Kungani iklayenti elilodwa le-VPN kuphela elixhuma ngemuva kwe-router efanayo

Ama-laptop amabili asekuxhumekeni kwasekhaya okufanayo, futhi i-VPN yasehhovisi yamukela elilodwa kuphela kuwo. Eyesibili iyaphela isikhathi noma ilinde kuze kube yilapho eyokuqala inqamuka, futhi akekho othinte isilungiselelo seklayenti phakathi kwemizamo emibili. Imininingwane yokungena iyafana naleyo eyayisebenza umzuzu owedlule, futhi lokhu kuyinkomba yokuthi ukuqinisekiswa akusona isizathu sokwehluleka. Izindlela ezintathu zakha leli phethini, futhi ilogi yeseva ngokwayo isho ukuthi ubhekene nayi yiphi.

Funda ilogi yesango ngaphambi kokuthinta iklayenti

Irekhodi yeseva yemizamo yomibili iphendula umbuzo wokuqala, futhi iphendula ngendlela eyodwa kwezintathu. Uma umzamo wesibili ungaveli nakanye kuleyo logi, iphakethe alikafiki kumlaleli, futhi inkinga ingeyasekhaya noma ingeyendlela yomhlinzeki. Uma ilogi ibhalisa umzamo futhi iwunqabe, ithunu liye lafika, ngakho indaba ingubunikazi, ilayisense noma umkhawulo wamaseshini, hhayi into ethile entanjeni. Uma ilogi ibhalisa iseshini ephumelelayo ngenkathi iklayenti lisabika ukwehluleka, bheka indlela yokubuya noma ukuthi ngabe amaklayenti amabili anikezwa ikheli elilodwa lethunu.

Isizinda sokuxhumeka sokuselula sihlukanisa imindeni leyo ngokushibhile: sebenzisa iklayenti lesibili ngedatha yeselula ngenkathi eyokuqala isaxhunyiwe. Impumelelo lapho ikhomba ekuxhumekeni kwasekhaya, futhi ukwehluleka okufanayo lapho kukhomba esangweni, okushiya i-router ingenacala. Asikho isiphumo esinquma sisodwa, kepha ngasinye sisusa uhhafu wendawo yokusesha emzamweni owodwa.

Bhala umphumela phansi ngaphambi kokushintsha noma yini, ngoba imiphumela emithathu yelogi iholela ekulungiseni okuthathu okungahlobene. Inothi elisho ukuthi yikuphi kokuthathu okubonile linexabiso elingaphezu kwesithombe sesikrini sephutha leklayenti.

I-router yenzani nge-GRE ne-NAT-T

I-PPTP iyisoni esivamile: itshaneli yokulawula i-TCP 1723 ngenkathi indlela yedatha i-GRE, okunguphrothokholi we-IP 47. Amarouter amaningi abathengi afika nomsizi we-PPTP olandelela ukuxhumana okukodwa kokulawula, ngakho iklayenti lesibili ngemuva kwe-NAT efanayo livula itshaneli yalo yokulawula bese lingayitholi neze indlela yedatha. Ukudlulisa imbobo ye-TCP enenombolo engu-47 akusizi lutho ku-GRE, ngoba i-GRE inombolo yephrothokholi hhayi imbobo.

L2TP phezu kwe-IPsec iziphatha ngendlela ehlukile ngokomklamo: i-IKE isebenzisa i-UDP 500, ukunqamula kwe-NAT kudlulisela umthwalo ovikelwe ku-UDP 4500, futhi ukuhlanganiswa kukhona khona ukuze amaklayenti ambalwa ngemuva kwekheli elilodwa afinyelele isango elifanayo. Lowo mklamo awuvimbeli isango noma ibhokisi eliphakathi ekubekeni umkhawulo wamaseshini ngekheli ngalinye, futhi kusuka kusofa ukwehluleka kokubili kubonakala kufana. Iphrothokholi ka-SoftEther ngokwayo inalolu hlobo lwenkinga: i-router engenakho ukudlula okusebenzayo ingena iklayenti lokuqala lisuka ku-LAN bese ilahla elesibili. Hlola iswishi ye-ALG noma yokudlula yerouter kuzo zombili izimo, ngoba umsizi obhalelwe iklayenti elidala angonakalisa amaphakethe athunyelwa ilelanyamanye.

