Umthetho womlaleli we-firewalld ngokumelene nenqubomgomo yokudlulisa: yini eyenza ngayinye

I-VPN exhumayo kodwa engafinyeleli ndawo ivamise ukuchazwa njengenkinga yodonga lomlilo, futhi isisombululo abantu abasisebenzisayo ukubeka i-interface yethela emuva endaweni ethembekile. Lokho kuyasebenza ngomqondo wokuthi ithrafikhi iqala ukuhamba, kodwa futhi ivumela okuningi kakhulu kunesevisi obekuhlosiwe. Izinqubomgomo ezimbili ezihilelekile zihlukile: enye ivumela ukuthuthwa kwangaphandle kusokhethi elalelayo, kanti enye igunyaza ithrafikhi ekhishiwe ukufinyelela umthombo othile. Ukuziphatha njengokuhlelo okukodwa yikho okuguqula imvume emincane ibe nkulu. Zombili zinqunywa ezindaweni ezihlukene, yingakho leli phutha lilula.

Izinqubomgomo ezimbili, ithela elilodwa

Inqubomgomo yangaphandle iphendula umbuzo olula: ingabe iphakethe elivela kulo mthombo lingafinyelela ku-UDP 1194 kule host? Inqubomgomo yangaphakathi iphendula omunye: ingabe iklayenti eligunyaziwe ngemuva kwalelo thela lingafinyelela le ndawo, ngale protocol, kule port? Eyokuqala imayelana nesokhethi, eyesibili imayelana nendlela, futhi i-firewalld izimodela ngezinto ezihlukene ngoba zinqunywa ezindaweni ezihlukene. Enye iyisici sesokhethi kule host, enye iyisici sendlela edlula kuyo.

Umphumela ongokoqobo ukuthi ithela elisebenzayo alisho lutho ngenqubomgomo yesibili, futhi inqubomgomo yesibili elungile ayiyenzi eyokuqala ingadingeki.

Vumela umlaleli wangaphandle wangempela

Qala ngokuhlola lokho osekuvele kwabiwe esikhundleni sokucabanga. Funda izindawo ezisebenzayo, bhala uhlu lwendawo eletha ukungena ngempela, futhi uhlole incazelo yesevisi efakiwe, ngoba igama lesevisi lichaza iqoqo lamaport futhi alisho lutho mayelana nokuthi umlaleli wale sevikha uyahambisana nakho.

firewall-cmd --get-active-zones
firewall-cmd --zone=public --list-all
firewall-cmd --info-service=openvpn

Uma umlaleli ngempela kungu-UDP 1194 kuleyo ndawo, vula ngqo leyo port nokuthuthwa, bese wenza umthetho othile ofanayo uhlale njalo ngemuva kokuwuhlola. Hlola futhi izabelo ezisekelwe emthonjeni, ngoba indawo eboshelwe ebangeni lomthombo ingabamba ithrafikhi ngaphambi kokuba indawo ye-interface iyibone.

Gunyaza indawo ekhishiwe ngokwehlukana

Ukuxhumana nesevisi esebenza kuseva ye-VPN uqobo inqubomgomo yokungena yasendaweni. Ukuxhumana okudluliselwa kwenye i-host ku-LAN kudinga inqubomgomo yokudlulisa, ukudlulisa okuvunyelwe ku-kernel kanye nomzila wempendulo — lezi yizimfuno ezintathu ezihlukene abantu abavame ukuzihlanganisa zibe yinye. Izinto zinqubomgomo zesimanje ze-firewalld zichaza ithrafikhi eqondisiwe phakathi kwendawo yokungena nendawo yokuphuma, futhi yilapho indawo efanele yokuveza ukuthi imithombo iphi ye-VPN ingafinyelela kuphi kumasevisi angasese.

Chaza ngokusobala imithombo evunyelwe bese uyeka konke okunye kuwela ekunqatshweni. Imvume yesevisi yangaphandle akuyona leyo nqubomgomo, kungakhathaliseki ukuthi ukuhlelwa kwezindawo kubukeka kanjani.

Kungani ukwethemba i-interface kuyindlela emfushane engalungile

Ukubeka i-interface yethela endaweni okugxilwe kuyo kwamukela konke kuvumela yonke ithrafikhi ekhishiwe ukufinyelela kuyo yonke imisebenzi eveza i-host, kuhlanganise leyo ongakayihloli. Ukuqondisa kabusha indawo ethembekile ukuba ibe nokukhawulela kumshini osebenzayo kubi nakakhulu, ngoba ezinye izinto zokuxhumana nezintaba zemithombo kungenzeka sezithembele encazelweni yayo futhi zizoshintsha ukuziphatha uma uyihlela. Uma udinga inqubomgomo emincane, dala eyodwa; ungasebenzisi kabusha indawo eyabiwe.

Futhi gcina isabelo sendawo yethela sizinzile ngayo noma iyiphi ingxenye ephethe lokho kulungiselelwa. Ukulahlekelwa isabelo lapho kuqalwa kabusha kudala ukwehluleka okubonakala njengenkinga yomthetho wodonga lomlilo kodwa empeleni kuyinkinga yokuqina.

Qinisekisa izinto ezintathu, kuhlanganise nokunqatshwa okukodwa

Hlola ukuxhumana kwangaphandle ngaphandle, hlola isevisi eyodwa yangaphakathi egunyaziwe kusuka kuklayenti elixhunyiwe, futhi uhlole isevisi eyodwa okufanele ihlale ingafinyeleleki. Ukuhlola kwesithathu yikho okuhlukanisa inqubomgomo kumphumela oseceleni, futhi yikho abantu abakweqa ngoba konke kubonakala kusebenza. Uma isevisi enqatshiwe iphendula, uvumele indawo hhayi isevisi.

Bhala phansi indawo, iphothi, ukuthuthwa kanye nento yenqubomgomo emibhalweni yeseva. Uma kungenjalo ushintsho olulandelayo kule host luzoqala kusukela kuleso sibikezelo.