Dweba indlela ekhululiwe: lapho idivayisi ye-VPN iphoqa inqubomgomo
Umdwebo ogcina kumsilaleli obethelwe awubonisi inqubomgomo ebalulekile. Dweba indlela ekhululiwe, bese uqhathanisa izindawo ngokuthi isicelo siwela ini.
Imidwebo yabathengisi ivamise ukugcina kumsilaleli obethelwe, ngoba yilowo oyingxenye enekheli lomphakathi. Umbuzo onquma isimo sokuphepha ukuthi kwenzekani ngemva kokukhulula, lapho iphakethe liba yi-IP evamile futhi lingafinyelela konke okuvunyelwe yithebula yomzila. Uma kungekho owayedweba lolo phiko, akekho umnikazi walo. Umhlahlandlela ongezansi uwudweba kuqala, bese uqhathanisa izindawo ngokuthi isicelo esikhululiwe siwela ini ngempela.
Dweba iphakethe ngemva kokukhulula, hhayi ngaphambi
Indlela yangaphandle iyingxenye edokhumentwa abathengisi: indawo yokugcina yomphakathi, inqubomgomo yokuthutha evuma ukuxhumana, kanye nensizakalo eyiqedayo. Indlela yangaphakathi iqala ngesikhathi iphakethe lilahlekelwa yisihloko somhubhe, futhi ukusuka lapho imithetho yomzila nokuhlunga engenalutho oluhlangene nomhubhe iyilawula. Beka kokubili ekhasini elilodwa, ngoba umdwebo onesokuqala kuphela ukhombisa ukuthi ukwamukela nokugunyaza kuyisinqumo esisodwa. Akusiyo, futhi igebe phakathi kwazo yilapho izindawo eziningi ziphambuka khona.
Bhala ingxenye yangaphakathi njengokulandelana okunezinombolo okunezinhlobo zamadivayisi eziqanjiwe, hhayi njengomcibisholo. Umcibisholo ufihla ukuthi isicelo siwela isihlungi yini, futhi ukuwela noma ukungaweli umbuzo wonke. Isinyathelo ngasinye ngezansi sisho idivayisi kanye neqoqo lemithetho elisebenza lapho, ngakho isihlungi esingekho sibonakala njengegebe hhayi njengento eshiwo umugqa.
- Iklayenti elikude: idivayisi yomsebenzisi edala umhubhe.
- Inqubomgomo yonqenqema: iqoqo lemithetho evuma ukuthutha kwangaphandle kumsilaleli womphakathi.
- Idivayisi eqedayo: indawo yokugcina ye-VPN ehlakaza iphakethe bese ilinikeza i-IP evamile.
- Isihlungi sangaphakathi: iqoqo lemithetho yokudlulisela noma yamaqembu okuphepha elikhawulela ukuhamba kusuka kuklayenti kuya ensizakalweni.
- Isihambisi sohlelo: insizakalo ethola isicelo esikhululiwe.
Izinqubomgomo ezimbili, abanikazi ababili
Inqubomgomo yangaphandle iphendula ukuthi ubani angasungula umhubhe, futhi ivezwa emithethweni evuma ukuthutha kuya ensizakalweni eqedayo. Inqubomgomo yangaphakathi iphendula ukuthi umsebenzisi oqinisekisiwe angafinyelela kuphi, futhi ihlala emithethweni yokudlulisela, emaqenjini okuphepha noma kuhlelo ngokwalo. Idivayisi eyodwa ingahlalisa kokubili, futhi umklamo onamadivayisi amaningi usenakho kokubili. Ukuwabiza ngamagama ahlukene yikho okukuvumela ukuthi usho ukuthi yikuphi okwehlulekile lapho umsebenzisi engafinyeleli uhlelo.
Izilawuli zokwamukela ezinjengezitifiketi nokuqinisekisa kwezigaba eziningi ziphendula ubunikazi kuphela, akukho okunye. Azinqumi indawo, futhi azinikezi imvume ngensiza ngayinye lapho umsebenzisi esengaphakathi.
Indawo inquma ukuthi isicelo siwela muphi umngcele
Izindawo ezintathu zivamile, futhi ngayinye ishintsha umngcele isicelo esikhululiwe esiwelayo. Qhathanisa ngokuthi kwenzekani lapho, yini engabona umbhalo ocacile, isiphi isilawuli esingasala sinqabe isicelo, nokuthi yini ehlulekayo kanye nedivayisi. Ithebula elingezansi lisebenzisa lezo zikholomu ezine esikhundleni sombuzo ojwayelekile, ngoba impendulo ngayinye iyisinqumo somklamo esihlukile.
