Ukulungiswa kwe-MSS ye-TCP esangweni le-Linux IPsec: kulungisa ini

I-Ping iyasebenza, i-SSH iyasebenza, ikhasi elincane liyalayishwa, bese kuthi yonke impendulo enkulu ime kuze kuphele isikhathi. Iphethini evamile ikhomba kubukhulu bephakethe hhayi ekufinyelelekeni: indlela ithwala ukuxhawulana namakhilobhayithi okuqala, bese ingxenye yosayizi ophelele inyamalala. Esangweni le-Linux IPsec, umthetho we-TCP MSS uvame ukuba yisixazululo, kodwa kuphela uma uqonda ukuthi ushintsha ini nokuthi iphakethe elikuthintayo likuphi ngempela. Ukulandelana ngezansi kulandela iphakethe kusukela kuphawu kuze kufike ekubekweni komthetho, ukuze ukwazi ukuma ngokushesha lapho incazelo ingasafaneleki.

Uphawu oluphakamisa i-MSS

I-TCP ixoxisana ngosayizi ophezulu wengxenye ekuxhawulaneni. Uma lelo nani likhulu kunalokho indlela engakuthwala ngemva kokufakwa, umthumeli uyaqhubeka nokukhiqiza izingxenye ezingafiki neze, futhi uxhumano luyama ngemva komjikelezo wokuqala. Izimpendulo ezincane ziyangena; ezinkulu azingeni.

Ukuphawula kwe-ICMP kungasindisa uxhumano ngokutholakala kwe-MTU yendlela, futhi umdidi womlilo olahla leyo milaye iguqula ukuma kube umgodi omnyama ongenalutho. Yingakho umhubhe ofanayo usebenza kuhlelo lokusebenza olulodwa futhi uhluleke kwelinye ngaphandle komehluko ocacile ekulungiselelweni.

Ini okwenziwa umthetho we-TCPMSS nokungekwenziwa

Umthetho ubhala kabusha inketho ye-MSS kumaphakethe okuxhawulana e-TCP njengoba edlula. Awubeki i-MTU yesikhombisi somhubhe, awushintshi inqubomgomo ye-IPsec, futhi kumakheneli amanje wehlisa kuphela inani elimenyezelwe esikhundleni sokuphakamisa elincane kakade. Uthinta futhi i-TCP kuphela; imithwalo ye-UDP, ukuziphatha kwe-DNS kanye nezikhethi zethrafikhi ezixoxiwe zingaphandle kokufinyelela kwayo.

Ngenxa yokuthi ushintsho lwenzeka ngesikhathi sokuxhawulana, uxhumano olukhona olwasungulwa ngaphambi komthetho lugcina inani lalo elidala. Hlola ngoxhumano olusha, futhi ulindele ukuthi umzamo wokuqala ngemva koshintsho yiwo ozokutshela okuthile. Akukho lutho emthethweni olufinyelela uxhumano osele luvuliwe. Yingakho isilungiso esisetshenziswe phakathi kwesigameko singabonakala sengathi asenzanga lutho.

Beka umthetho endleleni yangaphakathi ye-TCP

Esangweni le-Linux elisekelwe kwinqubomgomo, iphakethe elidluliselwa phambili lisabonakala njenge-TCP evamile lapho umdidi womlilo ulibona. Inqubomgomo ye-IPsec inquma ukuthi iphakethe lizovikelwa; umdidi womlilo awuboni isihloko se-ESP somfudumalo wangaphakathi, ngakho-ke ukufanisa ne-ESP lapha kuchaza iphakethe elihluke ngokuphelele. Lokho kungafani yikho okwenza eminye imithetho ibonakale ilungile futhi ingafani neze.

Ngamagama e-iptables, umthetho ungoweThebula le-mangle endleleni yokudlulisa, ukhawulelwe kumaphakethe okuxhawulana: iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1270. Inombolo iyisibonelo, hhayi ingunaphakade yomhlaba; yithole ezindlekweni zokufaka nase-MTU yangempela yendlela. Okulingana ne-nftables kubeka usayizi ophezulu wengxenye kucingo lwe-forward noma i-postrouting.

Gcina imithetho yokulalela yangaphandle ye-IKE ne-ESP ihlukile emthethweni wokudlulisa wangaphakathi. Umthetho owodwa ozama ukuvumela kokubili umfudumalo wohlelo lokusebenza kanye neprotocol yangaphandle ugcina ungafani ngokuthembekile nakukodwa kwako.

Hlonipha umnikazi womdidi womlilo nokulandelana kwe-NAT

Uma i-UFW ingumnikazi womdidi womlilo womsingathi, engeza izinguquko ze-mangle nokudlulisa ngokusebenzisa ukulungiselela kwayo okusekelwayo okuhlala njalo esikhundleni sokuthayipha umyalo onyamalala ekulayisheni okulandelayo. Umthetho ofakwe kuthebula elingalungile noma ngemva komthetho wokugcina awunawo umphumela, futhi ithebula elisebenzayo likufihlela lokho.

Ukuhunyushwa komthombo kuyisinqumo esihlukile esivame ukusebenzisana nalokhu. Ukukhululwa okubekwe ngaphambi komthetho jikelele we-masquerade kuvimbela ithrafikhi evikelwe ukuthi ingalahlekelwa umthombo odingwa yinqubomgomo yayo; akulungisi inkinga yosayizi, futhi umthetho wosayizi awulungisi inkinga yokuhumusha.

Qinisekisa ngokuncane, bese uma

Vula uxhumano olusha enkonzweni ehlulekayo futhi ubheke kokubili uhlelo lokusebenza kanye nezibali zomthetho. Uma ukuma kunyamalala, unobufakazi mayelana naleyo ndlela ye-TCP nalokho kufakwa. Awunabo ubufakazi bokuthi wonke ama-protocol e-VPN ayafaneleka, ukuthi wonke uhlelo lokusebenza lwe-UDP lulungisiwe, noma ukuthi inkonzo ethile ephezulu yayiyimbangela yokuqala.

Vumela ukuphawula kosayizi kwe-ICMP kusebenze lapho inqubomgomo ivuma khona, futhi phatha ngokuqapha ukulungiswa okuzenzakalelayo okusekelwe ku-MTU yomzila lapho indlela yangaphandle ye-IPsec ingamelwe umzila wangaphakathi. Uma isiphetho sincane, kulula kakhulu ukuxilonga isigameko esilandelayo.