Indlela yokuhlola okumbozwa yiswishi yezimo eziphuthumayo kumshini ohlaselwe

Gijimisa ukuhlolwa kokuphazamiseka, funda umphumela wesigaba ngasinye futhi ubone lapho iswishi yezimo eziphuthumayo ima khona: ivimba izindlela, hhayi isofthiwe efunda idatha ngaphambi kokubethelwa.

Vula iswishi yezimo eziphuthumayo, khipha iseva yomhubhe ku-inthanethi bese ubuka okusenziwa umshini. Ukuhlolwa kufanelekile ngoba kuhlukanisa lokho i-firewall ekugcizelelayo ngempela kulokho obukucabanga, futhi imiphumela incane kunalokho amakhasi amaningi omkhiqizo asikisela. Iswishi yezimo eziphuthumayo ilawula izindlela zenethiwekhi; ayilawuli isofthiwe esivele igijima kudivayisi. Ngigijimisa lokhu kulandelana kuwo wonke umshini okuthiwa yi-fail-closed yiklayenti, futhi kuthatha cishe imizuzu eyishumi.

Qala kuklayenti, hhayi kuseva

Indawo yokuphoqelela iyihost ohlezi kuyo: i-firewall yesistimu yokusebenza, isevisi esizayo noma idrayiver yeklayenti ye-VPN uqobo. Lokhu kubalulekile ngoba konke iswishi engakwenza kukhawulelwe yilokho leli sigaba elikubonayo. Uma iklayenti isebenzisa umthetho wokuhambisa kanye nophawu ukuvimba, noma yini enegunya elanele ingeza umthetho wayo; uma isebenzisa ithebula le-firewall ye-kernel, lawo magunya angahlela ithebula. Amandla e-cipher awangeni kulo mbuzo.

Ngakho okokuqala okufanele kutholakale ukuthi ubani ongumnikazi wenqubomgomo kule divayisi nokuthi kuvunyelwe ukweqa ini. Kumshini wokusebenza ophethwe, impendulo ngokuvamile iyi-ejenti yendawo yokugcina yenhlangano, futhi i-VPN yomuntu siqu ayikawususi lawo mandla, noma ngabe umhubhe uhlelwe kanjani.

Isinyathelo sokuqala: qinisekisa ukuvinjwa ezindleleni ocabanga ukuthi uzimboza

Yehlisa umhubhe ekupheleni okude, hhayi kuklayenti, ukuze iklayenti lisakholwa ukuthi kufanele lixhumeke. Bese uzama lokho umuntu angakuzama ngempela:

curl -m 5 -sS -o /dev/null -w '%{http_code}
' https://example.com
ping -c 2 1.1.1.1
ip route
nft list ruleset   # or: iptables -S

Ufuna iklayenti elihluleka ngokushesha nangokuhlanzekile, hhayi elilenga kuze kuphele isikhathi sesiphequluli. Ukulenga ngokuvamile kusho ukuthi amaphakethe alahlelwa buthule ngumthetho ongenakwenqaba, okwamukelekayo, kepha kungase futhi kusho ukuthi iklayenti lishiye indlela ejwayelekile endala ebheke kusixhumi esifile. Funda ithebula lokuhambisa ngenkathi umhubhe uphansi: indlela ejwayelekile esabheke kudivayisi yomhubhe kanye nomthetho we-firewall ovimba kuphela ukuxhumana okusha okuphumayo kuyizimo ezimbili ezihlukene, futhi eyodwa kuphela yazo i-fail-closed.

Phinda imiyalo efanayo ngenkathi inketho ye-allow-LAN yeklayenti ivuliwe futhi ivaliwe. Leso sishintshi yisona sizinda sezimangaliso eziningi, ngoba sivula kabusha indlela okwakubhalelwe ukuyivala enye inqubomgomo.

Isinyathelo sesibili: hlola i-DNS ne-IPv6 njengezindlela ezihlukene

Ukuxazululwa kwamagama yigebe elisinda ekusetshenzisweni okuningi, ngoba umbuzo ungaphuma ngento engeyona isixazululi sesistimu. Buza ngethuluzi elingayinaki ikhonfigurashini yakho yesixazululi, futhi uhlole uhlangothi lwe-v6 lapho:

dig +short example.com
dig +short @1.1.1.1 example.com
curl -6 -m 5 -sS https://example.com -o /dev/null -w '%{http_code}
'
ip -6 route

Izimpendulo ezingenalutho kuyo yomibili imibuzo yamagama ngenkathi umhubhe uphansi yiwona mphumela owufunayo. Uma umbuzo wesibili uphendula, ikheli lesixazululi elibhalwe ngokuqinile liyafinyeleleka futhi umhubhe akuwona kuphela indlela yokuphuma kumshini. Uma kuphela isicelo se-v6 esiphumelelayo, inqubomgomo imboza i-IPv4 futhi ingayinaki i-IPv6, okuwukho ukuvuza okufanayo emndenini wamakheli ohlukile.

