Impendulo ye-VPN yendawo-kuya-endawo ayidluli kumhubhe
Impendulo eqa umhubhe iyisinqumo somzila ohlangothini olukude. Hlola ithebula lamahost, izikhethi kanye ne-rp_filter, bese ukhetha umzila noma i-NAT.
Ngichithe ikusasa lasekuseni kumhubhe owaphuma kahle futhi wahambisa ithrafikhi ngendlela eyodwa kuphela: igatsha lalikwazi ukufinyelela kuseva yamafayela ekomkhulu, futhi konke ukuxhumana okuvulwa kusuka ekomkhulu kuya egatsheni kwakufa ku-SYN yokuqala. Ama-SA ayephakeme, izibali zomhubhe zikhula, futhi ukuxhawulana kwakungakaze kube yinkinga. Impendulo yayihanjiswa endaweni umhubhe ongayifinyeleli, futhi lokho kukhetha kungokwalolo hlangothi olukude. I-VPN yendawo-kuya-endawo ithwala kuphela amaphakethe okuthi ihosithi iwanikeze i-gateway, futhi ihosithi ngayinye yenza lokho kukhetha ngokwahlukana, kuyo yonke indlela, kusuka kuthebula layo lomzila.
Izindlela zombili zihanjiswa ngokwahlukana
I-IP ayikhumbuli indlela yengxoxo. Ihosithi ngayinye ethumela iphakethe yenza ukusesha kwayo kwe-prefix ende kunazo zonke, ikhetha ukugxuma okulandelayo okuyedwa bese ikhohlwa isinqumo. Isicelo nempendulo amaphakethe amabili angenabudlelwano ngokwenzeka asesicini esisodwa, futhi umhubhe ukugxuma okukodwa okungasetshenziswa noma kungasetshenziswa yinoma yikuphi kwawo. Akukho lutho ekushintshaneni kwe-IKE okufundisa iseva ekude ukuthi ingafinyelela kanjani isubneti yakho; izingxoxo zivumelana kuphela ukuthi yimaphi ama-prefix angabhalwa ngokuyimfihlo.
Leso sivumelwano siyisango lesibili. Ku-strongSwan izikhethi zethrafikhi yi-leftsubnet ne-rightsubnet, futhi iphakethe okungumthombo noma okuyiwa kulo okungaphandle kwababili abavunyelwene nabo alibhalwa ngokuyimfihlo, noma ithebula lomzila lithini. I-prefix ehanjiswa kumhubhe kodwa engekho kuzikhethi ukwehluleka okuthule kwendlela eyodwa: umzila ubonakala ulungile, iphakethe lisaphuma obala noma liyalahlwa, futhi ilogi ye-charon kuphela ekhonondayo.
Ihosithi ekude ayazi lutho ngomhubhe wakho
Ngaphakathi kwe-LAN ekude impendulo iyiphakethe elivamile elibhekiswe kuklayenti yakho. Ihosithi okuyiwa kulo ayiboni isihloko se-IPsec futhi ayinasizathu sokuthanda i-gateway ye-VPN; isesha i-prefix yakho, ayitholi lutho olucacile kunomzila wayo ozenzakalelayo bese iwulandela. Uma ozenzakalelayo ukhomba kufayela-wall yomgogodla, ifayela-wall inawo umzila wokubuyela kumhubhe noma ayinawo. Uma ingenawo, uthola ukulahla okuthule, i-ICMP unreachable, noma impendulo ephuma nge-interface ebheke kwi-inthanethi bese ifa.
I-interface yesibili yanele ukuphula lokhu ngisho lapho umzila ukhona. I-NAS enesixhumanisi sokuphatha kwenye i-VLAN, iseva ene-uplink yokugcina, umthetho wenqubomgomo othumela ububanzi bomthombo owodwa kwithebula lesibili: noma yikuphi kwalokhu kungabamba impendulo. Ku-Linux, i-ip rule show ne-ip route show table all zikhombisa imithetho namathebula okuthi uhlu ozenzakalelayo luzifihla.
Funda isinqumo emshinini othumela impendulo
Buza i-kernel ngaphambi kokushintsha noma yini, futhi uyinikeze ikheli lomthombo, ngoba imithetho encike emthonbeni ishintsha impendulo.
ip route get 10.10.5.10 from 10.20.30.15
ip rule show
ip route show table all
ss -tn state established "( sport = :445 )"Umphumela usho i-interface ephumayo nokugxuma okulandelayo. Uma i-interface kungenjalo ebheke kugateway ye-VPN, usutholile iphutha, futhi umsebenzi osele ukukhetha ukuthi umzila kufanele ube kuphi. I-ping evela kugateway ayifakazeli okuningi lapha: iphendula ngekheli ihosithi ekude engalibeka, hhayi ngekheli lelaptop yakho.
