I-split tunneling ye-PPTP ayisebenzi: lungisa kuqala indlela ye-GRE

Buka ukuxhumana kwe-PPTP kunyuka futhi kulula ukukholwa ukuthi ingxenye enzima isiphelile: iklayenti liyaziginisekisa, kuvela i-adaptha ye-ppp0 noma i-WAN Miniport, futhi iwindi lesimo liba luhlaza. Bese isicelo sokuqala esiya kumsingathi wangaphakathi siphelelwa isikhathi, futhi iphrofayela iyagxekwa. Ngokomkhuba kunezendlalelo ezimbili ezizimele okufanele zihlanjululwe: ukuthutha kwangaphandle okuthwala i-TCP 1723 ne-GRE, kanye nomgomo wangaphakathi onquma ukuthi yiziphi izindawo ezisebenzisa isixhumanisi se-PPP. Isimo esiluhlaza sifakazela kuphela ukuthi isendlalelo sokuqala sixoxile; mayelana nesibili asisho lutho.

Landela iklayenti kusukela kuphrofayela kuze kufike kusokhethi yokulawula

Vula ilogi yeklayenti bese uthola indawo lapho ixhumana khona neseva. I-PPTP iqala ngokuvula ukuxhumana kwe-TCP ocingweni lwe-1723 futhi ixoxe ngamapharamitha etheneli kuleso siteshi. Uma lesi sinyathelo sihluleka, akukho okunye okubalulekile ngemuva kwalokho, futhi iphutha ngokuvamile lisho ikheli leseva noma isikhathi sokuphela.

Qinisekisa ukuxhumana kokulawula ocingweni ngaphambi kokuthinta noma iyiphi indlela. Kuklayenti noma embobeni yesibuko, bamba i-TCP 1723 emzamweni owodwa wokuxhumana:

sudo tcpdump -ni any 'tcp port 1723' -c 20

Ukuxhawula okuphelile kanye nesikhathi esimisiwe kusho ukuthi isiteshi sokulawula sangaphandle siyasebenza. I-SYN engalokothi ithole i-SYN-ACK ikhomba udonga lomlilo, ikheli leseva elingalungile, noma umhlinzeki ohlunga umbobo. Ukuxhawula okulandelwa ukusethwa kabusha ngokushesha ngokuvamile kusho ukuthi iseva yenqabile izifakazelo noma uhlobo lwetheneli.

I-GRE iwuhlelo lwesibili, akuwona umbobo

I-PPTP ithwala umthwalo we-PPP ngaphakathi kwe-GRE enwetshiwe, uhlelo lwe-IP 47, olungenalo inombolo yombobo umzila ongayilandela. Yingakho umthetho ovumela i-TCP 1723 ungase ushiye itheneli lingenayo indlela yedatha. Amadivayisi e-NAT anesimo kufanele aqonde i-ID yocingo ngaphakathi kwe-GRE ukuze ahlanganise izimpendulo, futhi amaningi awakwenzi lokho. Ukucaciswa kwe-PPTP kugcina isiteshi sokulawula kanye nomthwalo we-GRE njengezingxenye ezihlukene, futhi uhlelo lwakho lokuhlola kufanele lwenze kanjalo.

Bheka uhlelo 47 ekubanjweni okufanayo, bese uqhathanisa okuphumayo nalokho okubuya:

sudo tcpdump -ni any 'proto gre' -c 20

Amaphakethe aphuma ngaphandle kwezimpendulo, ngenkathi i-TCP 1723 ihlala inempilo, yisiginesha yakudala ye-GRE evaliwe. Ukudlula kwe-PPTP kumzila womsebenzisi kuyisici sale firmware ethile, ngakho inethiwekhi yehhotela esebenzayo ayifakazeli lutho mayelana nelandelayo. Uma umzila unganikeli ukudlula futhi ungakwazi ukuwushintsha, inkinga ukukhethwa kohlelo, hhayi ithebula lemizila.

