Kungani ikheli le-VPN tunnel lakho lingavuli iphothi lokungena
Ikheli le-tunnel likhomba iklayenti lakho kontanga abangakwazi ukuhambisa kulo, futhi alikhiqizi silaleli nanini. Hlola ukubopha, indlela yokubuya, bese kuba umgomo.
Xhuma ku-VPN yasehhovisi, qala isevisi encane kuphothi 8443, thumela ikheli le-tunnel kumuntu osebenza naye, bese ubuka ukuxhumana kwehluleka ngenkathi iklayenti lisabika ukuthi lixhunyiwe. Akukho okonakele ku-tunnel: ikheli linikeziwe, iseshini iyasebenza, futhi amaphakethe okwakufanele athwale impendulo awakaze avunyelwe. Yenza izivivinyo ezintathu ezingezansi ngokulandelana futhi ume kulowo ohlulekayo, ngoba ngayinye inokulungiswa okuhlukile futhi kube kanye kuphela okumayelana ne-VPN.
Qala lapho isokhethi iboshelwe khona ngempela
Ngaphambi kokuthi noma yini ihambiswe, kufanele kube nokuthile okulalela ekhelini umshayi angakwazi ukufinyelela kulo. Amaseva okuthuthukisa ayizisulu ezijwayelekile, ngoba amaningi awo abopha ku-loopback ngokuzenzakalelayo futhi amukela kuphela ukuxhumana okuvela emshinini ofanayo. Ikheli le-tunnel alikushintshi lokho kubopha, futhi uhlelo lokusebenza luzokwenqaba ukuxhumana kudala ngaphambi kokuthi i-VPN ibandakanyeke.
ss -ltnp | grep 8443
netstat -ano | findstr 8443Funda ikholomu yekheli lendawo esikhundleni sesimo. 127.0.0.1:8443 kusho i-loopback kuphela, futhi ukulungiswa ukubopha ku-0.0.0.0 noma kukheli le-tunnel ngokwalo. 0.0.0.0:8443 kwamukela kuzo zonke izixhumanisi, okuyinto ebanzi kunalokho iningi elikuhlosayo lapho umshini unekheli lomphakathi futhi; 10.64.7.15:8443 inguqulo emincane elalela kuphela lapho umuntu osebenza naye angafinyelela khona. Phawula negama lenqubo kumphumela ofanayo, ngoba isibonelo esisele esivela ekuhloleni kwangaphambilini siyisizathu esivamile sokuthi iphothi libonakale livulekile futhi liphendule ngokuqukethwe okungalungile.
Bese ubuza ukuthi ngabe kukhona okungahambisa kulelo kheli
Ikheli le-tunnel linencazelo kuphela kontanga abalungiselelwe ukuthumela leso siqalo ku-tunnel. Umshini womuntu osebenza naye unetafula lawo, futhi uma ungenayo indlela eya ku-subnet ye-tunnel, iphakethe liya kusango lokuzimela futhi lifele endaweni engazi ukuthi ikheli likhona. Lona umbuzo wokuhambisa ohlangothini lomshayi, hhayi imvume ohlangothini lwakho.
| Symptom from the caller | What it usually means | Where to look next |
|---|---|---|
| Connection refused immediately | Nothing is listening on the address the packet reached | The bind address and the process owning the port |
| Connection times out with no reply | A policy dropped the packet, or no route returns | Server forwarding, host firewall, cloud security group |
| Works from the same machine only | Listener is on loopback, or no route reaches the tunnel address | Bind address, then the caller's route to that prefix |
Iseva ephakathi kwamaklayenti amabili ibalulekile ngokufanayo. Ekwakhiweni okuvamile kokufinyelela kude, iklayenti ngayinye ivula ukuxhumana okuphumayo okuya kusango, futhi usango lugcina isimo salezi zigelekeqe, ngakho izimpendulo zibuya ngendlela eluyaziyo kakade. Ukuxhumana kusuka kwelinye iklayenti kuya kwelinye kuyigelekeqe elisha okufanele usango lulwamukele futhi ludlulise, futhi ukusetshenziswa okuningi kukuvala ngamabomu ukuze kugcinwe amaklayenti ehlukene. Izinsizakalo ze-VPN zabathengi zivamise ukwehlukanisa ngokuzenzakalelayo; amasango ezinkampani kwesinye isikhathi akwamukela ngamaqembu.
