Iphutha le-PPTP 800 ne-812 kanye nokunqamuka ngemuva komzuzu

Imilayezo emithathu yamaphutha evela kuklayenti elilodwa le-PPTP ngokuvamile ichaza izinkinga ezintathu ezihlukene. Iphutha 800 lisho ukuthi umhubhe awukaze wakheka, iphutha 812 lisho ukuthi iseva yenqaba indlela yokuqinisekisa, futhi ukunqamuka ngemuva komzuzu kuyisibali sikhathi se-keepalive esinquma ukuthi umlingani onempilo usuhambile. Isigaba ngasinye sihluleka ngesizathu saso, ngakho ngasinye sidinga ukuhlolwa kwaso.

Iphutha 800 lisho ukuthi umhubhe awukaze wakheka

I-Windows ikhipha iphutha 800 lapho ingakwazi nhlobo ukwakha umhubhe, futhi umbhalo mayelana neseva engafinyeleleki noma amapharamitha okuphepha angafanele uyisifinyezo hhayi ukuxilongwa. I-PPTP idinga izinto ezimbili ezihlukene kusuka kunethiwekhi ngaphambi kokuba noma yiluphi ubufakazi buhlolwe. I-TCP 1723 ithwala isiteshi sokulawula, futhi iphrothokholi ye-IP 47, okungu-GRE, ithwala umthwalo ohlanganisiwe.

Hlola leyo ndlela yangaphandle ukusuka ngaphandle kwe-LAN yakho, ngoba uxhumano olusebenza ehhovisi alufakazeli lutho ngomkhawulo:

$ nc -vz vpn.example.net 1723
Connection to vpn.example.net 1723 port [tcp/*] succeeded!
$ sudo tcpdump -ni eth0 proto gre
tcpdump: listening on eth0, link-type EN10MB

Uma u-1723 ephendula futhi ukuthwebula kuhlala kungenalutho ngenkathi iklayenti lizama ukuxhuma, indlela isilahla iphrothokholi 47. Irotha elinesikhathi esidlulelisiwe se-1723 kodwa i-PPTP passthrough ivaliwe ikhiqiza lelo phethini ngqo: ukuxhawulana kwe-TCP kuyaqedwa, bese kuthi amaphakethe e-GRE anyamalale, ngakho ukwehluleka kubonakala njengenkinga yobufakazi nakuba kungekho mzamo wokungena owenziwe.

Qondisa ukudluliswa ekhelini le-LAN lamanje leseva, uvule i-PPTP passthrough lapho irotha linikeza khona, bese uzama futhi kusuka endaweni efanayo yangaphandle. Uma i-GRE ihlungwa phezulu futhi ungakwazi ukukushintsha, i-SSTP phezu kwe-TCP 443 noma i-L2TP/IPsec phezu kwe-UDP 500 ne-4500 inethuba elingcono kunanoma yiluphi ushintsho ongalwenza ohlangothini lwe-Windows.

Iphutha 812 ukwenqaba kwiseva kwendlela yakho yokuqinisekisa

Iphutha 812 libuya ngemuva kokuthi umhubhe usukhuphukile, yingakho lizwakala njengenkinga yephasiwedi. Iseva inqaba indlela yokuqinisekisa okwaxoxwa ngayo kuxhumano, hhayi ngempela iphasiwedi ngokwalo. Kuklayenti, vula ingeno ye-VPN, iya kuthebhu yezokuphepha, setha uhlobo ku-Point-to-Point Tunneling Protocol, khetha uhlu olucacile lwamaphrothokholi bese umaka i-Microsoft CHAP inguqulo 2.

Ungafunda isilungiselelo samanje ngaphandle kokuchofoza kudayalogi:

$ Get-VpnConnection -Name "Office" | Select-Object -ExpandProperty AuthenticationMethod
MsChapv2

Iseva edinga i-MS-CHAP v2 inqaba iklayenti elishiywe ku-PAP noma ohlotsheni oluzenzakalelayo oluxoxa ngokuthile okubuthakathaka, futhi iphutha lifika ngaphambi kokuhlolwa kwanoma yiliphi iphasiwedi lomsebenzisi. Ifomethi ye-akhawunti iyingxenye yesibili yalokho kunqaba. Kwesinye isikhathi i-Windows yathumela ubunikazi be-akhawunti ye-Microsoft obunesimo esingu-MicrosoftAccount\[email protected] ngenkathi iseva ifuna i-akhawunti yasendaweni noma yesizinda. Ukuthayipha i-SERVERNAME\username kwatshela i-Windows ukuthi yiluphi isitoreji se-akhawunti okufanele kubuzwe futhi kwasusa iphutha. Faka igama ngesandla esikhundleni sokuvumela ubufakazi obugciniwe ukuthi buphinde ifomethi yangaphambilini.

Ukunqamuka ngemuva komzuzu kuyisinqumo se-keepalive

Lapho umhubhe uxhuma, udlulisa ithrafikhi encane bese unqamuka, bheka indlela ye-LCP echo yeseva ngaphambi kokuthinta iklayenti. I-daemon icela umlingani njalo ukuthi aqinisekise ukuthi usakhona. Uma izimpendulo ezimbalwa kakhulu zifika ngaphakathi kwesabelomali esilungisiwe, iseshini iyadilizwa nakuba umsebenzisi usenesixhumanisi esisebenzayo.

Kuseva ye-Linux pptpd lawo manani ahlala ku-/etc/ppp/options.pptpd, futhi ukulungisa okuvamile ukwandisa isabelomali hhayi ukufinyeza isikhawu:

# /etc/ppp/options.pptpd
lcp-echo-failure 30
lcp-echo-interval 5
# then
sudo systemctl restart pptpd

Ukweqiwa okungamashumi amathathu esikhatshini semizuzwana emihlanu kuxolela ukuma okufushane esikhundleni sokumemezela ukuthi umlingani uhambe. Ukwehlisa inani libe kwelilodwa noma amabili kwenza i-jitter evamile endleleni ehumushiwe ibe ukunqamuka cishe njalo ngomzuzu. Uma iseva yakho iyi-Windows RRAS hhayi i-pptpd, bheka esikhundleni isikhathi sokuphela kweseshini ye-PPP kanye nenqubomgomo yokunqamuka lapho ungenzi lutho. Lokho kuhlala kwenye indawo, futhi ukuhlela ifayela le-pppd elingekho ngeke kushintshe lutho.

Ama-subnet agqagqene aphula indlela yedatha

Umhubhe we-PPTP ungaqinisekisa ngokuhlanzekile futhi ungafinyeleli ndawo uma zombili iziza zisebenzisa ibanga eliyimfihlo elifanayo, isibonelo i-192.168.1.0/24 ehhovisi nasekhaya. Iklayenti alikwazi ukusho ukuthi ikheli elithile likhomba kuphi umphathi, futhi ezinye izitaki ziyenqaba nhlobo ukufaka umzila esikhundleni sokukhetha owodwa.

Kuthathe njengokukhubazeka kwedizayini bese uphinda unombola uhlangothi olulodwa, noma unikeze iklayenti ibanga lokufinyelela elihunyushwe ngamabomu. Ukulungisa iphutha kuklayenti le-PPTP akukwazi ukulungisa isikhala sekheli esikhona kabili, futhi uphawu luzoqhubeka lubonakala njengokunqamuka okungahleliwe.

Qala ngesigaba esasehluleka: i-GRE ye-800, indlela kanye nochunge lwe-akhawunti ye-812, izilungiselelo ze-echo zomhubhe ofa ngokuhlelelwe isikhathi.