Ukushintsha umthetho we-firewall akusebenzi: ukulandelana kwemithetho nesimo sokuxhumana

Ushintshile umthetho, walayisha kabusha isethi yemithetho, futhi umhubhe uziphatha ngendlela efanayo nangaphambilini. Lo mphumela unezimbangela ezimbili ezijwayelekile, futhi zidinga izivivinyo ezihlukene. Mhlawumbe umthetho omusha ungemuva komthetho wangaphambilini oselwamukele iphakethe, noma ukushintshana okubonayo ukuxhumana okulandelelwayo okungakahlolwa kabusha yilokho kushintsha. Umthetho osekufayelini uveza inhloso; okunquma iphakethe yindlela esebenzayo ehlangana nayo. Yenza izivivinyo ezingezansi ngokulandelana, futhi phakathi nalokho gcina indlela yokubuya ivuliwe.

Ukulandelana kwemithetho nesimo sokuxhumana kuyizinkinga ezihlukene

Amaketanga ahleliwe ahlolwa phezulu kuya phansi, futhi umthetho wokuqala ofinyelela isinqumo sokugcina uqeda ukuhamba kulelo ketanga. Beka imvume ebanzi ngaphezu komthetho wokukhiya obhalwe ngokucophelela, bese umthetho wokukhiya uba umbhalo nje: ukhona kusethi, isibali saso singuziro, futhi akukho phakethe eliyofika kuso. Umbhalo ofanayo osetshenziswe kwelinye iketanga awufakazi lutho. Ku-nftables amaketanga ayisisekelo anamathela kumahuku ngokulandelana kwezinga, ngakho imvume kwelinye iketanga ayivimbeli elinye iketanga kuhuku noma ezingeni elihlukile ukubona iphakethe elifanayo.

Ukulandelela ukuxhumana kukhiqiza uphawu lwesibili, futhi ngaphandle kubonakala kufana ncamashi. Uma ukugeleza sekusesimweni sokugcina, imvume ye-established-or-related eduze nesihloko seketanga iyabuya ngaphambi kokuba umthetho wakho omusha ucutshungulwe. Izimele ze-NAT zinesimo esifanayo: ukuhumusha kwagcinwa lapho ukugeleza kuqala, ngakho umthetho we-postrouting ohleliwe awubhali kabusha isikhathi esivele sisebenza. Yingakho ushintsho lubonakala lusebenza ngo-09:00 ekuxhumaneni okusha futhi lubonakala lungenzi lutho esikhathini esivulwe othile ngo-08:55.

Amaqembu okuphepha asefu yamafu engeza imodeli yesithathu ebamba abantu abafunde ku-iptables. Imithetho yawo yokungena iwuhlu lwezimvume oluhlolwa njengeqoqo hhayi njengokuhamba kokufana kokuqala, inesimo, futhi ukususa umthetho wemvume akukuqedi ukugeleza okuselandelwa kakade. Ukucabanga umqondo wokufana kokuqala endaweni engenawo kuholela eziphethweni eziqinisekile kodwa ezingalungile.

Funda isethi esebenzayo yemithetho, hhayi ifayela olilungisile

Qala ngalokho okugcina ikhanda lokusebenza okwamanje. Ukuhlelwa okugciniwe okungakaze kusetshenziswe kuchaza inani elimangazayo lokuziphatha okungashintshile, futhi ukukukhipha kuthatha umyalo owodwa:

nft list ruleset
iptables-save

Bese ubuza ukuthi umthetho wakho ufinyelelwa noma cha. Izibali zamaphakethe ziphendula lokho ngqo, futhi ziphendula kangcono kunanoma yikuphi ukucabanga ngenhloso:

iptables -L FORWARD -v -n --line-numbers
nft list chain inet filter forward

Umthetho wokukhiya onesibali esinguziro ngemva komzamo wokuhlola wangempela awuyona inkinga yenqubomgomo, kuyinkinga yendawo. Ukuwususa kuwushintsho lomugqa owodwa, futhi isakhiwo sikhuluma siyiyo into eyabangela iphutha lokuqala. Ku-iptables -I kufaka ekuqaleni futhi -A kunezela ekugcineni; ku-nftables insert kubeka umthetho ekuqaleni kweketanga kuyilapho add kunezela ekugcineni. Lapho umthetho kufanele unqobe, sisho ngokucacile esikhundleni sokuthembela ekulandelaneni okwake kwalayishwa ngengozi.

