Iseva ye-PPTP ngemuva kwerutha yasekhaya: lungisa i-1723 ne-GRE kuqala

I-PPTP ngemuva kwerutha yasekhaya ihluleka ngezindlela ezimbili ezingahlobene, futhi ukuzihlanganisa kubiza ubusuku bonke. Okunye ukuhluleka iqhekeza ekudluliseni: irutha ivumela i-TCP 1723 idlule kodwa ilahle iphrothokholi ye-IP 47, ngakho iklayenti lihlala lilenga kusiphambeko 619. Okunye inkinga yosayizi: ithaneli iyaphakama, iqinisekise, bese iba lukhuni lapho iphakethe losayizi ogcwele kufanele lidlule. Ukwazi ukuthi iyiphi kulezi ezimbili onayo yisinyathelo sokuqala sangempela; okusele kuqhathanisa lokho irutha yakho engakusho, hhayi ukuthi imuphi umkhiqizo ungcono.

Izithwali ezimbili, futhi eyodwa kuphela enembobo

I-PPTP ihlukana izithwali ezimbili: uxhumano lokulawula ku-TCP 1723, namafreyimu e-PPP asongelwe ku-GRE enwetshiwe, okuyiphrothokholi ye-IP 47. I-GRE ayinayo inombolo yembobo, ngakho umthetho obhalwe njengokudlulisa imbobo 1723 awukwazi ukuyimboza, noma isixhumanisi sewebhu sibiza leso sikhala ngani. Irutha yasekhaya ivamise ukunikeza ibhokisi elibizwa ngokuthi ukudlulisa i-PPTP esikhundleni somthetho wephrothokholi, futhi lelo bhokisi lenza imisebenzi emibili: livumela iphrothokholi 47 ukuba idlule ku-firewall, futhi lifundisa i-NAT ukulandelela ukugeleza kwe-GRE. Kurutha ye-Linux leyo misebenzi iyimojuli ezihlukene nemithetho ehlukene, ngakho ukudlulisa okuhleliwe ngcezu kusaveza isiteshi sokulawula esisebenzayo. Thola ukuthi yiluphi ucezu olukhona ngaphambi kokushintsha noma yini.

I-firewall yeseva uqobo kufanele futhi ivumele iphrothokholi 47 isuka ekhelini lerutha. I-firewall yehosti evuma kuphela i-1723/tcp iphinda ikhiqize isiphambeko 619 ngaphakathi kwe-LAN, okwenza ukudlulisa okuphukile kanye nomthetho wehosti ophukile kubonakale kufana.

sudo iptables -S FORWARD | grep -i gre
sudo nft list ruleset | grep -i gre
lsmod | grep -E 'nf_conntrack_proto_gre|nf_nat_proto_gre'

Uma amamojuli engekho, walayishe nge-sudo modprobe nf_conntrack_proto_gre nf_nat_proto_gre futhi wenze ukulayisha kube ngokungapheli, ngoba ukuqala kabusha okukhohlwa umsizi kubuyisela ithaneli esebenzayo kusiphambeko 619. Umthetho wokudlulisa kufanele wamukele iphrothokholi 47 kuphela ngasekhelini leseva, hhayi i-LAN yonke. Incazelo ku-RFC 2637 ihlukanisa indlela yokulawula nendlela yedatha, ngakho asikho isikrini esisodwa sokudlulisa imbobo esichaza i-PPTP ngokugcwele.

Ibhokisi lokudlulisa noma umthetho wephrothokholi ocacile

Ibhokisi lokudlulisa elivula kuphela i-firewall liseduze nalokho okulungile kune-ALG ebhala kabusha izihlonzi zocingo. Ucezu lwe-firewall luyabikezelwa, ngoba iphrothokholi 47 iyamukelwa noma ilahlwe, futhi izibalo zitshela ukuthi yikuphi. Ucezu lokubhala kabusha yilapho abakhiqizi behluka khona, ngoba izihlonzi zocingo ze-PPTP zinge-ithaneli ngayinye futhi i-NAT ewuhlelayo kufanele ilandelele yonke iminxeba eyithintayo. Lapho iklayenti elilodwa lixhuma futhi amabili engaxhumi, i-ALG iyisola sokuqala.

Umthetho we-NAT wendawo ohlosiwe we-1723 nawo unenkinga yobunikazi. Uma umthetho wakudala usathumela i-1723 kuphonya hosti eyeka ukusebenzisa iseva, amaphakethe awela embotsheni evaliwe futhi insiza ye-PPTP yerutha uqobo iyeka ukuphendula, okufundwa njengokuhluleka kwe-firewall kodwa empeleni kuwumgomo ophelelwe yisikhathi. Funda umthetho nomgomo wawo ngaphambi kokwengeza owesibili. Kuma-rutha aziphetha wona i-PPTP, umthetho we-WAN uncintisana nensiza eyakhelwe ngaphakathi, ngakho khetha umnikazi oyedwa we-1723 nephrothokholi 47.

Amaklayenti amabili ngemuva kwe-NAT efanayo yiso isimo esihlukanisa ukudlulisa okulula kulokho okuhlakaniphile. Ukudlulisa iphrothokholi 47 ngaphandle kokubhala kabusha izihlonzi zocingo ngokuvamile kuziphatha kangcono kunomsizi ozama ukuzilungisa.

