Igama leketanga akulona iqhubu: iptables ne-nftables

Womabili ama-firewall angahlunga ithrafikhi ye-VPN edluliswayo, futhi anamathisela imithetho endleleni yephakethe ngezindlela ezihlukene. I-iptables inamaketanga akhelwe ngaphakathi etafuleni, ngakho i-FORWARD ikhona njengendawo yeqhubu enegama. I-nftables ihlukanisa igama leketanga nohlobo lwalo, iqhubu kanye nokubaluleka kwalo, okusho ukuthi iketanga elivamile elibizwa ngokuthi i-FORWARD alihlungi lutho. Ukuqhathanisa lezi zinto ezimbili kuchaza ukuthi kungani umugqa obonakala ulungile kwenye ithuluzi ungenamphumela kwenye.

Iketanga isitsha. Ukuthi i-kernel iyalibheka yini kuncike ekusetshenzisweni nasekutheni isethi yemithetho iyalixhumanisa.

Izinhlobo ezimbili, izindlela ezimbili zokuxhumanisa

Ku-iptables itafula le-filter liza namaketanga amathathu akhelwe ngaphakathi, i-INPUT, i-FORWARD ne-OUTPUT, futhi i--N yakha iketanga elichazwe umsebenzisi elisebenza kuphela lapho kugxunyekwa kulo kusuka kwelinye lawo. Incwadi ye-nftables yona ichaza amaketanga ayisisekelo, akhombisa uhlobo lwawo, iqhubu nokubaluleka, kanye namaketanga avamile, angenzi lokho. Iketanga eliyisisekelo lingaba nanoma yiliphi igama, futhi iketanga elivamile elibizwa nge-FORWARD alitholi sici kusuka kulebula yalo. Lowo ngumehluko wonke, futhi awubonakali esifundisweni esikhombisa umbhalo womthetho kuphela.

Ama-backend okuhambisana anezela isizathu sesibili sokungacabangi ngokuziphatha kusuka egameni lomyalo. Imibhalo ye-iptables ibala imisebenzi ehlukile ngaphansi kwe-iptables-nft, ngakho thatha i-nftables yemvelo, i-iptables-nft kanye nesethi yemithetho endala njengezinhlelo ezintathu hhayi izipeli ezintathu zento eyodwa.

Funda iphutha esimweni salo sangempela

Itafula elingekho, ukuhluleka kwemvume, ikhono le-kernel elingatholakali kanye neketanga elinegama elingekho kuyizinto ezine ezihlukene, futhi kube yinto eyodwa kuphela ephathelene neketanga. Bhala inguqulo yethuluzi, umndeni wekheli natafula eliceliwe, indawo yegama lenethiwekhi kanye nephutha lokuqala elinembile. Bese uhlola ukuthi iyiphi ingxenye ephethe isethi yemithetho: isevisi ye-firewall noma isango eliphethwe umkhiqizo lingakhiqiza amaketanga alo kanye nokulandelana. Ukwengeza iketanga lemvelo eceleni kwazo kushiya inqubomgomo ephethwe ingashintshiwe futhi kwenze uhlu lube nzima kakhulu.

Indawo yegama yesiqukathi ingaba nesethi yemithetho ehlukile kuneyo yomsingathi, ngakho umyalo oqaliswe esimweni esingalungile awukwazi ukukhombisa ukuthi iliphi iketanga elibone iphakethe elidluliswayo. Ukwenyusa amalungelo ngenxa yokuthi iketanga elilindelekile alibonakalanga akukona ukuxilonga.

Izibali zikhombisa ukufinyelela, hhayi isigwebo

Izibali zemithetho zikutshela ukuthi umthetho ufinyelelwe. Azikutsheli ukuthi umthetho olandelayo wavumela umsebenzi, futhi azibonisi ukuthi zonke izindlela ezinye zenqatshiwe. Zifunde ngesikhathi sokugeleza okulodwa okungenabungozi okugunyaziwe, kanye nokulandelana kwemithetho nokuxhunyaniswa kweketanga, futhi uzithathe njengokubhekwa okukodwa hhayi isigwebo. Isibali esingesona uziro kumthetho we-drop sisho ukuthi ithrafikhi yashayisana nawo; asisho lutho mayelana nethrafikhi engashayisananga nawo.

Ukudluliswa kwe-IP kwe-kernel kuyisethi ehluke ngokuphelele. Ukuba khona kweketanga akukuvuleli ukudluliswa, futhi ukungabikho kwelebula eyaziwayo akusho ukuthi ukudluliswa kumile.

Chaza ukugeleza okufuna ukukuvikela

Bhala isicelo esisodwa sekhasimende ngemva kokukhishwa kwesembozo: umthombo waso, indawo ekuyiwa kuyo, umndeni wekheli, nokuthi siphelela esangweni noma sidlula kuso. Okokufaka kwesevisi yasendaweni nethrafikhi edluliswayo kubonakala ezindaweni ezihlukene, ngakho kudinga imithetho ehlukile nokuhlolwa okuhlukile. Ku-VPN enebhuloho, qinisekisa nendlela yebhuloho, ngoba iketanga elisezingeni le-IP aliqapheli ngokuzenzakalela amafremu e-Ethernet.

Gcina ukufinyelela okuzimele kokubuyisela ngaphambi kokushintsha isango elikude. Bese uqinisekisa ukugeleza okuhloswe nokwenqatshwa okudingekayo ngaphansi kwesethi yemithetho efanayo. Iketanga elisha elingenalutho elinegama elijwayelekile akulona ukulungisa.

Ukuqhathanisa kuphetha ngombuzo owodwa: iliphi iqhubu i-kernel elibiza ngempela kuleli phakethe? Phendula lokho, futhi igama leketanga alisaba semqoka.