Yankunan Shorewall don hanyoyin fakiti biyu na OpenVPN
Raba jigilar OpenVPN da aka rufa wa asiri daga zirga-zirgar abokin ciniki da aka buɗe, ba da tunel yankinsa, kuma ba da izini ga sabis ɗaya kawai da abokin ciniki ke buƙata.
Koguna biyu na fakiti suna wucewa ta ƙofar Shorewall da ke ƙarshe OpenVPN, kuma ɗayansu ne kawai aka rufa wa asiri. Na farko shine jigilar abokin ciniki zuwa mai sauraron VPN a kan fuskar da ke fuskantar intanet. Na biyu shine buƙatar da aka buɗe da ke barin fuskar tunel zuwa uwar garken ofis ko sabis a kan ƙofar. Zana duka biyu kafin gyara manufofin, domin dokar da ta biya na farko ba ta yin komai ga na biyu.
Zana koguna biyu kafin gyara manufofin
Rubuta kogunan a matsayin layuka da tushe, manufa, yarjejeniya da tashar. A kan hanyar waje, tushen shine adreshin jama’a na abokin ciniki kuma manufar ita ce tashar sauraro ta ƙofar; Shorewall yana ɗaukar hakan a matsayin zirga-zirga daga intanet zuwa bangon wuta. A kan hanyar ciki, tushen shine kewayon adreshin tunel kuma manufar ita ce sabis ɗin da aka amince da shi. Layukan biyu suna da masu daban-daban ko da wani mai gudanarwa ɗaya ne ke kula da duka.
| Flow | Zone relationship | What to constrain |
|---|---|---|
| Encrypted OpenVPN transport | Internet to the firewall host | The listener's actual protocol and port |
| Decrypted request to a LAN service | VPN clients to the LAN zone | One approved server and service |
| Decrypted request to the gateway | VPN clients to the firewall host | Only the local services required |
| Request to another VPN client | VPN clients to VPN clients | Denied unless deliberately required |
Ƙara layi kawai idan buƙatar ta ƙare a kan ƙofar kanta, kamar samun damar mai warwarewa ko gudanarwa. Sabis a kan uwar garke yana bin manufar shigar uwar garke, ba hanyar da aka tura ba. Haɗa biyun shine yadda ƙaramin dokar tunel ke ƙarshe ya fallasa fuskar gudanarwa.
Ba da yankin tunel da iyakar fuska
Ana bayyana yankin matafiyi a cikin /etc/shorewall/zones, ana haɗa fuskar tunel a cikin /etc/shorewall/interfaces, kuma ana bayanin haɗin waje a cikin /etc/shorewall/tunnels. Daidaita da tsarin fitowar da aka shigar, domin tsarin ginshiƙai da sunayen zaɓuɓɓuka sun canza tsakanin manyan sigogi. Tashar misali ta jagorar ba dalili bane don ba da izinin tasha daban da wadda daemon ke saurara da gaske. TCP da UDP ba su da musanya kawai domin lambobin sun yi daidai.
Jagorar tana haɗa fuskoki da tun+. A kan uwar garke mai fiye da tunel ɗaya, wannan alamar iya iyakancewa na iya sanya VPN na biyu na wani matakin amincewa a cikin yanki ɗaya. Bitar iyakar a kan fuskokin da ke wanzu da gaske, kuma riƙe suna ƙarƙashin yanayin rayuwar mai kula da haɗi maimakon gyara sunayen fuska da hannu.
Jagorar tarihi tana ɗauke da samfuran tsarin OpenVPN da suka tsufa sosai, kuma ba a kamata a kwafi shawarwarin sirrinta cikin turawa ta yanzu ba. Aro tsarin yanki da kogi maimakon haka. Ɗauki tushen sirri daga manufar OpenVPN da ake kiyayewa a ƙofar.
Ba da izini ga hanyar da ka rarraba kawai
Karɓar babba daga yankin VPN zuwa LAN zane ne na farko, ba cikakkiyar manufa ba. Rubuta tushen abokin ciniki da aka yarda, adreshin sabis na gaske, yarjejeniya da tasha. Sannan karanta dokokin da ke sama da shi da tsohuwar yankin, domin ƙari kaɗan ba ya soke izini babba da ya riga ya dace. Zirga-zirga zuwa uwar garken ƙofar dangantaka ce daban da zirga-zirgar da ake turawa ta cikinta.
Zirga-zirgar abokin ciniki-zuwa-abokin ciniki na buƙatar nata shawarar. client-to-client na OpenVPN da routeback na Shorewall duka suna shafar ko abokan ciniki za su iya isa juna, kuma ba a kamata a kunna ɗayansu kawai don aikace-aikacen LAN ɗaya ya yi aiki ba. Yanke shawara inda ake aiwatar da keɓewa kafin ka gwada shi.
Riƙe hanyar amsa a cikin shiri ɗaya. Sabis ko na’urar sa dole ya san yadda za a mayar da zirga-zirga zuwa kewayon tunel, ko kuma ƙirar dole ta fassara tushen da gangan kuma cikin iyakar da aka yi niyya.
Tabbatar, sannan tabbatar da hanyoyin biyu
Tabbatar da tsarin kafin sake kunna wani abu, kuma riƙe zaman gudanarwa mai zaman kansa a buɗe idan sabon manufar ba daidai ba.
shorewall checkBayan cikakken bincike, yi amfani da tsarin kuma karanta abin da Shorewall ya loda. Waɗannan karatun suna bayanin manufar da ke gudana ba abin da fayil ya bayyana yana faɗa ba.
shorewall show zones
ip route get 192.168.10.20Gwada sabuwar buƙata da aka yarda da buƙata ɗaya da aka ƙi da gangan daga abokin ciniki ɗaya. Nasara ta musafaha OpenVPN tana tabbatar da musayar waje kawai; sabis ɗin da aka yarda da kuma tushen da aka ƙi suna tabbatar da manufar ciki da kake nufi. Sannan sake haɗa abokin ciniki kuma maimaita, domin sunan fuskar tunel da adreshin na iya canzawa tsakanin zama. Idan sakamakon ya bambanta, gyara iyakar yankin maimakon faɗaɗa dokar.