| Placement | What terminates there | What sees plaintext | Which control can still deny | Failure domain |
|---|---|---|---|---|
| Termination in a dedicated segment | A dedicated VPN endpoint | The endpoint and anything on its segment | The filter between that segment and the application | The segment path can bypass the filter if no rule sits on it |
| Termination on the edge firewall | The firewall's public listener | The firewall, after decapsulation | The firewall's inner rule set | Admission and inspection fail together |
| Termination on the protected LAN | The appliance's LAN leg | Every host on the protected LAN | Only a host control or a downstream gateway | The appliance and the protected hosts fail together |
Indawo yesithathu yiyo esusa ukuphoqelela buthule, ngoba uphiko olusegxabeni elivikelwe lunikeza idivayisi indlela eqondile umdwebo ongase ungayibonisi. Hlola izixhumanisi nemizila hhayi isithombe: ip route get 10.20.5.10 libika ukuthi iphakethe lizophuma ngasiphi isixhumanisi, futhi impendulo ayivamisile ukuba yileyo umklamo owacabanga yona. Indima yakudala yodonga lomlilo yokulawula ukuhamba phakathi kwezimo, njengoba kuchaziwe ku-NIST SP 800-41, iyisivivinyo esiwusizo lapha, ngoba idivayisi enophiko olungenamkhawulo oluya kunethiwekhi evikelwe ayilawuli okuningi. Ukucinga umzila kuwumdwebo othembekile ukwedlula lowo osesethulweni.
Ukuphatha kungokwandlela yako ngokwayo evunyelwe ngokucacile. Ukuvumela abasebenzisi ukuthi bafinyelele uhlelo akukudingi neze ukuvumela ukuthi bafinyelele isixhumanisi sokulawula sedivayisi, futhi lezi zimvume ezimbili kufanele zinikezwe ngemithetho ehlukene. Hlola zombili izindlela ngokwehlukana, ngoba umthetho owabiwe ufihla ukuthi iyiphi evuliwe.
Ukuhumusha kushintsha lokho imithetho engaphansi engakubona
Ukuhumusha komthombo kulula futhi kubhubhisa ulwazi. Ngemva kwe-masquerade iklayenti ngalinye libukeka njengedivayisi, ngakho umthetho ongaphansi owawubhalelwe ukuhlukanisa abasebenzisi awusakwazi lokho. Lokhu akusiyo inkinga yokuloga kuphela, kuyinkinga yenqubomgomo: umthetho osuselwe ekhelini leklayenti uba buthule umthetho osuselwe esangweni. Uma inqubomgomo ngomsebenzisi ngamunye ibalulekile, gcina umthombo noma phoqelela inqubomgomo ngaphambi kokuhumusha.
Indlela yempendulo ifanele ukuhlolwa okufanayo. Bhala ukuthi iyiphi indlela indawo yokugcina eyikhethayo yephakethe elibuyayo, ngoba ukubuya okungalingani kudlula ukuhlola okunesimo futhi kukhiqiza ukuxhumana okusungulwayo bese kuma. Zombili izinhlangothi kufanele ziwele umngcele owudwebile, kungenjalo umngcele uwumhlobiso.
sudo tcpdump -ni inside0 host 10.20.5.10
ip route get 10.20.5.10
sudo iptables -t nat -S POSTROUTINGYamukela umsebenzi ovunyelwe nowenqatshiwe
Hlola kusuka kuklayenti langempela elikude hhayi kusuka kusihambisi sokuphatha, ngoba isihambisi sokuphatha sivame ukuhlala endaweni umsebenzisi angasoze abe kuyo. Umsebenzi owodwa ovunyelwe ufakazela ukuthi indlela iyasebenza, futhi owodwa owenqatshiwe ufakazela ukuthi inqubomgomo yenza okuthile ngempela. Gijimisa kokubili ngemva kwakho konke ukushintsha kwendawo, futhi bhala ubunikazi bomthombo nendawo oyisebenzisile. Isivivinyo esifakazela impumelelo kuphela asikwazi ukuhlukanisa umthetho olungile nowengekho.
Bese uhlola izimo ezishintsha isimo: ukuxhuma kabusha, isikhathi esihlala isikhathi eside kunokushintshwa kokhiye, nokwehluleka kwedivayisi ngokwayo. Qhathanisa izibuyekezo, umthamo nokululama njengengxenye yokuhlelwa okufanayo, ngoba idivayisi eyodwa ephethe izilawuli eziningi ezinengqondo iyisizinda esisodwa sokuwohloka esinamalebula amaningi. Ibhokisi lesibili nalo alizimeli ngokwalo lapho ubufakazi bokuphatha obabiwe noma umzila ongenamkhawulo unqoba umngcele obekufanele uwudale.
Bhala indawo yokugcina, indlela ekhululiwe nesilawuli esiyikhawulelayo. Leyo mitsara emithathu ihlala inengqondo noma ngabe ukuqaliswa kubizwa ngani.