strongSwan ESP-in-UDP: lapho kungekho NAT okufanele kutholwe

Ukutholwa kwe-NAT kuthola ukuhunyushwa kwamakheli, hhayi inqubomgomo ye-firewall. Ukuxhumana kwesayithi ngaphandle kwe-NAT kusengadinga ukukhetha okucacile kwe-ESP-in-UDP.

Ukutholwa kwe-NAT kuphendula umbuzo owodwa: ingabe amakheli noma izimbobo zishintshile endleleni? Akuphenduli ukuthi i-firewall ivumela iphrothokholi ye-IP 50 yini. Amasango esayithi angenakho ngokuphelele ukuhunyushwa asengaba ngemuva kwenqubomgomo elahla i-native ESP, futhi leyo mfuneko kufanele ilungiselelwe esikhundleni sokutholwa. Indlela yi-ESP-in-UDP, futhi kuyisinqumo, hhayi enye indlela evela yodwa.

Ukutholwa kuyizibalo kumakheli, hhayi ukuhlolwa kwe-firewall

I-IKEv2 ithwala ama-payload okutholwa kwe-NAT aqukethe ama-hash amakheli nezimbobo zomthombo nendawo ekuyiwa kuyo. Uhlangothi ngalunye luqhathanisa okukutholile nalokho okubonayo endaweni, futhi ukungafani kuyatshela ukuthi kukhona okuhumushe iphakethe. Akukho lutho kulolo shintsho oluhlola ukuthi umzila phakathi udlulisa iphrothokholi 50 yini.

Umphumela ongokoqobo kufanele ushiwo ngqo. Umhubhe owawusebenza ne-native ESP awuzukuzitholela i-firewall entsha ekhawulelayo, futhi umzamo wayo olandelayo uzohluleka esigabeni sedatha ngenkathi i-IKE iqhubeka nokuphumelela. Uzobona izinhlangano zokuphepha ze-IKE ezisunguliwe kanye nokungabi nathrafikhi evikelekile, lokhu okubonakala njengephutha lokuhlela kuze kube yilapho ubamba ocingweni.

Ngakho-ke ukufakwa kwekhabethe kuyisici sokuxhumana okulungiselelayo, hhayi umphumela ozoxoxelwana ngayo izinhlangothi kusukela ekuziphatheni kwenethiwekhi.

Indlela i-encap eshintsha ngayo ukushintshana

Ekubekweni kwesimanjemanje kwe-strongSwan okulawulwa nge- swanctl.conf, isilungiselelo encap = yes kukuxhumana sithinta ukushintshana kokutholwa kwe-NAT ukuze zombili izinhlangothi zisebenzise ukufakwa kwekhabethe kwe-UDP kwe-ESP. Amaphakethe avikelekile abe esehamba ngaphakathi kwe-UDP, ngokuvamile embotsheni engu-4500, futhi zombili iziphetho kufanele zivumelane ngaleyo ndlela.

connections {
    site {
        encap = yes
        # existing approved peer, authentication and child settings
    }
}

Leyo ngxenye ingaphakathi kwencazelo yangempela yokuxhumana futhi ayisiyo iphrofayili ephelele yesayithi. Gcina amakheli ozakwethu, ukuqinisekisa kanye nezikhethi zethrafikhi ze-child ozisebenzisayo kakade; ukhiye owodwa owengeziwe ushintsha indlela idatha evikelekile ehlanganiswa ngayo, hhayi lokho evikela kona.

Umhlahlandlela we- strongSwan we-NAT-traversal uchaza lokhu kuziphatha, kuhlanganise nokusebenzisana nokuntanta kwembobo lapho kusetshenziswa i-MOBIKE.

Sebenzisa isilungiselelo esingesakho se-backend yakho

I-strongSwan inama-backend amabili okulungiselela, futhi ukhiye uyehluka phakathi kwawo. swanctl.conf ukuxhumana kuthatha encap, kuyilapho ipsec.conf ukuxhumana kwakudala kuthatha forceencaps. Ukufaka igama elingukhiye le-backend eyodwa kwelinye kuveza ukulungiselela okulayishwa ngaphandle kwesikhalo futhi kungashintshi lutho, okuyinto embi kunegephutha.

Hlola ukuthi iyiphi i-daemon esebenzayo ngempela ngaphambi kokuhlela noma yini. Ezabelweni eziningi zombili izifayela zikhona ngoba esinye insalela yokuthuthwa kwangaphambili, futhi esisebenzayo yileso esiqalwa iyunithi yesevisi. Funda leyyo yunithi esikhundleni sokuqagela ngezimpawu zesikhathi zefayela. Ukuhlolwa kwemizuzwana emihlanu lapha kuvimbela amahora okuhlola isilungiselelo esingalayishwanga lutho.

Faka ushintsho ngomnikazi wokuxhumana futhi usungule kabusha inhlangano phakathi kwewindi elilawulwayo. I-child esivele ifakiwe igcina ukufakwa kwayo kwekhabethe kwamanje ize ishintshwe, ngakho-ke ukuhlela ifayela kuphela akufakazeli ukuthi ilungiselelo elisha liyasetshenziswa.

Qinisekisa idatha ehlanganisiwe, hhayi imbobo kuphela

Bamba esangweni ngenkathi ithrafikhi evikelekile ihamba, bese uqhathanisa nalokho i-strongSwan uqobo ekubonayo:

$ sudo tcpdump -ni eth0 'udp port 4500' -c 20
$ sudo swanctl --list-sas --ike site
$ sudo ip xfrm state list

I-native ESP ivela njengephrothokholi ye-IP 50 futhi ayifani neze ne-UDP. I-ESP ehlanganisiwe ivela njengama-datagram e-UDP ku-4500 okungeyona i-IKE i-payload yawo. Ithrafikhi ye-IKE kuleyo mbobo efanayo ayibona ubufakazi bokufakwa kwekhabethe, ngoba i-MOBIKE ingahambisa i-IKE lapho ngenkathi indlela yedatha ihlezi i-native, ngakho-ke funda i-payload, hhayi inombolo yembobo.

Khumbula ne-MTU yendlela. Isembozo senezela izindleko ezengeziwe, futhi indlela eyayithwala i-native ESP ingadinga ukulungiswa lapho amaphakethe ekhula. Ukuphathwa kwe-ICMP okudingekayo kufanele kakade kube yingxenye yomklamo; ukufakwa kwekhabethe akususi lokho kuncika.

Vuma ushintsho lapho ithrafikhi entsha yezinhlelo zokusebenza ngaphakathi komhubhe ibonakala ekubambeni njenge-ESP ehlanganisiwe kuzo zombili iziphetho, futhi lapho isevisi yangaphakathi nendlela yayo yokubuyela isasebenza. Noma yini engaphansi kwalokho iwukulungiselela okubonakala kulungile efayeleni.

Izihloko ezihlobene