Ukuthi i-VPN yesayithi yakho iphela kuphi kunquma ukuthi yini ehlolwayo

Ithuneli phakathi kwamasayithi lifihla imininingwane eyodwa enquma wonke umklamo wokuhlola: idivayisi ngqo lapho iphakethe langaphakathi livela khona njengombhalo ocacile. Konke okungaphambi kwalelo phuzu kubona i-ESP, futhi konke okungemva kwalo kubona i-IP evamile umthetho ongayibamba. Beka umngcele endaweni engalungile futhi i-firewall oyikhokhele iba i-router enelayisense. Umhlahlandlela ongezansi udweba umugqa kuqala bese ucela ukuthi iyiphi idivayisi okufanele ibe ngumnikazi wawo.

Dweba umugqa lapho iphakethe liyeka ukushifrishwa

Kumodi yethuneli, iphakethe lasekuqaleni liyashifrishwa bese lisongwa kuheda entsha yangaphandle ye-IP eqondiswe esangweni elinguzakwethu. Lelo phakethe langaphandle lithwala iphrothokholi 50 ye-ESP, ngakho noma iyiphi idivayisi phakathi kwamasango amabili ingayihambisa ngaphandle kokufunda amakheli angaphakathi. Idivayisi yokuqala ekhipha ukushifra iwumngcele wokuphepha, futhi futhi iyidivayisi yokuqala engasebenzisa inqubomgomo ekugelezeni kwangaphakathi. Konke okungezansi kwalelo phuzu ukuhambisa okuvamile.

Maka izinto ezintathu kumdwebo: iphuzu lokugcina langaphandle elamukela i-ESP, amanethiwekhi avikelwe ashiwo kunqubomgomo, kanye nokugxuma okulandelayo okwenziwa yiphakethe elikhishiwe ukushifra. Uma lezi zinto ezintathu zingekho kudivayisi eyodwa, unokudlulisela okufanele kuklanywe, hhayi iphuzu elilodwa lokulawula.

I-RFC 4301 ibiza idivayisi ekhipha ukushifra ngokuthi isango lokuphepha futhi ithatha inqubomgomo yayo njengengxenye yomngcele. Lolu uhlaka olusizo kakhulu kunomkhakha womkhiqizo, ngoba idivayisi iwumngcele lapho iphethe inqubomgomo, hhayi lapho ishidi layo ledatha lithi i-firewall.

I-firewall njengokuphela: idivayisi eyodwa, iphuzu elilodwa lenqubomgomo

Uma i-firewall iqeda ithuneli, i-router ephezulu kufanele nje ilethe i-ESP kuyo. I-firewall iqinisekisa uzakwethu, ikhipha ukushifra, bese isebenzisa imithetho yayo evamile kuphakethe langaphakathi endleleni eya ku-VLAN yamaseva. Lokhu kunikeza indawo eyodwa yokufunda inqubomgomo nendawo eyodwa yokufunda amalogi, okuyinto ejwayelekile ukuthi icelwe ukucwaninga.

Hlola izimvume ezimbili ngokwahlukana. Ukuvumela i-IKE ne-ESP kudivayisi akusiwona umthetho ofanayo nokuvumela isayithi elikude ukuthi lifinyelele kuseva, futhi i-firewall eyamukela ithuneli kodwa ivimba ukugeleza kwangaphakathi ibonakala isuka kolunye uhlangothi njengethuneli eliphukile ngqo.

Izindleko zukuthi i-firewall manje isendleleni yayo yonke ithrafikhi yesayithi, ngakho ukudluliswa kwayo, imikhawulo yemisamo nokuziphatha kwayo ekushintsheni lapho kuhluleka kuba ukuziphatha kwethuneli uqobo. Yilinganisele imifudlana ehlangene yesayithi, hhayi iphrofayili yokufinyelela kude okungenzeka yathengwa ngayo.

I-router njengokuphela: ukugxuma kokuhlola kuba ukuzikhethela

Uma i-router ikhipha ukushifra, iphakethe selicacile lapho lifinyelela ithebula lokuhambisa. Uma i-firewall ehlukile kufanele ihlole leyo thrafikhi, i-router kufanele iyithumele nge-firewall futhi indlela yokubuya kufanele ibuye ngendlela efanayo. Umzila oqondile osuka ku-router uya ku-VLAN yamaseva ususa i-firewall endleleni ngokuthula kuyilapho uyishiya emdwebeni.