Hlola isiqondiso ngaphambi kokushintsha noma yini kusibungu. Uma ikheli le-tunnel liphendula lisuka kusango uqobo kodwa hhayi kusuka kontanga, umehluko isilungiselelo sekhayenti-kuya-kwekhayenti sasango, futhi akukho ukuhlela kwe-firewall yasendaweni okungayithatha indawo.
Ekugcineni, thola umgomo ovumela ukugeleza
Izingqimba ezintathu zomgomo ziphakathi kwephakethe elihambisiwe nesevisi ephendulayo: isinqumo sokusudlulisa seseva ye-VPN, i-firewall yesibungu, nanoma yiliphi iqembu lokuphepha lefu lijika eliphambi kwesibonelo. Zontathu kufanele zivumelane, futhi ziyehluleka ngezindlela ezihlukene, yingakho uphawu olusetafuleni olungenhla luwusizo kunomlayezo wephutha kusiphequluli.
I-firewall yesibungu iyingqimba abantu abayikhohlwayo ngemuva kokubopha okuphumelelayo, ngoba umthetho ovumela iphothi kusixhumanisi se-LAN awukuvumeli ngokuzenzakalelayo kusixhumanisi se-tunnel. Imithetho ekhawulelwe kusixhumanisi iwumklamo olungile futhi iyisizathu esivamile sesevisi esebenza isuka ehhovisi kodwa ingasebenzi isuka ekhaya. Funda ububanzi bomthetho, hhayi inombolo yephothi.
Ukuhlunga okunesimo kuchaza icala eliphambene. Ukuxhumana okuphumayo kusuka kukhompyutha yakho kudala isimo, futhi izimpendulo zako zamukelwa ngaphandle komthetho wokungena. Ukuxhumana komuntu osebenza naye kuyigelekeqe elisha ngokuphelele elingenasimo ngemuva kwalo, ngakho lidinga imvume ecacile. Lokho kungalingani kuyisizathu sonke sokuthi iseshini yesiphequluli esebenza kumshini wakho ingasho lutho mayelana nokuthi isevisi iyafinyeleleka yini ngaphandle.
Uma ukuhlola okukodwa kuhluleka, shintsha umklamo hhayi i-tunnel
Uma isidingo ukuthi umuntu osebenza naye avule isevisi yakho yasendaweni, impendulo eqotho ngokuvamile iwusistimu owakhelwe ukufinyelela kokungena. I-tunnel ye-SSH ehlehlisiwe iyincane kakhulu: umshini wakho uxhuma uphuma uya kusibungu umuntu osebenza naye asekwazi ukusifinyelela, futhi isilaleli sikhona kuleso sibungu.
ssh -N -R 8443:127.0.0.1:8443 [email protected]Isidluliseli sidinga GatewayPorts clientspecified ekulungiseleleni kweseva ye-SSH yaso, uma kungenjalo isilaleli esidlulisiwe sibopha ku-loopback kusidluliseli futhi umuntu osebenza naye uhlangabezana nokwenqatshwa okufanayo njengangaphambilini. Kunoma yini ehlala isikhathi esingaphezu kwantambama, isilinganisi somthwalo noma i-ingress enokuhlolwa kwezempilo nesitifiketi segama elishicilelwe iyithuluzi elingcono, futhi i-tunnel yendawo-kuya-ndawa enemizila yazo zombili izingxenye zokuxhumana iyimpendulo efanele lapho amanethiwekhi amabili edinga ngempela ukukhuluma.
Ngayinye yale mikhakho yenza ukuvezeka kucace, futhi lokho kuyiphuzu. I-VPN ihambisa amaphakethe phakathi kwamanethiwekhi owawuvele ugunyaziwe ukuwasebenzisa; ayishicileli isevisi futhi ayiguquli ikhompyutha ibe isibungu esibheke ku-inthanethi. Umsebenzi ukuquma ukuthi yikuphi kwezingqimba ezintathu okufanele kushintshwe, futhi i-tunnel ayivamisile ukuba ngenye yazo.