Linganisa ithaneli ngaphambi kokusola irutha

I-PPTP inciphisa umthwalo owusizo, futhi lokho kuncipha kuyizibalo, hhayi imfihlakalo. Iphakethe ngalinye lethanele lithwala isihloko se-IP sangaphandle, isihloko se-GRE esinwetshiwe, isihloko se-PPP futhi, ngokubethela, isihloko se-MPPE. Lapho indlela ingakwazi ukuthwala uhlaka olukhishiwe, amaphakethe amancane ayadlula, ukungena kuyaqedwa, futhi isikhathi siyama okokuqala lapho ukudluliswa kwefayela noma ukuxhawulana kwe-TLS kuthumela iphakethe losayizi ogcwele.

Bala inombolo esikhundleni sokuqagela. I-GRE enwetshiwe ibiza amabhayithi angu-8, i-PPP ibiza angu-4, i-MPPE ibiza angu-4, futhi isihloko se-IP sangaphandle sibiza angu-20, ngakho ithaneli lidla amabhayithi angu-36 ngaphambi kwanoma yimuphi umthwalo. Ku-WAN ye-PPPoE ephela ku-1492, i-PPP MTU enkulu kunazo zonke ehlalayo ingu-1492 susa u-36, okuwuku-1456. Setha i-mtu ne-mru kulelo nani kuzinketho ze-PPP futhi uphinde uhlole nge-ping engahlukanisi.

ping -M do -s 1464 198.51.100.7
grep -E '^(mtu|mru)' /etc/ppp/options.pptpd

I-ping ilinganisa indlela, hhayi ithaneli: umthwalo wamabhayithi angu-1464 kanye namabhayithi angu-28 ezihloko ze-IP ne-ICMP kugcwalisa kahle uhlaka lwamabhayithi angu-1492. Uma leyo ping yehluleka, yehlisa inombolo ize idlule bese ususa u-36 emphinjeni. I-MTU yethaneli esethwe ngaphezu komkhawulo wendlela ikhiqiza ukuqina ngaphandle komugqa owodwa wencwadi okhuluma ngosayizi.

I-PPTP, i-L2TP/IPsec noma i-OpenVPN kurutha efanayo

Irutha efanayo ingathwala noma iyiphi yamathaneli amathathu ajwayelekile, futhi umehluko ukuthi kufanele iveze ini. I-PPTP idinga imithetho emibili ezigabeni ezimbili ezihlukene. I-L2TP phezu kwe-IPsec idinga i-UDP 500 no-4500 wokushintshana kokhiye futhi, ngaphandle uma i-NAT-T ikuthwala, iphrothokholi 50 yomthwalo. I-OpenVPN idinga imbobo eyodwa ye-UDP futhi ayidingi msizi nhlobo.

Ikholomu ye-L2TP ayihambisani ne-GRE ngokuzenzakalela. I-ESP iyiphrothokholi ye-IP 50 futhi nayo ayinayo imbobo, ngakho irutha enobunzima nephrothokholi 47 ingaba nobunzima nephrothokholi 50 ngesizathu esifanayo. I-NAT-T ikhona ukusonga i-ESP ngaphakathi kwe-UDP 4500, futhi lapho iziphetho zombili zisekela, umthetho wephrothokholi 50 awusadingeki. Lokho kuyisici seziphetho, hhayi sebhokisi le-PPTP lerutha. Qinisekisa ukuthi iklayenti laxoxisana naluphi ugqumo lokusonga ngaphambi kokubhala imithetho yomibili.

I-OpenVPN iyinketho enezingxenye ezinyakazayo ezimbalwa kakhulu ohlangothini lwerutha. Imbobo eyodwa ye-UDP, ukudlulisa okukodwa, asikho isisizi sokulandelela ukuxhumana futhi akukho kubhala kabusha kwezihlonzi zocingo. Ukushintshana i-klayenti okufanele ifakwe esikhundleni sedayela eyakhelwe ngaphakathi, futhi lokho kuvame ukuba yisizathu esisodwa sokuthi i-PPTP ihlale engxoxweni.

Yini okufanele ilungiswe nokuthi yini okufanele ishintshwe

Ukulungisa ukudlulisa ne-MTU kukunikeza ithaneli elisebenzayo, hhayi elimele ligcinwe. Ukuqinisekisa kwe-MSCHAPv2 kwe-PPTP bekulokhu kuhlaselwa iminyaka eminingi, futhi ithaneli elisebenzayo lihambisa izifakazelo ezingabuyiswa ngaphandle kwe-inthanethi. Uma idivayisi ekude ikwazi ukusebenzisa i-L2TP/IPsec noma i-OpenVPN, thatha ukulungisa njengesinyathelo sesikhashana esinosuku.

Isinqumo sincike kulokho okusekelwa yiphetho elikude nokuthi uhlelo kufanele luhlale isikhathi esingakanani. Idivayisi endala ekhuluma kuphela i-PPTP ithola ukulungiswa; konke okungafakwa iklayenti kuyahanjiswa.

Ngaphambi kokuvala ithikithi, qinisekisa ukuthi iklayenti libekezelela ukudluliswa okukhulu hhayi ukungena kuphela, nokuthi irutha isabambelele kumthetho wayo wephrothokholi 47 ngemuva kokuqala kabusha. Ithaneli elidlula ikhophi eyodwa yefayela bese lifa ngemuva kokubuyekezwa kwefirmware okulandelayo alikaze liqedwe.