Ka gudubka VPN ee hal deked wuxuu u baahan yahay jid-siineed siyaasadeed

Codsku waa had iyo jeer nooc ka mid ah jumlad isku mid ah: hay VPN-ka baaritaanka, laakiin u oggolow SSH ama hawsha kaydka inay isticmaalaan xiriirka caadiga ah. Talo ku wareegaysa arrintan, in dekedda lagu gudbiyo xeerarka NAT ee iptables, taas ma qabanayo. Xeerka NAT wuxuu dib u qoraa cinwaannada iyo dekedaha gudaha qulqulka; waligiis ma doorto interface-ka uu baakadku ka baxo. Go'aankaas waxaa iska leh raadinta jidka, raadinta jidkuna waxay u baahan tahay caawimo si ay u aragto deked.

Sababta jid caadi ah uusan ula mid noqon karin deked

Linux wuxuu doortaa jid isagoo ka raadinaya cinwaanka goobta shax gudaha ah, ka dib marka shaxaha musharixiinta lagu sifeeyo xeerarka siyaasadda. Xeerarkaas waxay la mid noqon karaan calaamad firewall, cinwaan isha, interface soo galaya ama UID. Diiwaanka jidka laftiisu ma laha goob deked, sababtoo ah jidka waxaa la doortaa ka hor inta madaxa gaadiidku muhiim noqon.

iproute2 iyo kernel-yada hadda jira waxay ballaariyaan doorashada xeerka: ipproto, sport iyo dport waa la aqbalaa, marka ip rule add ipproto tcp dport 22 table 100 wuxuu u sheegaa ujeedka hal saf. Orso ip rule add help martigeliyaha dhabta ah si aad u aragto haddii dhismahaagu uu taxo dport. Haddii uu taxo, hal amar baad ku dhammeysatay; haddii kale, wadada calaamadda ee hoose waa u dhiganta.

Si kasta ha ahaatee xeerku waa uun tilmaame. Shaxda 100 wali waxay u baahan tahay jid, waana qaybta dadku illoobaan.

Saddex qaybood, ama hal

Qaabka casriga ah waa hal xeer oo kore iyo jid ku yaal shaxda beddelka ah. Qaabka caadiga ah wuxuu dhexda ku darayaa netfilter: calaamadee baakadka, ka dibna xeerka ku habee calaamadda. Labaduba waxay ku dhammaadaan isla raadintaas; waxay ku kala duwan yihiin halka dekedda laga akhriyo.

Habka calaamaddu wuxuu jiraa sababtoo ah netfilter wuxuu arkaa madaxa gaadiidka, koodhka jid-siineedkuna taariikh ahaan ma arkin. Taasi waa farsamada oo dhan, waxayna sharaxaysaa sababta jidka kaydku u yahay saddex qaybood oo wada shaqeeya halkii uu ahaan lahaa hal amar caqli badan.

Saddexda qaybood si kala horreysan

Marka hore, calaamadee qulqulka aad rabto inaad leexiso, silsilad ku shaqaysa goor hore oo ku filan si calaamaddu u jirto ka hor go'aanka jidka:

nft add table inet vpnexempt
nft 'add chain inet vpnexempt out { type route hook output priority mangle; }'
nft add rule inet vpnexempt out tcp dport 22 meta mark set 0x1

Marka labaad, u dir baakadaha calaamadeysan shax gaar ah:

ip rule add fwmark 0x1/0x1 table 100

Marka saddexaad, shaxdaas sii jid caadi ah oo mara xiriirka jirka. Cinwaannadu waa tusaale; ku beddel kuwaaga:

ip route add default via 192.168.1.1 dev wlan0 table 100

Ka bood tallaabada saddexaad oo baakadka calaamadeysan kama helo jid shaxda 100, sidaas darteed wuu guuldareystaa. Calaamaddu waxay u ekaanaysaa sida xeerku u burburiyay shabakadda, halka dhab ahaan uu ka tuuray wadada kaliya ee baakadka u hadhay.

Maxaa sii wada shaqaynta kadib baakadka kowaad

Calaamaduhu waxay khuseeyaan baakadaha baxa. Jawaabtu waxay ku timaadaa interface-ka jirka oo wata cinwaanka xiriirku qoondeeyay, shaxda weynina waxay weli doorbidikartaa tunnel-ka goobtaas. Laba farsamo ayaa jidka jawaabta joogto ka dhiga: xeer ku saleysan isha oo loogu talagalay cinwaanka xiriirka, iyo connection tracking oo go'aanka ilaaliya inta qulqulku nool yahay. Calaamadda ku kaydinta conntrack iyo ku soo celinta jawaabta waa habka caadiga ah ee loola dhigayo ka-reebitaan xaalad leh mid deggan.

Sifeeynta jidka gadaal waa dilaa kale oo aamusan. Haddii kernelku si adag u xaqiijiyo jidka soo noqodka jawaabtuna ku timaado interface aan shaxda weyni dooran lahayn, baakadka waa la tuuraa iyada oo aan fariin lahayn. rp_filter qiimayaasha caadiga ah way ku kala duwan yihiin qaybinta iyo haddii interface-ka la gudbiyo, marka akhri qiimaha dhabta ah halkii aad ka malayn lahayd inuu dammaan yahay.

Ha calaamadeyn gaadiidka tunnel-ka laftiisa. Tunnel WireGuard ama UDP OpenVPN ma aha TCP 22, marka cuntada kore waa ammaan, laakiin ka-reebitaan loo qoray sida wax kasta oo aan ahayn goobta tunnel-ka ayaa qaban kara baakadaha sirta ah oo burburin kara tunnel-ka si u eg wareeg jid-siineed.

Hubi halkii aad ka malayn lahayd

Weydii kernelka jidka uu qaadan lahaa, goobta iyo dekedda, ka dibna orso wareejinta dhabta ah:

ip route get 203.0.113.10
ip rule show
nft list ruleset

Haddii calaamaddu jirto laakiin tirooyinku waligood dhaqaaqi waayaan, xeerku ma habboona. Tirooyinku waa farqiga u dhexeeya habeynta aad qortay iyo siyaasadda uu kernelku dabaqayo.

Marka tani tahay qalab khaldan

Ka-reebitaannada ku saleysan dekedda ayaa dabiici ahaan jilicsan. Adeegyadu way raraan dekedaha, HTTP/3 waxay ku timaadaa UDP 443, hal barnaamijna wuxuu furi karaa dhowr qulqul oo noocyo kala duwan ah. Haddii shuruudda dhabta ahi tahay in barnaamijkani isticmaalo xiriirka caadiga ah, lakabka jid-siineedku waa meel khaldan; booska magaca shabakadda ama proxy barnaamij kasta ayaa ka fiican.

Haddii shuruuddu tahay in shabakad-hoosaadkani isticmaalo xiriirka caadiga ah, gabi ahaan ka bood calaamadaha oo ku dar jid gaar ah. Waa ka fudud, waa lagu arkaa hal shax, qofka xigana wuu hubin karaa isagoo aan akhrin xeerar.

Qor midka saddexda shuruudood ee aad dhab ahaan haysato ka hor inta aadan taaban firewall-ka. Farsamada kore waa sax, saxnaanta lagu dabaqo lakab khaldan waa uun hakad dheer.