Iphrofayela ye-WireGuard yesango le-IPsec: yini okufanele uyibuze esikhundleni

Ukuphela kwesikhathi sokuxhawulana nesango elithule ngokuvamile kusho amaphrothokholi amabili angahlangani neze. I-WireGuard peer ikhuluma i-Noise kuyilapho isango le-IPsec lilinde i-IKE. Ikheli ne-port okulungile akukushintshi lokho.

Ukusebenzisa kabusha i-endpoint kuphrofayela akuhlanganisi lezi ezimbili. Isinyathelo esilandelayo isicelo kumuntu ophethe isango.

Isicelo sokuqala: inguqulo yephrothokholi

I-IPsec ibiza umndeni hhayi uhlelo olulodwa lokusebenza. I-IKEv2 ne-IKEv1 ziyehluka ekushintshisaneni kwazo, ezinkethweni zokuqinisekisa nasekuziphatheni lapho inethiwekhi ishintsha. Isango eliphetha i-IKEv1 kuphela lizoziphatha ngendlela ehluke kakhulu kunesango elinikeza i-IKEv2. Nokuhlelwa kwekhasimende kuyashintsha kanye nakho.

Buza ukuthi iyiphi inguqulo isevisi eyiphethayo nokuthi isebenzisa ukuqaliswa okusekelwe emazingeni noma uhlobo lomthengisi olunekhasimende lalo. Amamenyu ezinhlelo zokusebenza ngokuvamile afihla leyo mpendulo ngemuva kwelebula elilodwa. Ilebula akuyona iphrothokholi.

Isicelo sesibili: indlela yokuqinisekisa yekhasimende

Ukuqinisekisa yindawo lapho iningi lomsebenzi wangempela likhona. Isevisi ingase ilindele isitifiketi somshini esinokusetshenziswa okunwetshiwe kokhiye okuthile, isitifiketi somsebenzisi, indlela ye-EAP phezu kwe-IKEv2 noma ukhiye owabiwe ngaphambili oboshelwe kubuwena. Ukuthi iyiphi esebenzayo kunquma ukuthi ikhasimende lidinga ini.

Ukhiye oyimfihlo we-WireGuard akusilo neyodwa yalezi. Ukhiye we-Curve25519 osetshenziswa ekuxhawulaneni okukodwa okuthile. Akukho ukuguqulwa okukwenza isitifiketi noma ubufakazi be-EAP. Ithuluzi elisho okuphambene nalo lishintsha igama lefayela noma lenza into engahlobene.

Incazelo ye-IKEv2 ku-RFC 7296 ichaza ukuthi ukuqaliswa kwaleyo nguqulo kufanele kusekele ini. Kuyisihluthulelo sempendulo engacacile yomsebenzisi, hhayi umhlahlandlela wokuhlelwa kwekhasimende.

Isicelo sesithathu: ubuwena obuthembekile kanye nezindawo

Cela ubuwena besango ngendlela ikhasimende okufanele libone ngayo, kanye ne-anchor yokuthembela eyiqinisekisayo. Bese ubuza ukuthi isevisi ihambisa iziphethu eziyimfihlo nezixazululi zini. Lezi zimpendulo ezimbili zinquma ukuthi umhubhe uthwala ini ngempela.

Ngaphandle kwazo ukuxhumana okusebenzayo kungase kwehluleke umsebenzi. Umhubhe ophakamile ngaphandle kwesixazululi esithunyelwe ushiya amagama angaphakathi engenampendulo. Isikhethi sokuhamba esingekho sishiya indawo ngaphandle komhubhe nakuba ukuxhawulana kuphumelele.

Ukuhlola i-endpoint kuphendula umbuzo ohlukile kunephutha lekhasimende. I-port efinyelelekayo ngaphandle kokuxhumana ikhomba ekuqinisekiseni, kuyilapho i-port engafinyeleleki ikhomba endleleni.

# what does the endpoint offer on its IPsec ports?
sudo nmap -sU -p 500,4500 198.51.100.44

# strongSwan: what did the IKE exchange negotiate?
sudo swanctl --list-sas
sudo swanctl --list-conns

Qalisa lokho kuhlola ngaphambi kokushintsha noma yini kukhasimende. Uma amaphothi ephendula futhi ukuxhumana kusahluleka, inkinga isebufakazini noma kunqubomgomo. Uma engaphenduli nhlobo, akukho ukuhlelwa kabusha kwephrofayela okuzosiza.

Lapho amaphrothokholi womabili kufanele abe khona kanyekanye

Ukuphatha zombili izethiwekhi kuyisizathu esivumelekile sokugcina womabili amaphrothokholi. Idizayini evamile iphetha i-WireGuard ne-IPsec kuma-interface ahlukene noma emasangweni ahlukene. Ukuhamba okuvunyelwe kube sekuthunyelwa phakathi kwazo.

Leyo dizayini yethula umngcele wokuthembela nokugunyaza, futhi kufanele kubhalwe kanjalo. Ukuthi yimaphi amaphare angaweqa, ngakuphi uhlangothi nangaphansi komthetho kabani kuyisinqumo sokuhlela nokuvikela umlilo. Akukho phrothokholi eyodwa enikeza lokho.

Lokho okungeyona inguqulo ebonakalayo. Ukuhamba okufika nge-WireGuard kwakhiwa kabusha kumhubhe we-IPsec, futhi zonke izinqubomgomo eziphakathi ziyasebenza kukho.

Qala ukhanyise izidingo zephrothokholi nokuqinisekisa zeseva. Bese usebenzisa ikhasimende nendlela yokubhalisa esekelwa umsebenzisi, futhi ugcine okhiye abayimfihlo kude neziguquli zewebhu ngenkathi lokho kwenzeka.