I-VPN yendawo-kuya-ndawo esekelwe emizileni neyomgomo: kuhluke ngani
I-IPsec esekelwe kumgomo ikhetha ithrafikhi ngesikhethi; eyesekelwe emizileni iyithumela ngesixhumi somhubhe. Zombili zisadinga imithetho yocango lomlilo nomzila wokubuya.
Lezi zinhlobo ezimbili zivikela ithrafikhi efanayo ngomshini ofanayo we-IPsec, futhi zehlukana mayelana nokuthi yini enquma ukuthi iyiphi iphakethe engena emhubheni. Kuxhumano olusekelwe kumgomo, izikhethi zethrafikhi okwavunyelwana ngazo zenza lowo msebenzi; kolusekelwe emizileni, umzila okhombisa esixhumini somhubhe uyawenza. Ukuhlanganisa lokhu kokubili kukhiqiza intambo yosekelo ejwayelekile lapho umhubhe uzibika njengomisiwe khona kuyilapho uhlelo lokusebenza lungafinyeleli ndawo. Umehluko ubaluleka kakhulu uma wengeza inethiwekhi, usebenzisa iphrothokholi yomzila, noma uhlola umzila ophuma ngokuthula ngomnyango ongafanele.
Izindlela ezimbili zokunquma ukuthi yini engena emhubheni
I-VPN esekelwe kumgomo yakha umgomo wokuphepha ohambisana neziqalo zomthombo nendawo eya kuyo, bese ibethela konke okuhambisanayo. Uzakwethu kufanele avumelane ngezikhethi ezihambisanayo, ngakho-ke ububanzi obusebenzayo ekugcineni buba yingxenye yezinto ezihlongozwe yizinhlangothi zombili. Akukho lutho ngaphandle kwaleyo ngxenye oluvikelwe, kungakhathalise ukuthi ithebula lomzila lithini.
I-VPN esekelwe emizileni yakha isixhumi esimele umhubhe futhi ivumele ithebula lomzila ukuthi lithumele ithrafikhi kuso. Iphrothokholi ye-IKE isabeka isimo nomgomo wokuxhumana ngakunye, futhi lokho yikhona okugqitywayo uma kunqunywa ukuthi imizila isithathe indawo yokubethela. Zombili izinhlobo zibethela nge-IPsec; kuphela indlela yokukhetha ehlukile.
Funda isiqhathaniso esingezansi njengeqoqo lezimpawu zokwehluleka hhayi njengethebula lamaphuzu, ngoba akukho kholamu ewina ngokwayo.
| Aspect | Policy-based | Route-based |
|---|---|---|
| What selects traffic | Negotiated selectors | A route into the tunnel interface |
| Adding a network | Edit selectors on both peers | Add a route, widen the selector once |
| Dynamic routing | Awkward to run over the tunnel | Runs over the interface directly |
| Typical failure | Tunnel up, host outside the selector | Tunnel up, no route or wrong source |
Esekelwe kumgomo: isikhethi yisivumelwano
Izikhethi zivunyelwana ngazo, azilungiswa nje. Phakamisa u-10.10.0.0/16 ohlangothini olulodwa no-10.10.1.0/24 kolunye, futhi inhlangano izohlanganisa lokho okwavunyelwana ngakho kuyilapho zonke ezinye izingixa zihlala ngaphandle.
Funda isimo esifakiwe esikhundleni sefayela lokuhlela. Ku-Linux uzakwethu, amathebula e-kernel ngokwawo ayiqiniso eliyisisekelo, futhi akhombisa okwasinda ezingxoxweni. Umgomo obalula iziqalo ezifanele kodwa ongenaso isimo esihambisanayo usho ukuthi inhlangano ayizange ikhuseleke. Isimo esibhangqwe nomgomo weqalo elingalungile siyinkinga ehlukile, futhi sikhiqiza umhubhe obonakala uphilile kuyilapho inethiwekhi encane ingafinyeleli ndawo.
sudo ip xfrm state
sudo ip xfrm policy
sudo swanctl --list-sasQhathanisa kokubili okuphumayo neziqalo ocabanga ukuthi uzivikela. Lokho kuqhathanisa okukodwa kuxazulula imibiko eminingi yomhubhe osebenzayo nesiphakeli esingafinyeleleki. Kubuye kukhombise ukuthi yiluphi uhlangothi okufanele lushintshwe, ngoba ukungafani kuvame ukubonakala ohlangothini olulodwa kuphela.
