Kungani i-PPTP ne-L2TP/IPsec zima ngaphambi kombuzo wegama lomsebenzisi?
Ukungabikho kombuzo wegama lomsebenzisi kusho ukuthi i-PPP ayikaze iqale, ngakho iphutha lisenokuthutha, ukushintshana kokhiye noma ukusethwa komhubhe. Hlola ukulandelana kwezigaba ngaphambi kokufaka kabusha.
Ukungabikho kombuzo wegama lomsebenzisi kuyisipho sokuxilonga: i-PPP ayikaqali, ngakho i-akhawunti, iphasiwedi nenqubomgomo yesizinda akukabuzwa. Kuxhumano lwe-PPTP noma L2TP/IPsec iklayenti licela ubufakazi kuphela ngemva kokuba umhubhe ukhona futhi iseva isiqalile iseshini ye-PPP. Konke okungahluleka ngaphambi kwalowo mzuzu ukuthutha, ukushintshana kokhiye noma ukusethwa komhubhe, okuyindawo encane kakhulu kune-«i-VPN yephukile».
Umbuzo ongekho unciphisa iphutha ezigabeni ezintathu
Bhala phansi isigaba sokugcina esiphumelele ngokubonakalayo, ngoba ngasinye sinomnikazi nendlela yokulungisa ehlukile. Ukuqagela izilungiselelo ze-akhawunti ngenkathi ubambeke ezigabeni ezimbili ngaphambili iyindlela isikhathi santambama esinyamalala ngayo.
| Stage | What has to work | How a failure looks |
|---|---|---|
| Reach | UDP 500, 4500 and 1701 — or TCP 1723 plus GRE — through every firewall and NAT device | Client hangs, then reports no response |
| Key exchange | Preshared key or certificate, phase 1 and phase 2 proposals | Fast error, or a stall after the client says it is verifying |
| Tunnel | L2TP or PPTP control channel, then PPP starts | Connects, then closes with no prompt |
| User auth | PPP credentials and an address pool with room | Prompt appears, then a rejection |
Iklayenti eliphelelwa yisikhathi ngaphandle kombuzo alikaze lithole ukuhlanganiswa kwe-IPsec, ngakho iphutha lise-IKE noma ekutheni amaphakethe akho afinyelela yini isango. Lelo elibika ukuthi liqinisekisa ubufakazi bese liwa lihambe kude kunalokho okushiwo umyalezo. Umbuzo olandelwa ukwenqatshwa ukufakazela ubuqiniso kwe-PPP, futhi lokho kungokwendatshana yekhasi lokungena, hhayi le.
Isigaba sokuqala: iphrothokholi evinjelwa unqenqema ngokuthula
I-PPTP idinga i-TCP 1723 yesiteshi sayo sokulawula kanye nephrothokholi ye-IP 47 yendlela yedatha, futhi kokubili kuhamba ngokwehlukana. Amanethiwekhi amaningi adlulisa i-1723 bese ewisa iphrothokholi 47, okukhiqiza umhubhe oxoxayo bese ungathwali lutho. Irotha eyenza i-NAT nayo idinga indlela yokudlula esekela i-GRE, futhi indlela yokufinyelela ye-IPv6 kuphela ayikwazi ukuthwala i-PPTP kunoma yikuphi ukumiswa.
I-L2TP phezu kwe-IPsec isebenzisa imbobo 500 ye-IKE nembobo 4500 yokuwela i-NAT, bese isonga ithrafikhi ye-L2TP ngokwayo ku-1701, kuyilapho i-ESP ithwala umthwalo ovikelekile uma ukuhlanganiswa sekukhona. Vumela izimbobo ezimbili zokulawula kodwa hhayi i-ESP, futhi uzothola ngqo uphawu olusekuqaleni kombhalo: intuthuko ebonakalayo, bese iklayenti lifile ngaphambi kwanoma yikuphi ukuxoxa kobufakazi. Ukuhlola kusuka ku-hotspot yocingo kuyindlela eshibhile yokwehlukanisa inkinga yeklayenti nenkinga yendlela.
Isigaba sesibili: ukhiye okungewona ukhiye, isiphakamiso esinganikezwa
Ukhiye owabiwe ngaphambili ongafani wehluleka ngokushesha nangokuthula, futhi uhlobo oluvamile ukhiye obonakala ulungile esikrinini kodwa ophethe ukwephuka komugqa okunamathiselwe noma isikhala ekugcineni. Kuklayenti le-Linux ingxoxo ayiyona ngempela umthombo weqiniso: ingezelo ye-L2TP ye-NetworkManager igcina izimfihlo kumafayela ngaphansi kwe-/etc/ipsec.d/, futhi ifayela elidala lokuxhumana ngalinye elisafakwa yi-/etc/ipsec.secrets lizosetshenziswa esikhundleni salelo osanda kulithayipha. Kopisha lelo fayela endaweni ephephile, likhiphe endleleni yokufaka, bese uphinda uthayiphe ukhiye ngesandla.
