Indlela ezenzakalelayo ye-XFRM igwinye i-IKE ne-ESP: gcina indlela yangaphandle

Inqubomgomo evikela konke ingabamba namaphakethe agcina umhubhe. Maka i-IKE ne-ESP, noma shiya indlela eya kumlingani.

Ithrafikhi ivikelwe, umhubhe uyasebenza, bese iyafa ekuvuselelweni kokhiye okulandelayo. Indlela ezenzakalelayo ngokusebenzisa isixhumanisi se-XFRM yayichaza ithrafikhi obufuna ukuyivikela. Yagwinya namaphakethe adingekayo ukuze kuqhubeke ukuvikelwa.

Izindawo ezimbili ezihilelekile azishintshisani. Ukuhamba kwezinto kumele kusho lokho ngokucacile.

Ukusesha umlingani kuya ngempela kuphi

Qopha imithetho esebenzayo, ithebula eliphethe indlela ye-XFRM kanye nekheli lomphakathi lomlingani. Bese ubheka indlela oxhumano lwangaphandle oluzoyithatha nomthombo walo wangempela kanye nophawu. Indawo evamile ayikutsheli lutho ngale ndlela yokulawula. Umthombo wangempela nophawu kuphela okunikeza impendulo ewusizo.

Ukuxhumana kokuqala okuphumelelayo nakho akufakazeli okuningi. Iphutha livame ukuvela ngemuva kokuba ukufakwa kwendlela kushintshe impendulo. Ukuqala kuyaphumelela, bese ukuvuselelwa kokuqala kungaphumeleli.

ip rule show
ip route show table 220
ip -4 route get 198.51.100.44 from 10.40.0.2
ip xfrm policy list

Uma ukusesha komlingani kugcina kusixhumanisi se-XFRM, amaphakethe angaphandle aqondiswa emhubheni abawakhayo ngokwabo. Lowo umjikelezo, ubonakala ngomyalo owodwa.

Izinketho zokukhipha ngaphandle esangweni lesimanje

Idokhumenti ye-strongSwan mayelana ne-VPN esekwe ekuhambeni kwezinto iletha izimpendulo ezimbili ezingokoqobo. Enye imaka i-IKE ne-ESP ukuze umthetho okhomba ethebuleni le-XFRM ungazihlangani nazo. Enye ishiya indlela yomlingani noma ukukhishwa ngaphandle okusesho olusengafinyelela kukho.

Khetha leyo iqoqo lakho lemithetho elingayiveza ngaphandle kwemiphumela emincane. Uphawu lucacile lapho ingxenye esele ye-stack isivele isebenzisa izimpawu. Luyingozi lapho imaski efanayo isho okunye kumthetho omunye. Zombili izinhlobo zamaphakethe zidinga lokhu kwelashwa noma ngabe kunjani.

Ukumaka i-IKE kuphela kushiya amaphakethe edatha endleleni ebhajwe. Lokho kukhiqiza umhubhe ohlanganisa isandla bese ungalithwali lutho.

Uphawu iyibhithi eyodwa ku-fwmark yephakethe okungekho okunye esangweni okulibiza: u-0x1 onemaski engu-0x1 uyisinqumo esivamile, futhi kumele sibekwe ezindaweni ezimbili ukuze ukukhishwa ngaphandle kusebenze. I-Charon iyidinga kusokhethi ye-IKE, futhi izilungiselelo zophawu olungenayo noluphumayo zoxhumano lwengane zidinga inani elifanayo ukuze namaphakethe ahlanganisiwe aphume enamaphawu. Imaski engu-0x1 esikhundleni sika-0xffffffff ishiya amabhithi asele ekhululekile, okubalulekile lapho enye insiza esebenzisana nayo isivele imaka amaphakethe kusihambisi esifanayo. Uma kokubili kubekiwe, umthetho ubhalwa njengokukhishwa ngaphandle, ngakho amaphakethe anamaphawu adlula ithebula eliphethe indlela ye-XFRM awele ethebuleni eliyinhloko:

ip rule add not fwmark 0x1/0x1 lookup 220 pref 1000
ip -4 route get 198.51.100.44 from 10.40.0.2 mark 0x1

Bese ufunda impendulo ngophawu olusetshenzisiwe. Ngaphandle kwalo uhlola indlela ithrafikhi evikelwe eyithathayo, okuphambene nombuzo walesi sigaba.

Ukufakwa okuzenzakalelayo kucabanga ukuthini mayelana nokwakhiwa

Ukufakwa kwendlela okuzenzakalelayo kwesixhumanisi se-XFRM kuncike kunguqulo ye-strongSwan kanye nokumiswa kwayo. I-ID yesixhumanisi, inqubomgomo efakiwe kanye nokuxhumana konke kumele kubhekisele ezintweni ezihlosiwe. Ukungafani kuvela njengendlela ekhomba buthule endaweni yangempela.

Ukukopisha inombolo yethebula noma imaski yophawu kusuka kwesinye isango yindlela izingqubu eziqala ngayo. Qala ngokuhlola ukuthi yini esivele iyisebenzisa. Ingqubu ithinta ithrafikhi ekude kakhulu kunomhubhe obufuna ukuwushintsha, futhi uphawu lwezifo aluvamisile ukukhomba ikhophi.

Izinguquko zekheli lomlingani ziyingxenye yomklamo. Indlela yesihambisi yekheli layizolo ayilona uhlelo lokubuyisela isiphetho, kuyilapho uphawu lusinda kulolo shintsho.

Qaphela ukuvuselelwa kokuqala

Hlola indlela yangaphandle ngemuva kokufakwa kwezindlela ezivikelwe, hhayi ngaphambili. Bese uqaphela ukuvuselelwa okulandelayo kanye nokushintshana kohlelo lokusebenza okukodwa. Iphutha livame ukuvela kulolo shintsho hhayi ekuqaleni.

ip -4 route get 198.51.100.44
sudo swanctl --list-sas
sudo tcpdump -ni any 'udp port 500 or esp'

Ukususa indlela ezenzakalelayo evikelwe isikhashana kuvame ukubuyisela ukuxhumana. Lowo mphumela uwukuxilonga, awukona okokugcina.

Umgomo uwukuhlukaniswa okuqinile phakathi kwethrafikhi yangaphakathi namaphakethe angaphandle ayithwelayo. Bhala indlela ekhethiwe kanye nethebula noma uphawu lwayo kumanothi esango. Uma kungenjalo umuntu olandelayo othinta imithetho uzobuyisela umjikelezo.

Izihloko ezihlobene