I-ESP ephumayo ngaphandle kwempendulo akusho ukuthi i-VPN ifile
I-ESP ivikela uhlangothi olulodwa ngokuhlangana ngakunye futhi ayiqinisekisi lutho. Qondanisa ingxoxo yangaphakathi kanye ne-SA engenayo ngaphambi kokuthi iseva ayiphenduli.
Uthwebule ithrafikhi kusibungu se-IPsec, wabona amaphakethe e-ESP ephuma, awubonanga lutho olubuyayo, futhi waphetha ngokuthi uhlangothi olukude lukhohlakele. Ukuthwebula akukusekeli lokho kuphetha. I-ESP ivikela uhlangothi olulodwa lwengxoxo futhi ayiqinisekisi lutho esigabeni se-IP, ngakho ukungabikho kwe-ESP ebuyayo kungasho ukuthi uhlelo lokusebenza lwalungenakho okungakusho, njengoba futhi kungasho ukuthi umhubhe ufile. Funda ukushintshana kwangaphakathi kanye nesimo sohlangothi olwamukelayo ngaphambi kokusola noma yimuphi umkhawulo.
Inkolelo: iphakethe ngalinye elivikelwe lithola impendulo
I-ESP akulona uhlelo lokucela nokuphendula. Ibethelela futhi iqinisekise noma yini ekhethwa inqubomgomo, futhi umamukeli uqinisekisa, uyihumusha futhi ahambise lelo phakethe langaphakathi ngaphandle kokukhiqiza elakhe iphakethe. Umbuzo we-UDP okungawunaki lokho okuyiwa kukho, noma umsindo we-ICMP olahliwe inqubomgomo engenayo, kudala ukuthula ezinhlangothini zombili njengomphumela ofanele. Ukuthatha lokho kuthula njengokwehluleka kwezokuthutha kukuthumela ukufuna iphutha lenethiwekhi elingakaze libekhona.
Lokho ukuthwebula kothando olulodwa okuqinisekisa ngempela ukuthi isitaki somthumeli sibethelele okuthile kuleyo ndawo yokubheka. Akukho lutho mayelana nokufika, futhi akukho lutho mayelana nenhloso yokuphendula. Umbuzo owusizo akuwona „kungani kungekho mpendulo“ kodwa „ingxoxo yangaphakathi kwakufanele ikhiqize ini“.
Ama-SA amabili, ama-SPI amabili, ingxoxo eyodwa
Ukuhlangana kwezokuphepha kwe-IPsec kuhamba ohlangothini olulodwa, ngakho ukushintshana okuvikelwe okuvamile kusebenzisa ukuhlangana okungena nokuhlangana okuphuma okunezikhombisi ezihlukene nesimo esizimele. Ukufuna ithrafikhi ebuyayo nge-SPI yephakethe eliphumayo kungakho iphutha lesigaba, ngoba noma iyiphi impendulo ihamba ngaphansi kwe-SA yomlingani uqobo ene-SPI yakhe. Esikhundleni salokho, hlanganisa ipheya ngezikhethi zethrafikhi namakheli omlangani.
Ukwenza kabusha ukhiye kwenza isithombe sibe nzima imizuzwana embalwa, ngoba isimo esidala nesimo esitshintshayo kungase kuhlangane. Uma uphawu luqale eduze nokushintshwa kukhiye, qoqa izikhombisi zokuhlangana kanye nezimpawu zesikhathi ndawonye hhayi igama lokuxhumana kuphela.
Okufanele ukwenze umamukeli ngaphambi kokuthi noma yini iphendule
| Stage | What to look at | Wrong conclusion if skipped |
|---|---|---|
| Sender encrypts | outbound SA packet counter | "the tunnel is up" |
| Peer receives | inbound SA counter and replay window | "the peer is down" |
| Inner delivery | target host or service logs | "routing is broken" |
| Application replies | the app's own trace | "the reply was dropped" |
| Protected return | the peer's outbound SA | "ESP only works one way" |
Umgqa ngamunye uhluleka ngokuzimela futhi ukwehluleka ngakunye kunomnini ohlukile, yingakho ukuthwebula okukodwa kungenakho ukubahlukanisa. Isibali sokungena siwubufakazi obuqondile kuphela bokufika, ngoba iphakethe elihluleka ukuqinisekiswa noma ukuhlolwa kokuphinda lilahliwe ngaphandle kwanoma iyiphi impendulo. Umlingani osibali sakhe sokungena singanyakazanga akunikezi lwazi ngombono wakhe.
