekisa ukuthi inqubomgomo iyavuma, ngoba isigaba sishintsha nokuthi yimiphi imithetho engenayo esebenzayo.

Iphrofayela efanayo ichaza i-ping ehlulekayo ngenkathi i-TCP 445 iphumelela: izicelo ze-echo zilahlelwa ku-Public ngokuzenzakalelayo.

Amagama awaweli ngokwawo ithuneli elinomzila

Ukuxazululwa kwamagama e-NetBIOS nokutholwa kwendawo kuncike ekusakazeni okungalethwa ithuneli elinomzila. Yingakho ukuthayipha igama elifushane leseva kuhluleka ngenkathi ikheli laso lisebenza, futhi ukwabelana kubukeka kugqekile lapho ukusesha kuphela okugqekile. Engeza irekhodi le-DNS leseva kusixazululi esinikezwa ithuneli, noma sebenzisa ikheli kusithikithi esifushane.

Uma ukusetshenziswa kusancike ku-WINS, kuyilungiselele kuklayenti esikhundleni sokuthemba ukuthi ithrafikhi yokusakaza izovela. Zama ngekheli kuqala ukuze ukuhluleka kwegama kungadidaniswa nokuhluleka kwe-firewall.

Zama isigaba esisodwa ngesikhathi futhi ufunde ukuhluleka kokuqala

Khuphukela phezulu: ping isango lethuneli, ping umsingathi we-LAN ngekheli, bese uvula iphothi lesevisi nge-Test-NetConnection -ComputerName 10.8.0.5 -Port 445, futhi ngemva kwalokho kuphela qinisekisa ubunikazi ekwabelaneni. Isinyathelo sokuqala esihlulekayo yisona sigaba okufanele silungiswe, futhi isinyathelo ngasinye esilandelayo umsindo kuze kudlule leso. I-ping ephendulayo ngenkathi iphothi lihlala livaliwe ikhomba i-firewall yeseva yamafayela uqobo, kanti iphothi elivulekayo naphezu kwama-ping athule likhomba ukuhlungwa kwe-ICMP. Bhala phansi isinyathelo sokuqala esihlulekayo ngaphambi kokushintsha noma yini, ngoba ushintsho lwesibili lufihla umphumela wokuqala.

Uma iseva ye-VPN ingewona umzila we-LAN, qinisekisa indlela yokubuyela kulowo mzila ngaphambi kokwengeza eminye imithetho kuseva. Ngaphandle kwayo izicelo zifinyelela umsingathi futhi izimpendulo ziphuma ngomzila ozenzakalelayo zibheke ku-inthanethi, lokho okubukeka kuklayenti njengokulahla kwe-firewall ngqo.

Gcina i-akhawunti yokwabelana ihlukile ekungeneni kwe-VPN emibhalweni yakho, ngoba ithuneli eliphumelelayo alisho lutho mayelana nezimvume zamafayela. Ukudalula i-SMB ku-inthanethi ukuze ugweme umthetho ongekho akusona isisombululo.