Lena yikhona ukwehluleka okufanele kufunwe kunethiwekhi ekhona: imizila emibili eya kusandulela esifanayo, eyodwa nge-firewall neyodwa eqondile, futhi eyoqondile iyanqoba ngobude besandulela noma ngemethrikhi. Ithuneli lisadlulisa ithrafikhi futhi ukuhlola okukholelwa kukho akwenzeki.

Amathuneli asekelwe emizileni enza lokhu kubonakale, ngoba ithuneli iyisixhumi esingahambiswa ngedivayisi enye. Amathuneli asekelwe kunqubomgomo akhetha ithrafikhi ngesikhethi, okungase kushiye iphakethe elikhishiwe ukushifra ku-router ngaphandle kwenye indawo yokuya.

Buza womabili amakhandidethi imibuzo emihlanu efanayo

Iphepha lokusebenza elifushane linqoba imatrixi yezici, ngoba umbuzo ngamunye uhambisana nomugqa owodwa emdwebeni. Buza ikhandidethi ngalinye:

• Yiziphi izinguqulo ze-IKE, yiziphi izindlela zokuqinisekisa uzakwethu namamodeli okuhambisa le nguqulo ewasekela ngempela?
• I-ESP yamukelwa kuphi, futhi ukugeleza okukhishiwe ukushifra kuvunyelwa noma kwenqatshwa kuphi?
• Amahostu endawo afunda kanjani izandulela ezikude, futhi uhlangothi olukude lufunda kanjani ezakho?
• Yikuphi ukudluliswa, inani lamisamo nokuziphatha kokushintsha lapho kuhluleka okufanele iphuzu lokugcina likubekezelele emthwalweni wangempela?
• Ubani umnikazi wemininingwane yokungena kukazakwethu, wenqubomgomo kanye nendlela yokubuyisela lapho ithuneli liyinto ephukile?

I-pfSense ibhala i-IPsec esekelwe kunqubomgomo nasekelwe emizileni njengamamodeli ahlukene anemingcele ehlukene, futhi lo mehluko ubalulekile kunethebuli elisebhokisini. Hlola imodi eqondile nokuhlunga okusekelwayo kwethrafikhi ekhishiwe ukushifra kunguqulo ozoyisebenzisa ngempela.

Uma ikhandidethi lingakwazi ukuphendula umbuzo wesibili ngomthetho ongawufunda, akusiwona umngcele owufunayo, kungakhathaliseki ukuthi lenza kahle kangakanani okunye. Cela umbhalo womthetho esikhundleni sokuthi yebo, futhi thatha impendulo engacacile njengokuthi cha.

Qinisekisa indlela ngokubamba, hhayi ngomdwebo

Umdwebo uchaza inhloso futhi ukubamba kuchaza ukuziphatha, ngakho qinisekisa ukuthi yisiphi isixhumi esithwala i-ESP nesiphi esithwala ukugeleza kwangaphakathi ngaphambi kokuthemba noma yisiphi sazo.

tcpdump -ni wan0 esp
tcpdump -ni lan0 host 10.60.4.20
ip xfrm policy list

Uma ukubamba kokuqala kubonisa i-ESP iza futhi kwesibili kubonisa iphakethe langaphakathi ohlangothini lwe-LAN, iphuzu lokukhipha ukushifra likhona lapho ucabanga khona. Uma iphakethe langaphakathi livela kusegimenti edlula i-firewall, ukuhambisa akulungile, kungakhathaliseki ukuthi umbhalo wenqubomgomo uthini. Uhlu lwe-xfrm lube selubonisa ukuthi yiziphi izikhethi ezifakiwe nokuthi ngakuphi uhlangothi.

Phinda ukubamba endleleni yokubuya, ngoba ukuhambisa okungalingani kuvamile lapho isayithi linemiphumela emibili engaba khona. Ithuneli elisebenza kwelinye uhlangothi liphelelwe yisikhathi kwelinye cishe njalo yilokhu, futhi akukho ukuhlela inqubomgomo ohlangothini olukude okukulungisayo.