Isebenza kanjani i-IPsec esekelwe emizileni nge-XFRM interface

I-IPsec esekelwe emizileni inikela ithebula lemizila isinqumo ebesithathwa izikhethi zenqubomgomo ngaphambili. Ku-Linux, ingxenye eyenza lokhu kube nokwenzeka yi-XFRM interface: idivayisi esetshenziswayo okuhamba kuyo kuhlotshaniswa nesimo se-IPsec ngesikhombisi se-interface hhayi ngesikhethi. Ukwakha eyodwa kuthatha umyalo owodwa futhi akufakazi lutho mayelana nokuthi umhubhe ukhona yini. Idivayisi iyihhuku phakathi kokuhamba kwemizila nenqubomgomo yokuphepha, futhi izinhlangothi zombili zalelo hhuku kufanele zilungiselelwe ngaphambi kokuthi kuvikelwe noma yini.

Iyini idivayisi futhi iyini engeyona

I-XFRM interface iyisibambo sokuhamba kwemizila. Amaphakethe ahamba ngayo angene kuyo ahlotshaniswa nezinqubomgomo ze-XFRM ezibhekisa kusikhombisi se-interface esifanayo, futhi uma inqubomgomo nesimo zikhona, ayavalwa. Ngaphandle kwalokho i-interface ikhona, izibali azinyakazi, futhi okuhambayo kuyaya endaweni engenanzuzo.

Lokhu ukwehlukanisa kokuqala kokuxilonga. Umzila ongena kudivayisi uyiqiniso lokuhamba kwemizila, isimo esifakiwe yiqiniso lokuphepha, futhi isibali esikhuphukayo kudivayisi akusikho kokubili. Lapho abantu bethi umhubhe uphezulu ngoba i-interface ikhombisa UP, bachaza amafulegi okuxhumana edivayisi engasetshenziswayo engenaye umlingani wayo. Ifulegi lisho ukuthi idivayisi yadalwa futhi yavulwa, akukho okunye.

Omunye umngcele: isikhombisi se-interface akulona igama. Amadivayisi amabili anamagama afanayo nezikhombo ezahlukene awabelani isimo, futhi uxhumano olulungiselelwe ngesikhombisi esingalungile lufaka isimo okungekho mzila oyoke uwusebenzise.

Yakha eyodwa ngokulandelana okulungile

Qala ngedivayisi yangaphandle nangenombolo ozoyifaka nasekumisweni kwedaemon. Isibonelo sisebenzisa i-eth0 njenge-interface yangaphandle kanye no-42 njengesikhombisi, amakheli okufanele uwashintshe ngawakho.

Khuphula idivayisi, bese uqinisekisa isikhombisi esibhalwe yikerneli ngaphambi kokuthinta ukumiswa kwe-VPN:

sudo ip link add xfrm0 type xfrm dev eth0 if_id 42
sudo ip link set xfrm0 up
ip -d link show xfrm0 | grep -o 'if_id [0-9]*'

Manje lungiselela uxhumano ku-strongSwan ngesikhombisi esifanayo, ngoba idaemon kufanele ifake izinqubomgomo nezimo ezibhekisa kuso. Setha izikhethi zokuhamba zasekhaya nezasekudeni ebangeni ozimisele ukuhamba kulo, bese uhambisa lelo banga phakathi kudivayisi. Ukumiswa kwedaemon nethebula lemizila kufanele kuvumelane ngesikhombisi nangezindawo zokuphela, futhi akukho okunikeza okunye.

Gcina i-IKE ne-ESP ngaphandle komzila womhubhe

Umzila ozenzakalelayo okhombisa kudivayisi ye-XFRM ubamba kokubili amaphakethe avaliwe nokuhamba akuthwalayo. Umphumela uyindilinga: isango lizama ukuthumela i-ESP yalo ngomhubhe okufanele i-ESP iwakhize.

Isixazululo umzila oqondile kakhulu wekheli langaphandle lomlingani ngokusebenzisa i-interface yomzimba, futhi unqoba owokuqala ngoba uhambisana namabhithi amaningi. Ukuhamba kwemizila okusekelwe ezimpawini kwenza umsebenzi ofanayo lapho imihubhe eminingi yabelana ngethebula elilodwa, futhi i-strongSwan ibhala zombili izindlela zokubeka okusekelwe emizileni.

Noma yini oyikhethayo, qinisekisa ukuthi iphakethe langaphandle liphuma lingavalwanga. Ukuhlola okusheshayo ukupinga ikheli langaphandle lomlingani ngemuva kokuthi umhubhe ukhuphuke; uma lokho kwehluleka ngesikhathi i-interface iphezulu, solwa ukubanjwa hhayi ukufinyeleleka. Ukuphikisana okufanayo kusebenza embobaneni ye-IKE, ngoba okuhamba nge-UDP kwedaemon uqobo akufanele kuhambiswe kudivayisi elizama ukuyimisa.

Hlola izibali ezindaweni ezimbili ngaphambi kokusola ukubethela

Izibali ze-interface nezibali zesimo zikala izigaba ezahlukene. Amaphakethe ahambiswa kudivayisi akhulisa idivayisi ngisho noma kungekho simo esihambisanayo, kuyilapho izibali zesimo zinyakaza kuphela okuhamba okwavalwa ngempela.

Funda kokubili, bese ufunda umbono wedaemon ngoxinxano lwengane:

ip -s link show xfrm0
sudo ip xfrm state list | grep -E 'src|proto|mode'
sudo swanctl --list-sas

Izibali zedivayisi ezikhuphukayo ngokukhishwa kwesimo okungenalutho zisho ukuthi ukuhamba kwemizila kuyasebenza futhi inqubomgomo ayihambisani, ngokuvamile iphutha lesikhombisi noma sesikhethi. Izibali zesimo ezikhuphukayo ngesikhathi uhlangothi olukude lungabiki lutho zisho ukuthi amaphakethe ayaphuma kodwa awafiki noma ahluleka ukuqinisekiswa, okukhomba endleleni noma ekumisweni komlingani. Uxhumano lwengane olusohlwini olungenakho ukuhamba kuyinkinga yesikhethi kolunye uhlangothi, hhayi isibethelo esiphukile.

Nquma ukuthi ubani ofaka imizila

Abanikazi ababili bethebula elimodwa lemizila bangumthombo ojwayelekile wokudlikiza. Uma idaemon ifaka imizila ngokuzenzakalela, umphathi wakho wenethiwekhi akufanele futhi afake umzila ozenzakalelayo ngayedivayisi efanayo, futhi umzila wokwenziwa ngesandla owengezwe iskripthi sokuqala uzosulwa ngokulandelayo lapho idaemon ilungiselela kabusha.

Khetha umnikazi oyedwa futhi uwubhale phansi. Uma imizila ingeyedaemon, gcina iskripthi sokuqala ngaphandle kwethebula futhi uvumele incazelo yoxhumano ichaze izikhethi zokuhamba. Uma ingeyomphathi wenethiwekhi, vala ukufakwa okuzenzakalelayo futhi wamukele ukuthi idaemon ngeke ilungise umzila ongekho lapho ixhuma kabusha.

Imithetho yokudlulisela neyodonga lomlilo iyisinqumo esihlukile phezu kwalokhu, ngoba isango elidlulisela okuhamba kwezinye izingqalobo lidinga kokubili. I-IPsec esekelwe emizileni yenza lokho kuhamba kube lula ukukuveza ngamathuluzi ajwayelekile emizila; ayikwenzi ungqimba lwenqubomgomo lube ukuzikhethela.