Iyiphi isigaba se-VPN esihlulekile: i-IPsec, ukulawula kwe-L2TP noma ukuqinisekiswa kwe-PPP
Thola isigaba sokugcina esiphumelele bese ulungisa lolo ungqimba kuphela: i-IPsec, itshaneli yokulawula ye-L2TP, ukuqinisekiswa kwe-PPP noma ukwabiwa kwekheli.
Ushintshe iphasiwedi futhi akukho okunyakazile, ngoba iphutha lalingekho ku-PPP. I-L2TP/IPsec ibika iphutha elilodwa lokuxhumana kokudluliswa okuhlanu okuhluke ngokuphelele, futhi ukudluliswa ngakunye kunokulungiswa kwako. Sebenza ngokuhlehla: thola isigaba sokugcina esiphumelele bese ushintsha kuphela lokho okuzayo ngemva kwaso. Ukulandelana ngezansi nakho kunquma ukuthi yibuphi ubufakazi obuqoqwa kuqala.
Phendula imibuzo emine ngokulandelana
Phoqelela umzamo omusha, ngoba amanye amaklayenti aqhubeka ekhombisa iphutha langaphambilini kuze kuxhunywe kabusha iphrofayela. Bese uphendula lokhu: ngabe kwakukhona ukuhlobana kokuphepha kwe-IPsec, ngabe kwavela ukuxhumana kokulawula kwe-L2TP nokushaya ucingo, ngabe i-PPP yafinyelela isinqumo sokuqinisekisa, futhi ngabe i-IPCP yanikeza iklayenti ikheli? Cha yokuqala yisigaba osilungisayo. Konke ngemva kwaso akukahlolwa, ngakho igama lomsebenzisi elinqatshiwe alifakazi lutho uma ukuhlobana kungakaze kube khona.
Vumelanisa amawashi ezinhlangothini zombili ngaphambi kokuqhathanisa. Umzamo wokuphinda ohlanze i-IPsec futhi wehluleka ku-PPP ubonakala njengophutha olulodwa uma iklayenti likhombisa umyalezo wokugcina kuphela futhi ilogi yeseva isagcina umzamo wangaphambilini. Funda ngesigxivizo sesikhathi, hhayi ngomugqa onomsindo kakhulu.
Uma unesithombe-skrini somsebenzisi kuphela, ncika ekwehlukaniseni okushibhile: ukhiye owabiwe ngaphambilini ongafanele kanye ne-xl2tpd engaphenduli neze kukhiqiza umbhalo ofanayo ebhokisini le-Windows, kodwa okunye kudinga imfihlo eshintshiwe ezinhlangothini zombili kanti okunye kudinga idemoni eqaliwe noma umthetho we-firewall kuseva uqobo. Idivayisi ephakathi nendawo ayikwazi ukulahla u-1701 wangaphakathi ngemva kokuba i-IPsec yemodi yokuthutha ikusongile, ngakho ungafuni isihlungi sendlela esingekho.
Yini engumnikazi wangempela wongqimba ngamunye
I-IPsec ivikela amaphakethe phakathi kontanga ababili; i-L2TP ithwala isikhathi se-PPP ngaphakathi kwaleyo ndlela evikelwe, yingakho i-RFC 3193 icacisa imodi yokuthutha esikhundleni somhubhe wayo. Ilebuli yeklayenti ithi L2TP, ngakho umhubhe nokungena kubonakala kuyindlela eyodwa. Akunjalo: ukuxhumana kokulawula kwe-L2TP kuqinisekisa iziphetho zomhubhe lapho ukusetshenziswa kukuvula khona, kanti i-PPP iqinisekisa umsebenzisi ngokwehlukile nge-CHAP, i-PAP noma i-MS-CHAPv2 ngokwenqubomgomo yeseva.
Lokhu kwehlukanisa kuchaza izimfihlo ezimbili abantu abahlala bezidida. Ukhiye owabiwe ngaphambilini uqinisekisa ontanga be-IPsec. Igama lomsebenzisi nephasiwedi kukhombisa umsebenzisi ku-PPP. Ukuphinda ubhale imfihlo ebiwe yi-Windows kuphrofayela eqinisekisa ngezitifiketi akushintshi lutho esigabeni esihlulekayo, futhi ukuhlela iphasiwedi ye-PPP akukwazi ukunikeza itshaneli evikelwe engekho. Ukuzibamba okufanayo kusebenza ekuhloleni ubunikazi: ungacishi ubunikazi kontanga noma ukuqinisekiswa kwesitifiketi ukuze uthole umhubhe, ngoba lapho okuxhumayo kuba indlela, hhayi untanga.
