Imodi ye-trap ye-strongSwan: kungani umhubhe we-IPsec ulinda ithrafikhi

Umhubhe we-IPsec ongenzi lutho ngesicelo awubonisi CHILD SA kuze kube iphakethe lihambisana nenqubomgomo yalo ye-trap. Funda isimo, hlola isiqhumisi futhi wazi ukuthi i-start ifanele nini.

Awekho CHILD SA avelayo kokuphuma kwesimo, umhubhe ubonakala ufile, bese kuthi i-ping eya kusubnet ekude iwukhulise. Ekuhlelweni kwe-IPsec ngesicelo, lokho kulandelana kuwumklamo, hhayi iphutha. Inqubomgomo ye-trap ifaka isikhethi futhi ilinde, futhi iphakethe lokuqala elihambisanayo liyona eqala i-IKE nengxoxo ye-CHILD SA.

Ingxenye yokudideka amagama: i-“up” isetshenziselwa izimo ezimbili ezihlukene. Ukulungiselelwa kulayishiwe futhi inqubomgomo ye-kernel ikhona, kodwa ukuhlangana kwedatha akukho. Isibonisi esibala kuphela ama-SA asebenzayo sizobika isayithi enempilo njengephansi noma ngabe akekho othumela ithrafikhi kuyo.

Umhubhe ongenzi lutho ngesicelo awunayo i-CHILD SA ongayibonisa

Umugqa we-trap awuqinisekisi lutho wodwa. Ucela i-kernel ukuthi igcine inqubomgomo yethrafikhi ekhethiwe futhi inyuse i-acquisition lapho iphakethe lidinga leyo nqubomgomo. I-daemon ithola i-acquisition, iyihlobanise nencazelo ye-child futhi ixoxe kusukela lapho. Kuze kube yileso sikhathi awekho ne-IKE SA ongayibonisa, yingakho kokubili uhlu kungaba lutho ngasikhathi sinye.

Yilokho kulandelana okwenza amalog afundeke. Kuqala kufika i-acquisition, bese kuba i-IKE_SA_INIT ne-IKE_AUTH, bese kuba i-CHILD SA. Uma ilog iphela ngokushesha ngemva kwe-acquisition, isiqhumisi sisebenzile. Ingxoxo yehlulekile, futhi umbuzo olandelayo umayelana nezimo zokuqinisekisa, iziphakamiso noma ukufinyeleleka, hhayi i-trap.

Nge-backend ye-kernel yase-Linux ungabona inqubomgomo ngaphambi kokuba kube khona noma iyiphi i-SA. Gijima ip xfrm policy bese ufuna isikhethi esinendlela ethi out nesifanekiso esikhomba ekuxhumaneni. Lowo mugqa uyisimo ngesicelo, futhi ukuba khona kwawo yinto yokuqala okufanele kuqinisekiswe.

I-start_action inquma ukuthi kukhona yini okulindayo

Yonke i-child ku-swanctl.conf ine-start_action. start iqala lapho ukulungiselelwa kulayishwa, trap ifaka inqubomgomo futhi ilinde, futhi none ishiya ukuqala kokunye. Kuphela trap okukhiqiza ukuziphatha “ping futhi iyenyuka” okuchazwe ngenhla.

children {
    office-lan {
        local_ts = 192.168.50.0/24
        remote_ts = 192.168.70.0/24
        start_action = trap
    }
}

Izinketho ezimbili zethrafikhi zichaza ukuthi yini ethathwa njengethakasisekayo, futhi iphakethe elivela kumsingathi ongaphandle kwalezo ziqiqi aliqhumisi i-trap; lihanjiswa ngendlela evamile. Ukwandisa izikhethi ukuze isiqhumisi sishiseke kakhulu kukhulisa nomkhakha umhubhe othi uyawuvikela, ngakho-ke zithole kuthrafikhi ohlose ukuyifihla ngempela.

