Ukweqa i-VPN ngephothi elilodwa kudinga ukuhlela imizila ngomgomo

Isicelo sihlala siwuhlobo lomusho ofanayo: gcina i-VPN yokuphequlula, kodwa vumela i-SSH noma umsebenzi wokugcina ikhophi ukuthi usebenzise uxhumano olujwayelekile. Iseluleko esisakazekayo ngalokhu, ukudlulisela iphothi ngemithetho ye-NAT ye-iptables, asikwenzi lokho. Umthetho we-NAT ubhala kabusha amakheli namaphothi ngaphakathi kokugeleza; awukhethi neze ukuthi iphakethe liphuma kuphi. Leso sinqumo singesokusesha komzila, futhi ukusesha komzila kudinga usizo ukuze kubonakale iphothi.

Kungani umzila ojwayelekile ungeke uhambisane nephothi

I-Linux ikhetha umzila ngokusesha ikheli lendawo ebekiwe ethebuleni, ngemva kokuthi amathebula angabangeneleki ahlungiwe ngemithetho yomgomo. Leyo mitherho ingahambisana nomaka we-firewall, ikheli lomthombo, isixhumanisi esingenayo noma i-UID. Isingeniso somzila ngokwaso asinayo inkambu yephothi, ngoba umzila ukhethwa ngaphambi kokuba inhloko yokuthutha ibe nencazelo.

I-iproute2 yamanje namakernel bandisa isikhethi somthetho: ipproto, sport futhi dport ziyamukelwa, ngakho ip rule add ipproto tcp dport 22 table 100 iveza inhloso ngomugqa owodwa. Gijimisa ip rule add help kusibungazwa sangempela ukuze ubone ukuthi ukwakha kwakho kufaka dport. Uma kunjalo, usuqedile ngomyalo owodwa; uma kungenjalo, indlela yomaka engezansi iyafana nayo.

Noma ngabe kunjani, umthetho uyisikhombi nje. Ithebula 100 lisadinga umzila, futhi yilowo oyingxenye abantu abayikhohlwayo.

Izingxenye ezintathu, noma eyodwa

Isimo sesimanje umthetho owodwa ongenhla kanye nomzila ethebuleni elihlukile. Isimo sakudala sifaka i-netfilter phakathi: maka iphakethe, bese ufanisa umaka emthethweni. Kokubili kuphelela ekusesheni okufanayo; kwehluka endaweni okufundwa kuyo iphothi.

Indlela yomaka ikhona ngoba i-netfilter ibona inhloko yokuthutha kanti ikhodi yokuhlela imizila ngokomlando yayingayiboni. Yiwona wonke umshini, futhi uchaza ukuthi kungani indlela yokubuyisela iyizingxenye ezintathu ezisebenzisanayo hhayi umyalo owodwa ohlakaniphile.

Izingxenye ezintathu ngokulandelana

Okokuqala, maka ukugeleza ofuna ukukuphambukisa, kuketanga eqala ngokushesha okwanele ukuba umaka ube khona ngaphambi kwesinqumo somzila:

nft add table inet vpnexempt
nft 'add chain inet vpnexempt out { type route hook output priority mangle; }'
nft add rule inet vpnexempt out tcp dport 22 meta mark set 0x1

Okwesibili, thumela amaphakethe anomaka ethebuleni elihlukile:

ip rule add fwmark 0x1/0x1 table 100

Okwesithathu, nikeza lelo thebula umzila ozenzakalelayo ngosixhumanisi somzimba. Amakheli ayizibonelo; faka awakho:

ip route add default via 192.168.1.1 dev wlan0 table 100

Yeqa isinyathelo sesithathu bese iphakethe elinomaka alitholi mzila ethebuleni 100, ngakho liyahluleka. Uphawu lubonakala sengathi umthetho waphula inethiwekhi, kanti empeleni wasusa indlela eyodwa eyayisele yephakethe.

Yini eyenza kuqhubeke kusebenza ngemva kwephakethe lokuqala

Amamaka asebenza kumaphakethe aphumayo. Impendulo ifika esixhumanisini somzimba nekheli elinikezwe isixhumanisi, futhi ithebula eliyinhloko lingase likhethe umhubhe kuleyo ndawo. Izindlela ezimbili zigcina indlela yempendulo ihambisana: umthetho osekelwe emthonjeni wokheli lwesixhumanisi, kanye ne-connection tracking egcina isinqumo ngobude bokuphila kokugeleza. Ukugcina umaka ku-conntrack nokuwubuyisela empendulweni yindlela evamile yokwenza ukukhishwa okunesimo kuzinze.

Ukuhlunga komzila ophambene ngomunye umbulali othule. Uma i-kernel iqinisekisa ngokuqinile umzila wokubuya futhi impendulo ifika esixhumanisini ithebula eliyinhloko elingeke likhethe, iphakethe liyalahlwa ngaphandle komlayezo. rp_filter amanani ozenzakalelayo ahluka ngesabelo nangokuthi isixhumanisi siyadluliselwa yini, ngakho funda inani elisebenzayo esikhundleni sokucabanga ukuthi licishiwe.

Ungamaki ukuthutha komhubhe ngokwawo. Umhubhe we-WireGuard noma we-UDP OpenVPN awuwona i-TCP 22, ngakho indlela engenhla iphephile, kodwa ukukhishwa okubhalwe njengakho konke ngaphandle kwendawo yomhubhe kungabamba amaphakethe abethelwe futhi kwephule umhubhe ngendlela ebukeka njengomjikelezo womzila.

Hlola esikhundleni sokucabanga

Buza i-kernel ukuthi ingathatha muphi umzila, wendawo nangephothi, bese ugijimisa ukudlulisa kwangempela:

ip route get 203.0.113.10
ip rule show
nft list ruleset

Uma umaka ukhona kodwa izibali zinganyakazi neze, umthetho awuhambisani. Izibali ziyingxenye yomehluko phakathi kokumiswa okukubhalile nomgomo owenziwa yi-kernel.

Lapho lena kuyithuluzi elingalungile

Ukukhishwa okusekelwe ephothini kubuthakathaka ngokwemvelo. Izinsiza zishintsha amaphothi, i-HTTP/3 ifika njenge-UDP 443, futhi uhlelo lokusebenza olulodwa lungavula ukugeleza okuningana kwezinhlobo ezihlukene. Uma isidingo sangempela ukuthi lolu hlelo lusebenzise isixhumanisi esijwayelekile, isendlalelo sokuhlela imizila asiyona indawo; isikhala samagama senethiwekhi noma i-proxy yohlelo ngalunye kufaneleka kangcono.

Uma isidingo ukuthi le nethiwekhi encane isebenzise isixhumanisi esijwayelekile, yeqa ngokuphelele amamaka bese wengeza umzila oqondile kakhudlwana. Kulula, kubonakala ethebuleni elilodwa, futhi umuntu olandelayo angakuhlola ngaphandle kokufunda iqoqo lemithetho.

Bhala ukuthi yisiphi kulezi zidingo ezintathu osinazo ngempela ngaphambi kokuthinta i-firewall. Umshini ongenhla unembile, futhi ukunemba okusetshenziswe esendlalelweni esingalungile kumane nje kuyisikhathi eside sokungasebenzi.