I-VPN yezindawo noma ukufinyelela kude: yini umuntu ngamunye axhumanisayo

Zombili izakhiwo zibizwa nge-VPN futhi zixazulula izinkinga ezihlukene. Ithuneli yendawo-kuya-ndawonye ixhumanisa amasango amabili, ngakho yonke ihost engemuva kwawo ingafinyelela amakheli avunyelwe ngaphesheya ngaphandle kokufaka noma yini. Ithuneli yokufinyelela kude ixhumanisa amadivayisi ngamanye angena kunethiwekhi, iklayenti elilodwa ngesikhathi. Lokhu kuqhathanisa kubalulekile ngoba amaphutha amaningi okusetshenziswa avela ekuhloleni okukodwa kuyilapho kulindeleke ukuziphatha kokunye, futhi uphawu luvamise ukuba ukuphela kwesikhathi kusevisi ithuneli efinyelele kuyo ngempela.

Izakhiwo ezimbili, imingcele emibili

Asikho isakhiwo esandisa isizinda sokusakaza se-LAN. Amadivayisi asohlangothini olude awaveli ohlwini lokuthola lwasekhaya, futhi ukulindela lokho kuyisiphakamiso sokuqala okufanele usilahle. Amagama e-DNS angasese owashicilela ngamabomu acacile ukubikezelwa kunezinye izinqubo zokuthola, futhi ahlala ekhona uma umhlinzeki eshintsha.

Thatha i-10.10.0.0/24 endaweni eyodwa ne-10.20.0.0/24 kwenye. Isango A lidinga umzila noma isikhethi sethrafikhi esithumela isiqalo esingu-10.20.0.0/24 ethunelini, kanti isango B lidinga isithombe saso esibonisa lokho. Ngemva kwalokho amahost azo zombili izinhlangothi asebenzisa ukuxhumana kwe-IP okuvamile futhi awakwazi ukwazi ukuthi ikhona ithuneli. Lokho kungabonakali kuyisici, futhi yikho okwenza ukwehluleka kubonakale njengamaphutha ajwayelekile enethiwekhi hhayi amaphutha ethuneli.

Okusekelwe kunqubomgomo nokusekelwe emzileni akulona ithuneli elifanayo

Ekufakweni kwe-IPsec okusekelwe kunqubomgomo, izikhethi zethrafikhi okuxoxwe ngazo zichaza ngokunembile ukuthi yimaphi amapheya omsuka nendawo ayo avikelwe. Uma kuvela inethiwekhi encane entsha ngemuva kwesango eyodwa futhi asikho isikhethi esiyihlanganisayo, ithuneli ihlala isebenza futhi leyo nethiwekhi encane ayithwalwa nje. Kusakhiwo esisekelwe emzileni, i-interface ithola ithrafikhi futhi ithebula lemizila liyanquma, okwenza ukwengezwa kwesiqalo kube wushintsho lomzila hhayi ukuxoxisana kabusha kwethuneli.

I-StrongSwan iveza kokubili ukubuka ngokuqondile, futhi ukuzifunda ndawonye kuyindlela yokuthola ukuthi yiluphi uhlobo olusetshenzisiwe ngempela.

swanctl --list-sas
ip xfrm policy
ip -4 route show table all | grep -E '10\.(10|20)\.'

Uhlu lwezikhethi olushiya ngaphandle isiqalo osidingayo luchaza ukwehluleka ngaphandle kokubamba iphakethe, kanti umzila okhomba ku-interface engalungile uchaza ukwehluleka kwesibuko endleleni yokubuya. Funda kokubili ngaphambi kokuxoxisana kabusha noma yini, ngoba ukuvuselelwa kokhiye ngeke kunezele isikhethi ongakaze usilungise.

Hlela amakheli ngaphambi kwethuneli

Izintaba ezigqagqene ziyiphutha lesakhiwo elingalungiswa ngokumiswa. Uma zombili izindawo zisebenzisa i-192.168.1.0/24, ihost edinga i-192.168.1.50 inabangaba ababili futhi ayinayo indlela yokukhetha. Ithuneli izoqinisekisa, izinhlangano zokuphepha zizosungulwa, futhi isinqumo somzila sizoba siphutha noma singacaci.

Khetha enye yezinketho ezintathu eziqotho: phinda ubale indawo eyodwa, humusha ibanga eligqagqene esangweni ukuze uhlangothi ngalunye lubone isiqalo esihlukile, noma shiya umzila oqondile walezo host bese ushicilela isevisi ngendlela enye. Ngayinye inezindleko, futhi eyokuqala ivamise ukuba ishibhile eminyakeni emibili. Nquma ngaphambi kokuba ithuneli ibekhona, ngoba emva kwalokho ushintsho luzothinta yonke idivayisi enamakheli amadala.

Xazulula futhi inkinga ye-MTU kusenesikhathi. Ithuneli inciphisa umthwalo owusizo, futhi isakhiwo esincike ekuhlukaniseni siziphatha ngendlela ehlukile kunesibopha i-MSS emasangweni.

Ukudluliswa nenqubomgomo kungaphandle kwethuneli

Isango kufanele lizimisele ukudlulisa amaphakethe phakathi kwe-interface yethuneli ne-interface ye-LAN, futhi izinhlangothi zombili zidinga inqubomgomo evumela isevisi. Ku-Linux lezi izilungiselelo ezimbili ezihlukene, kanye nemithetho ye-firewall enquma ukuthi ukugeleza okudlulisiwe kuvunyelwe nhlobo.

sysctl -w net.ipv4.ip_forward=1
iptables -A FORWARD -s 10.20.0.0/24 -d 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -s 10.10.0.0/24 -d 10.20.0.0/24 -j ACCEPT

Ihost eyamukelayo yengeza isendlalelo sesithathu: i-firewall yayo uqobo kusafanele yamukele iklayenti elivela kunethiwekhi encane ekude. Iseva yamafayela evumela kuphela i-/24 yayo yasendaweni izokwenqaba ithrafikhi edlulisiwe evela ku-10.20.0.7, kungakhathaliseki ukuthi ithuneli ibukeka iphilile kangakanani, futhi lokho kwenqaba kulula ukukufunda njengokwehluleka komzila.

Hlola kusuka kuhost, hhayi esangweni

I-ping ethunyelwa isango uqobo ingalandela ikheli lomsuka nenqubomgomo ehlukile kunethrafikhi yomsebenzisi edlulisiwe. Lokho kuyenza ibe ukuhlola okubuthakathaka futhi ngezinye izikhathi kuduhhise: iyaphumelela kuyilapho uhlelo lokusebenza lwehluleka, noma iyahluleka kuyilapho uhlelo lokusebenza lusebenza.

ip route get 10.10.0.5 from 10.20.0.7
ping -I 10.20.0.7 10.10.0.5
curl -sv --max-time 5 http://files.10-10.internal/ -o /dev/null

Sebenzisa ihost yangempela, ikheli lomsuka langempela kanye neprotocol yangempela esetshenziswa uhlelo lokusebenza. Bese ufunda indlela yokubuya ngokwehlukana, ngoba indlela eya phambili esebenzayo ngaphandle komzila wokubuya ikhiqiza ukuphela kwesikhathi okubonakala kufana nesevisi evinjiwe.

Khetha isakhiwo ngokombuzo owuphendulayo: ingabe uxhumanisa amanethiwekhi noma wamukela amadivayisi? Konke okunye, kuhlanganise nokuthi yimuphi umhlinzeki omisayo, kuvela kuleyo mpendulo.