Fakazela ukuthi itheneli ihambisa iphakethe elilodwa

Lapho i-GRE igeleza, izingxoxo ze-PPP zinikeza ikheli kusixhumanisi sekhayenti. Funda ukwabiwa esikhundleni sokukucabangela:

ip -4 addr show ppp0

Pingha ikheli lozakwabo elikhonjiswe njengendawo ewukufika yoxhumano lwephoyinti-kuya-kwephoyinti. Impendulo kulesi sigaba ifakazela ukuthi indlela ehlanganisiwe isebenza kusukela ekuqaleni kuze kube sekupheleni nokuthi iseva iphendula ngaphakathi kwetheneli. Uma uzakwabo ephendula kodwa izingingi zangaphakathi zingaphenduli, ukuthutha kwangaphandle kulungile futhi iphutha selidlulele ngaphakathi.

Yenza lokhu ngaphambi kokwengeza noma iyiphi indlela ehlukanisiwe. Ukuguqulwa kwendlela okwenziwe ngenkathi ukuthutha kuphukile kudala ukuguquguquka kwesibili futhi kufihle okokuqala.

Bhala umgomo ohlukanisiwe, kuhlanganise ne-DNS

Ukuhlelwa kwezindlela okuhlukanisiwe kuwuhlu lwezinqumo, hhayi ibhokisi lokuhlola. Yonke insiza yangasese okufanele yeqe itheneli idinga indlela edlula kusixhumanisi se-PPP, futhi yonke insiza okufanele ihlale yasendaweni akufanele ibe khona kuleyo ndlela. Ukudala indlela yenethiwekhi engaphansi yohlelo ngaphandle kwendlela ehambisana nokuxazulula kwayo yangasese kuyindlela evamile yokudala ukuphazamiseka okubonakala njengohlelo oluphukile.

Hlola isinqumo i-kernel esithathayo ngekheli elilodwa esigabeni ngasinye:

ip route get 10.20.5.10
ip route get 203.0.113.25

Okokuqala kufanele kusho i-ppp0, okwesibili isango elijwayelekile. Uma kokubili kusho isixhumanisi esifanayo, umgomo awuhlukanisiwe nhlobo. Engeza ikheli leseva ye-DNS ngokwayo ohlwini lwetheneli, ngaphandle kwalokho ukuxazululwa kwamagama ezingingi zangaphakathi kuphuma ngokuxazulula kwasendaweni futhi akubuyisi lutho olusizo.

Ukuhlola okuphindaphindekayo ngezinyathelo ezinhlanu

Gijimisa izendlalelo ngokulandelana futhi ume kokokuqala okwehlulayo: isiteshi sokulawula, ukubonakala kwe-GRE, impendulo yozakwabo we-PPP, indlela ehlukanisiwe yekheli langaphakathi elilodwa, kanye nesicelo sohlelo ngaphesheya kwetheneli. Isinyathelo ngasinye sinomyalo waso, ngakho ukwehluleka kungabangelwa esikhundleni sokuba yimfihlakalo.

Inguqulo emfushane yeklayenti le-Linux ibonakala kanje:

sudo tcpdump -ni any 'tcp port 1723 or proto gre' -c 40
ip -4 addr show ppp0
ping -c 3 192.0.2.1
ip route get 10.20.5.10

Kwa-Windows kusebenza ukulandelana okufanayo nge-route print kanye nesimo se-adaptha esikhonjiswe kuklayenti. I-PPTP iwuhlelo lwakudala, futhi uma iseva inikela nge-SSTP noma i-IKEv2, ukuthutha ngokuvamile ukusetshenziswa kwesikhathi okungcono kunokulungisa indlela encike ekudluleni kohlelo 47 esikhaleni ngasinye. Hlola isitifiketi kanye nesivumelwano sokuqinisekisa sesikhundla esikhundleni sokukopisha iphrofayela endala kumkhakha omusha.