I-OpenVPN handshake ku-Synology iyahluleka? Hlola ukudluliswa kwe-LAN

I-laptop yakho ibika ukuthi i-TLS handshake yehlulekile, ngakho isilingo siwukwakha kabusha izitifiketi. Ngaphambi kwalokho, buza umbuzo odikibhayo: i-Synology ilalela kupikiphi iphothi le-Ethernet ngempela? I-NAS enamaphothi amabili e-LAN inamakheli amabili, futhi iphakethe le-VPN Server ku-DSM libopha isilaleli salo se-OpenVPN kwelinye lawo. Lapho irutha idlulisela u-1194 kwelinye ikheli, akukho phakethe elifinyelela kusevisi, futhi iklayenti alinalutho lokuxoxisana ngalo.

Umbhalo wephutha uyakhohlisa ngoba uchaza into yokugcina eyazinywa yiklayenti, hhayi into yokuqala eyahamba kabi. Imizuzu emibili yokuqhathanisa ikhasi lephakethe nomthetho werutha iyasixazulula.

Thola ikheli isilaleli esiboshelwe kulo

I-DSM ibiza amaphothi ayo ngokuthi LAN 1 ne-LAN 2, futhi ngalinye linekheli nesixhumi-esincane esihlukile. Vula i-VPN Server, funda isixhumi esishiwo kuthebhu ye-OpenVPN, bese uvula i-Control Panel futhi ubhale ikheli le-IPv4 i-DSM enalo kuleso sixhumi. La makheli amabili, hhayi igama lomsingathi we-NAS, yiwona okumele adluliswe.

Ikhebula lesibili elixhunyiwe alidali isilaleli sesibili. Zombili izixhumanisi zingabonakala zixhunyiwe kuyilapho ikheli elilodwa lamukela ithrafikhi, futhi lapho izixhumi zombili zisesixhumi-esincane esisodwa, amakheli amabili ahluka ngedijithi eyodwa okungekho muntu oyifunda futhi ngaphambi kokugcina umthetho.

Bheka isokhethi ngokwayo nge-SSH, ngoba yilena kuphela indawo ekhombisa ukuthi idaemon iboshelwe kokuthini ngempela, hhayi lokho okuhlosiwe yikhasi lezilungiselelo.

sudo netstat -anp | grep 1194

Hlela ukudlulisela okukhona esikhundleni sokwengeza okunye

Imithetho emibili yephothi elilodwa langaphandle ishiya irutha likhululekile ukukhetha, futhi okuzokhetha kungashintsha ngemva kokubuyekezwa kwefirmware noma kokuqalisa kabusha. Vula umthetho osekhona kakade, shintsha ikheli lawo langaphakathi, gcina, bese uwuvula futhi futhi ufunde inani. Ukuqamba umthetho ngegama lesevisi kuyasiza, ngoba uhlu lokudlulisela okuhlanu okufanayo yiyona ndlela okubi eliphila ngayo.

external 1194/udp  ->  192.0.2.20:1194/udp

Gcina iphothi langaphakathi lilingana nephothi lokulalela, futhi gcina iphrothokholi lihambisana. I-UDP 1194 iyisilaleli esizenzakalelayo, kuyilapho iphrofayili ye-TCP idinga isilaleli sayo ohlangothini lwephakethe nokudlulisela okuhambisanayo kurutha. Ukudlulisela i-TCP kusevisi elilalela i-UDP kuphela kuveza ukuthula, hhayi iphutha.

Uma ikheli le-NAS livela ku-DHCP, libekele eceleni ngaphambi kokugcinwa komthetho. Ukuphela kwesivumelwano sokuqashisa kunikeza ikheli futhi, ukudlulisela kusabonisa inani elidala, futhi i-handshake iqala ukuhluleka ngosuku okungekho muntu othinte i-NAS ngalo. Ukuhlelwa okumile ohlangothini lwe-NAS kuxazulula le nkinga efanayo, inqobo nje uma ikheli lingaphandle kobubanzi be-DHCP berutha.

