Kungani i-TAP VPN ehlanganyelwayo isadinga i-HTTPS kuphothali
I-TAP VPN iqinisekisa umlingani, hhayi isevisi engemuva kwayo. Gcina ukuqinisekiswa kwegama lomsingathi kuphothali futhi uhlukanise omakhelwane ongabathembi.
Amadivayisi amabili anezimpawu zokungena ze-VPN ezivumelekile futhi ahlanganyela ingxenye eyodwa ye-Ethernet enamabhuloho. Yinye kuphela yazo okufanele iphendule iphothali lehhovisi, kanti enye isengafuna ikheli lephothali kuleyo ngxenye. Umhubhe wenze umsebenzi wawo: waqinisekisa zombili izingxenye futhi wabhalisa ngokufihlakeleyo yonke indlela eya kuseva. Engakwenzi ukufakazela ukuthi iyiphi yazo ephethe igama lesevisi, futhi leso sikhala siyisizathu sokuthi iphothali lisadinga isitifiketi esivumelekile.
I-VPN iqinisekisa ini ngempela
Ukuxhawulana kwe-VPN kuphendula umbuzo owodwa: iyiphi ingxenye eqedile lo mhubhe, futhi ngaluphi ubufakazi bokhiye. Leyo mpendulo ingeyengxenye ngayinye nokuxhumana ngakunye, futhi ayisho lutho ngezinsizakalo leyo ngxenye eziveza kamuva. Engxenyeni ye-TAP ingxenye ayiyona ngisho ikheli elilodwa, ngoba ingethula noma iyiphi i-MAC nanoma iyiphi i-IP ebhuloho elizimisele ukuyifunda. Ukuqinisekisa kuyama emaphethelweni omhubhe, hhayi kuhlelo lokusebenza.
Hlukanisa imibuzo emithathu esikhundleni sokuyihlanganisa ibe eyodwa. Ngayinye inendlela yayo yokusebenza nendlela yayo yokwehluleka.
| Question | Answered by |
|---|---|
| Which peer sent this packet? | VPN transport authentication |
| Which device owns this IPv4 address? | ARP, trusted only as far as the segment |
| Which service am I talking to? | Application TLS and hostname validation |
Ukusetshenziswa kungaba nomhubhe oqinisekiswe ngokuphelele nesevisi engaqinisekiswanga neze ngemuva kwawo. Kungaba nesitifiketi esiqinisekisiwe kumsingathi okheli lwayo lesigaba sesibili lifunwa enye ingxenye, yingakho zombili izilawuli kufanele zibe kumklamo hhayi enye esikhundleni senye. Ithebula liyingxoxo yonke emigqeni emithathu.
I-ARP engxenyeni ehlanganyelwayo ayiyona incwadi yamakheli
I-ARP ixhumanisa ikheli le-IPv4 ne-MAC kusixhumanisi sendawo futhi yamukela izimpendulo zanoma ubani kuleso sixhumanisi. Engxenyeni enebhuloho elivumelayo ingxenye ingafuna ikheli elingelinye idivayisi, futhi ibhuloho lidlulisela amafreyimu kulowo ophendule kwakamuva. Ukubhalisa ngokufihlakeleyo yonke indlela yeklayenti eya kuseva akukushintshi lokho, ngoba amafreyimu ayaxazululwa ngaphambi kokufika ebhulohweni. Umngcele wokwethemba we-ARP ingxenye, hhayi umhubhe.
Bheka lokho umsingathi akufundile ngempela: ip neigh show ibala ukuxhumanisa kwamanje nesimo kwako, futhi umbhalo oshintsha phakathi kwamakheli amabili e-MAC ngesikhathi sokusebenza okujwayelekile uwuphawu ofanele uphethwe hhayi ukunganakwa. Engxenyeni encane enempilo imibhalo enjalo ihlala izinzile isikhathi eside.
Ukuhlukaniswa kwezingxenye kanye nenqubomgomo yebhuloho kukhona ngqo kuleli cala. Umklamo ohlelwe ngemizila ngokuvamile uyimpendulo engcono lapho isevisi iyi-IP kuphela futhi amadivayisi angenasizathu sokubona amafreyimu omunye komunye.
Gcina ukuqinisekiswa kwesitifiketi lapho isevisi ikhona
I-TLS yohlelo lokusebenza iphendula umbuzo umhubhe ongakwazi ukuwuphendula: ngabe le yisevisi engangifuna ukuyifinyelela. Isiphequluli sihlola igama lomsingathi ngokumelene nesitifiketi, futhi lokho kuhlola ukuphela kwengxenye yeketango ebiza iphothali hhayi ingxenye.
Hlola lokho iseva ekuveza ngaphambi kokunquma ukuthi isexwayiso simane sidlula. openssl s_client -connect portal.example.internal:443 -servername portal.example.internal iphrinta iketango namagama angamanye esihloko. Uma igama olufakile lingekho kulelo hlu, isexwayiso silungile futhi isitifiketi yiso okufanele silungiswe. Ukufundisa abasebenzisi ukusidlula kuguqula isilawuli esisebenzayo sibe umhlobiso.
Umhlahlandlela wamabhuloho we-OpenVPN uchaza imodeli ye-Ethernet nezinketho zenqubomgomo ezizungezile, futhi yisireferensi esifanele salokho ingxenye okufanele ikuvumele. Yifunde ngaphambi kokuxegisa umthetho webhuloho, ngoba imodeli ewuchazayo yiyo okucatshangwa yikho konke ukuhlola okungenhla.
Nquma ukuthi lezo zingxenye kufanele zihlanganyele ingxenye noma cha
Isixazululo esishibhe kakhulu ngokuvamile ukuyeka ukuhlanganyela isigaba sesibili lapho imfuneko iwukufinyeleleka kwe-IP kuphela. I-VPN ehlelwe ngemizila inika iklayenti ngalinye ikheli lalo, isusa isizinda sokusakaza esihlanganyelwayo futhi yenza ukuhamba phakathi kwezingxenye kube yisinqumo senqubomgomo esikhundleni sokuzenzakalela. Ngaleso sikhathi iphothali linokheli olulodwa okufanele livikelwe futhi alikho umakhelwane ongalifuna.
Uma ingxenye kufanele ihlale, hlola isilungiselelo sohlangothi lweseva esivumela amaklayenti ukufinyelela komunye nomunye: grep -n client-to-client /etc/openvpn/server.conf. Uma sikhutshaziwe, ukuhamba kwamaklayenti kudlula kuseva futhi kungasihlungwa lapho. Uma sivuliwe, izingxenye zishintshana amafreyimu ngqo ngembhuloho, futhi izindawo zakho zokuhlunga iyibhuloho kanye nodonga lomlilo lomsingathi.
Bhala phansi ukuthi umsingathi ngamunye uncike kuziphi izivikelo ngempela: ukuqinisekiswa komhubhe, ukuhlukaniswa kwengxenye noma i-TLS yohlelo lokusebenza. Umsingathi oncike kuzo zontathu uyafaneleka. Umsingathi oncike kowokuqala futhi acabanga ukuthi ezinye ezimbili zeza nawo nguyena ogcina eseveza okuqukethwe okungalungile.