Ingxenye yesibili yalesi sigaba isiphakamiso. Zombili izinhlangothi kufanele zivumelane ngesethi efanayo yama-algorithm esigaba 1 — ukubethela, ubuqotho neqembu le-Diffie-Hellman — kanye nokuguqulwa kwe-ESP okufanayo kwesigaba 2, kungenjalo ukuhlanganiswa akukheki nhlobo. Isango elinikeza kuphela i-3DES, i-SHA1 ne-MODP1024 lizonqaba iklayenti elilungiselelwe ama-algorithm anamandla kakhulu, futhi ilogi yalo isho ukuguqulwa okunqatshiwe. Ilogi isho ukungafani uma uyifunda esikhundleni sokuqala kabusha isevisi. Esikhundleni sokukopisha uchungechunge lwama-algorithm kusukela kuchungechunge lwenkundla, buza isango ukuthi yikuphi ukuguqulwa elizoxoxisana ngakho ngempela: i-ike-scan eqondiswe ekhelini layo ibuyisela ukuguqulwa elizoxoxisana ngakho. Uma ukunikezwa okuwukuphela kungukubethela okungasavunyelwa inqubomgomo yakho, ukulungiswa kungokwesango, hhayi ukwehliswa kweklayenti.
Ku-Windows ukhiye nendlela yokuqinisekisa iqiniso kuhlala kuphrofayela ye-VPN, futhi ukungafani kubonakala ngaphambi kombuzo wobufakazi hhayi ngemva kwawo. Lapho umamukeli eyi-Windows Server, qinisekisa ukuthi indima yokufinyelela kude ifakiwe, ukuthi isitifiketi sihambisana negama iklayenti elixhuma kulo, nokuthi asikho isihlungi sembobo esincanyana kunezinketho ezingenhla.
Isigaba sesithathu: umhubhe ukhona futhi i-PPP ayiqali
Uma i-IKE isiphelile futhi umbuzo ungaveli, bheka idemoni yomhubhe hhayi unqenqema. I-L2TP idinga into elalela ku-UDP 1701 — i-xl2tpd noma i-kl2tpd ku-Linux, isevisi yokufinyelela kude ku-Windows — futhi isevisi efakiwe kodwa emisiwe ibonakala ohlangothini lweklayenti ifana ncamashi nephakethe elahliwe. Hlola umlaleli ngaphambi kokuvula kabusha imithetho osekuvele uyiqinisekisile. Bese i-PPP kufanele ixoxisane, futhi ukushintshana kokuqala kwe-LCP yilapho ukwehluleka okuthulile kuvame ukuhla khona.
Isicupho esisodwa kulesi sigaba akusona neze iphutha lenethiwekhi: i-Windows ivumela ukuxhumana okukodwa kohlobo oluthile lwe-VPN ngesikhathi, ngakho umzamo wesibili ubuyisela iphutha 937, «okunye ukuxhumana kwalolu hlobo kuyasetshenziswa». Lowo umthetho wasekhaya, futhi indlela yokuwedlula idivayisi ehlukile, uhlobo oluhlukile lomhubhe, noma ukwabelana ngokuxhumana okukodwa osekuvele kukhona.
Funda ilogi ngokulandelana kwezigaba esikhundleni sokuqagela
Misa iklayenti, liqalise kabusha, bese ufunda izingxenye ngokulandelana ezibhala ngakho ilogi. Okusho ukuthi kuqala idemoni ye-IPsec — i-strongSwan noma i-Libreswan, futhi i-ipsec --version ikutshela ukuthi iyiphi — bese idemoni ye-L2TP, bese kuba i-pppd. Noma iyiphi ingxenye eyabhala ekugcineni ngaphambi kokwehluleka iyona ekhombisa isigaba okufanele siphenywe, ngoba konke okulandela ngemuva kwayo ngokulandelana akuzange kusebenze nhlobo.
Qinisekisa ngokuxhumana okusha hhayi ngeseshini egciniwe, ngoba iklayenti elixhuma kabusha kusuka kunqolobane lingeqa izingxenye zokushintshana futhi likhiqize kabusha umphumela wakudala. Qinisekisa ukufinyeleleka, ukushintshana kokhiye, umhubhe ne-PPP ngakunye, ngalokho kulandelana. Khona-ke umbuzo ongekho uyeka ukuba yimfihlakalo futhi uba umugqa wesibili wohlu ongawusebenza ngempela. Lolo hlu futhi yilo olunikeza iqembu lenethiwekhi, obekuyodingeka licela ukuthi lihlole unqenqema ngenxa yephutha elihlala kudemoni engakaqalwa.