I-StrongSwan ithumela ikheli le-DNS i-Mac engakwazi ukulifinyelela

Konke kuyasebenza kuze kube umuntu evula i-MacBook. Umhubhe uyasungulwa, izingqalabutho zangaphakathi ziphendula ngekheli, kanti ukuxazululwa kwamagama kuyafa. Ku-iPhone iphrofayela efanayo iziphatha ngendlela efanayo, kuyilapho amaklayenti e-Windows ne-Linux elungile. Isibaluli se-DNS esithunyelwayo ngokuvamile siyisigebengu: iseva ikhipha ikheli lesixhumanisi sayo somphakathi, futhi iklayenti le-IKEv2 lakwa-Apple aliyithumeli imibuzo lapho ngomhubhe. Hambisa umhunyuli ungene echibini bese uphawu luyanyamalala ngaphandle kokuthinta iklayenti.

Uphawu lukhomba ekhelini elithunyelwayo

Lapho kukhona amapulatifomu ambalwa kuphela ehlulekayo, umhubhe nezimpawu zokungena cishe nakanjani zilungile, ngoba zabelwana ngazo. Okwehlukile indlela iklayenti ngalinye elusebenzisa ngayo umthwalo wokucushwa eliwutholayo, kuhlanganisa neseva ye-DNS yangaphakathi. Iklayenti elamukela ikheli kodwa eliqondisa imibuzo ngaphandle komhubhe ligcina linomhunyuli eliwubonayo kodwa elingakwazi ukuwusebenzisa.

Ikheli lomphakathi liwukuzikhethela okuvamile ngoba yilona ikheli umlawuli aselivele elazi. Futhi yilona kuphela ikheli eliqinisekisiwe ukuthi lingaphandle kwesimaphambili somhubhe uqobo, futhi yisona sici esihlukumeza amaklayenti akwa-Apple.

Bheka inani ngaphambi kokushintsha noma yini. Uma umhunyuli othunyelwayo kuyikheli le-WAN leseva, usutholile isimo senkinga futhi ungakweqa okunye ukuqagula. Qhathanisa nakho nesimaphambili sechibi, ngoba ikheli elingaphakathi kwechibi kodwa lingaphandle kobubanzi bokuqashisa yikho kanye okuzobonakala ngemva kokulungiswa. Amaminithi amabili nokucushwa angcono kunantambama yokubamba amaphakethe kuklayenti.

Khipha umhunyuli kububanzi bokuqashisa

Nikeza umhubhe uhlelo lwamakheli lapho umhunyuli engilungu lesubneti yechibi uqobo, bese ugcina lelo kheli ukuze akekho iklayenti elizoqashisa ngalo. Kulesi sibonelo ichibi ngu-10.180.7.0/24, iseva iphethe u-10.180.7.1, futhi ukuqashisa kuqala ku-10.180.7.2.

rightsourceip=10.180.7.2/24
rightdns=10.180.7.1

Isimaphambili sechibi nomhunyuli babelana ngesubneti eyodwa, ngakho umzila osewuthwala ithrafikhi yomhubhe nawo uthwala imibuzo. Yisona leso sici esisodwa esenza ukulungisa kudluleke phakathi kwamaklayenti. Ekucushweni kwe-swanctl lezo zinto ezimbili zivela njengencazelo yechibi nesilungiselelo se-DNS kuxhumano, hhayi kusintaksi ye-ipsec.conf.

Iseva ayidingi isixhumanisi esisha esibonakalayo salokhu. Ukwengeza u-10.180.7.1 kusixhumanisi se-loopback kwanele ukuze umhunyuli ubophele futhi uphendule, ngoba amaklayenti afinyelela kuwo ngomzila wechibi osevele ukhona. Gcina ikheli lingaphandle kobubanzi bokuqashisa ukuze akekho iklayenti elingalithatha ngengozi. Uma ichibi liphethwe isevisi yangaphandle ye-DHCP noma ye-RADIUS, gcina ikheli nalapho, kungenjalo iklayenti lokuqala elicelayo lizolithatha.

