Khawulela i-OpenVPN Gateway ku-LAN eyodwa ngemithetho ye-UFW

Nquma imvume ngaphambi kokuvula ifayela lomlilo wendonga: amaklayenti aqinisekisiwe angavula ukuxhumana okubheke kwisethi yezindawo ethile eyodwa, futhi isango kufanele lenqabe wonke omunye umzila wokudlula ngisho nalapho iklayenti lifaka imizila eyengeziwe. Lowo musho uwumklamo, futhi wonke umthetho ongezansi ukhona ukuze uwusebenzise. Noma yini ebanzi, njengayo yonke indawo yamakheli angasese, ukuphuma ku-inthanethi ngomhubhe noma uhambo phakathi kontanga, kuwumklamo ohlukile odinga isinqumo saso. Imithetho futhi inesizungu ngamabomu, ngoba umlilo wendonga ohlakaniphile yilowo okungekho muntu ongawuhlola kamuva.

Qala ngokubhala i-topology nemvume

Isibonelo sisebenzisa i-Community OpenVPN iseva enedivayisi ye-TUN yendawo yomsebenzisi ebizwa ngokuthi tun0, iqoqo lamaklayenti 10.77.0.0/24, kanye nesethi yezindawo eyodwa exhunywe 192.168.60.0/24 ku- lan0. Ukudluliswa kwe-IPv4 kuyasebenza kakade futhi i-LAN inayo imvume yokubuyela eqoqweni, ngakho akukho lapha okuncike ekuhumusheni phakathi kwakho kokubili.

Umlilo wendonga kule host ungowase-UFW, futhi akukho sethi yemithetho yesitsha noma ithebula le-nftables elihlukile elingafaka umzila wokwamukelwa wangaphambili. Indlela emfushane yokwehlisa umfudlana edlula isihlungi ingenza imigqa yokuqapha ibe umhlobiso nje, ngakho qinisekisa ukuthi akukho okusebenzayo. Shiya ukudluliswa client-to-client kwe-OpenVPN ngokwayo kucishiwe, ngoba uhambo phakathi kontanga olungaze lweqe isihlungi sohlelo lokusebenza alunakulinganiswa ngalo. Isilaleli sangaphandle nemithetho yokuphatha zihlala njengoba zinjalo, ngoba lolu shintsho lulawula uhambo lomhubhe olususiwe ukubethela esikhundleni sokushintsha umlilo wendonga.

Beka onogada ngaphambi kokwamukelwa kokuqala kwe-UFW

Imvume yomzila elandelwa ukwenqaba ayanele emngceleni oqinile. Imithetho ye-before ejwayelekile yamukela uhambo olusunguliwe kanye ne-ICMP ethile ngaphambi kokuba noma yimuphi umthetho womsebenzisi ubhekwe, ngakho umfudlana owavunyelwa ngesonto eledlule ungahlala ngaphandle komkhawulo omusha wendawo okuyiwa kuyo ngenxa nje yokuthi usanomumo. Yenza ikhophi yokuphepha yamafayela e-UFW futhi ugcine ikhonsoli yangaphandle komkhawulo ivuliwe ngaphambi kokuhlela.

Esigabeni *filter sefayela /etc/ufw/before.rules, memezela imigqa emibili eceleni kwezimemezelo ezikhona nangaphambi kwanoma yimuphi umugqa womthetho.

:vpn-src-guard - [0:0]
:vpn-reply-guard - [0:0]

Ngokushesha ngemva kwezimemezelo, nangaphambi kwezimvume zokungena nokudluliswa, gxuma kuyo futhi uchaze ukuthi ivumela ukuthi kudlule ini.

-A ufw-before-input -i tun0 -j DROP
-A ufw-before-forward -i tun0 -j vpn-src-guard
-A ufw-before-forward -o tun0 -j vpn-reply-guard

-A vpn-src-guard -o lan0 -d 192.168.60.0/24 -s 10.77.0.0/24 -m conntrack --ctdir ORIGINAL -j RETURN
-A vpn-src-guard -j DROP

-A vpn-reply-guard -i lan0 -d 10.77.0.0/24 -s 192.168.60.0/24 -m conntrack --ctstate RELATED,ESTABLISHED --ctdir REPLY -j RETURN
-A vpn-reply-guard -j DROP

Gcina ingxenye esele yesigaba kanye nomugqa wayo COMMIT. Ukunamathisela ithebula lesibili lesihlungi noma ukususa imithetho engahlobene yindlela umlilo wendonga ophenduka ngayo ukuphazamiseka, futhi ifayela lisekubeni elilodwa lokubuyisela emuva ekubeni ikhophi eyodwa ebalulekile.

