I-tunnel ephelele ku-strongSwan idinga u-0.0.0.0/0 ezinhlangothini zombili

I-tunnel ephelele idinga u-0.0.0.0/0 njenge-remote_ts yeklayenti ne-local_ts yesango, kanye nokudlulisa, i-NAT nomzila wokubuya. Hlola konke okune.

Ukuxhumana kwe-strongSwan okusebenza kwi-subnet eyodwa yangasese ngeke kuthwale ithrafikhi ye-inthanethi ngoba nje othile uhlele umugqa owodwa. I-tunnel ephelele isivumelwano phakathi kwezinhlangothi ezimbili mayelana nokuthi iyiphi ikheli i-child SA eyivikelayo, futhi uhlangothi ngalunye lubiza olunye ngokuhlobene nalo. Yenza uhlangothi olulodwa lube ngolulungile olunye lube nolungalungile, i-child SA ngeke inyuke noma izonyuka incane kunalokho obekuhloswe. Izivivinyo ezinhlanu ezingezansi zilandela leso sivumelwano kusukela kuklayenti, ngesango, kuze kufike kwi-inthanethi.

Qala ngokuhlola isikhethi seklayenti

Iklayenti ichaza lokho elifuna ukukuvikela ohlangothini olukude njenge-remote_ts, futhi konke elikuthumayo kuvela kukheli lwalo olwabiwe. Kuthrafikhi ye-inthanethi lelo nani kufanele lihlanganise izindawo umsebenzisi azofika kuzo ngempela, okusho ngokwedlulele indawo yonke ye-IPv4. Iklayenti elisabala i-subnet eyodwa licela i-tunnel ehlukanisiwe, noma ngabe iphrofayela ibizwa kanjani kusixhumi. Uhlangothi lomthombo ngokuvamile yi-dynamic ngoba ikheli labelwa ngesikhathi sokuxhumana. Umthombo ogxilile obhalwe lapho uyaphuka ngokushesha uma iqoqo lamakheli lishintsha.

children {
    net {
        local_ts  = dynamic
        remote_ts = 0.0.0.0/0
    }
}

Lesi siqephu akusona isifayela esiphelele sokuxhumana, futhi sicabanga ukuthi ukuqinisekisa, ubunikazi kanye neqoqo lamakheli obuciko sekuvele kulungisiwe. Isikhethi somthombo seklayenti nekheli elabelwa iseva kusamele kuhambisane, uma kungenjalo i-child SA izonyuka nendawo engabanga ilindelwe yizinhlangothi zombili. Yilayishe nge-swanctl --load-all futhi ufunde okukhishiwe ngaphambi kokucabanga impumelelo. Ifayela elihlukaniswayo lingasala lenqatshwa ngenxa yesikhethi esingahlangani nesiphakamiso sohlangothi olunye.

Hlola isikhethi sesango ohlangothini lwaso

Isango lifunda umqondo ofanayo lisuka ohlangothini oluphambene. Izindawo ze-inthanethi ziyasekhasini lesango, ngakho i-local_ts yaso yiyona ebanzi futhi i-remote_ts yaso ichaza iqoqo lamaklayenti. Lokho kuphenduka yikhona iphutha elivame kakhulu ekuhlelweni kwe-tunnel ephelele, futhi kudlula ekubuyekezweni ngoba imigqa yomibili ibonakala ithembekile ngayinye iyodwa.

children {
    rw {
        local_ts  = 0.0.0.0/0
        remote_ts = 10.77.0.0/24
    }
}

Ukukopisha isiqephu seklayenti kufayela lesango kudala umbhangqwana wezikhethi ongachazi lutho oluwusizo, ngoba izinhlangothi zombili zizofuna indima efanayo. Umhlahlandlela wokudlulisa we-strongSwan ubhala ngokucacile ukubhangqa kweklayenti nesango, futhi kufanele kufundwe eceleni kwefayela lokuxhumana hhayi ngemuva kokwehluleka. Ifayela lesango lidinga futhi incazelo yeqoqo okubhekisela kulo i-remote_ts. Isikhethi esisho iqoqo elingekho silayishwa ngaphandle kwesikhalo futhi sihluleka ngesikhathi sokuxhumana.

I-ipsec.conf endala isebenzisa izindima zesobunxele nesokudla ngamakhiya ahlukene, futhi umugqa we-rightsubnet awuwona ukushintshwa okuqondile kwenani le-swanctl. Gcina lezi zinhlobo ezimbili zokubhala kumafayela ahlukene esikhundleni sokunamathisela elilodwa kwelinye. Ukuzixuba kudayirekhithri elilodwa yiyo indlela ukuxhumana okusebenzayo okubuyela ngayo buthule ngemuva kokuqalisa kabusha.

