Ubani omphendulayo ngempela ekhelini elikhethekile le-VPN?

Ikheli elihlezi lingasetshenziswa esabelweni senhlangano akusilona isilaleli, futhi ukulengeza ku-firewall akukudali neyodwa. Kukhona okumele kuqede i-IKE kulelo kheli, futhi indlela iyahluka kuye ngokuthi i-gateway iyaliphethe ikheli noma idivayisi ephezulu iyalihumusha. Umzila wephakethe uwona ohlukanisa lokhu kokubili, futhi uwona onquma ukuthi iyiphi imfanelo yeplathifomu oyidingayo ngaphambi kokuba othile avule isicelo soshintsho. Qala ngokwenza imodeli yomzila, bese ukhetha.

Umzila wephakethe ngemuva kwekheli

Uzakwabo uthumela i-IKE ekhelini alinikeziwe, ku-UDP 500 noma ku-UDP 4500 uma ukudlula kwe-NAT kuhilekile. Noma iyiphi idivayisi ephethe lelo kheli emzileni iyamukela i-datagram endaweni bese iyaphendula, noma iyidlulisela kwenye indawo. Lena yimibono emibili kuphela, futhi konke okunye kulesi sihloko kuvela ekutheni iyiphi iqinisekile.

Ukuthola endaweni kusho ukuthi kukhona isokhethi kuleyo divayisi, eboshelwe kulelo kheli. Ukudlulisa kusho ukuthi i-datagram iyabhalwa kabusha bese ithunyelwa phambili kwelinye iphuzu lokugcina, eliba naso isokhethi ngaleso sikhathi. Umthetho we-firewall ovumela i-UDP 500 awukutshele lutho ngokuthi iyiphi kulezi ezimbili eyenzekayo.

Bhala irekhodi ngaphambi kokuthinta noma yini: ikheli ozakwabo abaxhumana ngalo, indlela inethiwekhi ephezulu eliletha ngayo, i-interface yendawo noma iphuzu lokugcina elinomqondo elilithathayo, kanye nenqubo ephendula i-IKE. Imigqa emine, futhi ngamunye ungahlolwa. Uma omunye wabo engaziwa, lokho kungaziwa kuwumsebenzi wokuklama hhayi imininingwane yokuqalisa okuzonqunywa kamuva. Ukuwagewalisa ngemuva kokugunyazwa kwesicelo soshintsho yikho okwenza umthetho wokuhumusha ungezwe kudivayisi engalungile.

Imodeli A: i-gateway iphethe ikheli

Kumodeli yokuqala i-gateway yona ngokwayo iphethe ikheli, kungaba njengekheli lesibili ku-interface ekhona, njengekheli ku-interface ekhethekile, noma njenge-loopback iplathifomu eliyisekelayo njengephuzu lokugcina lethunjela. Lezi yimfanelo ezintathu ezihlukene ezinemizila emithathu yokuhlela ehlukene, futhi iplathifomu elisekela eyodwa lingase lingazisekeli ezinye.

Qinisekisa ukuthi iplathifomu kanye nokukhishwa kusekela ngqo lokhu kuhlelwa ngaphambi kokuklama ngakho. Ibhlokhi eligaywe ngomzila, ikheli elengeziwe ku-interface kanye nephuzu lokugcina le-loopback akushintsheki, futhi imibhalo yokukhishwa okukodwa ayithembisi ukuthi okulandelayo kuzokwenza okufanayo.

ip -br addr show
ss -lunp | grep -E ':500|:4500'
sudo tcpdump -ni eth0 'udp port 500 or udp port 4500'

Isokhethi elalelayo siwubufakazi. Uma kungenalutho oluboshelwe ekhelini, i-gateway ayisiyo isiphetheli noma ithebula lomzila lithini, futhi ukubanjwa kwephakethe kuzobonisa ama-datagram efika kungenalutho oluphendulayo.

Ungafaki i-interface yesibili ku-subnet esivele ikhona kwenye indawo ku-topology futhi ungacabangi ukuthi iplathifomu izokuxazulula. Ama-subnet e-interface anqamulelayo akha ukukhetha komthombo okungacaci, futhi kumaplathifomu amaningi ukwenqaba ngokuphelele ukuhlelwa.