Bopha umhunyuli bese uvala ingu-53

Ukunikeza ikheli akufani nokulalela kulona. Umhunyuli olalela kuphela ekhelini le-LAN uzokwenqaba noma uzibe imibuzo ethunyelwe ekhelini lechibi, futhi iklayenti libona isikhathi sokuphela esibonakala njengokwehluleka komzila.

interface: 10.180.7.1
access-control: 10.180.7.0/24 allow
access-control: 0.0.0.0/0 refuse

Leso sigaba se-unbound samukela imibuzo evela echibini lomhubhe futhi senqaba konke okunye, okuyinqubomgomo efiswa iningi lemihunyuli yezinkampani. Uma isenzakalo esifanayo siphendula namaklayenti e-LAN, engeza isimaphambili se-LAN ngokucacile esikhundleni sokwandisa ukulalela kuyo yonke imithombo.

Imithetho yomlilo bese kufanele ivumelane nokulawula ukufinyelela komhunyuli uqobo. Yamukela ingu-53 evela echibini, bese uyilahla kuyo yonke enye indawo, kodwa qala ngokuhlola ukulandelana kweketanga.

iptables -A INPUT -p udp --dport 53 -s 10.180.7.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -s 10.180.7.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j DROP
iptables -A INPUT -p tcp --dport 53 -j DROP

Ukwamukela okubanzi kwangaphambilini kwenza leyo migqa emibili yokugcina ibe ngumhlobiso, futhi umhunyuli uhlala ufinyeleleka kusuka ku-inthanethi. Funda isethi yemithetho esebenzayo nezibali esikhundleni sokwethemba ukulandelana obukuhlosile. Inqubomgomo ehlukile, okuwukuthumela ikheli lomphakathi nokuvumela imibuzo kusuka kunoma yimuphi umthombo, iyasebenza kumaklayenti amaningi, kodwa ibeka umhunyuli ku-inthanethi futhi idinga ukulinganiswa kwayo kwejubane nokuqapha.

Qinisekisa ukuthi iklayenti likutholile ngempela

Bheka umbono weserva kuqala, bese lowo weklayenti, ngoba womabili awavumelani ngendlela efundisayo. Uhlu lwechibi lukhombisa ukuthi iliphi ikheli elaqashiswa, futhi uhlu lwezinhlangano zokuphepha lukhombisa ukuthi uxhumano lumi yini ngobunikazi obulindelekile.

swanctl --list-sas
swanctl --list-pools
dig +short @10.180.7.1 intranet.plant.example

Umbuzo oqondile ufakazela ukuthi umhunyuli uphendula ekhelini lechibi lisuka kumsingathi ongakwazi ukulifinyelela. Akufakazeli ukuthi i-Mac yakhetha leyo seva. Ku-macOS, i-scutil --dns ibala imihunyuli ngesevisi ngayinye enomkhawulo futhi inolwazi olungaphezu kwephaneli lesifinyezo; ku-Windows, i-Get-DnsClientServerAddress ikhombisa ukuthi i-adaptha yomhubhe yayamukela yini inani elithunyelwe.

Uma iklayenti likhombisa ikheli lechibi kanti imibuzo isaphela isikhathi, umzila womhubhe noma uketanga womlilo unecala. Iklayenti elingabiki mhunyuli lisho ukuthi umthwalo wokucushwa awuzange ufike, ngakho bheka indlela lelo pulatifomu elusebenzisa ngayo izilungiselelo ezithunyelwe, hhayi inethiwekhi. Bhala ukuthi yikuphi kwalokhu okubili okubonile ngaphambi kokushintsha okunye. Lezo zinto ezimbili zokwehluleka zibonakala zifana kuthikithi losekelo futhi ziholela ekulungiseni okuphambene.