Hlola i-child SA okuxoxiswane ngayo, hhayi ifayela

Ukulungiselelwa okugciniwe kufakazela inhloso futhi akukho okunye. Uhlangothi olunye lunganciphisa lokho obekuceliwe, futhi i-child SA ekhona ayishintshwa ngoba nje ifayela elingaphansi kwayo lishintshile. Qinisekisa ukuthi yini ngempela efakiwe ngaphambi kokushintsha enye into.

swanctl --list-conns
swanctl --list-sas
ip xfrm policy list

Umyalo wokuqala ukhombisa lokho idaemon ekulayishile, owesibili ukhombisa ama-child SA asunguliwe, nowesithathu ukhombisa izinqubomgomo i-kernel ezizozisebenzisa. Uma ifayela lithi 0.0.0.0/0 futhi uhlu lukhombisa i-subnet eyodwa, izingxoxo zinciphise indawo futhi ukufunda kabusha ifayela ngeke kukuchaze lokho. Misa i-child, yiqalise kabusha, bese uqhathanisa okukhishiwe kokuthathu futhi. I-child ebuya nendawo encane efanayo incishiswa uhlangothi olukude hhayi ifayela lendawo, futhi lokho kuyingxoxo nomunye umlawuli hhayi ukulungiswa kwendawo.

Funda izinhlangothi zombili ohlwini lwezinqubomgomo, ngoba i-tunnel efaka uhlangothi olulodwa hhayi olunye iyinkinga yomzila egqoke ingubo yokulungiselela. Izinqubomgomo zokuya nokubuya kufanele zisho umbhangqwana wezikhethi ofanayo ngendlela yesibuko, futhi isibuko esingekho iyiphutha kudaemon noma esiphakamisweni hhayi embhalweni wesikhethi.

Hlola ukudlulisa nomzila wokubuya

Isikhethi sivumela ithrafikhi ingene esangweni, kodwa asenzi isango lidlulise leyo thrafikhi phambili. Ukudlulisa kufanele kuvuliwe, udonga lomlilo kufanele luvume ukugeleza, futhi impendulo kufanele ithole indlela yokubuyela eqoqweni lamaklayenti. Lezi yizimfuno ezintathu ezihlukene, futhi ngayinye ihluleka ngophawu oluhlukile. Umthetho wokudlulisa ongakho uziphatha njengomgodi omnyama, kuyilapho umzila wokubuya ongakho uziphatha njenge-tunnel yohlangothi olulodwa.

sysctl net.ipv4.ip_forward
iptables -t nat -S | grep -i masq
ip route get 1.1.1.1

Amakheli eklayenti angasese ngokuvamile adinga ukuhunyushwa komthombo ngamabomu ngaphambi kokuba aphume kusixhumi somphakathi, kuyilapho ukwabiwa okugcwele umzila kudinga okunye ukwelashwa. Uma i-NAT ihilelekile, gcina okuhlukile okusekelwa ukuqaliswa ukuze ithrafikhi okufanele ihlolwe inqubomgomo yezokuphepha ingahunyushwa idlule kuyo. Umthetho obanzi we-masquerade okopishwe kwelinye isango ushintsha ukugeleza okuningi kakhulu kunalokho umbhali wawo ayekuhlosile. Bhala umthetho weqoqo lamaklayenti kuphela, futhi ushiye umbono ochaza ukuthi kungani ukhona.

Kuklayenti, qinisekisa imizila efakwe yi-backend hhayi imizila oyicabangile. Umphathi ovalelwe ukufaka imizila udinga umklamo womzila ogcinwa ngesandla, futhi lowo mklamo kufanele ubuyekezwe njalo uma i-tunnel ishintsha. Hlola ithebula lomzila ngemuva kokuxhuma kabusha, hhayi kuphela ngemuva kokuqalisa okusha.

Hlola lokho i-tunnel engakamboxi

Umbhangqwana wezikhethi uhlanganisa i-IPv4 futhi akukho okunye. I-IPv6, i-DNS nanoma iyiphi inqubomgomo yezinga lohlelo izinqumo ezihlukene ezinganakwa buthule yisikhethi esibanzi se-IPv4. I-tunnel ethwala yonke iphakethe le-IPv4 isengavuzisa konke ukusesha kwegama.

Shono ngokucacile umzila we-DNS ohlosiwe, ngoba i-tunnel ephelele esaxazulula amagama ngesixazululi sendawo ivuzisa imibuzo ngaphandle kwe-tunnel futhi yephula amagama angasese. Uma iklayenti linikezwa ikheli le-IPv6, lowo mkhakha wamakheli udinga ukwelashwa okufanayo, uma kungenjalo umsingathi uzokhetha umzila i-tunnel engawuvikeli. Hlola ngegama kuphela uhlangothi lwangasese olungaphendula ngalo, futhi uthatha impendulo yomphakathi njengokuvuza.

resolvectl query intranet.example.internal
traceroute -n 1.1.1.1

Qinisekisa uchungechunge ngaleyo miyalo emibili kanye nezikhethi okuxoxiswane ngazo kusukela ohlwini olungenhla. Uma i-traceroute ikhombisa i-router yendawo njengehop yokuqala, ithrafikhi ayisebenzisi i-tunnel noma ngabe izikhethi zithini. Ukufinyelela kwi-inthanethi kuphelele kuphela uma ithrafikhi ekhethiwe yamukelwa, yadluliswa futhi yabuyiswa ngesango eliklanyelwe. Ukuthola i-0.0.0.0/0 kuphrofayela ukuqala kwalolo chungechunge, hhayi ubufakazi balo.

Izihloko ezihlobene