Vimba Ibanga Elilodwa Lendawo Yokuyisa kuwo Wonke Amaqembu Amaklayenti e-VPN
Umbuso owodwa we-nftables ungala isiqalo sendawo yokuyisa kumaqembu e-VPN avunyelwe ngaphandle kokuthinta ithrafikhi yesango uqobo. Qondanisa i-hook nendawo.
Umbuso owodwa unggcina iqembu le-VPN elivunyelwe kude nebanga lendawo yokuyisa ngaphandle kokuphazamisa enye into eyenziwa isango. Umbuso uqobo mfushane; izinto ezinquma ukuthi uzosebenza yindawo ye-hook alikuyo kanye nendawo yawo kuketanga. Uma wehluleka kulezi zimbili, uthola udonga lomlilo olubonakala lulungile kodwa oluziphatha ngendlela engafani. Qala kulokho okwenziwa iphakethe uma umbuso uwubona.
Umbuso uqondanisa ini ngempela
Umbuso uqondanisa izinto ezintathu ngesikhathi esisodwa: i-interface yokungena, isiqalo somthombo kanye nesiqalo sendawo yokuyisa. Zontathu kufanele zibe yiqiniso ngaphambi kokusetshenziswa kwe-drop, futhi yikho okuligcina lincane. Ukulifunda njengenkulumo eyodwa kulula kunokulifunda njengezinqubomgomo ezintathu ezihlukene.
Ukuqondanisa kwe-interface yikho okuhlukanisa ithrafikhi yamaklayenti edluliswayo ekuxhumaneni kwesango uqobo. Ngaphandle kwakho, umbuso okhuluma kuphela ngeqembu lomthombo uzophinde uthinte amaphakethe isango uqobo eliwakhiqizayo kusuka kulelo kheli, uma kwenzeka lokho. Isiqalo somthombo sihlinzeka inqubomgomo kumaklayenti avunyelwe, kanti isiqalo sendawo yokuyisa siyihlinzeka kubanga elilodwa. Funda umbuso njengokuhlangana hhayi njengohlu.
Bhala amanani amathathu ngaphambi kokuhlela noma yini: igama le-interface yethuneli, iqembu elihanjiswa iseva, kanye nesiqalo ohlose ukusilahla. Iphutha lokuthayipha kunoma yiliphi lawo lidala umbuso ohlaziywa ngokucacile kodwa ongavikeli lutho. Gcina lawo manani amathathu kurekhodi loshintsho eduze kombuso.
I-hook inquma ukuthi umbuso ukhuluma nobani
Iketanga le-netfilter lixhunywe ku-hook, futhi i-hook inquma ukuthi iketanga libona amaphakethe api. I-hook ye-forward ibona ithrafikhi eqondiswa ngesango, futhi yilokho okuthiwa ithrafikhi esuka kuklayenti iya endaweni yokuyisa. Konke okunye kuketanga kuqondiswe kwabanye abalaleli.
I-hook ye-input ibona ithrafikhi eqondiswe esangweni uqobo, ngakho umbuso obekwe lapho ulawula ukufinyelela ezinsizeni zaso hhayi ukudlula. I-hook ye-output ibona ithrafikhi ekhiqizwa isango uqobo, okuphambene nalokho okudingwa inqubomgomo yeqembu lamaklayenti. Amagama amaketanga yizimpawu ezingahleliwe ezikhethwe ngobhala imithetho, ngakho ungaphathi i-hook ngaphandle kwegama. Hlola lapho iketanga lixhunywe khona ngaphambi kokucabanga ukuthi lingaqondanisa ini.
| Hook | Traffic it sees | Right for this policy |
|---|---|---|
| input | Addressed to the gateway | No, that is the host's own services |
| forward | Routed through the gateway | Yes, for client-to-destination traffic |
| output | Generated by the gateway | No, that is the opposite direction |
Ukufunda ukuxhumana kuyisheke lomugqa owodwa oluvimbela umbuso ukuthi ungaweli kuketanga olungakaze lubone iphakethe.
