Ngemuva kokukhipha umfihlo: iyiphi inqubomgomo ebona kuqala ithrafikhi yakho ye-VPN

Ikhebula alisho ukuthi imuphi umthetho osebenze ukuhamba. Shono igebe lenqubomgomo nomqansa olandelayo, bese ufakazela ukuthi impendulo ihamba ngendlela efanayo.

Ukuhamba kwe-VPN kungaba ngokufihliwe ngokuphelele futhi kuqinisekiswe ngokuphelele futhi kugcine kufike endaweni okungekho muntu owayihlele. Ikhebula olijwayezayo alinqumi ukuthi imuphi umthetho osebenza iphakethe langaphakathi; lokho kwenziwa igebe lenqubomgomo nomzila. Ngakho amadizayini amabili abukeka efanayo kumdwebo we-rack angaba nokusetshenziswa okuhluke ngokuphelele. Ukukhetha phakathi kwawo kuqala ngokusho igama lesilawuli esibona kuqala ukuhamba okukhishiwe umfihlo.

Nquma ngegebe lenqubomgomo, hhayi ngesikhala

Wonke amapulatifomu e-VPN ahlola ithrafikhi ekhishiwe umfihlo endaweni ethile ngaphambi kokuyidlulisa, futhi leyo ndawo inegama ekulungiselelweni. Kwipulatifomu eyodwa yisihlungi senqubomgomo yeqembu, kwelinye inqubomgomo yesixhumanisi noma ipheya lesifunda, futhi kudivayisi ehambisa imizila kungase kube umucu we-forward kuphela. Igebe liyona nto eqinisekisa umthetho, kanti imbobo yeswishi iyindawo nje lapho ikhebula liphela khona. Ukuthola igebe yisinqumo sokuqala, ngoba konke okunye ukuhlelwa maqondana nalo.

Ngaphambi kokubheka ihadiwe, bhala phansi ukuhamba: ubani umthombo, kuphi lapho kuyakhona, imuphi umthetho wokuxhumana oyithwalayo nokuthi iyiphi insizakalo evunyelwe. Bese uthola isilawuli esiqinisekisa ngakunye kwalezi ziqinisekiso ezine.

Izindlela ezimbili, izindaba ezimbili ezihlukene zokusebenza

Izinhlobo ezimbili zivamile futhi ngayinye ingase ilungele imfuneko ehlukile.

endpoint -> shared inside subnet -> server
endpoint -> dedicated transit -> policy firewall -> server subnet

Uhlobo lokuqala lungaqinisekisa konke okudingekayo esangweni, inqobo nje uma inqubomgomo yalelwe lowo mkhondo futhi iseva ingenayo indlela yokuyizungeza. Uhlobo lwesibili lunezela umngcele, kodwa kuphela uma imizila nenqubomgomo zenza ngempela ithrafikhi idlule kuwo. Iseva ekwisigaba esifanayo nendawo yokugcina ingase ingalokothi ilandele umqansa waphakathi ocatshangelwayo. Umdwebo ukhombisa inhloso, futhi ithebula lemizila ikhombisa okwenzekayo.

Qinisekisa ngokusesha umzila hhayi ngomdwebo. Isixhumanisi iphakethe eliphuma ngaso nomqansa olandelayo ewukhethayo kunquma ukuthi uhlobo lwesibili lusebenza njengoba kwaklanywe yini.

ip route get 10.30.7.20
sudo iptables -S FORWARD
sudo tcpdump -ni inside0 host 10.30.7.20

Ehlukanisa i-topology nokuhlukaniswa

Ukwabelana ngesubnet akwenzi indawo ingathembekile, futhi ukudlula okukhethekile akukwenzi kube nokuvikelwa. Okunqumayo umkhawulo osetshenziswa ngempela, ukudluliswa okwenzeka ngempela nokuthi ubani ophatha ingxenye ngayinye. Ukubala amaswishi akusho lutho nganoma yikuphi kwalokhu kuthathu. Nquma ngokusuka enqubomgopomeni nasemzileni, bese i-topology ilandela isinqumo.

Phatha futhi amaqembu ethrafikhi ngokwahlukana. Amachibi okufinyelela kude, iziqalelo zeziza-kuya-ezizeni kanye namanethiwekhi emigqa yangasese kungabelana ngedivayisi eyodwa futhi kudingeke imithetho ehlukile, ngoba ubunikazi kanye nobungozi bawo buhlukile. Umthetho obhalelwe iqembu elilodwa uvalelela amanye ngokuthula lapho babelana ngohlelo lwamakheli.

Hlola ukwehluleka nokuphathwa kwayo yonke indawo

Indawo ngayinye inendlela yokwehluleka, futhi umbuzo owusizo ukuthi yini esasebenza lapho ingxenye ima. Izixhumanisi eziningi ezinengqondo kudivayisi eyodwa efile azinikezi ukululama okuzimele, futhi i-firewall engezansi ebelana ngamandla afanayo noma ngumphathi ofanayo ayisiwona umngcele wesibili. Buza ukuthi umzila wokuphatha udlula kuphi, ngoba ikhonso elifinyeleleka kuphela ngomhubhe akuwona umzila wokululama nhlobo; ssh [email protected] true ukusebenza ngaphandle komhubhe kuyindlela eshibhile yokuqinisekisa ukuthi ikhonso alincikile kuwo. Imibhalo yenqubomgomo yeqembu yepulatifomu eyodwa ibeka isihlungi sayo kuthrafikhi ngemva kokukhipha umfihlo nangaphambi kokufihla, okuyiyo kanye leyo nhlobo yegebe elinegama okufanele lifunwe kunoma yimuphi umkhiqizo.

Bhala indaba yokwehluleka yomuntu ngamunye obanga isikhundla eceleni kwendaba yokusebenza. Indawo enqoba ekuhlolweni kodwa yehlulwe ekululameni iwukushintshana, futhi kufanele ibhalwe kanjalo esikhundleni sokutholakala phakathi kwesigameko.

Yamukela ngokugeleza okuvunyelwe nokunqatshiwe

Ngecebo lokuhlola elivunyelwe, hlola izinto ezintathu kumthombo wangempela we-VPN: uhlelo lokusebenza okufanele lusebenze, insiza okungafanele isebenze, kanye nendlela impendulo ebuyela ngayo. Ukunqatshwa ubufakazi bokuthi inqubomgomo iyasebenza, kanti ukugeleza okuvunyelwe kukhombisa kuphela ukuthi umzila ukhona.

Gcina umzila okhethiwe kanye nomphumela wenqubomgomo ndawonye, ngoba umphumela ongenawo umzila awukwazi ukuphindwa futhi umzila ongenawo umphumela awukwazi ukuvikelwa. Lolo pheya lunenzuzo enkulu ekukhetheni indawo yokuxhuma kunanoma yisiphi isimangalo sokuthi yiluphi ungqimba lweswishi oluphephile ngokwemvelo.

Izihloko ezihlobene