Ukunamathisela uhlelo lwe-Linux ku-VPN ngemithetho ye-UID

Ukunamathisela uhlelo olulodwa ku-VPN ku-Linux ikakhulukazi inkinga yomzila, futhi umthetho we-firewall unquma kuphela okwenzekayo ngemuva kokukhethwa komzila. Uma ufaka i-UID yohlelo ku-OUTPUT ngaphambi kokuba umhubhe ube nomzila ozenzakalelayo, umthetho ulahla impela ithrafikhi obufuna uyivikele. Lowo mthetho awuboni futhi inqubo ye-resolver ephendula imibuzo ye-DNS yohlelo. Lungisa ukulandelana futhi i-akhawunti eyodwa engenazo izimvume iba umkhethi othembekile womhubhe ohlukanisiwe.

Nikeza i-akhawunti umzila ngaphambi kwesinqumo

Ukufana komnikazi kuphendula umbuzo owodwa: ingabe isokhethi yendawo engaphansi kwale UID yakha iphakethe? Ayikhethi isixhumi esibonakalayo futhi ayikwazi ukuhambisa ithrafikhi osekuyithunyelwa yithebula eliyinhloko nge-NIC ebonakalayo. Yingakho umthetho we-UID ongenawo umzila ohambisanayo uvimbela uhlelo esikhundleni sokuluqondisa kabusha.

Dlulisa i-akhawunti kuyitebula yayo kuqala, bese uvumela i-firewall iqinisekise umphumela. Lokhu kusebenza kusibungu esine-iproute2 eqonda i-uidrange, okubikwa ip rule help ngomugqa owodwa. Ithebula 100 ligcina umzila ozenzakalelayo odlula emhubheni, futhi umthetho uthumela kuphela i-UID 1000 kulelo thebula. Konke okunye kuhlala kuthebula eliyinhloko futhi kuqhubeka kusebenzisa isixhumanisi esibonakalayo.

ip rule add uidrange 1000-1000 table 100
ip route add default dev tun0 table 100

I-akhawunti yesibili edinga omunye umhubhe ithola ithebula 101 nomthetho wayo, ngoba amaphrofayili amabili awakwazi womabili ukuba nomzila ozenzakalelayo kuthebula elilodwa. Amaphrofayili e-NetworkManager ngawesistimu yonke, ngakho le ngxenye ihlala yenziwa ngesandla, futhi imithetho iyanyamalala lapho kuqalwa kabusha ngaphandle uma okuthile ikubuyisela. Bhala amathebula kuskripthi sokuqalisa eduze kwencazelo yomhubhe ukuze ukuxhumeka kabusha kungashiyi i-akhawunti eyodwa emzileni ongafanele.

Kungani ukukhishwa kwe-loopback kubulala umhubhe

Iningi lezinguqulo ezikopishiwe zomthetho zilahla yonke iphakethe elingaphumi nge-loopback. Umhubhe awuyona i-loopback, ngakho lelo hlobo lilahla futhi ithrafikhi yomhubhe, futhi umphumela ubonakala njenge-VPN efile hhayi iphutha le-firewall.

Lapho i-OUTPUT isebenza, i-kernel isivele yakhetha isixhumi sokuphuma, ngakho -o kuqhathaniswa nempendulo yomzila hhayi nekhanda lephakethe. Ukufana komnikazi kubhekwa kuphela ku-OUTPUT naku-POSTROUTING, futhi amaphakethe adlulisiwe awanayo isokhethi engayifunda. Leyo nhlangano isho ukuthi ukukhishwa kufanele kushiwo isixhumi somhubhe futhi kuphike lokho kufana, hhayi ukuphika i-loopback.