Ukulethwa kuyisinyathelo esihlukile ekuhumusheni. Isimo singaba semthethweni futhi iphakethe lilahliwe kamuva inqubomgomo engenayo noma umzila ongafaki indawo yangaphakathi, ngakho hlola ukuthi isibungu esihlosiwe sabona umbhalo ocacile yini esikhundleni sokucabanga ukuthi isibali esihlanzekile sisho ukuthi iphakethe laya lapho ubufuna khona.
I-ESP yemvelo akuyona i-UDP
I-ESP yemvelo iyi-phrothokholi ye-IP 50, engeyona i-TCP noma i-UDP futhi engenazo izimbobo. Ngakho umthetho we-firewall ovumela i-IKE ku-UDP 500 awusho lutho mayelana nomzila wedatha, futhi isihlungi esibhalwe sizungeze izimbobo singavumela umhubhe ukuthi uxoxisane bese silahla konke okuthwalwa ngaphakathi kuwo. Hlola umzila wedatha ngokwahlukile, kumodi oyibonile ngempela.
Ngemuva kwe-NAT isimo siyashintsha: umthwalo ovikelwe uhamba ngaphakathi kwe-UDP, ngokuvamile embotsheni engu-4500, njengoba i-RFC 3948 ichaza. Rekhoda imodi esebenzayo ngaphambi kokubhala noma yimuphi umthetho, ngoba idivayisi esendleleni ingaphatha i-ESP yemvelo ne-ESP ehlanganiswe ku-UDP ngendlela ehluke ngokuphelele, futhi amabhokisi athile aphakathi avumela elinye kuyilapho elahla elinye.
Funda izibali eziyingxenye yalesi sigameko
Kusibungu se-strongSwan, swanctl --list-sas ibika izibali zamaphakethe namabhayithi ngokuhlangana ngakunye kuzinhlangothi zombili, okwanele ukuhlukanisa „akukaze kufike“ kokuthi „kwafika futhi akwaphendulwa“. Ku-Linux, /proc/net/xfrm_stat ibala ukwehluleka okuhlanganisiwe njengesimo esingekho, inqubomgomo engekho kanye namaphutha ephrothokholi. Lezo zibalo ziqongelelwa kusukela ekuqaliseni futhi ziyingxenye yendawo eyodwa yamagama yenethiwekhi, ngakho inombolo enkulu akuyona ukuthiwa.
Thatha ukufundwa okubili eduze kwewindi lesigameko endaweni efanele yamagama futhi uqhathanise umehluko, uma kungenjalo uzokhweza amaphutha eviki eledlule kuthikithi yantambama. Faka indawo yamagama kanye nezimpawu zesikhathi zombili kuthikithi ukuze umfundi olandelayo akwazi ukuphinda ukuqhathanisa esikhundleni sokwethemba isibalo.
Qamba isigaba, hhayi umsoliswa
Isiphetho esiwusizo sisho lapho iphakethe lama khona: alikaze lamukelwe, lamukelwa futhi lahlwa, lalethwa kodwa alwaphendulwa, noma laphendulwa futhi lalahleka endleleni ebuyayo. Ngakunye kulokhu kukhombisa umnini ohlukile nomyalo olandelayo ohlukile. „Akukho mpendulo evela kuseva ye-VPN“ kuhlanganisa amaphutha amane ahlukene abe umusho owodwa ukuthwebula okungazange kuwulungise.
Gcina ukuthwebula kuncane, futhi gcina isimo se-kernel esingahluziwe ngaphandle kwamathikithi, ngoba singathwala into yokhiye okufanele ingaphumi kusibungu. Umehluko wezibali kanye nezimpawu zesikhathi yizo izingxenye okufanele zidluliselwe kumuntu olandelayo.