Sawir wadada la sirfay: halka qalabka VPN uu ku dhaqangeliyao siyaasadda
Jaantus ku joogsada dhageysataha siran ma muujiyo siyaasadda muhiimka ah. Sawir wadada la sirfay, kadib isbarbardhig meelaha iyadoo loo eegayo waxa codsigu gudbo.
Jaantusyada iibiyaasha badanaa waxay ku joogsadaan dhageysataha siran, sababtoo ah waa qaybta leh cinwaan dadweyne. Su'aasha goynaysa mawqifka amniga waa waxa dhaca kadib sirfidda, marka baakadu noqoto IP caadi ah oo ay gaari karto wax kasta oo shaxda marinku ogolaato. Haddii aan cidina sawirin lugtaas, ma leh milkiile. Hagaha hoose ayaa marka hore sawira, kadibna isbarbardhigaa meelaha iyadoo loo eegayo waxa codsiga la sirfay dhab ahaan gudbo.
Sawir baakada kadib sirfidda, ma aha ka hor
Wadada dibadda waa qaybta iibiyaashu diiwaangeliyaan: barta ugu dambeysa ee dadweynaha, siyaasadda gaadiidka ee ogolaata xiriirka, iyo adeegga dhammeeya. Wadada gudaha waxay bilaabataa marka baakadu lumiso madaxa tunnel-ka, halkaasna waxaa maamula sharciyada marinka iyo shaandhaynta oo aan wax xiriir ah la lahayn tunnel-ka. Dhig labadaba bog isku mid ah, sababtoo ah jaantus leh oo keliya kan hore waxay soo jeedinaysaa in gelitaanka iyo fasaxa ay hal go'aan yihiin. Ma aha, iyo farqiga u dhexeeya waa halka badi meelaha ku khaldamaan.
Qor lugta gudaha sida taxane lambaraysan oo leh noocyo qalab magac leh, ma aha sida fallaadh. Fallaadh waxay qarinaysaa haddii codsigu gudbo shaandhayn, gudbidda ama aan gudbin waa su'aasha oo dhan. Tallaabo kasta oo hoose waxay magacaabaysaa qalabka iyo xeerarka halkaas ka shaqeeya, sidaas darteed shaandhaynta maqan waxay u muuqataa sida god, ma aha sida wax khad ku tilmaamay.
- Macmiilka fog: qalabka isticmaalaha ee abuura tunnel-ka.
- Siyaasadda cidhifka: xeerarka ogolaada gaadiidka dibadda ee dhageysataha dadweynaha.
- Qalabka dhammeeya: barta VPN ee kala baxda oo baakada u dhiiba IP caadi ah.
- Shaandhaynta gudaha: xeerarka gudbinta ama kooxaha amniga ee xaddida taraafikada macmiilka ilaa adeegga.
- Martigeliyaha codsiga: adeegga hela codsiga la sirfay.
Laba siyaasad, laba milkiile
Siyaasadda dibadda waxay ka jawaabtaa cidda dhisi karta tunnel, waxaana lagu muujiyaa xeerarka ogolaada gaadiidka ilaa adeegga dhammeeya. Siyaasadda gudaha waxay ka jawaabtaa adeegga ay isticmaale la xaqiijiyey gaari karo, waxayna ku nooshahay xeerarka gudbinta, kooxaha amniga ama codsiga laftiisa. Hal qalab ayaa qaadi kara labadaba, nashqadda leh qalab badan ayaa weli leh labadaba. Magacaabistooda gaar ah ayaa keliya kuu ogolaanaysa inaad sheegto midkee fashilmay marka isticmaalahu aan gaarin codsi.
Kontaroolada gelitaanka sida shahaadooyinka iyo xaqiijinta dhowr arrimood waxay ka jawaabaan aqoonsiga oo wax kale ma aha. Ma go'aan siyaasadda meelaynta, mana siiyaan fasax kheyraad kasta marka isticmaalahu gudaha joogo.
Meelaynta ayaa go'aanaysa xadka codsigu gudbo
Saddex meelayn ayaa caan ah, mid kastana waxay beddelaysaa xadka codsiga la sirfay gudbo. Isbarbardhig iyaga iyadoo loo eegayo waxa halkaas ku dhammaada, waxa arki kara qoraal cad, kontaroolka weli diidi kara codsiga, iyo waxa qalabka la fashilma. Shaxda hoose waxay isticmaashaa afarta tiir halkii su'aal guud, sababtoo ah jawaab kastaa waa go'aan nashqadeed gaar ah.