Fakazela ukuthi ukugeleza kuyalandelelwa

Ngaphambi kokusola umthetho, hlola ukuthi ithrafikhi ingukuxhumana okulandelelwayo ngempela. Buza ithebula lesimo ngokugeleza okuthile esikhundleni sokukuthulula konke:

conntrack -L -p tcp --dport 1194
conntrack -E -p tcp --dport 1194

Uhlu lukhombisa isimo nesikhathi esisele, futhi yileyo ndlela ohlukanisa isikhathi esisunguliwe emzamweni omusha; imodi yezehlakalo inyathelisa izibuyekezo lapho zenzeka, okusiza lapho uxhuma iklayenti kabusha. Uma ukugeleza sekukhona esimweni esisunguliwe ngaphambi kokuthi uthinte noma yini, akukho kulungiswa kwemithetho yokuhlunga okuzoshintsha isiphetho sako. Lokhu akulona iphutha ku-firewall, lokhu kuyisivumelwano sokuhlunga okunesimo.

Phikisa indlela emfushane yokukhipha ithebula lonke ngesango lokukhiqiza. conntrack -F iyatholakala, futhi ibhubhisa nokugeleza konke okulandelelwayo emshinini, kuhlanganise nesikhathi sokuphatha osisebenzela kuso kanye nomhubhe othwala igobolondo lakho. Amarekhodi ngamanye angasuswa lapho uwadinga ngempela, kodwa ukugeleza okusha okuvela embotsheni yomthombo omusha ngokuvamile kuwukuhlola okuhlanzekile.

Ezinye izindlela azilandelwa, futhi ziziphatha ngokuphambene. Ithrafikhi emakwe njenge-notrack kuthebula le-raw, eminye imihubhe edlula amahuku ajwayelekile, kanye nokuhleleka okungalingani okuhlukanisa ukugeleza phakathi kwamasango amabili konke kukhiqiza amaphakethe ahlolwa ngamanye, noma isimo esingakaze sakhiwe kuzo zombili iziphetho. Uma izibali zinyakaza kuphakethe ngalinye, solisa uhlobo olunjalo lwendlela ngaphambi kokusola ukulandelana.

Hlola kusuka ekugelezini okusha ngendlela yokubuya

Ngaphambi kokuhlola umthetho ongase unqamule ukufinyelela kude, setha indlela yokubuyisela: ikhonsoli yomhlinzeki, ikhonsoli ye-serial, ikheli lokuphatha elingaphandle kwebhande, noma i-interface yesibili umthetho ongakwazi ukuyifanisa. Isikhathi sokubuyisela emuva ungumngane ofanele, ngoba sizobuyisela isethi yangaphambilini yemithetho ngisho uma isikhathi sakho sifa phakathi nokuhlola.

Bese uhlola ngokushintshana okwakungeke kakade kukhishwe isimo. Nqamula futhi uxhume iklayenti ukuze kwakheke isihlanu esisha, futhi ubuke iziphetho zombili ngenkathi lokho kwenzeka:

tcpdump -ni eth0 'tcp port 1194'
journalctl -k -n 50 --no-pager

Yenza ukuhlola kuzo zombili izinhlangothi. Umthetho ovimbela ukuxhawula kokungena okusha usengavumela indlela yokuphendula, noma okuphambene, futhi umphumela wohlangothi olulodwa uyisizathu esijwayelekile sokuthi ukuvala kusebenze kancane. Xhuma futhi kanye ngemuva kokuhlola ukuze uqinisekise isimo esizinzile, futhi uhlole ukuthi ukufinyelela okuphatha okusemthethweni kusindile; umthetho obhalelwe umbobo owodwa unomkhuba wokufanisa ibanga elibanzi kunalokho obekuhloswe.

Rekhoda injongo nendawo kanye nomthetho

Umthetho ongenanjongo erekhodiwe umthetho okungekho muntu onesibindi wokuwususa. Eceleni komuhlinzeki ngamunye wokukhiya, gcina ukugeleza okugadiwe, iketanga nehuku okuhlala kulo, indawo okufanele uyibambe uma kuqhathaniswa nezimvume ezibanzi, kanye nokuhlola okwakufakazela lokho. Uma othile ehlela isethi yemithetho ezungezile ezinyangeni eziyisithupha kamuva, leyo nothi iyisixwayiso esisodwa sokuthi indawo yayihloselwe.

Ngaphambi kokuvala ushintsho, qinisekisa izinto ezine: isethi esebenzayo yemithetho ihambisana nefayela, umthetho omusha unamabhalane angewona uziro ngemva komzamo omusha, indlela ephambene nokufinyelela kokuphatha kusasebenza, futhi uxhume kabusha kanye ukuze ufakazele isimo esizinzile hhayi isimo sesikhathi esidala kunoshintsho. Uma okunye kwalokhu kungaqinisekisiwe, ushintsho awukapheli, noma ngabe umhubhe wenzani.