Fakazela ukuthi amaphakethe ayafika noma cha

Qala ukuthwebula ku-NAS kuqala, bese uxhumanisa kuklayenti, futhi ufunde ikheli lomthombo kokukhishiwe. Ukuthwebula okuqalwa ngemva kwephutha akubonisi lutho futhi akufakazeli lutho.

sudo tcpdump -i any -n udp port 1194

Ukuthula kusho ukuthi ithrafikhi yafa ngaphambi kwevisi: ikheli langaphakathi elingalungile, iphothi elivaliwe kufirewall ye-DSM, noma isixhumi esivaliwe ngokomthetho wokuphatha. Amaphakethe kokukhishiwe asho ukuthi ukudlulisela kuyasebenza, futhi iphutha elisele lingaphezulu kwesendlalelo senethiwekhi, okuyindawo yokusesha encane kakhulu.

Ukuthwebula kubuye kusho isixhumi iphakethe elifike kuso, futhi lolo dethi elilodwa lihlukanisa umthetho oqondiswe kupothi okungalungile nomthetho oqondiswe kupothi olungavuliwe. Bheka isibali serutha ngokwaso phakathi nomzamo ofanayo uma sikhombisa. Isibali esinganyakazi ngenkathi ukuthwebula kuhlala kungenalutho sikhomba irutha, kuyilapho isibali esinyakazayo ngokuthwebula okungenalutho sikhomba indlela phakathi kwamadivayisi amabili.

Lapho amaphakethe efika, yeka ukusola ukudlulisela

Iphrofayili ingumsolwa olandelayo, futhi isizathu esivamile ubudala. Ifayela le-.ovpn elikhiwe liqukethe igunya nezinto kusukela esikhathini sokukhipha, ngakho iphakethe elishintshiwe isitifiketi salo kamuva lizokwenqaba iklayenti elisaphethe ikhophi endala.

Ukuthutha kungokunye ukungafani okufanele kuhlolwe ngokucacile, ngoba iphrofayili nephakethe kuhlelwa ezindaweni ezihlukene. Ukushintsha iphrofayili isuka ku-UDP iye ku-TCP ngaphandle kokushintsha iphakethe kushiya iklayenti lilinde isilaleli esingekho, futhi iklayenti libika umbhalo ofanayo we-handshake ojwayelekile ewubika kukho konke okunye. Funda umugqa we-proto efayelini, bese ubheka iphrothokholi ekhethiwe ekhasini leseva, futhi kuphela lapho nciphisa ngokuthi ziyavumelana. Ukufunda imithetho yefirewall ye-DSM ukuhlolwa kwesithathu: umthetho ovumela iphothi lisuka kusixhumi-esincane sasekhaya kodwa hhayi kwi-inthanethi kulula ukuwushiya ngemva kokuhlola, futhi udala ukuxhumana okusebenza kusuka ekhishini futhi kwehluleke kuzo zonke ezinye izindawo.

Hlola indlela umsebenzisi okude ayihamba ngempela

Iklayenti elingaphakathi kwe-LAN efanayo lingafinyelela i-NAS ngaphandle kokuthinta ukudlulisela, ngakho akufakazeli lutho ngokufinyelela okude. Sebenzisa ifoni evaliwe i-Wi-Fi, noma buza umuntu ongaphandle kwenethiwekhi, futhi ubheke isibali serutha phakathi kwalowo mzamo. Uma umzamo okude uhluleka kuyilapho owasekhaya uphumelela, ukudlulisela noma ifirewall kusekhona esithombeni.

Bhala isimo esisebenzayo ngenkathi sisebenza: iphothi langaphandle, ikheli langaphakathi, iphrothokholi, isixhumi sephakethe, kanye negama lephrofayili nosuku lokukhipha. Lapho i-handshake yehluleka futhi, umehluko phakathi kwaleyo nothi nokuhlelwa kwamanje yiwona phutha, futhi akekho okumele athole futhi ukuthi isevisi isebenzisa liphi iphothi kulawa amabili.