Imithetho yokudlulisa zonke izimbobo ingagwinya isilaleli sakho se-WireGuard
Umthetho obanzi wokudlulisa ungagwinya izilaleli ze-WireGuard ne-SSH ze-gateway uqobo. Khetha imithetho emincane noma ikheli lomphakathi elihlukile, bese uhlola indlela yokulawula.
I-gateway yomphakathi isivele isebenza nge-WireGuard ku-UDP 51820, i-SSH ku-22 kanye nohlelo olulodwa okufanele lufinyeleleke kusukela ku-inthanethi. Umthetho ohehayo udlulisela yonke imbobo ku-peer bese uthi sekuqediwe. Ku-gateway ye-WireGuard umthetho onjalo ungabamba ezokuthutha zawo umgudu futhi kukuvalele ngaphandle kumshini owuqedayo. Ukushicilela yisinqumo somzila esinokuhluka kwendlela yokulawula, hhayi umugqa owodwa we-DNAT.
Umnyango womphakathi noma umnyango womgudu: khetha owodwa
Ukushicilela isevisi kwakha indawo entsha yokungena ku-inthanethi. Akufani nokunikeza i-peer ubulungu be-VPN, ngoba isivakashi asingeni emgudwini futhi i-gateway iba ubuso bomphakathi be-backend. Lowo mehluko unquma izilaleli zomthetho kanye nesitifiketi sawo.
Izindawo zokuphatha azivamisile ukufaneleka kuleyo ndawo. Ikhasi lokuphatha elifinyelelwa amaklayenti e-VPN agunyaziwe ligcina indawo yokuhlasela ngaphakathi emgudwini futhi ligwema ukuveza ifomu lokungena ekuskeneni okungahleliwe. Izindawo zokugcina zohlelo zomphakathi zisadinga isitifiketi sazo se-TLS, ukuqinisekisa kanye nomkhawulo wejubane; isinyathelo se-WireGuard esibethelwe asivikeli ingxenye yesivakashi kuya ku-gateway.
Uma isevisi ngempela kufanele ibe ngumphakathi, bhala igama le-host, isitifiketi esiyihlanganayo kanye nezikhala zezivakashi okufanele ziyifinyelele. Lezo zinto ezintathu zinquma ukuma komthetho kanye nenqubomgomo yokuhlunga kamuva. Noma yini engaphandle kwazo ukwanda kobubanzi kwisilaleli somphakathi.
Imbobo eyodwa ingena, i-backend eyodwa iphuma
Sebenzisa imbobo eyodwa yomphakathi kanye nesevisi eyodwa ye-backend. Kulesi sibonelo i-eth0 ithwala ikheli lomphakathi elingu-198.51.100.20, ikheli lomgudu we-gateway ngu-10.200.0.1, futhi i-peer isebenzisa uhlelo ku-10.200.0.7. I-TCP 9443 yomphakathi imephwa ku-TCP 8443 ye-peer:
iptables -t nat -A PREROUTING -i eth0 -d 198.51.100.20 -p tcp --dport 9443 -j DNAT --to-destination 10.200.0.7:8443
iptables -t nat -A POSTROUTING -o wg0 -d 10.200.0.7 -p tcp --dport 8443 -m conntrack --ctorigdst 198.51.100.20 --ctorigdstport 9443 -j SNAT --to-source 10.200.0.1Umthetho we-SNAT uhambisana ne-backend ehumushiwe kanye nendawo yomphakathi yasekuqaleni, ngakho okunye ukuxhumana kuleyo sevisi ye-backend kuhlala ngaphandle kwale mephu. Futhi kufihla ikheli lesivakashi kusukela ku-peer, futhi lokho ukushintshana okwenza ukubuya okuhleliwe okugcina umthombo kube umklamo ohlukile. Isithenjwa sezandiso ze-iptables sichaza zombili izinhloso kanye nezinketho zazo zokufanisa.
Ukudlulisa kusadinga ukuvulwa, futhi uchungechunge lokuhlunga ludinga imvume yendawo ehumushiwe nembobo kanye nezimpendulo ezisunguliwe. Uchungechunge lwe-FORWARD lubona indawo ehumushiwe ngemva kwe-DNAT, ngakho umthetho obhalwe ngokumelene nekheli lomphakathi awuhambisani nephakethe elidlulisiwe. Bhala imvume ngokumelene ne-tuple ye-backend, hhayi eyomphakathi.
I-peer kufanele yamukele ukuxhumana kwesevisi kusukela ekhelini lomgudu we-gateway futhi ithumele impendulo emuva ngomgudu. I-AllowedIPs yayo kufanele igunyaze umthombo eyithola ngempela, okungukuthi ngaphansi kokuhunyushwa komthombo ikheli lomgudu we-gateway, futhi ukufakwa okubanzi kwe-0.0.0.0/0 kuwo wonke ama-peer akudingekile kulo mklamo. Okudonsa phansi ukuthutha kokubuya i-peer eluhlu lwayo olushoda nalelo kheli, noma umklamo ogcina umthombo odlulisa ikheli lesivakashi uqobo esikhundleni salokho, ngakho hlola umthombo i-peer ewubona ngempela hhayi lowo osemthethweni wakho.
