I-Windows L2TP ilayisha amasayithi ambalwa: susa ibhithi le-DF ku-pfSense

I-laptop iyaxhuma, i-intranet iyalayisha, futhi izingosi ezimbalwa zomphakathi ziyabamba. Ukuqinisekisa nokuhamba kwedatha kusebenza ngokusobala, okushiya usayizi wephakethe njengencazelo. Ku-tunnel ye-L2TP/IPsec i-MTU esebenzisekayo incane kunaleya i-adaptha esayikhangisa, futhi iklayenti iyaqhubeka nokuthumela amaphakethe anosayizi ogcwele nebithi «ungahlukanisi» ivuliwe. I-gateway ye-pfSense ingayalelwa ukususa leyo bhithi, futhi iyona ndlela eshesha kakhulu yokuqinisekisa ukuxilongwa ngaphambi kokukulungisa kahle.

Qala ngamakhasi ahlulekayo

Ngaphambi kokuthinta noma yisiphi isilungiselelo, bhala ukuthi yiziphi izindawo ezihlulekayo nalezi eziphumelelayo. Ukuxhawula okuhlala ngaphansi komkhawulo we-tunnel kuqedwa ngokujwayelekile, kuyilapho ukudluliswa okudinga ingxenye yosayizi ogcwele kuma phakathi nendlela. Lokho kwehlukanisa kuwuphawu lwenkinga yosayizi hhayi lwesihlungi, ngoba indawo evinjiwe yehluleka lapho kwakhiwa uxhumano hhayi phakathi nekhasi. Kokubili ukuqaphela akubizi lutho futhi kunciphisa uphenyo ngokushesha.

Hlola nge-ping ebeka ibhithi futhi elawula usayizi womthwalo. Umthwalo omkhulu kakhulu odlulayo ukutshela i-MTU yangempela yendlela, futhi inani elikhangisiwe le-adaptha likhombisa ukuthi zikude kangakanani zombili.

Bhala zombili izinombolo. Ukulungiswa kuncike ekutheni iyiphi enephutha, futhi izombili yizo eziqinisekiswa ukurekhoda kamuva.

Ibhithi le-DF lenza ini lapho liphuma

Ukufaka ngaphakathi yisizathu sokuhluka kwezinombolo. I-IPsec yengeza i-ESP, i-L2TP yengeza esinye isihloko, ngakho-ke i-tunnel ithwala umthwalo omncane kunokuxhumana komzimba. I-Windows isabika amabhayithi angu-1500 ku-adaptha futhi ibeka «ungahlukanisi» kulokho ekukuthumelayo. Lapho iphakethe elinjalo lingangeni, impendulo efanele evela ku-gateway umlayezo we-ICMP ocela umthumeli ukuba unciphise. Yingakho i-tunnel edlulisa ama-ping amancane ingase yehluleke ekulayisheni ifayela.

Lowo mlayezo uvame ukungafiki neze. Ukugxuma okuthile kungase kuhlunga i-ICMP, noma akukho okukhiqizayo, futhi umthumeli uphinda usayizi ofanayo kuze kube ukudluliswa kuyanikezela.

Ukuthula yikho okujwayelekile lapha, yingakho uphawu lufundwa njengokuvinjwa okukhethiwe. Akukho okubhala umlayezo we-ICMP ongekho kulo ilogi yeklayenti.

Ukukhetha kwe-pfSense, nokho okungakwenzi

Ukukhetha kutholakala ekhasini leSistimu, Okuthuthukile, I-firewall ne-NAT, kunombhalo «Susa amabhithi e-DF angavumelekile esikhundleni sokulahla amaphakethe». Esikhundleni sokulahla iphakethe elikhulu kakhulu elithwele ifulegi, isihlungi sisusa ifulegi futhi sivumela iphakethe ukuba lihlukaniswe phansi. Iphakethe libalwa njengelingavumelekile lapho lingehluleki ukweqa i-interface ephumayo ngosiqephu esisodwa.

Ukukhetha kubuyisela ukuxhumana ngaphandle kokuthinta iklayenti, yingakho kudumile. Kuyindlela yokweqa futhi: ukuhlukanisa kudla i-CPU futhi kwenza isiqephu ngasinye esilahlekile sibize kakhulu.

Kusebenza kuphela kuthrafikhi edluliswayo, hhayi kuthrafikhi ekhiqizwa yi-firewall ngokwayo. Ikhasi elifanayo linikeza «Khubaza Ukuhlanza Kwe-firewall», okucisha ngokuphelele ukwenziwa kwaba yinto ejwayelekile, futhi lokho kuwushintsho olubanzi kakhulu kunalokho okudingwa yile nkinga.

Ukulungiswa okuncane okugcina i-TCP ingahlukanisiwe

Cishe zonke izingelezi ezibambekile yi-TCP, futhi i-TCP ingaxoxa ngesiqephu esincane esikhundleni sokuthembela ekuhlukaniseni. Ukukhawulela i-MSS ku-interface ye-tunnel kubhala kabusha inani elikhangisiwe phakathi kokuxhawula, ngakho uhlangothi ngalunye luthumela okungena ngempela. Indlela ibe iziphatha ngendlela ebikezelwayo futhi akukho phakethe okudinga ukuhlukaniswa.

Lokho kushiya i-UDP ekutholeni noma kukukhetha kwe-DF. Lapho izingosi ezihlulekayo zingamakhasi ewebhu ajwayelekile, umkhawulo uyilo shintsho okufanele lukhethwe.

Iklayenti ingabika i-MTU yayo ye-adaptha nge-netsh interface ipv4 show subinterfaces. Qhathanisa leyo nombolo nalokho iseva ekholelwa ukuthi kuvunyelwene ngakho, ngoba zombili azihlali zilingana. Lelo nani yilo elizosetshenziswa ngempela uhlelo lokusebenza, noma ngabe ukuxoxa kwabika ini.

Qinisekisa ngokurekhoda, bese usetha kabusha isimo

Rekhoda ezinhlangothini zombili ngaphambi kokunquma: umkhondo owodwa lapho kuhamba khona i-tunnel, nomunye lapho kuhamba khona i-interface ye-WAN. Amaphakethe aphuma ngosayizi ogcwele ngaphandle kwe-ICMP ebuyayo akhomba umkhawulo njengongqimba olulungile. Izimpendulo ezifika bese zifa endleleni yokubuya zikhomba i-MTU ye-tunnel esikhundleni salokho.

Sula ithebula lezimo ngaphambi kokuzama futhi, ngoba izingelezi ezikhona zigcina usayizi wazo wangaphambili wesiqephu. Bese ulayisha ikhasi elihlulekile futhi ufunde umbono wezimo wethrafikhi yezinhlangothi ezimbili esikhundleni sezibali zohlangothi olulodwa. Uma lisabamba, rekhoda futhi esikhundleni sokuzama ibhokisi lokuhlola elinye.