Kungani i-IKEv2 kwi-Android ihluleka echwebeni le-UDP elingajwayelekile

Ifomu lendabuko le-IKEv2 lithatha ikheli, hhayi ichweba. Qinisekisa ukuthi iklayenti iyalisekela, setha amachweba womabili eseva, bese ubheka ukufreyimwa namarekhodi.

Isango liphendula i-IKEv2 ku-UDP 4443 ngesizathu esithile, iphrofayela inenkambu ebizwa ngokuthi i-Server, uthayipha igama lomsingathi nechweba, futhi ucingo lubika ukuthi alikwazi ukufinyelela iseva noma alikwazi ukuxazulula ikheli. Akukho okubhliwe. Ifomu lendabuko le-Android lilindele umsingathi, futhi kunjalo naku-Windows. Ichweba elingokwezifiso yikhono leklayenti ngaphambi kokuba kube isilungiselelo seseva, futhi amaklayenti ambalwa kuphela akuvumela ukuliveza. Dlula ezingxenyeni ezintathu ngokulandelana: iklayenti ingasho ini, iseva ilalela ini, nokuthi iziphetho zombili zifreyima amaphakethe ngendlela efanayo.

Okwathunyelwa ucingo ngempela

Uchungechunge lwe-host:port enkambini eyenzelwe igama luxazululwa njengegama. Isixazululi asibuyiseli lutho i-vpn.example.net:4443, futhi iphutha olibonayo akusona isikhathi esiphelile echwebeni, kodwa ukwehluleka kokuxazulula igama noma ukungafinyeleleki. Lo mehluko ubalulekile, ngoba ukuzama futhi ngegama elifushane noma ngenye inethiwekhi ngeke kulungise uchungechunge ifomu elingakwazi ukuluhlaziya.

Iphrofayela yendabuko ye-IKEv2 ku-Android, njengeklayenti le-VPN elakhelwe ngaphakathi ku-Windows, iboshelwe emachwebeni ajwayelekile e-IKE. Awekho anomboniso wenkambu yechweba, futhi akukho ukuhlela kwephrofayela okwengeza enye. Uma isilaleli somqhubi sikhona ngempela ku-4443, iklayenti elakhelwe ngaphakathi iyithuluzi elingalungile, hhayi elilungiswe ngendlela engalungile.

Sebenzisa iklayenti elikhombisa ichweba

Iklayenti le-strongSwan le-Android libhala ichweba leseva elilungisekayo kuzilungiselelo zephrofayela ezithuthukile, yingakho livela cishe kuyo yonke iresiphi esebenzayo yalo mklamo. Lokho kusekelwa kungokwalelo klayenti: enye i-app ye-IKEv2, noma igatsha lomhlinzeki le-app efanayo, ingase ingabonisi inkambu efanayo ngisho noma i-daemon ye-strongSwan engaphansi iyisekela.

Cela umqhubi isethi yonke ngasikhathi sinye: igama lesango, ichweba le-UDP, indlela yokuqinisekisa, kanye nobunikazi beseva okufanele iklayenti ilindele. Ichweba elingokwezifiso akusona isizathu sokucisha ukuhlola izitifiketi noma ukushintsha amaphrothokholi. Faka ichweba lapho iklayenti elifakiwe likulindele khona, futhi uma lelo klayenti lingenayo inkambu enjalo, impendulo ingenye iklayenti egunyaziwe, hhayi indlela yokuqhamuka.

Iseva inamachweba amabili, futhi womabili kufanele afane

I-IKE iqala ku-UDP 500, futhi ukudlula kwe-NAT ngokuvamile kuhambisa i-IKE ne-ESP ehlanganisiwe ku-UDP 4500. Lezi zilungiselelo ezihlukene ku-strongSwan, ngakho iseva esihanjiswe echwebeni elilodwa elingokwezifiso kufanele iguqule womabili abe yinani elifanayo:

plugins {
  socket-default {
    port = 4443
    port_nat_t = 4443
  }
}

Uma ichweba elilodwa lisebenza kuzo zombili izindima, i-daemon kufanele yehlukanise i-IKE ne-ESP-ngaphakathi-kwe-UDP kusokhethi efanayo, okukwenza ngophawu lwamabhayithi amane okungeyona i-ESP olwandulela umyalezo we-IKE. Yingakho iklayenti lingenakho ukuxoxisana echwebeni elingokwezifiso bese liqhubeka buthule ku-4500, futhi yingakho umusho othi “vele ushintshe ichweba” ufihla imfuneko yokufreyima.

Ukudlulisela akusona isilaleli

Ukudlulisela u-4443 kwisilaleli se-IKE esijwayelekile yindlela yokwehluleka ebukeka icishe iphumelele. Ukushintshana kokuqala kuyafika, iseva iyaphendula, bese uxhumano luma noma luphendule izikhiye zibe lutho, ngoba impendulo iphuma kwelinye ichweba futhi ukuxhumana okuhlanganisiwe kwakamuva akukaze kuhambisane nesimo esidalwe iziphetho zombili. Umthetho obhala kabusha ichweba lendawo ngaphandle kokuhambisa isilaleli ukhipha impela lo mphumela ovulekile ngengxenye.

Indlela kufanele futhi ivumele i-UDP kusuka ekugcineni kuya ekugcineni. Ukuthi i-TCP 443 idlula kunethiwekhi yehhotela noma yomqhubi akusho lutho nge-IKEv2 echwebeni le-UDP, ngisho noma inombolo iyafana. Lapho kuvunyelwe kuphela i-TCP 443, ichweba le-UDP elingokwezifiso aliguquli i-IKEv2 ibe yi-HTTPS, futhi impendulo efanele ingaba enye indlela yokufinyelela hhayi olunye ucwaningo lwechweba.

Hlukanisa izigaba ezintathu lapho uhlola

Thwebula kuseva ngenkathi iklayenti lizama kanye. Isicelo esingafiki neze siwumbuzo wendawo yokugcina noma wothango; isicelo esifika ngaphandle kwempendulo siwumbuzo wesilaleli noma wenqubomgomo; impendulo elandelwa ukuthula iwumbuzo wokufreyima noma wobunikazi.

tcpdump -ni eth0 -vv udp port 4443

Bese ufunda umyalezo weklayenti hhayi isikhombisi salo esijikelezayo. Iphutha lesiphakamiso lisho ukuthi ama-algorithm awahambisani, ukwehluleka kokuqinisekisa kusho ukuthi ubunikazi noma izitifiketi azihambisani, futhi ukuthunyelwa kabusha okuphindaphindiwe ngaphandle kwempendulo kusho ukuthi akukho okuphendulayo kulelo chweba. Hlola isigaba esisodwa ngesikhathi futhi ushintshe inkambu eyodwa phakathi kokuzama; imibhalo ye-strongSwan mayelana nokudlula kwe-NAT ichaza uphawu nokuziphatha kwechweba okukubonisayo ukuthwebula.

Izihloko ezihlobene