Yimaphi amachweba e-VPN okufanele avulwe ku-firewall: iphrothokholi ngayinye
I-PPTP idinga i-TCP 1723 kanye ne-GRE, i-L2TP/IPsec idinga i-UDP 500 ne-4500 kanye ne-ESP, kanti i-SSTP, OpenVPN ne-WireGuard zidinga ichweba elilodwa ngalinye. Nakhu okufanele kuvulwe.
Imiyalo emibili ehlukene inquma ukuthi umhubhe we-VPN uzodlula yini ku-firewall: ichweba i-client ecisha kulo kanye nephrothokholi ethwala umthwalo. Vula eyokuqala kuphela khona umhubhe uzogunyazwa, kodwa ngemva kwalokho akukho datha ezohamba. Okuncane kakhulu ichweba elilodwa le-TCP kanye ne-GRE ku-PPTP, amachweba amabili e-UDP kanye ne-ESP ku-L2TP/IPsec ne-IKEv2, kanye nechweba elilodwa ku-SSTP, OpenVPN ne-WireGuard. Isiqondiso, ukulandelela isimo kanye ne-NAT kunquma okunye.
Qala ngechweba i-client ecisha kulo
Umphakathi ngamunye unendawo yokungena i-client eqala ukuxhumana nayo, futhi yilowo ndawo yokungena umthetho wakho wemvume okufanele uwusho ngokuthi. Amaklayenti e-PPTP axhuma ku-TCP 1723. I-L2TP/IPsec iqala i-IKE ku-UDP 500 bese idlulela ku-UDP 4500 lapho kusetshenziswa ukunqamula kwe-NAT, kuyilapho uhlaka lwe-L2TP ngokwalo lukwi-UDP 1701 ngaphakathi komhubhe. I-SSTP isonga isikhathi ku-TLS ku-TCP 443, i-IKEv2 ixoxisana ku-UDP 500 no-4500, i-OpenVPN isebenzisa i-UDP 1194 ngokujwayelekile kodwa ivame ukudluliselwa ku-TCP 443, kanti i-WireGuard ilalela ku-UDP 51820.
| Family | Rule to add on the gateway | Typical mistake |
|---|---|---|
| WireGuard | UDP port from ListenPort, for the peer address | Assuming 51820 when the config says otherwise |
| OpenVPN | The configured UDP or TCP port, often 443 | Opening 1194 after the server moved |
| SSTP | TCP 443 limited to the gateway IP | Allowing 443 to any destination |
| IKEv2 | UDP 500 and UDP 4500, plus ESP | Allowing only 500 and losing NAT-T |
| L2TP/IPsec | UDP 500, 4500, ESP, and 1701 inside the tunnel | Exposing 1701 to the internet |
| PPTP | TCP 1723 and IP protocol 47 | Writing a rule for TCP 47 |
Thatha lezi zinombolo njengamanani ajwayelekile hhayi izinto ezingaguquki. Isixhumi se-WireGuard sisebenzisa noma yiliphi ichweba lokulalela elikhonjiswa ukuhlelwa kwaso, futhi iseva ye-OpenVPN ingahlala kunoma yiliphi ichweba elikhethwe umlawuli. Funda ukuhlelwa kweseva ngaphambi kokubhala umthetho, ngoba i-firewall evulelwe u-1194 ayisizi sevayo eshanjelwe ku-443.
Ikholomu yesithathu yilapho iningi lamathikithi ezinguquko lihamba khona kabi. Umthetho ukhona, kodwa ukhomba endaweni okungeyona, isiqondiso okungesona noma ukuthutha okungekona.
I-GRE ne-ESP izinombolo zephrothokholi, hhayi amachweba
I-GRE ne-ESP azinawo nhlobo amachweba, ngakho ifomu le-firewall elamukela izinombolo zamachweba kuphela alikwazi ukuziveza. I-GRE iyiphrothokholi ye-IP 47 futhi i-ESP iyiphrothokholi ye-IP 50, zombili ziqhathaniswa ngesikhala sephrothokholi kusihloko se-IP. Umthetho obhalwe njengechweba le-TCP 47 awuhambisani nalutho, futhi yileyo ndlela inqubomgomo ye-PPTP ebonakala ilungile kodwa ilahle wonke iphakethe ngemva kokuxhawulana.
Amarutha asekhaya afihla lokhu ngemuva kwebhokisi lokukhetha lokudlula elifaka umthetho wephrothokholi futhi, ku-GRE, sifake nomsizi we-NAT odingekayo ukuze kuhlelwe ukugeleza. Ku-firewall yangempela wengeza iphrothokholi ngokwakho: vumela iphrothokholi ye-IP 47 iye kuseva ye-PPTP, vumela iphrothokholi ye-IP 50 iye esangweni le-IPsec. Lapho inkundla inganikezi isikhala sephrothokholi, ukufaka embo kuyindlela yokuphuma, yingakho i-IKEv2 ingabuyela ku-UDP 4500 nokuyingakho i-OpenVPN ne-WireGuard zingakaze zihlangabezane nale nkinga.
