Gelitaanka VPN ilaa VLAN: marka hore dhismo shaxda, ka dib xeerarka
Doorar dhinac, adeegyo dhinaca kale. Shan baaritaan ayaa u beddela naqshad aan caddayn oo gelitaanka VPN ilaa VLAN ah shax uu milkiilaha firewall-ka fulin karo.
Ka bilow shaxda, ma aha qaabka firewall-ka. Shax leh doorar dhinac iyo adeegyo dhinaca kale ayaa milkiilaha barnaamijku dib u eegi karaa, milkiilaha amnigu ka doodi karaa, kuna fulin karaa qof kasta oo haysta gateway-ga. Dib-u-eegistaas way ka jaban tahay in la hagaajiyo xeerar aan cidina isku raacsanayn.
Hal saac oo qoraal ah ayaa badbaadisa toddobaad ka dib oo ah baaritaanka xeerarka. Naqshaddu waxay ka hadlaysaa cidda gaadha adeeg tee, waana qaybta ka badbaadda lambaraynta dib-u-habaynta.
Tallaabada 1: magacow doorarka ka hor shabakadaha
Ka bilow dadka, ma aha swiichka. Qor koox kasta oo si fog isku xirta iyo jumlad keliya oo qeexaysa waxa kooxdaas qabato, sida shaqaalaha bakhaarka oo akhriya heerarka kaydka ama qandaraasle ilaalinaya hal isku-dhac. Haddii laba koox ay helaan gelitaan isku mid ah, ujeeddadan waa hal door.
Halkan istaag haddii door uu jiro oo kaliya sababtoo ah jaantus urureed. Door aan lahayn baahi adeeg oo gaar ah wuxuu noqdaa saf unugyo isku mid ah, safafka isku mid ahna waxay qof ku dhiirrigeliyaan inuu mar dambe si fudud u bixiyo shabakad-hoosaad dhan. U kala qaybi waxa dadku qabtaan, ma aha cidda saxeexda kharashkooda. Lix doorar ayaa badanaa badan xafiis yar, saddexna badanaa waa sax.
Tallaabada 2: unug kasta u beddel bayaan adeeg
Unug leh «Barnaamijyada» lama tijaabin karo. Unug leh «HTTPS ilaa ERP host-ka 443, laga bilaabo barkada shaqaalaha» waa la tijaabin karaa. Beddel magac kasta oo shabakad ah meel loo socdo, borotokool iyo deked, ka dib ku dar ku-tiirsanaanta aan adeeggu la'aanteed shaqayn, sida xallinta gudaha ama bixiyaha aqoonsiga.
| Check | Passes when | Stop if |
|---|---|---|
| Destination named | Host and port appear in the cell | Cell names a VLAN or a subnet |
| Direction stated | Initiator and responder are both clear | Cell implies two-way access |
| Dependency listed | DNS or identity path is explicit | Whole infrastructure range is granted |
| Negative case written | At least one denied pair is recorded | Only allow rules exist |
Tiirka jihadu wuxuu qabtaa khaladaadka ugu qaalisan. Fasaxa shaqaalaha inay barnaamij furaan macneheedu ma aha fasaxa server-yada barnaamijka inay xiriiro ku noqdaan laptop-yada shaqaalaha, xeerka xaaladda leh ee fasaxa jihada koowaadna badanaa waxaa loo akhriyaa sidii mid fasaxaya tan labaad.
Tallaabada 3: go'aanso halka aqoonsigu siyaasad noqdo
Qof waa inuu u beddelo fadhi la xaqiijiyay door gateway-gu fulin karo. Ikhtiyaarada la taageeray waxaa ka mid ah siyaasadda kooxda ee ay bixiso backend-ka xaqiijinta, sifooyinka fadhiga la aamini karo, ama barkado cinwaan oo gaar ah door kasta. Saddexduba way shaqeeyaan; sumadda uu macmiilku soo diro ma shaqayso. Dooro habka gateway-gaagu diiwaangeliyo, ma aha kan qoraal madal ku sharraxay.
Bixinta cinwaan uun u eg inuu VLAN ka tirsan yahay waa isla jawaab-la'aan labbiska kale. Hagaha Netgate ee xeerarka firewall-ka OpenVPN wuxuu caddeeyaa kala-soocidda: in tunnel-ku koro loo ogolaado waa go'aan ka duwan in taraafiku dhex maro loo ogolaado.
Qor habka aad dooratay iyo halka loo habeeyay. Marka door isbeddelo, qoraalkaas waa farqiga u dhexeeya hal tafatir iyo raadin saddex interface. Waxay sidoo kale u sheegtaa hantidhawraha halka uu marka hore eegto.
Tallaabada 4: fiiri cinwaanka isha ee uu arko meesha loo socdo
Siyaasadda gudbinta waa inay ku habboonaato isha dhabta ah xadka. Haddii gateway-gu u tarjumo macaamiisha VPN cinwaankiisa, firewall kasta oo hoose wuxuu arkaa hal isha wuxuuna waayaa awoodda go'aan qaadasho door ahaan. Haddii uu ilaaliyo cinwaanka macmiilka, wadada soo noqoshada waa inay jirtaa barkadaas.
Tijaabi labada jihada ka hor qorista xeerarka ugu dambeeya, ka dib qor isha la arkay agteeda unug kasta. Ku socodsii isla baaritaanka laba door oo kala duwan oo isbarbar dhig natiijada. Haddii labaduba ay muujiyaan cinwaanka gateway-ga, kala-soocidda doorarku horey ayay u lumtay. Shax u malaynaya cinwaanno la ilaaliyay halka gateway-gu tarjumaad isha sameynayo wuu ku guuldareystaa ACL-ka hoose ee ugu horreeya.
Tallaabada 5: tijaabi unug kasta ka hor inta aan la sii daayin
U beddel unug kasta oo la ogolaaday hal hawl socotay, unug kasta oo la diidayna kiis diidmo ah. Labadaba ka socodsii macmiil ku jira doorka dhabta ah, ma aha console-ka gateway-ga, sababtoo ah console-ku wuxuu dhaafaa wadada aad tijaabinayso.
# allowed: staff role reaches the ERP endpoint
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 5 https://erp.internal.example/health
# denied: the same role must not reach a management host
nc -vz -w 3 10.30.5.11 22
# observed source address at the destination
sudo tcpdump -ni any 'tcp port 443 and host 10.30.20.15'Kiis diidmo ah oo isku xira waa natiijo la helay, ma aha shil, meeshiisuna shaxda waa unug guuldareystay ilaa xeerka la hagaajiyo. Hayso amarrada tijaabada agteeda shaxda si dib-u-eegaha xiga uu mar kale u socodsiiyo halkii uu dib u dhisi lahaa sababaynta.
Shaxda dhammaatay waxay ka cimri dheer tahay gateway-gii loo qoray. Xeerarku way isbeddelaan firmware iyo iibiyaha, halka safka sheegaya in qandaraasle gaadho hal adeeg mashruuc uu run ahaanayo ilaa shaqadaas isbeddelo.