Ukuqinisekisa akusona isiphetho se-PPP. Ngemva kokwamukelwa komsebenzisi, i-IPCP ixoxisana ngekheli leklayenti kanye nezinketho ze-DNS ne-WINS izeseva ezilungele ukuzinikeza. Iklayenti lingadlula i-CHAP noma i-MS-CHAPv2 kodwa liphele lingenalo ikheli, okuwukuphuthela ngaphakathi kwe-PPP hhayi inkinga yomzila. I-L2TP emsulwa ngaphandle kwe-IPsec ihlala ivumelekile futhi ingavikelwe, ngakho ukuxhumana okuphumelelayo akukaze kufakazele ukuthi ithrafikhi ivikelwe; hlola lokho iseva ekudingayo, hhayi ilebuli yeklayenti.
Nquma ngesigaba sokuqala esingekho
Funda ithebula ngokwento yokuqala engekho, ukusuka kwesobunxele kuya kwesokudla. Ikholomu yesokudla iwumsebenzi okuwukuphela kwawo ofanele ngaleso sikhathi; konke okusesobunxele kwayo sekufakazelwe, futhi ukuphinda ukuhlole kushisa iwindi lokuphazamiseka ngaphandle kokwengeza ulwazi.
| First thing missing | What it means | Change this |
|---|---|---|
| No IKE reply on 500 or 4500 | The path or the listener never answered | Firewall, NAT-T forwarding, server listener |
| IKE runs, no IPsec association | Identity, key, or proposal mismatch | Proposal and PFS set, pre-shared key, local and remote ID |
| Association up, no L2TP control connection | Inner signalling never reached xl2tpd | UDP 1701, tunnel and session sections, NAT encapsulation |
| Control connection up, PPP auth refused | The user or method was rejected | Credential format, allowed auth method, account policy |
| PPP auth accepted, no address assigned | IPCP never completed | Address pool in xl2tpd.conf, ms-dns and ms-wins in options.xl2tpd |
| Address assigned, applications fail | The inner path is wrong | Routes, DNS, MTU or MSS, server forwarding |
Imigqa emithathu ifanele isexwayiso. Umugqa we-1701 yindawo lapho amaklayenti e-Windows angemuva kwe-NAT evame ukugcina khona: ukuhlobana kuqedwa, bese kungafiki lutho, futhi imbangela ukusongwa hhayi iphasiwedi embi. Umugqa we-IPCP yiwo ofundwa ngokungalungile njengenkinga yomzila, ngoba i-Windows isonga ikheli elingekho kumphutha 720 futhi isithonjana setreyi sithi nje ukuxhumana kwehlulekile; lokho kuphuthela kusemva kokuqinisekisa nangaphambi kokuhambisa umzila. Umugqa wokugcina akusona ngisho ukwehluleka kwe-IPsec, nakuba isithonjana sithi kunqanyuliwe.
Imiyalo ehlukanisa izingqimba
Kuseva ye-Linux eqhuba i-strongSwan, i-swanctl --list-sas ibala ukuhlobana okusunguliwe nobunikazi kontanga, kanti i-ipsec statusall ihlanganisa amahostu amadala e-strongSwan ne-libreswan. Ngezansi, i-ip xfrm state ikhombisa ukuhlobana kwangempela kwe-kernel, kuyilapho i-ss -lunp | grep 1701 ifakazela ukuthi i-xl2tpd iboshelwe kuphi. Qhuba i-xl2tpd -D ngaphambili ukuze ubone ukuxhumana kokulawula nokushaya ucingo, futhi uvule ukulungisa amaphutha kwe-pppd ku-/etc/ppp/options.xl2tpd ukuze ubone indlela ephakanyisiwe nempendulo.
Uma amalogo ekhombisa ukuqinisekisa okuphumelelayo, umbuzo olandelayo ukuthi i-IPCP yaqedwa yini. Hlola ukuthi i-ip range esigabeni se-[lns default] se-/etc/xl2tpd/xl2tpd.conf isenamakheli akhululekile yini, nokuthi i-/etc/ppp/options.xl2tpd ngempela ithwala i-ms-dns ne-ms-wins uma iklayenti ikulindele. Ichibi eliphelile nokukhethwa kwe-DNS okungekho kubonakala kuhlukile ocingweni: okokuqala kushiya iklayenti lingenalo ikheli futhi kunokuthi 720, okwesibili kunikeza ikheli kodwa akukho isixazululi, ngakho amagama ehluleka kuyilapho i-ping emakhelini aluhlaza isebenza. Akukho nakukodwa okulungiswa ngokuphinda ubhale iphasiwedi.