| Placement | What terminates there | What sees plaintext | Which control can still deny | Failure domain |
|---|---|---|---|---|
| Termination in a dedicated segment | A dedicated VPN endpoint | The endpoint and anything on its segment | The filter between that segment and the application | The segment path can bypass the filter if no rule sits on it |
| Termination on the edge firewall | The firewall's public listener | The firewall, after decapsulation | The firewall's inner rule set | Admission and inspection fail together |
| Termination on the protected LAN | The appliance's LAN leg | Every host on the protected LAN | Only a host control or a downstream gateway | The appliance and the protected hosts fail together |
Meelaynta saddexaad waa tan si aamusnaan uga saarta dhaqangelinta, sababtoo ah lug ku taal qaybta la ilaaliyay waxay qalabka siinaysaa waddo toos ah oo laga yaabo in jaantusku aanu muujin. Baar interface-yada iyo wadooyinka halkii sawirka: ip route get 10.20.5.10 waxay sheegtaa interface-ka baakadu ka bixi doonto, jawaabtuna inta badan ma aha tii nashqaddu qaadatay. Doorka caadiga ah ee darbiga dabka ee xakameynta taraafikada u dhexeeya mawqifyada, sida lagu sharraxayNIST SP 800-41, waa tijaabo faa'iido leh halkan, sababtoo ah qalab leh lug aan xaddidnayn oo u socota shabakadda la ilaaliyay wax badan ma xakameeyo. Raadinta waddo waa jaantus daacad ah ka badan tii soo bandhigga.
Maamulka waxaa iska leh waddadiisa si cad loo ogolaaday. U oggolaanshaha isticmaalayaasha inay gaaraan codsi marnaba ma u baahna in loo oggolaado inay gaaraan interface-ka kontoroolka qalabka, labada fasaxna waa in laga bixiyaa xeerar kala duwan. Baar labada waddo si gooni ah, sababtoo ah xeer la wadaago waxay qarinayaa midka la furay.
Turjumaaddu waxay beddelaysaa waxa xeerarka hoose arki karaan
Turjumaadda isha waa sahlan tahay oo waxay baabi'isaa macluumaad. Ka dib masquerade macmiil kastaa wuxuu u eg yahay qalabka, sidaas darteed xeer hoose oo loo qoray kala soocidda isticmaalayaasha ma samayn karo taas. Tani ma aha oo keliya dhibaato diiwaangelin, waa dhibaato siyaasadeed: xeer ku salaysan cinwaanka macmiilka si aamusnaan ah wuxuu noqdaa xeer ku salaysan gateway-ga. Haddii siyaasadda isticmaale kastaa ay muhiim tahay, ilaali isha ama dhaqangelisiyaa siyaasadda ka hor turjumaadda.
Wadada jawaabtu waxay mudan tahay baaritaan la mid ah. Diiwaangeli waddada uu meesha loo socdo u doorto baakada soo noqota, sababtoo ah soo noqoshada aan isku midka ahayn waxay dhaafsiisaa baaritaanka xaaladda oo waxay abuurtaa xiriir dhisma kadib xannibma. Labada jiho waa inay gudbaan xadka aad sawirtay, haddii kale xadku waa qurxin.
sudo tcpdump -ni inside0 host 10.20.5.10
ip route get 10.20.5.10
sudo iptables -t nat -S POSTROUTINGAqbal hawlgalka la ogolaaday iyo mid la diiday
Ka tijaabi macmiilka fog ee dhabta ah halkii ka tijaabin lahaa martigeliyaha maamulka, sababtoo ah martigeliyaha maamulka badanaa wuxuu fadhiyaa meel aan isticmaalahu waligiis gaari doonin. Hal hawlgalka la ogolaaday wuxuu caddeeyaa in waddadu shaqeyso, mid la diidayna wuxuu caddeeyaa in siyaasaddu wax ka qabanayso. Socodsii labadaba ka dib isbeddel kasta oo meelayn, oo diiwaangeli aqoonsiga isha iyo meesha aad isticmaashay. Tijaabo caddaynaysa guul oo keliya ma kala sooci karto xeer sax ah mid maqan.
Kadib tijaabi xaaladaha beddela xaaladda: dib u xiriir, kulamad ka sarreeya wareegga fure, iyo fashilka qalabka laftiisa. Isbarbardhig cusboonaysiinta, awoodda iyo soo kabanaynta sida qayb ka mid ah isla qaabka, sababtoo ah hal qalab oo qaata kontaroolo macquul ah oo badan waa hal qayb fashil leh sumado badan. Sanduuqa labaadna ma madaxbannaan marka aqoonsiga maamulka la wadaago ama waddo aan xaddidnayn ay ka adkaato xadka uu ahaa inuu abuuro.
Diiwaangeli barta ugu dambeysa, wadada la sirfay iyo kontaroolka xaddida. Saddexdaas sadar waxay macne yeeshaan si kasta oo fulinta loo magacaabo.