nc -vz 203.0.113.5 1723
sudo tcpdump -ni any proto gre

Imikhawulo yobunikazi ebukeka njengemikhawulo yokuthutha

I-router ayisona kuphela esisolwayo, futhi ilogi iyihlukanisa kwenye indlela. Lapho iseva ye-OpenVPN ibophela igama elivamile ekhelini elilodwa lethunu, womabili amadivayisi athola lelo kheli, futhi ngaphandle kwe-duplicate-cn iseshini entsha iyaxosha endala. Ukuvula leyo nketho kushiya kokubili kuxhunyiwe kodwa kushiya kunobunikazi obubodwa, isitifiketi esisodwa nesinqumo esisodwa sokuhoxiswa, okuyinto embi kunalokho okubonakala. Idivayisi yesibili isuke ingeke ihoxiswe iyodwa, ngakho iswishi yokunethezeka isusa buthule ukulawula ongase ukudinga kamuva.

Funda incwadi yeseva nefayela layo lesimo ndawonye, ngoba elinye likhombisa isinqumo sokuqinisekisa kanti elinye likhombisa ukuthi ngubani oxhunyiwe manje. Imibhalo emibili eyabelana ngegama elivamile kanye nekheli elibonakalayo elilodwa iqinisekisa ukushayisana kobunikazi hhayi umkhawulo werouter. Amasango ezentengiselwano engeza imikhawulo yawo, njengohlelo oluvumela iseshini eyodwa ngesikhathi esisodwa, inani lamalayisense noma umthetho ovumela iseshini eyodwa kukheli ngalinye lomphakathi, futhi asikho isilungiselelo serouter esishintsha noma yikuphi kwalokho.

sudo journalctl -u openvpn-server@server -n 60 --no-pager
cat /run/openvpn/server.status

Fanisa ukulungisa nombhalo welogi

Ukunqatshwa elogini kudinga imininingwane yokungena ehlukile kudivayisi ngayinye, umkhawulo ophakeme ovela kulowo ophethe insizakalo, noma indawo yesibili yokuphela yesango yomshini owodwa. Uma kungekho mzamo wesibili ofinyelela kuseva, ukulungisa okuhlala njalo i-router edlulisa iphrothokholi futhi egcina amaseshini angaphezu kwelilodwa, noma ukuthutha i-router eyiphatha kahle, njengokugeleza okukodwa kwe-TCP noma i-UDP. Ukukhetha phakathi kwalokho yisinqumo mayelana nokuphila kwengxenyekazi, hhayi mayelana nezilungiselelo zeklayenti.

Ungakopishi iphrofayela yedivayisi esebenzayo kumshini wesibili bese uthi umsebenzi uphethile. Lokho kuguqula inkinga yokuxhumana ibe inkinga yokulawula ukufinyelela, ngoba i-laptop elahlekile ayisakwazi ukwehlukaniswa nekhophi esasetshenziswa. Kubuye kufihle isiphambeko sokuqala, esibuya ngaso leso sikhathi lapho kuvela idivayisi yesithathu.

Ukuqinisekisa amaseshini amabili aphilayo

Xhuma womabili amadivayisi ngesikhathi esisodwa, sebenzisa uhlelo oluhlosiwe kwelinye ngalinye, bese uphinda uxhume elilodwa kuwo bese uyaphinda. Isithonjana sesibili esivela isikhashana asiqinisekisi lutho mayelana nokugeleza, futhi iseshini ewela ngemuva kwemizuzu eyishumi iyiphutha elinye elinomnikazi ohlukile. Qhathanisa lokho iseva ekubika ekugcineni nalokho abasebenzisi abakubonile, ngoba lezi zindaba ezimbili zivame ukungavumelani.

Uma womabili amaseshini ephila futhi ethwala ukugeleza, ukulungisa kuyahlala, futhi inothi olibhale ekuqaleni liba irekhodi lokuthi kwakuyini okungalungile. Uma kusala elilodwa kuphela, buyela esinyathelweni sokuqala bese uhlola ukuthi yikuphi kwemiphumela emithathu yelogi onakho manje, ngoba impendulo kungenzeka isishintshile. Abasizi berouter bangafihla inkinga evela futhi kwenye inethiwekhi, ngenkathi umkhawulo ngekheli ngakunye ulandela umsebenzisi hhayi idivayisi. Ukuhlola kusuka kwenye inethiwekhi yindlela eshibhile yokuthola ukuthi yikuphi kwalokho okulungisile ngempela.