I-PPTP iyaxhuma bese ilenga ngemuva kwe-Linux NAT: umsizi we-GRE

Othile udlulisela u-1723, iklayenti lifinyelela iseva, ukuqinisekisa kuqala, bese konke kuma ngaphandle kwephutha. Isiphetho esingokwemvelo iphasiwedi engalungile, ngakho iphasiwedi iphindwa kabusha izikhathi ezintathu. Ukudlulisela kwakulungile futhi izifakazelo zazilungile. Okwaphukile iphrothokholi yesibili ukudlulisela okungakaze kuyihlanganise, kanye nenani eliyisisekelo le-kernel ela yeka ukusiza ngokuthula.

Ukudlulisela kwakungelona inkinga nanini

Umthetho wokudlulisela imbobo uchaza ithrafikhi ye-TCP noma ye-UDP. Awukwazi ukuchaza umthwalo oshintshela kwenye iphrothokholi ye-IP phakathi nesikhathi, futhi i-PPTP yenza njalo.

Yingakho uxhumano lubonakala luphelele kuze kube umzuzu lapho lulenga khona. Ingxenye umthetho wembobo ongayilawula yaphumelela, futhi ingxenye ongakwazi ukuyilawula yiyo engaphumelelanga.

I-TCP yokulawula, i-GRE yedatha

Ucingo luxoxisana nge-TCP 1723. Uma selumi, umthwalo ungena ku-GRE, iphrothokholi ye-IP 47, engathwali zinamba zembobo nhlobo. Umthetho oncike ezimbobweni awunakho ukuqhathanisa.

Okuthwalwa yi-GRE isihlonzi socingo esisekhasini laso, futhi umhumushi we-NAT kufanele abhale kabusha leyo nkambu ngendlela efanayo kuzo zombili izinhlangothi, kungenjalo izingxenye ezimbili zesikhathi ziyeka ukuvumelana. Ukubhalwa kabusha kohlangothi olulodwa hhayi olunye kwakha isikhathi esiqinisekisa bese silahla wonke amaphakethe edatha. Yilokho kanye ukuma komkhondo: impumelelo, bese kuthula.

I-GRE engenalutho ngaphandle kwe-PPTP ayidingi ukubhalwa kabusha okunjalo, yingakho umhubhe ojwayelekile we-GRE ungasemsebenzini ngomzila ohlehlayo kumaklayenti e-PPTP endleleni efanayo.

Amamojula amane kanye ne-sysctl eyawacisha

Amamojula amabili aphethe ukwakheka, nf_conntrack_proto_gre ne-nf_nat_proto_gre. Amanye amabili aphethe isihlonzi socingo, nf_conntrack_pptp ne-nf_nat_pptp. Ukulayisha okokugcina kudonsa amanye ngezincikileyo, ngakho uhlu lwamamojula kufanele lubonise wonke amane.

Imiyalelo emidala isebenzisa isiqalo se-ip_ sangesikhathi se-2.6. Lezo miyalo ingabonakala isebenza ingakalayishi lutho, ngakho hlola uhlu olulayishiwe hhayi isimo sokuphuma.

Ukubalayisha akwanele manje. Kusukela ku-Linux 4.7 i-sysctl net.netfilter.nf_conntrack_helper i-0 ngokuzenzakalela, lokho kucisha ukwabiwa kumsizi okuzenzakalelayo emigele emisha. Irukhithi ingaba nayo yonke imojula futhi ingahumushi lutho. Hlola inani elisebenzayo ngaphambi kokubheka uhlu lwamamojula futhi.

Noma uvule ukwabiwa okuzenzakalelayo emhlabeni wonke, noma uxhume umsizi emigele ewudingayo bese ushiya konke okunye njengoba kunjalo:

iptables -t raw -A PREROUTING -p tcp --dport 1723 -j CT --helper pptp

Ikhetho lesibili yilona elincanyelwayo. Lilinganisa ukuziphatha kuthrafikhi ye-PPTP esikhundleni sokuphinda kunike amandla ukwabiwa okuzenzakalelayo kuyo yonke irukhithi.

Ukuvula iphrothokholi engenazo izimbobo

Umthetho wodonga lomlilo ovumela u-1723 awusho lutho ngephrothokholi 47. Ku-firewalld, vumela iphrothokholi esifundeni esibheke kuklayenti. Ku-iptables ejwayelekile, yamukela iphrothokholi ye-gre kuchungechunge lokufaka.

Bese ubamba kuzo zombili izinhlangothi. Amaphakethe ashiya iklayenti ngaphandle kwezimpendulo ezifikayo kusho ukuthi indlela yokubuya ihlungiwe, futhi lokho kuyiphutha elihlukile kusuka kuzifakazelo ezenyusiwe.

Ngemva kokuxhuma, umkhawulo wosayizi

I-GRE ifaka ikhasi, futhi i-PPP engaphakathi yengeza okwengeziwe, ngakho isixhumanisi esisebenzayo sibika i-MTU engaphansi kakhulu kuka-1500. Izimpendulo ezincane ziyalayishwa kanti ezinkulu ziyalenga, okubonakala njengenkinga yesibili engahlobene evele ngomzuzu okuxazululwa ngawo eyokuqala.

Funda i-MTU ku-adaptha ye-PPP yeklayenti bese uyihlanganisa nokubala kwerukhithi uqobo esikhundleni sokwehlisa izinamba kuze kusebenze okuthile. Amaphakethe anosayizi ogcwele aphuma kungabuyi lutho akhomba kulo mkhawulo hhayi ekuhumusheni.

Ukulungisa indlela kubuyisela umsebenzisi emsebenzini, futhi lokho akwenzi i-PPTP ibe ukukhetha okuhle. I-MS-CHAPv2 ne-RC4 sekuyisikhathi eside zingasasetshenziswa, ngakho thatha ukulayishwa kwamamojula njengokulungisa kwesikhashana futhi uhlele ukudlulela kwiphrothokholi enakekelwayo.