Beka umbuso ngaphambi kwe-accept ebanzi
Imithetho ihlolwa ngokulandelana, futhi isinqumo sokuqala siyaphumelela. I-accept ebanzi eduze phezulu kuketanga iqeda ukuhlolwa kwemaphakethe eziqondanisayo, ngakho i-drop eyengezwe kamuva ayisoze yasebenza kuzo. Yilowo mthetho wokulandelana iyona sizathu sonke sokuthi umbuso obonakala ulungile ungabi nawo umthelela.
Faka umbuso ngaphambi kwe-accept esikhundleni sokuwengeza ekugcineni. Uma iketanga selivele lineno-accept ejwayelekile ye-interface yethuneli, umbuso omusha kufanele ube ngaphambi kwayo, kungenjalo uwumhlobiso nje. Hlola ukulandelana okuphumayo hhayi ifayela olilungisile, ngoba isethi yemithetho ehlanganiswe kumafayela amaningi ingase ingavumelani neyodwa yawo. Bese uqinisekisa ngephakethe lokuhlola elivela eqenjini.
sudo nft list chain inet filter forward
sudo nft insert rule inet filter forward iifname "tun0" ip saddr 10.90.0.0/24 ip daddr 198.51.100.0/24 drop
sudo nft -c -f /etc/nftables.confUmyalo wesithathu uhlaziya ifayela ngaphandle kokulisebenzisa, okubamba amaphutha e-syntax ngaphambi kokuba abe ukuphazamiseka. Kusebenzise ngohlelo lokuhlehla, ngoba umbuso ongalungile kuketanga le-forward ungase anqamule ithuneli osebenza ngapha kwalo.
Imifudlana ekhona ayinendaba nombuso wakho omusha
Ingeno ye-conntrack eyadalwa ngaphambi kokuba umbuso ube khona iyaqhubeka nokuqondanisa nokwamukelwa kwangaphambili. Yikho lokho i-drop entsha ngezinye izikhathi ibonakala isebenza kuxhumano olusha futhi ingenzi lutho kulolo oluhlolwayo.
Funda ukuqondanisa kwesimo phezulu kuketanga. Uma kwamukela ithrafikhi ye-established ne-related ngaphambi kombuso wakho, wonke umfudlana osuvele uqhubeka ugeleza kuze kube uvalwa. Ngokuvamile yikho ukuziphatha okufunayo embusweni ophuthumayo, futhi kuyadida uma ulindele ukunqanyulwa ngokushesha. Nquma ukuthi yimuphi umthelela owufunayo ngaphambi kokuthunyelwa. Ukuhlola okusebenzisa kabusha uxhumano oluvuliwe kuzokutshela indaba engalungile.
sudo conntrack -L -s 10.90.0.14 -d 198.51.100.20
sudo nft list ruleset | grep -n -A3 'ct state'Umyalo wokuqala ukhombisa ukuthi umfudlana ukhona yini, futhi owesibili ukhombisa ukuthi umbuso wesimo wangaphambili usawamukela yini. Womabili afundwa kuphela futhi aphephile ukuwasebenzisa ngesikhathi sezehlakalo.
Lokho umbuso lo ongakho
Umbuso awulona uhlu olumnyama lwamagama wesizinda, inqubomgomo ye-IPv6 noma umkhawulo ku-akhawunti eyodwa yohlelo lokusebenza.
Ngakunye kwalokho kudinga indlela yako. Ukuvimba isizinda kufanele kuxazulule amagama, into eyingxenye yokuhlunga amaphakethe engayenzi. Ithrafikhi ye-IPv6 idinga ukuqondanisa kwayo, ngoba inkulumo ye-ip ayisho lutho ngamaphakethe e-ip6. Umkhawulo wezinga lohlelo lokusebenza ungowensiza noma ungowummeleli oqinisekisiwe, hhayi ukuqondanisa kwesiqalo. Ukuhlukanisa lezo zidingo yikho okuvimbela umbuso omncane owodwa ukuthi ungacelwa ukwenza imisebenzi emine.
Isivumelwano esinikezwa yilo mbuso sicacile: ithrafikhi esuka eqenjini elivunyelwe iya esiqalweni esisodwa sendawo yokuyisa iyalahlwa, kuyilapho ithrafikhi yesango engahlobene igcina inqubomgomo yayo ekhona. Bhala lowo musho eduze kombuso, futhi umuntu olandelayo uzokwazi ukuthi wawenzelwani.