Funda ukuthi unogada ngamunye uvumela ukuthi kudlule ini futhi wenqaba ini

Umugqa wokuqala uqhubeka nokucubungula kuphela lapho umthombo useqoqweni, indawo okuyiwa kuyo iyisethi yezindawo eyodwa, isixhumanisi sokuphuma yi-LAN futhi iphakethe lihamba ngendlela yasekuqaleni yomfudlana wawo. Konke okunye okufika kusuka kumhubhe kuyalahlwa, kuhlanganise nomthombo ongaphandle kweqoqo nanoma iyiphi indawo okuyiwa kuyo engale kwesethi yezindawo evunyelwe.

Iphakethe laphakathi kontanga lingena futhi liphume ku- tun0, ngakho lehluleka esivivinyweni sesixhumanisi se-LAN ngisho ngaphambi kokufika ekuhloleni indawo okuyiwa kuyo. Ukuxhumana okusha kusuka ku-LAN kuya kumaklayenti nakho kwehluleka esivivinyweni sendlela yokuphendula, okuvala ngokuzenzakalela umzila wokubiza obuyela emuva.

RETURN umgomo ugcina inqubomgomo ejwayelekile ye-UFW isebenza. Le migqa iyahluza, futhi imvume yomzila oyengeza ngemva kwalokho isananquma ukuthi iphakethe elisindile lamukelwa yini. Lokho kwehlukanisa yikho okukuvumela ukuthi ngemva kwalokho ushintshe isethi yezindawo evunyelwe endaweni eyodwa. Ukube onogada bamukele amaphakethe ngqo, wonke umthetho wesikhathi esizayo ubuzodinga ukwengezwa kabili.

Vumela isethi yezindawo futhi uvale izicabha zohlangothi

Qala ngokubuka kuqala imvume yomzila, bese ususa ifulegi lokubuka kuqala ukuze uyisebenzise: sudo ufw --dry-run route allow in on tun0 out on lan0 from 10.77.0.0/24 to 192.168.60.0/24. Ngemva kwalokho buyekeza ukulandelana kwemithetho yomsebenzisi, ngoba ukwenqaba kwangaphambilini kusanqoba imvume yakamuva. Imvume yesethi yonke yezindawo nayo iyisimo esingalungile lapho kufanele kufinyeleleke kuphela umkhoshi we-HTTPS we-host eyodwa.

Qaphela okwenziwa ukulahla kokungena: amaklayenti omhubhe awakwazi ukufinyelela kunoma iyiphi isevisi kusango ngokwalo, kuhlanganise isilaleli se-DNS esiboshelwe ekhelini laso le-LAN. Ukusingatha i-DNS lapho kudinga ukuhlukana okwenziwe ngamabomu ngaphambi kokulahla kanye nesivumelwano semvume esibuyekeziwe. Uma i-UFW iphatha i-IPv6, engeza ukulahla okuhambisanayo kwe- tun0 efayeleni before6.rules futhi, ngoba uhlu lwezindawo okuyiwa kuzo lwe-IPv4 alusho lutho ngamaphakethe e-IPv6.

Qinisekisa inqubomgomo elayishiwe, hhayi ukubuka kuqala

Buka kuqala ukulayisha kabusha, kusebenzise esikhathini sokunakekela, futhi ufunde isethi yemithetho ephilayo.

sudo ufw --dry-run reload
sudo ufw show raw

Qinisekisa ukuthi onogada bomhubhe bavela ngaphambi kwezimvume ezijwayelekile zesimo ne-ICMP. I- ufw status elula ayibonisi imithetho ye-before ehlelwe ngesandla, yikho abasebenzi baphetha ngokuthi umthetho awukho kuyilapho empeleni ulayishiwe. Funda uhlu oluhlaza kusuka phezulu kuye phansi esikhundleni sokufuna ucezu. Uma onogada bevuka ngemva kwemvume yesimo, umngcele awukwenzi okushiwo yifayela.

Bese uvivinya ukuziphatha hhayi umbhalo. Vula ukuxhumana okusha ku-host evunyelwe futhi ubheke impendulo, qondisa isicelo esingenabungozi endaweni okuyiwa kuyo engaphandle kwesethi yezindawo futhi uqinisekise ukuthi iyafa, zama ukuxhumana phakathi kontanga, zama isevisi yasendaweni esangweni, futhi zama ukuxhumana kwe-LAN-kuya-klayenti okungaceliwe. Hlanganisa umfudlana owodwa ongaphandle kobubanzi owawukhona ngaphambi koshintsho, futhi ususe lowo mfudlana kuphela esikhundleni sokukhipha ithebula lonke lokulandelela lomshini.

Rekhoda imikhawulo eceleni kwemithetho: lokhu kukhawulela ukudlula futhi akukho okunye. Akuvimbeli iklayenti ekusebenziseni ukuxhumana kwalo kwe-inthanethi, akuvimbeli i-host ye-LAN evunyelwe ekudluliseleni uhambo phambili, futhi akuthathi indawo yokuqinisekisa ngaphakathi kwezinsizakalo ezivunyelwe.