Isikripthi sokwehla noma umthetho we-firewall: yikuphi okumisa ukuvuza?

Ukwethula izixhumanisi ngesikhathi sokunqamuka kuyinto eqinile futhi ngokuvamile kusebenza ngaphandle kwemvume. Qhathanisa nomthetho we-firewall ophila ngemva kokuwa futhi uvala isikhala.

Amadizayini amabili athembisa into efanayo: lapho umhubhe uwile, akukho okukhayo ngaphandle ngokucacile. Enye isebenzisa isikripthi ngesikhathi sokwethula futhi isika izixhumanisi. Enye ishiya umthetho we-firewall usebenza futhi ayiceli lutho kuklayenti ye-VPN. Ziyehluka ngokuthi ngubani onegunya lokwenza, okwenzekayo phakathi nesikhala nokuthi umshini ubuyela kanjani ku-inthanethi ngemva kwalokho. Ukuwaqhathanisa kulawo maphuzu amathathu kunenzuzo enkulu kunokuphikisana ukuthi yikuphi okuqinile.

Umsebenzi ofanayo ngezindlela ezimbili

Iklayenti lingasebenzisa ama-hook lapho umhubhe ukhuphuka noma lapho uhlakazwa, uma iphrofayela ivumela ukusetshenziswa kwesikripthi. Leyo hook isebenza ngaphakathi komjikelezo wokuphila kweklayenti, ngesikhathi lapho uxhumano luvalwa. Umthetho we-firewall wona ungowohlelo futhi awunandaba nokuthi iklayenti liyasebenza, liwile noma libulewe.

PropertyTeardown scriptFirewall unit
Runs when the client is killedNoYes
Needs privilege at teardown timeUsually yesConfigured once, at boot
Acts on the whole machineOften, including recovery pathsOnly on the flows it matches

Leyo thebula iyimpikiswano yonke. Isikripthi esisebenza kuphela ekuvaleni okuhle sihlanganisa isimo obukukhathazeke kakhulu ngaso; isimo esibalulekile ukuwa noma inethiwekhi enyamalalayo, futhi akukho kuzo ezimbili okunikeza ukwethula okuhlanzekile.

Okungenziwa futhi okungenakwenziwa yi-hook yokwethula

Iphethini ebhaliwe ihamba izixhumanisi zenethiwekhi futhi yehlisa konke ngaphandle kwe-loopback. Lapho idivayisi ebonakalayo isiphansi, akukho okungaphuma ngaphandle komhubhe, futhi lowo umqondo.

#!/bin/sh
for dev in /sys/class/net/*; do
  name=$(basename "$dev")
  [ "$name" = lo ] || ip link set dev "$name" down
done

Futhi yehlisa inethiwekhi yasendaweni, noma yiluphi usizo olusingathwa umshini, kanye nendlela obungeyisebenzisa ukulungisa inkinga. Kukhompyutha ephathwayo idivayisi engenantambo ngezinye izikhathi idinga ukushintshwa ngesandla ngemva kwalokho, ngakho ukuphazamiseka okufushane kuphenduka isikhathi sokulungisa. Okubi nakakhulu, i-hook ingase ingavunyelwa ukwenza noma yikuphi kwalokho: lapho iklayenti lilahla amalungelo, isikripthi sokwethula sisebenza ngaphansi kwe-akhawunti engenamalungelo, futhi zonke izinguquko zezixhumanisi zehluleka ngephutha lemvume elibhalwa ngaso leso sikhathi lapho kungekho muntu ofunda irekhodi.

Hlola ukuthi iklayenti liqalwa kanjani ngaphambi kokuthemba i-hook. Isikripthi esisebenza uma usisebenzisa ngesandla njenge-root asifakazi lutho mayelana nosizo oluqala lapho kuqalwa umshini.

Okwenziwa umthetho we-firewall ngendlela ehlukile

Umthetho ovumela kuphela uhambo lomhubhe uqhubeka usebenza lapho inqubo yeklayenti ingasekho, ngoba i-kernel ayincikile kuleyo nqubo. Umthetho futhi mncane: uvimba ngqo imisakazo efanayo futhi ushiya i-loopback, isubnethi yasendaweni nendlela yokubuyisela kube yodwa, yingakho ungeshiyi umshini usenkingeni.

Inani ukuthi umthetho kufanele ubhalwe futhi unakekelwe ngumnikazi we-firewall yomsingathi, futhi kufanele usho idivayisi yomhubhe eyakhiwe yiklayenti ngempela. Lokho kusho ukuthi umthetho nephrofayela kufanele kunakekelwe ndawonye; isixhumanisi esiqanjwe kabusha sishiya i-firewall evimba konke futhi engachazi lutho.

Asikho isu elenza elinye lingabi nasidingo. Umthetho we-firewall ongalokothi ulayishwe kabusha ngemva kokuhlela unjengenganekwane njengesikripthi esingalokothi sisebenze.

persist-tun inquma ukuthi kukhona isikhala yini

Lapho idivayisi yomhubhe isinda ukunqamuka, nezindlela eziya kuyo ziyasinda. Uhambo lulahlwa esikhundleni sokuqondiswa kabusha, ngakho indlela ezenzakalelayo ayibuyeli egayithiweyini ebonakalayo. Yikho lokhu kuziphatha okwenza ukuvuza kungabi nokwenzeka ngisho ngaphambi kokuthi noma yimuphi umthetho we-firewall uhlanganyele.

Ngaphandle kwalesi silungiselelo idivayisi isuswa kanye nezindlela, futhi indlela ezenzakalelayo ingaphinda ikhombe egayithiweyini ebonakalayo. Ukuthi izokwenza lokho kuncike endaweni yokusebenza nakuklayenti, futhi yikho kanye okwenza kufanele isimo sibhekwe kunokucatshangwa. Thatha isilungiselelo njengengxenye ye-kill switch, hhayi njengokukhetha kokusebenza.

Gcina indlela yokuxhuma kabusha iphila, bese uhlola izimo ezine

Ukuvinjwa okuqinile kungase futhi kuvimbele iklayenti ukuthi ixhume kabusha, ngoba iklayenti lisadinga indlela eya kuseva ngokusebenzisa igayithiweyi ebonakalayo ngenkathi konke okunye kunqatshwa. Faka indlela yomsingathi yalelo kheli elilodwa ngaphambi kokuthi umhubhe ukhuphuke, futhi xazulula igama kuqala, ngoba i-DNS ingase ivinjiwe ngesikhathi oyidingayo.

ip route add 198.51.100.20/32 via 192.168.0.1 dev wlan0

Bese uqinisekisa izimo hhayi ilebula. Dweba izikhathi ezine ngamabomu: ukuqala okubandayo ngaphandle komhubhe, isikhathi esinempilo, ukuwa okungacelwanga muntu, kanye nesikhathi ngemva kokululama. Esikhathini ngasinye funda indlela ezenzakalelayo futhi wenze isicelo esisodwa okubonakala kuso ikheli lokuphuma. Uhlelo oluyeka lapho umhubhe uphansi alusho lutho mayelana neklayenti le-imeyili noma isibuyekezi, ngakho phinda ukuhlola kokugcina ngohlelo olulodwa lwangemuva. Bhala phansi umthetho, amagama ezixhumanisi kanye nezinyathelo zokubuyisela, ngoba i-kill switch okungekho muntu ongayiqinisekisa iyindaba nje.

Izihloko ezihlobene