strongSwan vips: ukucela ikheli le-virtual ku-IKEv2

I-vips icela ikheli le-IKEv2 langaphakathi; i-gateway inquma ukuthi izokunikeza ini. Lungiselela isicelo, silayishe, bese uqinisekisa ukuthi umphenduli wabela ini ngempela.

Iklayenti lakho le-IKEv2 lingacela i-gateway ikheli langaphakathi, futhi i-gateway inquma ukuthi izobuyisela ini. Ku-strongSwan leso sicelo siyisethingi ye-vips, futhi sihlala siyisicelo ngisho noma ubhala ikheli elithile kuso. Umhlahlandlela ongezansi ulungiselela isicelo, uwulayishe futhi ufunde okubuyile, ngoba lezo zinyathelo ezintathu zehluleka ngezindlela ezintathu ezihlukene. Akukho kuzo okufushane ngokuthayipha ngamandla.

I-vips icela ini, futhi yini engakwazi ukuyithembisa

I-vips iyingxenye yencazelo yoxhumano futhi icela umphenduli ikheli le-virtual. Umhlahlandlela we-strongSwan wamakheli e-virtual usho ngokusobala ukuthi impendulo ingaba ikheli elinye, noma ingabi bikho nhlobo, futhi yilowo musho abantu abawudlulayo lapho bebhala inani futhi belindele ukuthi livela. Isicelo sisafanele ukwenziwa, ngoba okuhlolayo yimpendulo. Thatha isethingi njengesiyalo sokubuza, hhayi njengokuhlelwa komphumela.

Ukucela i-0.0.0.0 kuwukucela noma yiliphi ikheli le-IPv4 le-virtual elitholakalayo, lokhu ngokuvamile kulungile lapho inani eliqondile lingabalulekile. Ukucela ikheli elithile kuyisikhombisi se-gateway, hhayi isicelo kuyo.

Ingxenye ye-swanctl nendawo yayo

Isethingi isengxenyeni yoxhumano, hhayi efayeleni layo futhi hhayi kuphrofayela yesistimu yokusebenza. Le ngxenye ehlukanisiwe ikhombisa isimo:

connections {
  net {
    local_addrs = 192.0.2.10
    remote_addrs = 203.0.113.5
    vips = 10.77.0.31
    children {
      net { local_ts = dynamic remote_ts = 10.77.0.0/24 }
    }
  }
}

Yilayishe ngefayela eliphethe uxhumano, bese uqala uxhumano futhi ufunde umphumela. Ingxenye enamathiselwe esigabeni esingalungile ikhipha iphutha lokuhlaziya noma, okubi nakakhulu, uxhumano olulayishwayo ngaphandle kwesicelo obucabanga ukuthi usenzile. Gijimisa imiyalo emithathu ngokulandelana futhi ugcine okukhiphayo.

swanctl --load-all --file /etc/swanctl/swanctl.conf
swanctl --initiate --child net
swanctl --list-sas

I-local_ts ikhetha ithrafikhi, ayidali ikheli

I-local_ts ibiza isethi yethrafikhi evikelwa yi-SA yengane; ayifaki ikheli ku-interface. Lapho i-IP ye-virtual isixoxiwe, i-strongSwan iyeka ukusebenzisa isikhethi sayo esijwayelekile sokuguquguquka futhi isebenzisa ikheli elinikeziwe esikhundleni salokho. Uma ubophela isikhethi ekhelini elingokoqobo, uba uqinisekisa into okungenzeka ukuthi i-gateway ayikunikezanga, futhi yingakho ukwehluleka kubonakala njenge-SA esebenzayo enethrafikhi engayi ndawo. Isikhethi sichaza ithrafikhi, kanti ukwabiwa kuvela kolunye ushintsho.

Enye indlela yokuthola ikheli langaphakathi elizinzile iwukuba nalo ngokwasekhaya. Beka ikheli ku-interface ngaphambi kokuthi umhubhe ukhuphuke, khombisa isikhethi kulokho osekuvele kukhona, futhi uhlele umlingani kanye nomzila kuzungeze lokho.

Kulolo hlelo akukho okuxoxwayo, ngakho-ke akukho okungabelwa kabusha, futhi yilokho ukushintshana: ukuqiniseka esikhundleni sokwenza wena umsebenzi wamakheli. Kuwumshini ohlukile, hhayi uhlobo lwe-vips, yingakho kokubili akufanele kuxutshwe kuxhumano olulodwa. Isikhethi esiboshiwe eduze kwekheli elixoxiwe siwuxhumano olusebenza kuze kube yilapho i-gateway isabalalisa enye into.

Qinisekisa ukuthi umphenduli wabela ini ngempela

Funda uhlu lwe-SA lwelikheli elinikezwe i-gateway, bese uqinisekisa ukuthi ikheli likhona ku-interface. Uma kokubili kungafani, umhubhe uphezulu futhi ithrafikhi ayiyi lapho ocabanga khona. Ikheli elinikeziwe elingafiki ku-interface nakancane liwukwehluleka okudida kakhulu kulokhu kulandelana, ngoba ingxenye ngayinye ibonakala ilungile iyodwa.

Gcina amakheli amane ahlukene emanothini akho: ikheli langaphakathi eliceliwe, elinikeziwe, ikheli le-LAN lomshini, kanye nokuphuma komphakathi okubikwa iwebhusayithi. Angamazinga ahlukene futhi avela ezindaweni ezihlukene. Umhlahlandlela obhala wonke amane yilowo omunye umuntu angawulandela ngaphandle kokubuza ukuthi ubusho liphi ikheli. Wafunde futhi ngemva kokulayisha kabusha ngakunye, ngoba inani elinikeziwe yilona kuphela elichaza umhubhe ophilayo.

Gcina umklamo oqinile wodwa

Uma udinga ikheli langaphakathi eliqinile, hlela ukubekelwa eceleni ku-gateway futhi ushiye isicelo seklayenti siyisicelo. Ukuxuba isikhethi esiboshiwe nekheli elixoxiwe kunikeza uxhumano olusebenza kuze kube yilapho i-gateway iwabela enye into. Bhala umthetho wokubekelwa eceleni eduze koxhumano, ngoba yingxenye umlingani angakwazi ukuyithola efayeleni lokuhlela. Khona-ke iklayenti elisha lizuzu umthetho njengefa esikhundleni sokuphinda liwuthole.

Kuklayenti le-Mac elakhelwe ngaphakathi akukho nalinye lalawa magama ezinketho. Sebenzisa noma yikuphi ukwabiwa noma ukubekelwa eceleni okunikezwa i-gateway kanye nephrofayela eshicilelwa umqhubi, futhi thatha noma yiliphi inani ohlangothini lweklayenti njengesikhombisi kuze kube yilapho uselufunde futhi ukwabiwa. Ukuhoxa emuva kuwukususa umugqa we-vips nokulayisha kabusha, okukubuyisela kulokho i-gateway eyabela ngakho ngokuzenzakalelayo.

Izihloko ezihlobene