I-SSH iyawa ku-VPN njalo ngomzuzu? Akuyona i-keepalive

Isikhathi esifa ngesikhathi esiphindayo ngokuvamile silahlekelwa isimo se-firewall, hhayi ama-keepalive. Landelela izinhlangothi zombili ngaphambi kokuthinta i-MTU noma izikhathi.

I-SSH iyaxhuma, isebenze cishe umzuzu, bese iyabanda ngesikhathi esicishe sifane njalo. Incazelo evamile i-idle timeout, ngakho abantu behlisa i-MTU futhi basethe ama-keepalive eklayenti. Uxhumano lwe-WireGuard engangisebenza ngalo lwase lwadlula kukho konke lokhu: i-MTU yethumbu encane, izilungiselelo ze-client-alive, i-keepalive yethumbu emisiwe. Ukuphuka kwaqhubeka kungakaguquki. Imbangela yaba umzila we-LAN onalingani, futhi leli phethini kufanele laziwe ngoba linqoba noma yikuphi ukulungiswa okusekelwe ezikhatheni.

I-keepalive ifakazela ukuthi umsingathi wakho usakulungele ukuthumela. Ayikwazi ukwenza idivayisi egcina isimo ibone impendulo engalokothi idlule kuyo.

Inganekwane: ama-keepalive alungisa ukuphuka okuthule

Ama-keepalive e-SSH akhona ngomsebenzi owodwa: ukuvimbela into ebala ukuthula ekuthatheni isikhathi esingasebenzi. Lokho bakwenza kahle. Awekho azixazulula idivayisi egcina isimo eyabona iphakethe lokuqala ohlangothini olulodwa yabe ingayiboni impendulo, ngoba akukho lutho oluthunyelwa yiklayenti olushintsha ukuthi iyiphi i-interface esetshenziswa yimpendulo.

Ukushintsha i-MTU kungenye indlela edumile yokulungisa, futhi inendlela efanayo yokwehluleka. Ukwehlisa i-MTU kusiza ekuhlukanisweni nasezinkingeni ze-MTU yomzila, futhi akwenzi lutho emzileni. Uma izikhathi zakho ne-MTU sezizwakala kahle futhi ukuphuka kusenzeka ngesikhathi esiphindayo, isikhathi sikutshela ngokuphela kwesikhathi endaweni ethile, hhayi ngosayizi wephakethe. Bhala phansi isikhathi bese usiqhathanisa nokuphela kwesikhathi kwesimo kuyo yonke idivayisi esemzileni.

Uphawu ukuhleleka kanye nesikhathi esihlala sisebenziseka ngaphakathi kwaleso sikhathi. Ukuphuma kwesikhathi kokungenzi lutho kwenzeka lapho kungenzeki lutho; lokhu kwenzeka ngesikhathi ubhala.

Ithuba elengeziwe lenza ini ngempela

Beka ikhompyutha ephathwayo kanye ne-VPN gateway ku-LAN eyodwa, ne-firewall ye-LAN ehlukile njenge-gateway ezenzakalelayo. Ikhompyutha ithumela ithrafikhi ebhekise ku-VPN kuyi-firewall, i-firewall iyidlulisela kuyi-gateway, futhi izimpendulo ze-gateway zibuya ziqonde nge-LAN ziye ekhompyutheni. Lolo nyawo lwesibili alukaze ludlule kuyi-firewall, ngakho ithebula layo lesimo ligcina uhhafu wokuxhumana.

Amakheli angezansi akhombisa lolo hlelo:

Laptop:             192.168.50.20
LAN firewall:       192.168.50.1
WireGuard gateway:  192.168.50.10
Remote VPN subnet:  10.77.0.0/24

Ukuqondisa kabusha nokuphatha isimo bese kuguqula i-handshake esebenzayo ibe uxhumano olufa kamuva hhayi ngokushesha. Ukubambezeleka ukuqedwa kwesikhathi komugqa wesimo noma ukwehluleka kokuhlola okuqinile, yingakho isikhathi sibonakala simishini kangaka.

