Aagagga Shorewall ee labada waddo ee baakadaha OpenVPN
Kala sooc gaadiidka OpenVPN ee sirta ah iyo taraafikada macmiilka ee la furay, sii tunnel-ka aaggiisa, oo fasax kaliya hal adeeg oo macmiilku u baahan yahay.
Laba qulqul baakadood ayaa mara albaabka Shorewall ee soo afjara OpenVPN, oo kaliya mid ka mid ah ayaa sir ah. Midda koowaad waa gaadiidka macmiilka oo u socda dhageystaha VPN ee interface-ka internet-ka u jeeda. Midda labaad waa codsiga la furay ee ka baxa interface-ka tunnel-ka oo u socda server xafiiseed ama adeeg ku yaal albaabka. Sawir labadaba ka hor inta aadan wax ka beddelin siyaasadda, sababtoo ah qaanuun buuxiya midda koowaad waxba ma qabato midda labaad.
Sawir labada qulqul ka hor inta aadan wax ka beddelin siyaasadda
Qor qulqulka sida safaf leh isha, meesha loo socdo, borotokoolka iyo dekedda. Waddada dibadda, isha waa cinwaanka dadweynaha ee macmiilka oo meesha loo socdo waa dekedda dhageysiga ee albaabka; Shorewall waxay u arkaa taraafik internet ka yimaada oo u socda darbiga dabka. Waddada gudaha, isha waa baaxadda cinwaannada tunnel-ka oo meesha loo socdo waa adeegga la ansixiyay. Labada saf waxay leeyihiin milkiileyaal kala duwan xitaa marka hal maamule labadaba maareeyo.
| Flow | Zone relationship | What to constrain |
|---|---|---|
| Encrypted OpenVPN transport | Internet to the firewall host | The listener's actual protocol and port |
| Decrypted request to a LAN service | VPN clients to the LAN zone | One approved server and service |
| Decrypted request to the gateway | VPN clients to the firewall host | Only the local services required |
| Request to another VPN client | VPN clients to VPN clients | Denied unless deliberately required |
Ku dar saf kaliya haddii codsigu ku dhammaado albaabka laftiisa, sida gelitaanka xalliyaha ama maamulka. Adeegga ku yaal host-ka wuxuu raacaa siyaasadda gelitaanka host-ka, ma aha waddada la gudbiyay. Isku darka labadaba waa sababta qaanuun tunnel cidhiidhi ah uu ugu dambeyn u bandhigo interface maamul.
U qoondee aagga tunnel-ka iyo baaxadda interface-ka
Aagga safarka waxaa lagu dhawaaqaa /etc/shorewall/zones, interface-ka tunnel-ka waxaa lagu xiraa /etc/shorewall/interfaces, xiriirka dibadda waxaa lagu sharraxaa /etc/shorewall/tunnels. La qabso syntax-ka nuqulka la rakibay, sababtoo ah habaysha tiirarka iyo magacyada xulashooyinka way is beddeleen inta u dhaxaysa nuqullada waaweyn. Dekedda tusaalaha buugga hagaha maaha sabab loo fasaxo deked ka duwan midda daemon-ku dhab ahaan dhageysto. TCP iyo UDP isma beddeli karaan kaliya sababtoo ah tirooyinku way isku bexeen.
Buugga hagaha wuxuu interface-yada ku kooxeeyaa tun+. Host leh tunnel ka badan hal, calaamaddaas guud waxay dhigi kartaa VPN labaad oo heer kalsooni kala duwan leh isla aaggaas. Dib u eeg baaxadda marka la barbardhigo interface-yada dhab ahaan jira, oo magacaabista ku hay sida ay tahay ee ku hoos jirta wareegga nolosha maareeyaha xiriirka halkii aad gacanta ku wax ka beddeli lahayd magacyada interface-yada.
Buugga hagaha taariikhiga ah wuxuu ka kooban yahay tusaalooyin qaabeynta OpenVPN oo aad u duug ah, oo taladiisa sirta ah waa in aan lagu koobiynin hirgelinta hadda. Amaahso tusaalaha aagagga iyo qulqulka beddelkiisa. Saldhigga sirta ka qaado siyaasadda OpenVPN ee albaabka ee la ilaaliyo.
Fasax kaliya waddada aad kala soocday
Aqbalaadda ballaaran ee aagga VPN ilaa LAN waa sawir bilow ah, maaha siyaasad dhammaatay. Qor isha macmiilka ee la fasaxay, cinwaanka dhabta ah ee adeegga, borotokoolka iyo dekedda. Kadib akhri qaanuunnada ka sarreeya iyo caadada aagga, sababtoo ah wax yar oo lagu daray ma joojiso fasax ballaaran oo horey u habboon. Taraafikada u socota host-ka albaabka waa xiriir gooni ah oo ka duwan taraafikada laga gudbiyo.
Taraafikada u dhaxaysa macmiillada waxay u baahan tahay go’aan u gaar ah. client-to-client ee OpenVPN iyo routeback ee Shorewall labaduba waxay saameeyaan haddii macmiilladu gaari karaan midba midka kale, oo midkoodna waa in aan la shidin kaliya si hal barnaamij LAN u shaqeeyo. Go’aanso halka go’doomintu lagu dhaqan galayo ka hor inta aadan tijaabin.
Ku hay waddada jawaabta isla qorshaha. Adeegga ama router-kiisa waa in uu ogaado sida taraafikada loogu celiyo baaxadda tunnel-ka, ama naqshaddu waa in ay si ula kac ah oo ku dhex jirta baaxadda loogu talagalay u tarjunto isha.
Xaqiiji, kadibna caddee labada waddo
Xaqiiji qaabeynta ka hor inta aadan wax dib u bilaabin, oo fur galmo maamule oo madaxbannaan haddii siyaasadda cusub khalad tahay.
shorewall checkKadib hubin nadiif ah, codso qaabeynta oo dib u akhri waxa Shorewall soo rartay. Akhrintan waxay sharraxaan siyaasadda socota ee ma aha waxa faylku sheegayo u muuqdo.
shorewall show zones
ip route get 192.168.10.20Tijaabi hal codsi cusub oo la fasaxay iyo hal codsi si ula kac ah loo diiday isla macmiilka. Gacan-qaadashada OpenVPN ee guulaysata waxay caddeynaysaa kaliya isweydaarsiga dibadda; adeegga la fasaxay iyo kheyraadka la diiday waxay caddeynayaan siyaasadda gudaha ee aad u jeedsatay. Kadib dib u xiriir macmiilka oo ku celi, sababtoo ah magaca iyo cinwaanka interface-ka tunnel-ka way is beddeli karaan inta u dhaxaysa fadhiyada. Haddii natiijadu ka duwan tahay, hagaaji baaxadda aagga halkii aad ballaarin lahayd qaanuunka.