Hlola ukuthi umthetho uhlangana nani ngempela ngaphambi kokusola iklayenti. Isibali siphakethe esihlala siku-zero esangweni sisho ukuthi umthetho awukaze uqale ukusebenza, futhi noma ngabe kufakwa kabusha kangaki ohlangothini lweklayenti akukushintshi lokho.
Isiqondiso, isimo ne-NAT kushintsha impendulo
Iklayenti elitshayela ngaphandle kanye nesango elilalela ngaphakathi ziyizimfuneko ezihlukene, futhi uhlu olulodwa lwamachweba lungalunga kwelinye isiqondiso lube lungalungile kwelinye. I-firewall eyazi isimo ilandelela ukugeleza kwe-UDP ku-500 no-4500 futhi ivumele izimpendulo ukuba zibuye ngaphandle komthetho wesibili. I-ESP ne-GRE azithwali amachweba, ngakho idivaysi ye-NAT ayinalutho engalubamba futhi idinga umsizi noma ukufaka embo ukuze ilandelele isikhathi.
Ukunqamula kwe-NAT yingxenye evame ukushiywa. I-IKEv2 iqala ku-UDP 500, ithole idivaysi ye-NAT bese iqhubeka ku-UDP 4500, ngakho inqubomgomo evumela u-500 kuphela inikeza umhubhe osungulwayo bese uthula. I-L2TP/IPsec yenza umnyakazo ofanayo. Uma ukubamba kwakho kukhombisa ukushintshana kokuqala kodwa kungabonisi ukuhamba okuqhubekayo, funa umthetho oma ku-500.
Bhala isiqondiso kanye nawo wonke umthetho. «Vumela i-UDP 4500» akusho lutho kuze kube usho ukuthi kusukaphi kuya kuphi, futhi umthetho olungile kuklayenti elihambayo ngokuvamile awulungile kumlingani wesayithi-kuya-sayithi.
Hlola yonke indlela ngokubamba
Gijimisa ukubamba esangweni, hhayi kuklayenti: iklayenti libhala kuphela lokho okufikile. Lezi zihlungi zihlanganisa imiphakathi engenhla futhi zikhombisa ukuthi isiphi isigaba asikho:
sudo tcpdump -ni any tcp port 1723
sudo tcpdump -ni any udp port 500 or udp port 4500
sudo tcpdump -ni any proto gre
sudo tcpdump -ni any proto 50Funda okukhishiwe njengokulandelana. Lapho ukuxoxisana kuvela kodwa iphrothokholi yomthwalo ingaveli, ukulahleka kwenzeka ndawana thize phakathi kweklayenti nesango. Lapho kokubili kuvela kodwa ikhasi lihluleka, i-firewall ayisasona isola; bheka umzila, i-DNS noma ichibi lamakheli anikezwe iklayenti.
Emishinini engenayo i-tcpdump, ubufakazi obufanayo buvela kuzibali zesixhumi nemithetho. Amabhayithi angena kodwa awaphumi kusixhumi somhubhe — lokho kukhombisa indlela yokubuya hhayi umthetho wokuqala wemvume.
Shiya iqoqo lemithetho ongayivikela
I-SSTP ku-TCP 443 ayihlukaniseki ne-HTTPS evamile kunoma yisiphi isihlungi esisekelwe emachwebeni, futhi yilokho okuhlosiwe lapho inethiwekhi ivumela ukuhamba kwewebhu kuphela. Yingakho futhi umthetho ka-443 kufanele usho isango njengendawo ekuyiwa kuyo esikhundleni se-inthanethi yonke. Susa imithetho yesikhashana yanoma-ikuphi-kuya-kunoma-kuphi ngokushesha lapho umhubhe usebenza. Bhala ukuthi wuphi umthetho ohlangene, inombolo yephrothokholi lapho ikhona, nesiqondiso, ukuze umuntu olandelayo aqale ngobufakazi.
Amasango asefwini wendawo-kuya-sayithi enza ukukhetha kubonakale: iphrofayela elandiwe isebenzisa i-SSTP ku-443 noma i-IKEv2 ku-500 no-4500, futhi kufanele uvule kuphela lokho iphrofayela ekukhetha ngempela. I-PPTP ayikufanele ukukhishwa kwe-GRE kunethiwekhi yesimanje, ngoba abahlinzeki bemakhalekhikhini bavame ukulahla iphrothokholi 47 kungakhathaliseki i-firewall yakho. Ngaphambi kokuvala ithikithi, qinisekisa ukuthi umthetho uhambisana nechweba ekuhlelweni kweseva, ukuthi isikhala sephrothokholi sibekiwe lapho umphakathi ukudinga khona, nokuthi indawo ekuyiwa kuyo isango hhayi noma yiliphi ikheli.