Lapha isithenjwa se-swanctl.conf sibala amanani amukelekayo, kanye nezenzo ezihlukene ze-close ne-DPD ezilawula okwenzeka uma i-SA isikhona.

Thola ukuthi isiqhumisi siqukile yini

Qala nge-swanctl --list-conns, bese uqinisekisa ukuthi i-child ilayishwe ngentshisekelo oyifunayo. Bese uthumela iphakethe elilodwa kumsingathi ongaphakathi kwe-local_ts eya ekhelini elingaphakathi kwe-remote_ts bese ubuka i-swanctl --list-sas. Uma okukhiphayo kungashintshi, awekho i-acquisition efinyelele i-daemon.

Izizathu ezimbili ezijwayelekile ze-trap ethule: iphakethe lenziwa i-source-NAT ngaphambi kokufinyelela inqubomgomo futhi alisahambisani ne-local_ts, noma uxhumano aluzange lulayishwe ngenxa yephutha lokubhala noma lezimo zokuqinisekisa. Gijima futhi i-swanctl --load-all bese ufunda okukhiphayo ngaphambi kokuthinta izikhethi. Uxhumano olungalayishwanga alufaki nqubomgomo, ngakho-ke akukho okuthrafikhi engakubangela.

Indlela nayo ibalulekile: i-trap efakelwe ithrafikhi ephumayo ayiqali ngephakethe elingenayo. Uma uhlangothi olukude kufanele lukhulise umhubhe, ludinga i-trap yalo, noma lolu hlangothi ludinga i-start.

Ukulinda iphakethe lokuqala akusona njalo ukushintshana okufanele

Amaseshini asebenzisanayo azwa izindleko zokuhlela. Isicelo sokuqala sikhokha ngokushintshana kwe-IKE nangengxoxo ye-CHILD, futhi iklayenti elinesikhathi esincane lingashiya ngaphambi kokuba i-SA ibe khona. start ehamba phambili isusa lokho kubambezeleka kwephakethe lokuqala. Kodwa igcina umhubhe uvulekile wethrafikhi okungenzeka ingafiki neze.

Amaqiniso amathathu anquma ukukhetha: ukuthi indlela isetshenziswa kangaki, ukuthi isicelo sokuqala sinesikhathi esiqinile yini, nokuthi i-peer iyafinyeleleka yini ekusungulweni. Ithrafikhi yeqembu ngezikhathi ezithile kanye ne-peer okungenzeka ingaxhunyiwe ngesikhathi sokuqala, kokubili kusekela i-trap. Iklayenti elizwela ukubambezeleka kanye ne-peer efinyeleleka njalo kusekela i-start. Uma izinhlangothi zombili zingaqala, vumelanani ukuthi ubani ophethe isiqhumisi ukuze ningabi nezingxoxo eziphindwe kabili.

Inqubomgomo efakiwe nayo ayisona isiqinisekiso sokungavuzi. Uma imfuneko i-fail-closed, i-firewall kufanele ilahle ithrafikhi engenayo i-SA, futhi lowo mthetho uhlala ngaphandle kwencazelo ye-child.

Bhala imigqa emithathu eqeda ingxoxo elandelayo

Bhala izikhethi, isenzo sokuqala kanye nokuphuma komyalo okubonisa inqubomgomo ikhona ngaphandle kwe-SA. Leyo migqa emithathu ihlukanisa “ngesicelo futhi kungenzi lutho” ne-“akulayishwa” ngokuzayo lapho othile ebika umhubhe uphansi. Kuthatha umzuzu ukuyibhala. Ngaphandle kwayo uphenyo olufanayo luqala kusuka kuqanda.

Hlola kumsingathi ongaphakathi kwesikhethi ngempela. I-ping evela ku-router uqobo ivamise ukuthatha enye indlela futhi ayifakazeli lutho ngenqubomgomo evikela isubnet engemuva kwayo.

Izihloko ezihlobene