UFW na watsar da sabar DNS ta VPN da zarar ramin ya tashi
Manufar hana ta asali ta UFW tana rufe mu'amalar ramin kuma. Rarraba zirga-zirga bisa alkibla, ba da izinin mai warwarewar da aka tura a tun0, sannan buɗe hanyar waje.
Sunaye suna daina warwarewa a daidai lokacin da VPN ta haɗa, yayin da ping zuwa adireshin jama'a ke ci gaba da amsawa kuma yanayin garu ba ya nuna wani abu da zai yi kama da kuskure. Babu abin da ya canza a manufar; abin da ya canza shi ne sabon mu'amala ya bayyana, kuma hana ta asali tana rufe shi tun daga fakiti na farko. UFW tana yanke hukunci bisa alkibla da mu'amala, don haka ƙa'idar da aka rubuta don haɗin mara waya ba ta faɗin komai game da zirga-zirgar da ke barin ramin. Gyaran shi ne kaɗan daga cikin ƙananan ƙa'idoji da ake amfani da su a wani tsari na musamman.
Alamar tana bayyana ne kawai bayan ramin ya tashi
Manufar hana ta asali tana yin daidai abin da aka gaya mata: duk abin da ba shi da ƙa'idar da ta dace ana ƙi shi, a kowace mu'amala da ta wanzu. Ramin bai wanzu ba lokacin da aka rubuta ƙa'idojin, don haka babu ɗayansu da zai iya kama shi, kuma hana da ta kasance a koyaushe yanzu tana aiki kan warware sunaye. Zirga-zirga kai tsaye zuwa adireshin zahiri na iya yin aiki har yanzu idan izini mafi faɗi ya rufe shi, wanda shi ya sa ping zuwa mai warwarewa na jama'a ke yin nasara yayin da neman suna ke kasawa. Rashin shi ne ƙa'ida ga mu'amalar da manufar ba ta taɓa gani ba.
Wannan kuma yana bayyana dalilin da ya sa gazawar ke juyawa da tsafta: sauke ramin kuma sunaye suna sake warwarewa, domin tambaya tana komawa zuwa mu'amalar da ke da ƙa'idoji. Manufar da ke kasawa kawai yayin da ramin ya tashi ba matsalar DNS ba ce, kuma daidaita mai warwarewa da kansa yana ɓata mafi yawan lokaci a nan. Karanta jerin mu'amaloli kafin karanta tsarin mai warwarewa.
Alkiblobi uku, jerin ƙa'idoji daban-daban uku
Zama ɗaya yana taɓa ƙa'idoji a fiye da alkibla ɗaya, kuma rami yana ƙara mu'amala ta biyu ga kusan kowane ɗayansu. Da farko rarraba zirga-zirgar bisa alkibla da mu'amala yana mai da sauran aikin inji, domin kowane layi da ke ƙasa yana buƙatar ƙa'idarsa a wurinsa. Misalan suna amfani da tun0 da tafki na 10.8.0.0/24, don haka maye gurbin sunaye da jeri da waɗanda suka fito daga fitarwar abokin ciniki kansa.
| Direction | Example packet | Rule that admits it | Written on |
|---|---|---|---|
| Client to the pushed resolver | A DNS query to 10.8.0.1 | Destination port 53 over the tunnel | The client's tun0 |
| Client to the VPN server | A handshake to the server's public address | Server address and port on the physical link | The client's physical interface |
| Server to a service | SSH from the pool to port 22 | Source pool, destination port, tunnel interface | The server's tun0 |
| Anyone to the listener | The VPN listener itself | 1194/udp on the public side | The server's public interface |
Ana rikita layi biyu sau da yawa domin dukansu suna ambaton ramin. Ƙa'ida ga mai warwarewa tana ba da izinin zirga-zirgar da abokin ciniki ke aikawa cikin ramin, yayin da ƙa'ida ga SSH ke ba da izinin zirga-zirgar da sabar ke karɓa daga gare shi; suna rayuwa a kan na'urori daban-daban kuma suna kasawa daban. Layin da aka fi mantawa shi ne na biyu, domin abokin ciniki ba zai iya gina ramin kwata-kwata ba har sai an ba da izinin zirga-zirgarsa zuwa adireshin jama'a na sabar. Yi aiki daga sama zuwa ƙasa kuma kowace gazawa tana da dalili ɗaya mai yiwuwa.