Ku-Windows okulinganayo yi-Find-NetRoute -RemoteIPAddress 10.10.5.10 esinqumweni ne-Get-NetRoute ethebuleni. Umzila owengezwa nge-New-NetRoute futhi othwele i-metric ephakeme kunowozenzakalelayo uyahlulwa ngokuthule, ngakho funda ikholomu ye-metric, hhayi umbhalo. Bese uqinisekisa ngamaphakethe: i-tcpdump -ni any "host 10.10.5.10 and tcp port 445" ku-interface ye-LAN ekude ikhombisa isicelo, futhi isihlungi esifanayo ohlangothini lomhubhe sikhombisa ukuthi impendulo ibuyile yini. Isicelo sibonakala ngaphandle kwempendulo kusho ukuthi impendulo yahanjiswa kwenye indawo noma yalahlwa; impendulo ku-interface engalungile ikunikeza umoni ngaphambi kokuthi uthinte umzila.
Lapho i-gateway yesiva ingeyona iphoyinti lokugcina le-VPN
Izindawo eziningi zibeka ifayela-wall phakathi kwamaserva nesiqoqi. Leyo fayela-wall idlulisela impendulo, ngakho idinga umzila we-prefix yeklayenti yakho obheke kugateway ye-VPN, kanye nenqubomgomo yokudlulisa kuzo zombili izindlela. Amadivayisi agcina isimo enza kubi nakakhulu: isicelo sawela ifayela-wall sisuka kuhosithi ye-LAN eyayivumile, impendulo manje ivela kolunye uhlangothi, futhi umbhalo wokulandelela ukuxhumana awusahambisani, ngakho iphakethe liyalahlwa njengelingavumelekile esikhundleni sokwenqatshwa. Yingakho ilogi yenqubomgomo ibonakala ingenalutho ngenkathi ithrafikhi inyamalala.
I-gateway inesihlungi sayo sesibili. Ukuhlunga komzila ohlanekezelwe kwe-Linux kulahla amaphakethe umthombo wawo ongafinyeleleki nge-interface ewawele ngayo, futhi lokho kuyisimo esiqondile somzila wokubuyela ongalingani osemthethweni. umhlahlandlela wokudlulisa we-strongSwan udinga i-net.ipv4.ip_forward ne-net.ipv4.conf.all.rp_filter exegisiwe ngenxa yaleso sizathu. Inani eliqinile elingu-1 kunoma iyiphi i-gateway liphula umzila olungile ngokuthule, futhi i-nstat -az ikhombisa ukulahla uma wazi ukuthi ubheke kuphi.
| Symptom | Where the reply is most likely lost |
|---|---|
| Gateway ping works, LAN host silent | Source address the far host cannot place in its table |
| SYN arrives, no SYN-ACK, tunnel counters flat | No route to the client prefix on the far host or its gateway |
| Reply counted on the internet-facing interface | Default route or policy rule on the far host |
| Firewall reports invalid state | Asymmetric path through a stateful device |
| Worked until a link failed over | New path is asymmetric, or rp_filter now rejects it |
Hanjisa noma humusha, bese uqinisekisa kuzo zombili izindlela
Lezi zinto ezimbili zokulungisa azilingani. Ukwengeza umzila kugcina ikheli leklayenti lingashintshiwe, ngakho imithetho esekelwe emthonbeni, amalogi okucwaninga kanye nezinhlelo ezirekhoda ofonayo ziyaqhubeka zisebenza; intengo ukuthi ukugxuma ngakunye okwenza isinqumo kudinga umzila, okusho izindawo eziningi zokwenza iphutha. Ukufihla ikheli kugateway ekude kufinyeza umzila wokubuyela ekugxumeni okukodwa, ngoba impendulo manje ibhekiswe kugateway uqobo, futhi kufihla ukuthi iyiphi iklayenti eyenzile ini.
iptables -t nat -A POSTROUTING -o eth1 -s 10.20.30.0/24 -j MASQUERADEYikhethe ngamabomu: lapho amaklayenti eba yikheli legateway, ama-ACL asekelwe emthonbeni awasakwazi ukuwahlukanisa, futhi i-conntrack kufanele ibambe ukuhlela ukuze impendulo ibhalwe ibuyele kumhubhe. Uma izikhethi zisakhipha i-prefix yeklayenti, i-NAT ayishintshi lutho, ngoba isicelo asikaze singene kumhubhe.
Ngaphambi kokuthi uthi kulungisiwe, qinisekisa izinto ezine ngokulandelana: umzila kuhosithi ethumela impendulo, umzila kukho konke ukugxuma okudlulisayo, izikhethi ezimboza zombili iziprefix, kanye nokuthwebula okukhombisa impendulo ingena kumhubhe nomthombo owulindele. Bese uphinda ukuhlolwa kusuka kwenye indawo. Indlela eyodwa edlulayo iwumklamo ovulekile ngohhafu, futhi indlela yesibili ivamise ukwehluleka ngesizathu esihlukile kunaleso osilungise manje.