Iziphequluli zenza lokhu kube nzima ukukufunda ngaphandle, ngoba isiphequluli esilungiselelwe i-DNS nge-HTTPS sixazulula umbuzo ngesicelo se-HTTPS: umbuzo uvimba kuphela ngokulingana nokuvinjelwa kwephothi 443 kuleyo ndawo yokugcina. Kumhost lapho inqubomgomo ivumela khona i-subnet yasendaweni, leso sicelo sisengafinyelela isixazululi ku-LAN.

Isinyathelo sesithathu: hlukanisa ukuchayeka kwenethiwekhi nokuchayeka kwendawo yokugcina

Manje ingxenye okungekho mthetho we-firewall ofinyelela kuyo. Iswishi yezimo eziphuthumayo ivimba izindlela zokuphuma kumshini; ayivimbeli isofthiwe ekumshini ekufundeni idatha ngaphambi kokubethelwa, futhi ayivimbeli leyo sofwethi ekusebenziseni umhubhe ngokusemthethweni. Isiqophi sezikhiye, isandiso esinonya, isikrini eshiywe singakhiyiwe, iklayenti lokuvumelanisa elinegunya elibanzi: konke kudlulisa ulwazi ngoxhumano iswishi ekwamukela ngokukhululeka.

Kunjalo nangesofthiwe yokuqapha umqashi ayifake ngamabomu. Ukuvimba izindlela akukususi, futhi ukuthenga iseva entsha ye-VPN akulona ikhambi, ngoba ukuchayeka kungaphambi komhubhe.

Umphathi webhodi lokunamathisela okulayisha ku-akhawunti yefu ukhombisa lokhu ngokucijile. Ithrafikhi ibethelwe, indawo iyavunyelwa, futhi iswishi yezimo eziphuthumayo ibika isimo esiphilile sonke isikhathi.

Isinyathelo sesine: bhala isitatimende esisekelwa ukuhlolwa kwakho

Ngemva kokuhlolwa kokuphazamiseka ungasho amaqiniso athile: yiziphi izinhlelo ezihlulekile, yiziphi izindlela ezime, i-DNS ne-IPv6 zizenze kanjani, nokuthi ukuvinjwa kwahlala yini ngenkathi umhubhe uwa. Awukwazi ukusho ukuthi isistimu yokusebenza ihlanzekile, futhi awukwazi ukusho ukuthi isevisi ekupheleni okude izogcina ukungena kwakho kuyimfihlo.

Gcina lezi zinkinga ezimbili zihlukene futhi unikeze ngayinye isilawuli sayo:

  • Iswishi yezimo eziphuthumayo: imfuneko yokuhluleka echaziwe, eqinisekiswa ukuhlolwa kokuphazamiseka okukuphindayo ngemva kokuthuthukiswa kweklayenti ngakunye.
  • Ukwethemba kwedivayisi: izibuyekezo ezisekelwayo, ukuvikelwa kwendawo yokugcina okuvela emthonjeni othembekile, ukubuyekezwa kwezimvume nezicelo zokuqinisekisa ezingachazwanga.
  • Isigameko: landela inqubo yepulatifomu noma yenhlangano uma kusolwa ukuhlaselwa; iseva entsha akusona isinyathelo sokuhlanza.
  • Ukudalula: uma ucela usizo, ungamanamathiseli okhiye abayimfihlo noma izingobo zokuxilonga eziphelele, ngoba amalogi nezithombe zesikrini zithwala izimfihlo ezifanayo noxhumano.

Gijimisa ukulandelana futhi ngemva kwesibuyekezo esilandelayo, ngoba iswishi yezimo eziphuthumayo iyikhonfigurashini ehamba nezinguqulo. Ukuhlolwa kuwubufakazi kuphela bokuthi ukuziphatha okuthembelayo kuseyikho okutholayo.

Izihloko ezihlobene