Mai warwarewa da aka tura yana buƙatar ƙa'idarsa
Ko ramin yana ɗauke da DNS ya dogara da abin da sabar ke aikawa. Sabar da ke tura zaɓin mai warwarewa tana saka adireshi na sirri a cikin tsarin abokin ciniki, kuma wannan adireshin ana iya tafiya da shi ne kawai ta ramin. Idan sabar ba ta tura komai ba, abokin ciniki yana riƙe da mai warwarewar da yake da shi, kuma ƙa'idojin da ke ƙasa ba su da abin da za su ba da izini. Duba yanayin da aka tura da sakamakon tambayar yanzu kafin rubuta wani abu:
dig +short @10.8.0.1 example.com
resolvectl status tun0
sudo ufw status numberedFitarwar yanayi tana ambaton mai warwarewar da ake amfani da shi da haɗin da aka ɗaure shi da shi, kuma binciken hanya da ke bayansa yana nuna wace mu'amala ce za ta ɗauki tambaya zuwa wannan adireshin. Lokacin da mai warwarewa ke zaune a wani haɗi, matsalar ta gabaci garu kuma babu ƙa'idar da za ta taimaka. Lokacin da duka biyu suka yarda kan ramin, ana buƙatar ƙa'idoji biyu, domin UDP yana ɗauke da yawancin tambayoyi kuma TCP yana karɓa lokacin da amsa ta yanke. Rubuta duka ƙimar biyu, domin su ne waɗanda ƙa'idojin za su ambata:
sudo ufw allow out on tun0 to 10.8.0.1 port 53 proto udp comment 'pushed resolver'
sudo ufw allow out on tun0 to 10.8.0.1 port 53 proto tcp comment 'truncated answers'Buɗe hanyar waje kafin ta ciki
Abokin ciniki dole ya isa adireshin jama'a na sabar kafin rami ya wanzu, don haka ƙa'idar da ta shafi shi tana zaune a haɗin jiki kuma dole ta kasance a wurinta da farko. Manufar da ke ba da izinin mai warwarewa amma ta manta sabar tana barin abokin ciniki gaba ɗaya bai iya gina ramin ba, kuma ana ɗora wannan alamar a kan kill switch. Sannan ba da izinin ayyukan da kake so da gaske ta ramin, ƙa'ida ƙunƙunta ɗaya a lokaci ɗaya, maimakon buɗe mu'amalar gaba ɗaya. Ƙananan ƙa'idojin su ne dalilin da ya sa hana za ta iya kasancewa a wurinta.
sudo ufw allow out to 198.51.100.10 port 1194 proto udp comment 'vpn server'
sudo ufw allow out on tun0 to any port 443 proto tcp comment 'web through tunnel'Tsari yana da muhimmanci yayin gwaji, domin ƙa'idar farko ita ce ke barin ramin ya tashi kwata-kwata. Ƙara ta, haɗa, kuma tabbatar ramin ya tashi kafin ƙara ƙa'idar aikin, domin yin duka biyu a lokaci ɗaya yana nufin gazawa ba ta gaya maka komai game da wane rabin ne ba daidai ba. Maye gurbin adireshin takardu na sama da wurin da abokin ciniki aka saita shi don amfani da shi.
Kammala ɓangaren abokin ciniki ta hanyar cire haɗi da gangan. Hana ya kamata har yanzu ta ƙi zirga-zirgar da ka ware da gangan, domin mai warwarewa da ke amsawa yayin da ramin ya tashi yana rufe rabin manufar da ke ƙi idan akwai shakka.
Abokin ciniki da ya haɗa ba a yarda da shi ba tukuna
Sabar tana da nata alkibla da za a yi la'akari da ita, kuma abokin ciniki da ya kammala musafaha har yanzu ba zai iya isa ga wani abu da ke gudana a sabar ba har sai sabar ta yarda da shi. Ƙa'idar mai sauraro na jama'a tana barin ramin ya wanzu kawai; ba ta barin zirga-zirgar ramin ya shiga. A sabar waɗannan ƙa'idoji biyu ne da ƙari da dubawa ɗaya cewa aikin yana saurara da gaske:
sudo ufw allow 1194/udp comment 'openvpn listener'
sudo ufw limit in on tun0 from 10.8.0.0/24 to any port 22 proto tcp comment 'admin over tunnel'
ss -ltn | grep ':22'Tafkin da ke cikin ƙa'idar dole ya yi daidai da jerin da sabar ke rabawa, kuma lambar ramin dole ta dace da wadda sabar ta ƙirƙira, domin ƙa'ida ga wata mu'amala ba za a bambanta ta da babu ƙa'ida ba. limit da gangan ne ga tashar gudanarwa, domin yana iyakance haɗi mai maimaitawa maimakon karɓe su ba iyaka. Dubawar mai sauraro tana raba tasha da aka rufe da fakitin da aka jefar, waɗanda daga ɓangaren abokin ciniki suke kama da juna. Ƙa'idojin da aka ƙididdige su ma ba su ne cikakken hoto ba: ƙa'idojin before na UFW da kowane layin nftables da aka rubuta da hannu suna daidaitawa da wuri kuma har yanzu suna iya ƙin fakitin da jerin ya nuna yana ba da izini.