Iphakethe eliphi inqubomgomo ye-VPN ene-WAN ezimbili okufanele iyifanele?

Izicelo zokuhambisa i-VPN ngomugqa wesibili wokukhuphuka zichaza imisebenzi emibili ehlukene okungenani, futhi inqubomgomo elungisa eyodwa ayithinti enye. Emsebenzini wokuqala, ukuthutha okubethelwe phakathi kweziphetho ezimbili kudlulela kwelinye ikheli le-WAN. Kwesibili, ukugeleza kohlelo lokusebenza okususiwe kokubethelwa komsebenzisi oxhunyiwe kuphuma kubheke kwesinye isinyathelo esilandelayo. Kokubili kusemthethweni, kokubili kusebenzisa umzila, futhi ngakunye kudinga ukufana kwiphakethe elikhona endaweni lapho isinqumo sithathwa khona. Hamba ngazo lezi zivivinyo ngezansi ngokulandelana, ngoba eyokuqala inquma ukuthi iyiphi iphakethe okufanele imithetho elandelayo iyibize.

Qamba izinkulumo ezimbili

Cabanga ngomsebenzi okude oxhumeke kusango lehhovisi, ovula i-HTTPS eya kuseva yohlelo lokusebenza yangaphakathi. Kunezinkulumo ezimbili ezizimele ocingweni, futhi zinezinkomfa ezihlukene emaphethelweni womabili. Inkulumo yangaphandle ihamba phakathi kweziphetho ezimbili ze-VPN: isuka kukheli lesango iye kukheli lozakwabo, ngokweprothokholi nechweba okwavunyelwana ngakho. Inkulumo yangaphakathi ihamba isuka kukheli elinikezwe iklayenti iye kukheli leseva yohlelo lokusebenza echwebeni 443.

Ichweba lomgomo wohlelo lokusebenza akulona ichweba lokuthutha le-VPN, futhi akukho nani lenqubomgomo ku-TCP 443 elizohambisa ithungo. Ngokufanayo, umthetho oqondisa kabusha ikheli lokuthutha lozakwabo awusho lutho mayelana nokuthi isicelo se-HTTP salowo msebenzisi siya kuphi ngemva kokususwa kokubethelwa. Bhala izinkulumo zombili nezinkomfa zazo zangempela ngaphambi kokuthinta umthetho, ngoba ukudideka okuningi kule ndawo kuvela ekutheni iqanjwe eyodwa kanti enye iyalungiselelwa.

Thola lapho inqubomgomo yakho ingabona khona iphakethe ngempela

Ukufana kufanele kuhlolwe kuchungechunge nasekhaleni lamagama lapho iphakethe lisekhona ngesimo osichazile. Umthetho onamathele ekungeneni kwe-LAN ubona iphakethe langaphakathi lingabethelwe, ngaphambi kokuthi liqondiswe ethungeni. Umthetho osetshenziswa kuthrafikhi ekhiqizwa endaweni ubona amaphakethe akhiqizwa isango ngokwalo, futhi awuwuhlanganisi ngokuzenzakalela uthrafikhi isango eliwudlulisayo nje. Ukuphuma okufakwe embozweni kwesinye isimo sesithathu, ngokuvamile kusingathwa kusixhumi esibonakalayo esithwala ithungo hhayi ohlangothini lwe-LAN.

Yingakho ucezu olulodwa lokuhlela luziphatha ngendlela ehlukene ezingxenyeni ezimbili: amaphoyinti okunamathisela ahlukene, futhi ingwegwe yenqubomgomo yomkhiqizi ingaba ngaphambi noma ngemva kwesinyathelo sokubethela. Funda indlela yephakethe yomkhiqizo othile esikhundleni sokucabangela ukulandelana kusuka kumdwebo womunye umkhiqizi.

Qinisekisa ukuthutha okwavunyelwana ngakho

Kuma-IPsec afakwe embozweni we-UDP, RFC 3948 ibeka i-ESP ngaphakathi kwe-UDP futhi isebenzisa uphawu olungelona i-ESP ukuze i-IKE ihlale ihlukaniseka echwebeni elabiwekanayo. I-ESP evamile iyiprothokholi ye-IP, akuwona ichweba le-TCP noma le-UDP, ngakho umthetho wodonga lomlilo obhalwe ngenombolo yechweba awuzukuhambisana nawo nhlobo. Lo mehluko unquma ukuthi inqubomgomo yakho ye-WAN idinga umthetho we-UDP, umthetho weprothokholi, noma kokubili.

Amanani avunyelwene ngawo anqoba lawo akhunjulwayo. Funda amachweba namakheli amanje omhlanganiso kudivayisi esikhundleni sokwengeza i-TCP 4500 noma ichweba elidala lomkhiqizi ukuze uqiniseke, okuheha uthrafikhi ongahlobene futhi kufihle inkinga yangempela yokuhlukanisa.

Hlola indlela yokubuya ngaphambi kokuzibophezela

Impumelelo yokuphuma ifakazela ingxenye yedizayini. Iphakethe elibuya libheke echibini lamaklayenti akude alisabonakali ngaphansi kwekheli leklayenti uma ukufakwa embozweni sekushintshe, ngoba umgomo wangaphandle uyikheli lokuthutha lozakwabo. Uma umugqa wesibili wokukhuphuka ufinyelela lozakwabo ngesinye isisebenzi, ukuhumusha nokuhlunga kwaso kungase kungavumelani neyokuqala, futhi umhlanganiso kungase kudingeke wakhiwe kabusha esikhundleni sokuthuthwa.

Isimo sokuhumusha amakheli enethiwekhi siyisisulu esivamile sokushintshwa kwe-WAN. Rekhoda umugqa wokukhuphuka okhethiwe, ikheli lomthombo wangaphandle elilindelekile, ukuhumusha okusetshenziswayo nokufinyeleleka kozakwabo kubuyela kuwo, bese ugcina ukuthutha kufinyeleleka ngaphandle kokukuthumela ethungeni elikuthwalayo.

Qinisekisa zombili izingqimba ngokuthwebula okubili

Ukuthwebula okukodwa kusixhumi se-WAN nokukodwa ngaphakathi ethungeni kuqeda umbuzo ngokushesha kunanoma yikuphi ukuqhathanisa kokuhlela. Kugijime kusuka esangweni ngesikhathi iklayenti eligunyaziwe lenza isicelo esisodwa, futhi gcina womabili amafayela.

sudo tcpdump -ni wan1 'udp port 4500' -c 20
sudo tcpdump -ni tun0 'tcp port 443 and host 203.0.113.10' -c 20
ip route get 203.0.113.10 from 10.8.0.6

Ukuthwebula kokuqala kufanele kubonise inkulumo yangaphandle iphuma kusixhumi obukade usiqonde, nekheli lomthombo elilindelekile. Kwesibili kufanele kubonise inkulumo yangaphakathi kanye kuphela, ngaphandle kokuphindwa, ikheli leklayenti lingumthombo futhi iseva yohlelo lokusebenza ingumgomo. Ukusesha komzila kuqinisekisa ukuthi iyiphi ithebula umgwaqo abengayisebenzisa kulelo bhangqa lomthombo nomgomo, futhi yilapho iphutha lenqubomgomo livame ukuvela khona. Uma okukodwa kwalokhu ukuthwebula kungaveli, iphoyinti lesinqumo likwenye indawo hhayi lapho umthetho unamathele khona, futhi ukulungisa kungokwalapho hhayi ekufaneni okubanzi.