Akukho kulokhu okuvela ekucushweni kweklayenti, yingakho ukukufuna kuvame ukuqala efayeleni elingalungile.

Khetha umzila owodwa ohlosiwe

Ngohlelo olungenhla, ukuhambisa i-subnet ekude ngqo kuyi-VPN gateway kususa uhhafu wokuxhumana:

sudo ip route add 10.77.0.0/24 via 192.168.50.10
ip route get 10.77.0.42

Lawa amakheli ayizibonelo. I-hop elandelayo kufanele ifinyeleleke ku-LAN yakho, isiqalo kufanele kube inethiwekhi ekude ehlosiwe, futhi umyalo wesibili ukubonisa umphumela ngaphambi kokuthi unthembe. Uma i-gateway ingekho ku-subnet yakho, lo mzila akuwona ukulungiswa okufunayo.

Uma i-firewall ihloselwe ukuqapha ithrafikhi phakathi kwalezo zinhlelo, ukuhamba ngokuzungeza kwayo kuwumklamo ongafanele. Kunalokho vumela izinhlangothi zombili ziwele umngcele futhi ucubungule imizila ohlangothini ngalunye ukuze indlela yokubuya ihambisane. Inhloso umzila owodwa ohlosiwe, hhayi ukuhlolwa kwesimo okuncane.

amanothi mayelana nokuhambisa okungalingani ze-Netgate zichaza ukungalingani kwezinga le-interface okufanayo nezinkinga zesimo ezikudala, ngakho zifunde ngaphambi kokuxegisa ukuphathwa kwesimo emhlabeni wonke. Ukuphuka okubekwe isikhathi okufana naleli cala akuwona ubufakazi ngokwako. Thatha isihloko njengencazelo yendlela eyodwa yokwehluleka, bese ufakazela ukuthi inethiwekhi yakho iyavumelana nayo ngaphambi kokushintsha inqubomgomo yesimo yomhlaba wonke.

Hlola kuzo zombili iziphetho

Funda umzila wekhompyutha oya endaweni ehlosiwe kanye nomzila wendawo ehlosiwe ubuyela ekhompyutheni; lezi izinqumo ezimbili ezihlukene futhi cishe esisodwa sazo asilungile. I-ping ephumelelayo evela ku-gateway uqobo ingafihla inkinga ngokuphelele, ngoba isuka emshinini omzila wawo usulungile. Udinga izinhlangothi zombili njengoba zibonwa iziphetho ezimbili zesikhathi sangempela.

Ngemva kokulungisa, vula kabusha i-SSH futhi ugcine isikhathi sivulekile kude ngesikhathi esasihluleka ngaphambili. Bese wenza umzila ube ngowaphakade ekucushweni kwenethiwekhi okugunyaziwe, ngoba umyalo wokushintsha owodwa awulona uhlelo lokuqalisa kabusha futhi inkinga izobuya ekuqaliseni okulandelayo nenimfihlo entsha.

Lapho ukungalingani kulungile

Ukuhambisa okungalingani kuvamile emanethiwekhi amaningi futhi akulona udonga ngokwencazelo. Kuba inkinga lapho ukulandelela isimo, ukuhumusha noma inqubomgomo kuncike ekuboneni umzila ongawuboni, futhi ngakunye kwalokhu kunekhambi elihlukile. Hlola lokho idivayisi ephakathi ikudinga ngempela ngaphambi kokuklama kabusha ngokuzungeza.

Impendulo ehlala njalo ibiza imizila emibili, idivayisi okudingeka ibone yomibili, kanye nomzila okwenza lokho kwenzeke. Uma ungeke ukwazi ukuyibiza idivayisi, awukayitholi imbangela.

Izihloko ezihlobene