Gcina izilaleli ze-gateway uqobo ngaphandle komthetho
Ukuhunyushwa kwendawo kwenzeka ngaphambi kokuba umshini unqume ukuthi iphakethe liyendawo, ngakho i-UDP 51820 ingagcina ise-peer hhayi kwinqubo egcina konke ukuxhumana kwe-peer. Umthetho ulayisha ngempumelelo futhi umgudu uyafa, okuwukwehluleka okunzima ukukufunda ohlangothini lwe-peer.
I-SSH, ama-ejenti okuqapha kanye nanoma iyiphi enye isevisi ephethwe ku-gateway inokuchayeka okufanayo. Umthetho odlulisa konke awuhlukanisi indlela yokulawula kuhlelo olushicilelwe, futhi ukuqala kabusha kokuqala ngemva koshintsho yikhona lapho ukuvalelwa ngaphandle kuba sobala. Umthetho ohlanganisa konke awuxwayisi ngesevisi ayithatha ngokuthula. Uyithola lapho ukuxhumana okulandelayo kwehluleka.
Uma ukudlulisa okubanzi kudingeka ngempela, gcina izimbobo zokulawula ngaphambi komthetho ohlanganisa konke noma sebenzisa ikheli lomphakathi elihlukile lokushicilela. Inketho yesibili ihlanzekile ngoba ikheli lokulawula ligcina inqubomgomo yalo, kodwa umhlinzeki kufanele anikeze lelo kheli; ukwengeza irekhodi le-DNS akwabi linye.
Ukudlulisa okubanzi kwe-TCP ne-UDP nakho akuzona zonke izivumelwano. I-ICMP, i-IPv6, impendulo ye-MTU yendlela kanye nokuthutha kwangaphandle kwe-VPN kudinga inqubomgomo yazo, futhi umthetho ohlanganisa i-TCP ne-UDP ushiya lezo zimo kuchungechunge oluzenzakalelayo.
Khetha imodeli ngaphambi kokubhala imithetho
Izinhlobo ezine zihlanganisa iningi lezinto ezishicilelwe ze-gateway, futhi ukukhetha kuncike ekutheni zingaki izevisi oziphethe kanye nokuthi ungabekezelela kangakanani ingozi yendlela yokulawula. Ithebula elingezansi lizihlela kusukela kwencane kakhulu kuya kwibanzi kakhulu.
| Model | What it protects | Cost | Use when |
|---|---|---|---|
| Narrow port forward | Every other listener, including the VPN | One rule per service | Few services, stable ports |
| Catch-all with reserved ports | Ports named in the exception list | Rule order becomes critical | Many services and disciplined review |
| Separate public address | Control address fully isolated | Provider must supply the address | High-value publication |
| VPN-only access | No public entry at all | Visitors need the tunnel | Admin interfaces and internal tools |
Qala ngemodeli encane ngisho noma ulindele izevisi eziningi kamuva. Yiyo elula kakhulu ukuyihlola, futhi ukuguqula iqoqo lemithetho emincane libe umthetho owodwa obuyekeziwe ohlanganisa konke kulula kunokuthola ukuthi yisiphi isilaleli esabanjwa umthetho obanzi. Noma iyiphi imodeli oyikhethayo, gcina imithetho kumnikazi we-firewall. Ukusebenzisa imigqa ye-iptables eduze kokulungiselelwa kwe-UFW noma kwe-nftables okubuye kulawule lochungechunge olufanayo kukhiqiza inqubomgomo eshintsha ngokulandelana kokuqala.
Fakazela kokubili ukushicilela nendlela yokulawula
Hlola kusukela kuklayenti langaphandle eligunyaziwe usebenzisa igama le-host eligunyaziwe kanye nesitifiketi esivumelekile ngalo. Qinisekisa ukuthi iyiphi i-backend ephendulile, bese uhlola ukuthi izimbobo zomphakathi ezingahlobene zisalawa. Ukuhlolwa kwesitifiketi okuvaliwe akusona isivivinyo se-HTTPS esiphumelelayo, futhi ukuxhumana okufinyelela i-backend engalungile kubi kunokwehluleka.
Ngemva kwalokho, qinisekisa i-gateway uqobo: xhuma i-peer ye-WireGuard, vula isikhathi se-SSH futhi uqinisekise ukuthi ukuqapha kusabika. Isevisi eshicilelwe ingasebenza ngenkathi indlela yokulawula yephukile, ngakho zombili izivivinyo kufanele zibe kuwindi lokushintsha elifanayo. Qala kabusha kanye ukufakazela ukuthi imithetho iphinde isetshenziswe ngokulandelana okulindelekile, bese ususa ukushicilela futhi uqinisekise ukuthi ukususa kuhambisana nokwengeza. Ukwengeza okuningi kokuqala nokususa okungaphelele yikhona okwenza isivivinyo sesikhashana sibe ukuvuleka okungunaphakade.