I-tunnel ye-VPN ayixhumani neze: lapho amaphakethe ema khona ngempela

Iklayenti liqhubeka lizama futhi, ilogi iyama ngaphambi kokuthi ukuxhawulana kuqedwe, futhi iseva ayibhali lutho neze. Lelo phethini liqondisa ukunaka kude nobufakazi bokuqinisekisa futhi libheke indlela: okuthile phakathi kweziphetho ezimbili kwenqaba ukuthwala iphrothokholi edingwa i-tunnel. Nquma lapho amaphakethe ema khona ngaphambi kokuthinta noma yikuphi ukulungiselelwa, ngoba iphrothokholi ehlungiwe kanye nephasiwedi engalungile kukhiqiza iphutha elifanayo elinomusa kumaklayenti amaningi. Izivivinyo zihlelwe ngokwezindleko, okushibhile kuqala.

Fakazela lapho ithrafikhi ima khona

Thwebula ngasikhathi sinye kusikhombisi-mkhathi sokuphuma sekilayenti nase-seva. Qhathanisa okwaphuma nalokho okwafika, futhi bhala ukuthi umehluko uvela kuluphi uhlangothi.

Akukho lutho kuseva kusho ukuthi indlela noma i-NAT yokuqala ilahla ithrafikhi, kuyilapho ukufika okungenazo izimpendulo kukhombisa i-firewall kuseva noma indlela yokubuyela engekho. Irotha evamise ukuqeda ama-tunnel ayivamisile ukugcina ilogi ewusizo, ngakho ukuthwebula kuba umbhalo. Bhala imbobo yendawo ekuyiwa kuyo kanye nenombolo yephrothokholi, ngoba kokubili ukwehluleka kubonakala kufana engxoxweni yekilayenti.

I-PPTP iyafa ngaphandle kwephrothokholi 47

I-PPTP ithwala ukulawula ku-TCP 1723 kanye nedatha yayo ngaphakathi kwe-GRE, okuyiphrothokholi ye-IP 47 hhayi inombolo yembobo. Ukudlulisela i-1723 kuphela kuveza umphumela ojwayelekile: uxhumano luyazifakazela bese luthula, ngoba awukho umthetho wephrothokholi ethwala umthwalo. Iklayenti alikwazi ukuhlukanisa lokho nephasiwedi enqatshiwe, ngakho ukuthwebula kufanele kube ngaphambi kwezinguquko zokulungiselelwa.

I-passthrough ihamba ngakolunye uhlangothi olumelene nokudlulisela okungenayo, futhi i-firmware ivamise ukusebenzisa ilebula elilodwa kukho kokubili ngokwanele ukudida wonke umuntu. Kukilayenti le-Linux i-firewall yasendaweni ingalahla i-GRE kudala ngaphambi kokuthi irotha ihlanganyele, ngakho iphrothokholi 47 idinga umthetho wayo futhi umsizi we-conntrack kufanele ulayishwe. I-ufw ye-Ubuntu igcina leyo mikhuba kufayela le-before, ngoba imikhuba evamile ye-allow ayikwazi ukuveza inombolo yephrothokholi. Ngemuva kwalokho phinda ulayishe i-firewall esikhundleni sokuqalisa kabusha umshini.

# /etc/ufw/before.rules, inside *filter
-A ufw-before-input -p gre -j ACCEPT
sudo ufw allow 1723/tcp
sudo modprobe nf_conntrack_pptp
sudo conntrack -L | grep gre

I-L2TP ne-IPsec ngemuva kwama-NAT amabili

L2TP ngaphakathi kwe-IPsec idinga i-UDP 500 yokushintshana kokhiye, i-UDP 4500 lapho i-NAT itholakala, kanye ne-ESP njengephrothokholi 50. Ngayinye yazo ihlungwa ngokwahlukile, ngakho umthetho ovumela eyodwa awufakazeli lutho mayelana nezinye ezimbili. Amarotha amabili alandelanayo ahumusha iphakethe ngalinye kabili, futhi iziphetho azisavumelani ngokuthi kuxoxwanisweni ngaluphi uhlangothi.

Yenza ibhuloho ngemodem yangaphandle, noma cisha i-NAT kurotha yangaphakathi, ukuze ikheli lomphakathi lifinyelele idivayisi eqeda i-tunnel. Lapho kungenakwenzeka khona kokubili, i-tunnel kufanele iqalwe ngaphakathi komngcele we-NAT ekabili, hhayi ukuqedwa lapho.

Amanethiwekhi omhlinzeki nokwabiwa kwamakheli

Ikheli le-WAN elingaphakathi kwe-10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 noma i-100.64.0.0/10 lisho ukuthi irotha ayinalo ikheli lomphakathi futhi akukho kudlulisela okungenayo okuvela ku-inthanethi okungayifinyelela. I-NAT yezinga lomhlinzeki iphinde ihlunge izinguqulo ezingazilindele, futhi i-GRE ivamise ukuba yisisulu kuma-linki eselula. Qhathanisa ikheli le-WAN kurotha ngokwayo, hhayi ikheli elibikwa isayithi yokusesha leklayenti elingemuva kwayo.

Ukusebenzisa irotha efanayo ocingweni olunentambo kuhlukanisa okutholakele ngomhlinzeki nephutha lokulungiselelwa esivivinyweni esisodwa. Lapho umhlinzeki enqaba iphrothokholi, izinketho ezisele ukuthutha okunye ku-443 noma i-tunnel eqalwe ngaphakathi.

Funda uhlu lwabalaleli ngaphambi kokuvala izimbobo

Ukuskena kwezimbobo okukhathazayo ngokuvamile kuyisethi yezici efika ivuliwe. Bhala uhlu lwabalaleli, hlobanisa isokhethi ngayinye nengxenye ethile, bese ucisha leso sici esikhundleni sokuvala imbobo, ukuze imibono emibili ingehlukani.

ss -lntup
systemctl list-units --type=service --state=running | grep -i vpn
nc -vz 203.0.113.10 1723
nc -vzu 203.0.113.10 4500

Izimiso ezizenzakalelayo ze-SoftEther ziyisibonelo esihle: i-TCP 443, 992 kanye ne-5555, kanti izici ze-L2TP/IPsec ne-tunnel ye-DNS zengeza amasokhethi azo. Ukucisha lezo zici kususa abalaleli esikhundleni sokubafihla, futhi isivivinyo esivela kumsingathi wangaphandle sisho ukuthi umhlinzeki uyayivumela yini imbobo ukuba idlule neze. Umalaleli ophendula endaweni angase abe usavalekile phezulu, ngakho qhathanisa ikheli le-WAN lerohta ngokwayo nalokho okubikwa isevisi yangaphandle.