I-PPTP passthrough ayikho: lungisa iphutha 807 le-VPN ku-Windows

Ukudlulisa i-TCP 1723 ngokuvamile kuhlanza ingxenye yokuqala ye-PPTP bese kushiya okusele kuphukile, ngakho i-Windows isabuyisela iphutha 807 lapho izama. Umcabango olandelayo ukwengeza umthetho wepothi 47, futhi yileso sinyathelo esichitha intambama yonke: i-GRE iyinombolo yephrothokholi ekhanda le-IP, hhayi ipothi ikhwelo lokudlulisa elingayifanisa. Kuze kube irutha ivumela iphrothokholi 47 futhi iyixhumanise nokushaya okufanayo, umhubhe awukakwazi ukuqala. Izigaba ezingezansi zihlukanisa imigudu emibili, bese ziyihlola ngayinye ngayinye.

Ithebula lamapothi alinawo umugqa wenombolo yephrothokholi

I-PPTP isebenzisa izingxoxo ezimbili ezihluleka ngezindlela ezahlukene. Leyo ekwi-TCP 1723 iqala ukushaya, idlulisa ulwazi lwesixhumanisi futhi iyidabule lapho umsebenzisi enqamula. Uhlangothi lomthwalo lusebenza ngaphakathi kwe-GRE, okuyiyo ekhanda le-IP eliyiphawula ngenombolo yephrothokholi 47, futhi ngaphakathi kwalowo mhubhe i-PPP ixoxisana ngesixhumanisi kuyilapho i-MS-CHAPv2 ihlola ubufakazi.

Njengoba i-GRE inganayo ikhanda lokuthutha, ayidaluli amapothi, ngakho umthetho obhalelwe amapothi awunakho okungafaniswa nakho. Irutha edlulisa i-1723 yakha imephu yaleyo seshini ye-TCP bese ima lapho. Ifirmware ephethe ingxenye yesibili ibiza lesi sici ngokuthi i-PPTP passthrough noma i-PPTP ALG, futhi enye ifirmware ayinikeli kokubili futhi ayikhulumi ngesikhala. Ilebula ebhokisini lokukhetha incane kakhulu kunokuthi iphrothokholi 47 ibonwa nhlobo.

Yini i-Windows eyibikayo lapho indlela yedatha ifa

Iphutha 807 lithi ukuxhumana akukwazanga ukuqedwa, okusho empeleni ukuthi ukushaya kwafika kuseva futhi umgudu wedatha awuvukanga. Isinqumo mayelana nokuthutha, hhayi mayelana ne-akhawunti. Iphutha 691 yilona elikhomba kubufakazi noma ekungafanini kwephrothokholi yokuqinisekisa, ngakho likuthumela kwenye indawo ngokuphelele.

Sebenza ekuthuthweni ngaphambi kokuthinta iphasiwedi. Ukushintsha ubufakazi ukulandela i-807 kushiya iphutha langempela endaweni yalo futhi kwenza umzamo olandelayo kube nzima ukuwufunda.

Kungani iklayenti lesibili liphula umhubhe osebenzayo

Ngaphandle kwamapothi okubahlukanisa, idivayisi ye-NAT ayikwazi ukuhlukanisa amaklayenti amabili e-PPTP njengoba ihlukanisa amaseshini amabili e-HTTPS. Ngakho amadivayisi amaningi abathengi avumela ukushaya okukodwa kwe-PPTP futhi akulandelela ngekheli lomthombo. I-laptop eyayisebenza yodwa iyeka ukuqedela lapho omunye umshini ushayela ngaphandle, futhi ohlangothini lweklayenti ukuhluleka kubonakala kungahleliwe. Leyo phatheni ingeyefirmware, futhi akukho shintsho lwephrofayela oluyishintshayo.

Buka ithebula lokuxhumana ngenkathi womabili amaklayenti eshaya. Uma kuphela isibungu sokuqala esiphethe imephu, irutha isifinyelele umkhawulo walokho ekusekelayo futhi asikho isilungiselelo ohlangothini lweklayenti esingayisusa.

Khombisa ukuthi iyiphi ingxenye ehlulekayo

Qinisekisa ukuthi i-TCP 1723 iyafika ngaphambi kokushintsha noma yini kurutha, ngoba leyo mpendulo inquma ukuthi iyiphi ingxenye oyihlolayo. Zisebenzise kusukela kuklayenti le-Windows ngokumelene negama lakho leseva. Eyokuqala iphrinta ukuthi ipothi liphendulile yini, futhi eyesibili ishaya ngaphandle kwebhokisi lengxoxo, okwenza imizamo ephindwayo iqhathaniseke.

Test-NetConnection vpn.example.com -Port 1723
rasdial "Work VPN"

Umphumela weqiniso ekuhlolweni kwepothi usho ukuthi umgudu wokulawula uvulekile futhi i-GRE iyisola esisele. Umphumela wamanga usho ukuthi ukuhambisa, isihlungi noma ukudlulisa kuphukile, futhi akukho shintsho lwe-GRE olungakusindisa. Uhlangothi lwedatha kufanele lubhekwe lapho lubonakala khona, ekupheleni kweseva noma kurutha.

tcpdump -ni any proto 47

Okulingana nakho ku-Wireshark isihlungi sokubonisa ip proto 47, okulula ukunikeza umuntu ongakhululekile ku-shell. I-GRE efika kungaphumi lutho njengempendulo isho ukuthi indlela yokubuya idinga ukulungiswa.

Yini empeleni elungisa iphutha

Lapho irutha iveza isilungiselelo, nika amandla i-PPTP passthrough, noma vumela ngokusobala iphrothokholi 47 kufirmware eyamukela imithetho. Ku-RouterOS umthetho we-forward ufanisa iphrothokholi ngqo, okungeke neze kwenze ukudluliswa okusekelwe emapothini. Ifirmware yabathengi ngokuvamile ifihla isinqumo esifanayo ngemuva kwebhokisi lokukhetha, ngezinye izikhathi ngaphansi kwezilungiselelo zokuphepha hhayi ngaphansi kokudluliswa kwamapothi. Uma kungekho ukulawula okunjalo, akukho ohlangothini lweklayenti okungayinxephezela.

/ip firewall filter add chain=forward protocol=gre action=accept
/ip firewall filter print where protocol=gre

Ukushintsha i-PPTP kungenye indlela futhi ngokuvamile eshibhile. Irutha eliqeda ngokwalo i-VPN ligwema i-NAT ephindwe kabili kumaklayenti angenayo, futhi iphrothokholi i-NAT esekelwe emapothini eseyiphethe ayidingi passthrough nhlobo: i-OpenVPN phezu kwe-UDP, i-SSTP phezu kwe-TCP 443, noma i-L2TP/IPsec ne-NAT-T egoqa i-ESP ku-UDP 4500. I-PPTP futhi incike ku-MS-CHAPv2, obuthakathaka bayo obhalisiwe buyenza ibe ukuqokwa okubi kokusatshalaliswa okusha ngisho ngemva kokunyamalala kwephutha.

Bhala phansi ukuthi wuphi umthetho owenza umehluko, ngoba indawo efanayo izohlangabezana nomkhawulo ofanayo lapho umsebenzisi wesibili ecela ukufinyelela. Ukulungiswa kwezinga lephrothokholi kufanele kube semanothini enethiwekhi, lapho unjiniyela olandelayo ezobheka khona.