Ingabe ukwehliswa kwe-NAT kwezingodo kuyayephula imithetho yakho yomzila we-VPN?

Ukushesha kungadlula ihukhi umgomo wakho oncike kulo, noma kumane kugudluze lapho izibali zibuyekezwa khona. Hlukanisa leyo miphumela ngaphambi kokushintsha izilungiselelo.

Ukuvula ukushesha kwe-NAT kwezingodo kungenza ukusethwa kwe-VPN kusheshe, futhi kungabangela ukuba umgomo womzila uyeke ukusebenza kwamanye amaphakethe ngaphandle kwanoma yimuphi iphutha. Ukuthi yikuphi kwalokho okwenzekayo kuncike kulokho okudlulwa yindlela esheshayo, futhi lokho kuyahluka phakathi kwefirmware, inguqulo ye-kernel kanye nohlobo lokushesha olusetshenziswayo. Imenyu yezilungiselelo ayivamisile ukutshela ukuthi yikuphi osanda kukuvula.

Izimangalo ezimbili zifanele zihlukaniswe ngaphambi kokuba kusolwe isisheshisi: ukuthi umthetho uyekile ukuphoqelelwa, nokuthi isibali siyekile ukubuyekezwa. Lokhu akukona ukubona okukodwa.

Izinhlobo ezintathu zokushesha zihlanganiswa ndawonye

Ukwehliswa kokudlulisela, ukushesha kwe-cryptographic kanye nokwehliswa kwesiteshi sedatha somhubhe kuyizindlela ezihlukene ezivame ukwabelana ngeswishi eyodwa. Ukwehliswa kokudlulisela kuvumela ukugeleza okusunguliwe ukuba kudlule ingxenye yesitaki esijwayelekile, ukushesha kwe-cryptographic kwenza umsebenzi we-cipher ushibhe, futhi ukwehliswa komhubhe kuhambisa ukugoqwa kuyiye ezingodweni. Irotha enza ukushesha komgwaqo ojwayelekile ingashiya ukugeleza komhubhe kuyo yonke indlela enensayo, futhi lokho kuwumphumela wokusebenza hhayi ukushintsha komgomo. Kukhona futhi okuphambene, lapho ukugeleza komhubhe kwehliswa khona kuyilapho umgomo ozungezile usahlolwa.

Linux flowtables yiso eseshicilelwe esifanele ukufundwa kakhulu, ngoba ukugeleza okusunguliwe kungadluliselwa endleleni esheshayo. Ukubalwa kwazo nokuphathwa kwesimo kuyehluka ekudluliselweni kwakudala, futhi yikho izibali eziqala ukubonakala zixakile.

Isibali esiyeka ukunyakaza asifakazi okuningi

Izibali zomthetho zibala amaphakethe adlula emthethweni, futhi ukugeleza okwehlisiwe kungase kungabe kusadluli kuwo futhi ngemva kwephakethe lokuqala. Lokho kukhiqiza isibali esima kuyilapho ukugeleza kuqhubeka, futhi sibukeka sifana ncamashi nokudlula uma uthemba inombolo. Ukubuka isibali kusasiza njengophawu lokuthi ukugeleza kushiye indlela ebalwayo. Okunye ukuxilonga kufanele kuvele lapho amaphakethe aya khona ngempela.

Ukucabanga okuphambene kwehluleka ngokubi okufanayo. Ukulanda okusheshayo akubonisi ukuthi imithetho yakho yokukhipha ngaphandle kanye nokuphathwa kokwehluleka kusasebenza, ngoba kuhlola ukugeleza okukodwa hhayi umgomo.

Izimo ezintathu zinquma ukuthi ukwehliswa kuyawephula yini umgomo

Isimo sokuqala ukuthi ingabe indlela esheshayo ibonisana nehukhi umgomo wakho oncike kulo, ngoba umgomo ochazwa ngamamaki nemizila uvame ukuphila kunalowo owakhiwe ekuhlungweni kwephakethe ngalinye. Okwesibili ukuthi ingabe i-firmware iyavuma nhlobo leyo nhlanganisela, ngoba ezinye izakhiwo zicisha ukwehliswa ngokuzenzakalela lapho umhubhe noma isici se-firewall sisebenza. Okwesithathu ukuthi ingabe ukugeleza kufanelekile, ngoba ukushesha ngokuvamile kuxhumene nokugeleza okusunguliwe futhi kungase kukhiphe amaphakethe ahlukanisiwe noma angajwayelekile. Lapho kukuthathu kuvuna ukushesha umgomo usasebenza, futhi lapho okokuqala kwehluleka khona akukho ukulungisa okukubuyisela.

Funda imibhalo yomhlinzeki yenhlanganisela oyisebenzisayo, hhayi imodeli yerotha iyonke. Izinguqulo ze-firmware zishintsha lezi zimpendulo buthule.

Hlola umgomo, hhayi ukudlula kwedatha

Linganisa lokho umgomo okufanele ukukuqinisekisa ngaphambi kokulinganisa ukuthi kuhamba ngokushesha kangakanani. Imiyalo engezansi ikhombisa ukuthi i-flowtable ifakiwe yini, ukulandelela ukuxhumana kubona ini, nokuthi iklayenti liphuma kukuphi ikheli. Qhathanisa ukuxhumana okusha ngemva koshintsho, ngoba okusunguliwe kungase kugcine indlela yako endala.

nft list flowtables
conntrack -L | head -n 20
curl -sS --max-time 8 https://api.ipify.org; echo
ping -c 3 192.168.50.20

Umhlahlandlela we-flowtable ohlanganisa ukugeleza komhubhe ukutshela ukuthi indlela esheshayo iyasebenza, futhi ithebula lokuxhumana likhombisa ukuthi ukugeleza kulandelwa ngendlela oyilindele. Ukuhlolwa kwekheli kuqinisekisa ukuphuma lapho umgomo ukhuluma ngokuphuma ku-inthanethi, kuyilapho i-ping iqinisekisa indawo yangasese okufanele ihlale ifinyeleleka. Gijimisa isethi efanayo ngokushesha kucishiwe bese kuvulwa, futhi uqhathanise imiphumela hhayi izikhathi.

Bhala phansi isilungiselelo sangaphambilini ukuze ukuhlola kuhlale kubuyiseka. Umyalo ojwayelekile wokuthi ukwehliswa kucishwe kuyo yonke indawo uthathwa njengekhambi lesikhashana, hhayi njengokutholakele.

Izihloko ezihlobene