I-loopback isafanelekela i-ACCEPT yayo ngaphezu kwe-DROP, ngoba iphakethe lokuqala le-DNS elivela ohlelweni liya ku-stub yendawo ngokusebenzisa lo. Beka imithetho emibili ngale ndlela yokulandelana, futhi i-akhawunti ifinyelela ku-stub, bese ifinyelela emhubheni, futhi akukho okunye.

iptables -I OUTPUT 1 -o lo -m owner --uid-owner vpnapp -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner vpnapp ! -o tun0 -j DROP

I-IPv6 iyisethi ehlukile yemithetho, futhi ipheya elenzelwe i-v4 kuphela lishiya ip6tables lingathintekile. Uhlelo olukhetha amarekhodi e-AAAA lungaphuma ngosixhumanisi esibonakalayo ngaphandle kokufinyelela ku-DROP. Bonisa yomibili imithetho ku-ip6tables, noma vala i-IPv6 kusibungu lapho umhubhe ungathwali ikheli le-v6. Imithetho engezwe ngesandla nayo iyanyamalala lapho kuqalwa kabusha, ngakho yigcine nge-netfilter-persistent save noma yakha kabusha umqondo ofanayo njengethebula le-nftables elilayishwa iyunithi yokuqalisa.

Izimpendulo ze-DNS zivela kwenye inqubo

Umbuzo wohlelo ku-127.0.0.53 udlula ku-ACCEPT ye-loopback, futhi yilapho ukufana kwe-UID kuma khona. I-resolver ye-stub idlulisela phezulu isuka ku-akhawunti yayo yensizakalo, ngakho umthetho oboshelwe ku-vpnapp awuboni umbuzo wesibili. Uma i-resolver ikhetha iseva ye-LAN yosixhumanisi, izimpendulo zibuya nge-NIC ebonakalayo kuyilapho amaphakethe ohlelo uqobo ehla emhubheni. Umphumela obonakalayo umhubhe osebenzayo onamagama aphukile, noma amagama aphendulwa iseva ongayikhethanga.

Lungisa ukuxazululwa kwamagama osixhumanisini somhubhe, hhayi kuhlelo. Nikeza iphrofayili yomhubhe iseva ye-DNS nesizinda sokuhambisa, bese uqinisekisa nge-resolvectl query kanye ne-resolvectl status tun0 ukuthi i-resolver iyisebenzisela amagama abalulekile. Ngaphakathi kwendawo yamagama yenethiwekhi inkinga iyanyamalala, ngoba i-resolver yendawo yamagama yazi kuphela umhubhe.

Hlola umthetho kusukela ku-akhawunti uqobo

Buza i-kernel ukuthi i-UID ithola umzila upi, bese wenza isicelo njengaleyo akhawunti futhi uqhathanise ikheli lokuphuma nelakho le-akhawunti yakho. Uma kokubili kubika ikheli elifanayo, umthetho ufana nokunye hhayi ithrafikhi oyihlolile. Umyalo wokuqala ngezansi ukhombisa ukuseshwa komzila ngaphandle kokuthumela iphakethe, lokho okuhlukanisa iphutha lomzila nephutha le-firewall.

ip route get 1.1.1.1 uid 1000
sudo -u vpnapp curl -s https://ifconfig.co

Izibali zikhombisa ukuthi umthetho wake wasebenza yini. Gijima iptables -vnL OUTPUT, funda inani lamaphakethe eduze komthetho ngamunye, futhi thatha uziro eduze kwe-DROP ngemuva kwethrafikhi yangempela njengephutha lokufana.

Ithrafikhi edluliswayo ingaphandle kwalo mklamo. Ikhonteyina noma i-VM ngemuva kwebhuloho ayinaso isokhethi yendawo ephethwe vpnapp, ngakho ukufana komnikazi akukaze kusebenze futhi lawo maphakethe alandela inqubomgomo ye-FORWARD. Uma lowo msebenzi kufanele uhlanganiswe, wuhlole ngokwehlukile futhi bhala inqubomgomo eboshelwe ebhulohweni noma kukheli lekhonteyina. Umklamo uyama lapho ithebula, ukukhishwa kwesixhumi, i-resolver nemithetho ye-v6 konke kukhombisa ohlangothini olulodwa; shiya noma yikuphi kukho futhi i-akhawunti iyavuza noma ilahlekelwa uxhumano.