Kungani umzila we-OpenVPN uhlulwa umgomo we-XFRM we-strongSwan

Amaphakethe angalandela umzila we-OpenVPN futhi abanjwe umgomo we-IPsec, futhi le nhlanganisela ibonakala njengephutha lokuhlela kusuka kuzo zonke izinhlangothi ngaphandle kwaleyo efanele. I-Linux ixazulula umzila bese ibonisana nedathabhezi ehlukile yemigomo yezokuphepha, ngakho umzila wendawo oqondile kakhulu awususi umgomo we-XFRM ohambisanayo. Uphawu olubonakalayo wuthrafikhi ophuma kusibungazwa futhi ongafiki neze, kuyilapho imigudu yomibili izibika iphilile. Izinketho ezintathu ziyakuxazulula lokhu, futhi ukuthi ukhetha iphi kuncike ekutheni yimuphi kulemigudu emibili okufanele uthwale lesiqalo.

Izinqumo ezimbili, hhayi esisodwa

Ukukhethwa komzila kuphendula umbuzo omncane: yikuphi ukugxuma okulandelayo nekheli lomthombo okufanele kuthwale lephakethe. Idathabhezi yemigomo yezokuphepha iphendula omunye: ingabe lephakethe idinga ukuvikela kwe-IPsec, futhi ngaphansi kwaziphi izinketho. Kokubili kusebenza kuyiphethethe elifanayo, futhi ukugcwalisa okokuqala akusho lutho ngokwesibili. Yingakho ukushintsha isilinganiso noma ukwengeza umzila ongaguquki kungashiya uphawu lungakathinteki.

Isikhethi se-IPsec esibanzi siyimbangela evamile. Umgomo ovikela i-172.16.0.0/12 uhlanganisa ne-172.20.8.0/24, lapho umqondisi angase ahlose ukufinyelela khona ngomgudu we-OpenVPN. Inhloso ikhona kuphela kuthebula lokuhlela, futhi idathabhezi yemigomo ayikaze yazi ngakho.

Kubheke lokho njengokungqubuzana phakathi kwemigudu emibili yokuvikela ehleliwe, hhayi umncintiswano phakathi kwezilinganiso ezimbili. Ukulungisa kungokwesigaba esahlelwa ngobukhulu obungalungile.

Funda umzila okhethwa i-kernel ngempela

Qala ngokusesha okwenziwa i-kernel, kuhlanganise nekheli lomthombo nanoma yimuphi umthetho womgomo ongase uyihambise kwelinye ithebula. Umzila okuthebula eliyinhloko kungenzeka ungabhekwa neze uma umthetho wangaphambili ukhetha elinye ithebula, futhi ukufana kwesiqalo eside kakhulu kusebenza kuphela ngaphakathi kwethebula elikhethwa umthetho.

ip rule show
ip route show table all
ip route get 172.20.8.20 from 10.44.7.15

Umyalo wokugcina ubalulekile, ngoba uprinta umzila okhethiwe kanye nekheli lomthombo i-kernel ebingayisebenzisa. Qhathanisa lokho okukhishiwe nesikhethi umgomo we-IPsec ohambisana naso. Uma umzila ukhomba kusixhumi se-OpenVPN futhi umgomo usahambisana nalabo ababili, usubuye wakhiqiza ukungqubuzana ngaphandle kokuqagela.

Gcina ama-dump engenazo izindawo ezingahlobene ngaphambi kokuba afike kuthikithi. Ithebula lokuhlela elisuka kusibungazwa sokukhiqiza lithwala i-topology yangaphakathi, futhi imigqa ephendula umbuzo kuphela efanele ukunanyatheliswa.

Funda futhi umgomo osebenzayo

Uhlu lwemigomo lubonisa inkomba, izikhethi kanye nesifanekiso esinquma okwenzeka kunqubo ehambisanayo. Funda inkomba yokuphuma kuqala, bese ufunda uhlangothi lokungena lwethrafikhi ebuyayo, ngoba okuhlukile okuya ohlangothini olulodwa kwakha uxhumano oluqala futhi lungaqedi neze.

ip -s xfrm policy
swanctl --list-sas

Qhathanisa izikhethi ezisohlwini neziqalo okwavunyelwana ngazo uxhumano. Ukucisha ukufakwa kwemigudu kwe-strongSwan akususi leyo migomo, futhi ukushintsha isilinganiso akushintshi ukuthi imuphi umbhangqwana womthombo nendawo umgomo owuvikelayo. Lokhu kulungiswa okungamanga okubili kufanele kukhishwe ekuqaleni, ngoba abantu bazama khona kuqala.

Uma uhlu lungenalo umgomo wesiqalo obusilindele, inkinga ikwenye indawo futhi ithebula lokuhlela cishe likhuluma iqiniso. Uma liqukethe umgomo obanzi okhuluma ngesiqalo, uthole ukubanjwa.

Izinketho ezintathu uma yomibili imigudu isemthethweni

Ukunciphisa isikhethi se-IPsec iyinketho ehlanzekile kakhulu uma isiqalo esibanzi sasiwukulula hhayi imfuneko. Ukwehlisa isikhethi sethrafikhi ekude kuma-subnet angempela angemuva kwe-IPsec kususa ukungqubuzana kuso sonke isibungazwa ngesikhathi esisodwa, futhi izindleko zayo ukuxoxisana kabusha kukhiye, hhayi isigaba esisha.

Okuhlukile kwe-passthrough iyinketho yokuhlinza uma isikhethi esibanzi kufanele sihlale. I-strongSwan isekela uxhumano oluhlukile olunengane esebenzisa imodi ye-pass, lokho okutshela i-kernel ukuthi ithrafikhi ehambisanayo akufanele isetshenzwe yi-IPsec. Ikheli elikude le-loopback livimbela lolo xhumano ekukhethweni kontanga abangena, futhi izikhethi kufanele zichaze umbhangqwana ogunyaziwe wangempela hhayi konke.

connections {
    openvpn-exception {
        remote_addrs = 127.0.0.1
        children {
            openvpn-exception {
                local_ts = 10.44.7.0/24
                remote_ts = 172.20.8.0/24
                mode = pass
                start_action = trap
            }
        }
    }
}

Izibonelo zokuhlelwa kwe-strongSwan zibhala lolu hlobo lomgomo kanye nenqubo yontanga ye-loopback. Inketho yesithathu iwukuthi umklamo osuselwe emzileni onezixhumi ze-XFRM, oxhumanisa umgomo nethrafikhi ehlelwa ngokusixhumi esinegama esikhundleni sesikhethi somhlaba wonke. Lokhu kuwukufuduka hhayi ukulungiswa, futhi ithrafikhi kusafanele ihlangabezane nezikhethi okwavunyelwana ngazo.

Fakazela okuhlukile ngaphandle kokwenza okunye buthakathaka

Ngemva kokulayisha ushintsho, hlola okuhlukile nendawo ejwayelekile okufanele ihlale ivikelwe. Hlola izinhlangothi zombili, bese wehlisa umgudu we-OpenVPN futhi uqinisekise okwenzeka kuthrafikhi ekhishiwe. Okuhlukile okuthumela lesiqalo ngokuthula obala lapho umgudu uphansi yisinqumo somgomo okufanele usithathe ngamabomu, hhayi ukusithola ngesikhathi sezehlakalo.

Bhala ukuthi yisiphi isiqalo esisebenzisa umuphi umzila nokuthi kungani. Uma kungenjalo unjiniyela olandelayo obona isikhethi esibanzi uzovula kabusha uphenyo olufanayo, futhi impendulo izohlala kumyalezo we-commit okungekho ozowufunda.