Imodeli B: idivayisi ephezulu iyalihumusha

Kumodeli yesibili i-firewall ephezulu iphethe ikheli elikhethekile futhi idlulisela ukuhamba kwenye i-gateway ye-VPN ehlukile. Lokho wukuhumusha kwendawo okuwumkhondo obuyayo, futhi kuwukuklama okuvumelekile ngokuphelele uma kubhalwe kanjalo.

Okungebona wubufakazi bokuthi idivayisi ephezulu ithole isokhethi ye-VPN yendawo. Ukuhumusha kudlulisa amaphakethe; akwenzi ibhokisi eliphezulu libe umphenduli we-IKE. Uma umthetho ophezulu ususwa noma umkhondo wawo obuyayo waphuka, i-VPN iyama nakuba i-gateway iphilile futhi izilaleli zayo zingalimalanga.

Rekhoda womabili amakheli: lelo ozakwabo abaxhumana ngalo kanye lelo i-gateway elibona ngempela. Bese urekhoda ukuthuthwa kanye nomkhondo obuyayo, ngoba ukuhumusha okusebenza ku-UDP 500 kodwa kungasebenzi ku-ESP evalelwe kuzoxhuma bese kwehluleka ukuthwala ukuhamba, okuwukwehluleka okudidayo ukulungisa kamuva.

Ubunikazi akusilo ikheli langaphandle

I-IPsec yehlukanisa iphuzu lokugcina lethunjela nokuhamba elikuvikelayo, futhi ukwakheka kugcina lezo zincumo ezindaweni ezihlukene. Ukushintsha ikheli ozakwabo abaxhumana ngalo akushintshi ngokuzenzakalela ukuthi imiphi imigqa yangaphakathi evunyelwe, imiphi imizila efakiwe noma imiphi imithombo umhlangano ongayifinyelela.

Ubunikazi obuqinisekisiwe buhlukile futhi. I-IKEv2 ithwala umthwalo wobunikazi kanye nokushintshana kokuqinisekisa okungadingi ukufana nekheli lephakethe langaphandle, futhi yikho kanye okwenza ukuklama okuhumushiwe kusakwazi ukuqinisekisa ngendlela efanele.

Lokho kuzimela kuyasiza futhi kuyisicupho. Amagama amabili e-DNS axazuluka esilalelini esisodwa esivamile awakhethi ama-backend e-VPN ahlukene, futhi isitifiketi esisho ubunikazi obubodwa angeke sanelise uzakwabo olindele obunye. Qinisekisa ukuthi uzakwabo uqinisekisa ini ngaphambi kokucabanga ukuthi ikheli lodwa linquma lokho.

Yamukela ukuklama ngokubuka uxhumano olulodwa

Hlola ukuthi uxhumano olusha olugunyaziwe lulethwa kuphi ngempela, ubuphi ubunikazi obuphendulayo, futhi yikuphi ukuhamba okuyimfihlo okuvunyelwe kamuva. Imibono emithathu, izingqimba ezintathu ezihlukene, futhi ukusesha komphakathi okuphumelelayo kwekheli akuhloli neyodwa yazo.

Gcina futhi icala elingelona: uzakwabo okungafanele amukelwe, noma umugqa wangaphakathi okungafanele ufinyeleleke, oqinisekisiwe ngemuva koshintsho. Irekhodi olibhale ekuqaleni yilona elenza lokho kuhlolwa kwenzeke ngaphandle kokwakha kabusha ukuklama kusuka enkumbulweni.

Injongo yakho konke lokhu iwukuvumela umnikazi wenethiwekhi ukuthi akhethe indlela yokwabela esekelwayo esikhundleni sokuthembela esitatimendeni esivamile mayelana nokuthi yini i-firewall ngayinye engayenza ngekheli elengeziwe. Yiso leso sitatimende lapho lezi zakhiwo zihluleka khona, ngoba sizwakala sikholeka kuyo yonke iplathifomu futhi ngokuvamile asilona iqiniso kunoma yiyiphi. Irekhodi lemigqa emine linquma lokho eplathifomuni yakho ngemizuzu eyishumi.