Kuklayenti, isengezo se-L2TP se-NetworkManager sibhala ingxoxo ye-pppd kujenali, ngakho i-journalctl -u NetworkManager -b ivamise ukuhlukanisa umhubhe phezulu, ukuqinisekisa kunqatshiwe kusuka awukho umhubhe nhlobo. Ku-Windows, i-Get-VpnConnection ibika izilungiselelo zangempela zokuqinisekisa zephrofayela, futhi izehlakalo ze-RasClient ngaphansi kwe-Application ku-Event Viewer zisho ingxenye ehlulekile. Uma ibhokisi lengxoxo lifiphele kakhulu, vula i-netsh ras set tracing * enable.
Ukubamba kudinga ukuqaphela okukodwa. Nge-IPsec yemodi yokuthutha, i-UDP 1701 yangaphakathi ishicilelwe, ngakho ukubamba kusixhumi sangaphandle kukhombisa i-ESP, noma i-UDP 4500 ngaphansi kwe-NAT-T, futhi akukho i-L2TP nhlobo. Ukungabikho kwe-1701 ekubambeni kulindelekile futhi akusona ubufakazi bembobo evinjiwe; bheka ukuthi izibali ze-ESP noma ze-4500 zinyakaza yini.
I-NAT, i-MTU nemizila: lapho isitaki sikhohlisa khona
I-NAT iphula izicabango ngaphambi kokuba kufakazelwe noma yini. I-ESP iwumthetho wayo we-IP, ngakho idivayisi ehumushayo iyilahla ngaphandle uma ontanga besonga; yilokho okunikezwa yi-UDP 4500. Kuseva ye-Windows eyona uqobo ingemuva kwerutha yasekhaya noma isango le-NAT lamafu, isigaba se-IPsec sehluleka ngophutha 789 kuze kube i-AssumeUDPEncapsulationContextOnSendRule isetwa ku-2 ngaphansi kokhiye we-PolicyAgent futhi umshini uqalwa kabusha, futhi ukwehluleka kuhlala kungahlukaniseki nombobo uvaliwe. Amaklayenti angemuva kwe-NAT alula: uma iseva inekheli lomphakathi, i-NAT-T ku-UDP 4500 iyawathwala futhi lelo nani alihileleki.
Uma i-PPP isiphezulu, i-MTU enomgodi omnyama ilingisa umhubhe ofile: amaphakethe amancane ayadlula, ukuxhawulana kwe-TLS noma ukulayisha ikhasi kuyalenga, futhi iklayenti lingase likhombise ukuthi lixhunyiwe. Yehlisa i-MTU yesixhumi noma ucindezele i-MSS esangweni ngaphambi kokusola iseva. Ukuhambisa umzila komhubhe ohlukanisiwe kungomunye umkhohlisi; isibonelo somrete esiphushelwe ngemaski engafanele sishiya umhubhe uphilile kanti uhlelo olulodwa lungafinyeleleki. Igama lomhosi eliyimfihlo lengeza isinyathelo salo: uma umbuzo uphuma ngesixazululi sendawo, igama lihluleka ukuxazululwa ngaphambi kokuba noma yimuphi umzila uhlolwe.
Uhlu lokuhlola ngaphambi kokuthinta ubufakazi bokuqinisekisa
Sebenza ngohlu ngokulandelana futhi ume entweni yokuqala ehlulekayo. Isinyathelo ngasinye sishibhile, futhi ngasinye sikhipha isigaba sonke sezinguquko.
- Qinisekisa ukuthi ukuhlobana kukhona ezinhlangothini zombili, kuqhathaniswa nobunikazi kontanga hhayi ilebuli elixhunyiwe.
- Qinisekisa ukuthi i-UDP 1701 ifinyelela ku-xl2tpd; ukuhlobana okungenalo ukushaya ucingo wukuphuthela kwakho.
- Funda isinqumo se-PPP futhi, uma kuqinisekisile, umphumela we-IPCP, ngaphambi kokucabanga ukuthi iphasiwedi ayilungile.
- Manje kuphela phinda ufake ubufakazi bokuqinisekisa ngendlela iseva eyilindele, ngoba isiqalo sesizinda sishintsha i-akhawunti.
- Uma kusahluleka, bamba izinhlangothi zombili ngezikhathi ezihambisana bese uqhathanisa isigaba ngesigaba.
Ukuma esinyathelweni sesibili kusho inkinga yendlela noma yokusongwa, futhi akukho kuhlela kwephasiwedi okuzokunyakazisa. Ukuma esinyathelweni sesithathu kusho ukuthi ilogi isivele isho indlela noma ichibi lamakheli okufanele lilungiswe. Noma kunjalo, ushintsho olulandelayo yilolo ongaluqinisekisa, futhi uyeka ukuzungeza kuzilungiselelo ezingakaze zihileleke.