Esekelwe emizileni: isixhumi yisivumelwano
Isixhumi se-XFRM sinikeza umhubhe igama kanye nobunikazi, futhi ithrafikhi ifinyelela kuso ngoba ithebula lomzila lisho njalo. Iziqalo eziningi ezikude zibe seziyinkinga yomzila esikhundleni senkinga yesikhethi, futhi iphrothokholi yomzila ingazimemezela. Lokho kuyinzuzo yangempela, hhayi ukubethela.
Isixhumi asikususi isidingo somgomo. Iphrothokholi ibeka imithetho yesixhumi ngasinye eboshwe kubunikazi besixhumi, ngakho-ke iphakethe elifika kwisixhumi esingalungile lisahluleka. Ikheli lomthombo uzakwethu angeke alivume nalo liyahluleka, ngisho nomzila ophelele. Okusekelwe emizileni kusho ukuthi umzila unquma ukungena, hhayi ukuthi umgomo unyamalele.
sudo ip link add xfrm0 type xfrm dev eth0 if_id 42
sudo ip route add 10.20.0.0/16 dev xfrm0
ip -s link show xfrm0
ip route get 10.20.5.10Bheka izibali zesixhumi uma umzila ususendaweni. Umzila ukhona kodwa izibali zihlala zinguziro kusho ukuthi akukho okuhambisanayo okungeniswa emhubheni, futhi lokho kuvame ukukhombisa isimo esingekho hhayi umzila ongakho.
Lapho lezi zinhlobo ezimbili zehlukana khona ngempela
Ukungeza inethiwekhi ukuvivinyo okumsulwa kakhulu kokuthi iyiphi imodeli ekufanele. Umklamo osekelwe emizileni wengeza umzila futhi wandise isikhethi okungenani kanye, kuyilapho umklamo osekelwe kumgomo uhlela amapheya eziqalo kuzo zombili izinhlangothi futhi uvumelane kabusha. Amanethiwekhi amancane amabili azinzile enza lokho kuhlela kube lula, futhi angamashumi amabili akwenza kube iphrojekthi.
Awekho amamodeli ashintsha ucango lomlilo, futhi iziqhathaniso zivame ukuma ngaphambi kwaleli phuzu. Isikhethi esibanzi noma umzila obanzi kunquma okubethelwayo, hhayi okuvunyelwe.
Ukuziphatha kwe-MTU kuyahluka futhi empilweni. Ukufaka kunciphisa umthwalo osebenzisekayo, futhi isixhumi esisekelwe emizileni sithwala i-MTU yaso, ngakho-ke ukucindezela i-MSS kuzo zombili izango kugwema uphawu lomgodi omnyama lapho izimpendulo ezincane zifika kanti ezinkulu zinyamalala. Imihubhe esekelwe kumgomo ihlangabezana nodonga olufanayo ngakolunye uhlangothi, ngoba isikhethi asisho lutho ngosayizi wephakethe. Setha ukucindezela ngamabomu esikhundleni sokusola uzakwethu.
Ukufuduka ngaphandle kokulahlekelwa umzila wokubuya
Rekhoda amapheya eziqalo akhona ngaphambi kokushintsha noma yini, bese uhambisa umzila wohlelo olulodwa futhi uwubheke kusukela ekuqaleni kuze kube sekupheleni. Umhubhe omiswayo awuwona umhubhe odluliselayo, futhi umehluko ubonakala ohlangothini lwempendulo.
Uma ozakwethu bexhuma kodwa izingixa ze-LAN zingakwazi, hlola umzila wokubuya nekheli lomthombo elizosetshenziswa yisixa esikude. Isixa esinezixhumi ezimbili singaphendula kusukela kwesingalungile, futhi akukho shintsho lwesikhethi elilungisa lokho. Bhompa ithrafikhi kuzo zombili iziphetho ngaphambi kokuhlela ama-algorithms.
ip route get 10.20.5.10
sudo tcpdump -ni any host 10.20.5.10 and icmp
sudo swanctl --list-connsGcina umzila wokuphatha ongancikile emhubheni ngenkathi usebenza. Ukubuyela emuva kulula uma ukufinyelela kwegethi ngokwako kungagibeli kuxhumano oluhlolayo.