Indlela yokunciphisa ukufinyelela phakathi kwamahhovisi amabili axhumene nge-VPN
Ithubhu lesayithi-kuya-sayithi akulona ukwethembana. Yakha imethrikhi yomthombo, indawo nesevisi, yisebenzise kuthrafikhi esusiwe ukubethela, futhi ufakaze nokwenqatshwa.
Ithubhu lesayithi-kuya-sayithi liphendula umbuzo owodwa, ukuthi amahhovisi amabili angakwazi yini ukushintshana ngamaphakethe, futhi lishiya ovumelekile uvulekile: iyiphi idivayisi yegatsha engafinyelela iyiphi isevisi emaphakathi. Ukuthatha ithubhu njengokwethembana kuyindlela ikhompyutha yesivakashi eqeda ngayo isendleleni efanayo neseva yezezimali. Isixazululo akulona ithubhu elingcono, kodwa uhlu olucacile lwezimvume olusetshenziswa ngemva kokususa ukubethela. Le ncwadi ihola lolo hlu kusukela encazelweni kuze kufike ekwenqatshweni okufakazelwe.
Sebenza ngale ndlela, futhi ungandisi umzila wethubhu kuze kudlule izinyathelo zenqubomgomo ezingezansi.
Bhala imethrikhi ngaphambi kokuthinta isango
Umugqa owusizo ubiza izinto ezintathu: iqembu lomthombo, umphathi noma inethiwekhi yesevisi yendawo, kanye nephrothokholi kanye nechweba elisetshenziswa uhlelo ngempela. Igatsha nesikhungo sedatha akuzona izinto ezifakiwe. I-DNS yangasese kanye nezinsizakalo zokuqinisekisa zithola imigqa yazo kuphela lapho uhlelo lungakwazi ukusebenza ngaphandle kwazo.
Qoqa imithombo ngendima hhayi ngokulula kwenethiwekhi encane: abasebenzi, izivakashi, ukuphatha. Lapho zontathu zabelana nge-LAN eyisicaba, isango alikwazi ukuzihlukanisa ohlakeni lwenethiwekhi, ngakho ukulawulwa kobunikazi noma ukuhlukaniswa kufanele kuqale. Bese ubhala imethrikhi phansi ngomnini nosuku lokubuyekeza emugqeni ngamunye.
| Umthombo | Indawo | Isevisi | Isinqumo |
|---|---|---|---|
| abasebenzi begatsha | uhlelo lokubhuka 10.10.5.10 | TCP 443 | vumela esangweni esisusa ukubethela |
| abasebenzi begatsha | i-VLAN yokuphatha amaseva | noma yini | ukwenqatshwa okusobala |
| i-Wi-Fi yezivakashi | noma ibuphi ububanzi obumaphakathi | noma yini | enqaba ngaphambi kwethubhu |
| umphathi wokugxuma wokuphatha | i-VLAN yamaseva | TCP 22 kanye no-3389 | vumela nge-MFA, i-firewall yomphathi inciphisa kakhulu |
Sebenzisa lapho kususwa khona ukubethela kwamaphakethe
Imithetho evumela i-IKE ne-ESP yakha kuphela ithubhu langaphandle. Ithrafikhi yangaphakathi ifika ngokukhanyayo kusixhumi sethubhu, futhi yilapho kufanele khona uhlu lwezimvume: uchungechunge lokudlulisa kudivayisi esusa ukubethela, ukulahla okuzenzakalelayo, umthetho owodwa emugqeni ngamunye wemethrikhi. Emasangweni e-Linux lokho kusho ukuthi ukudlulisa kuvuliwe futhi imithetho yokuhlunga isedivayisini yethubhu, hhayi kuxhumo lomzimba, njengoba kuchaza umhlahlandlela wokudlulisa we-strongSwan.
Izisihlukanisi zethrafikhi ziyisinqumo somzila, hhayi isinqumo sokugunyaza. Isisihlukanisi esibanzi esihlanganisa zombili izinethiwekhi ezincane singaba silungile ekuhambiseni umzila kuyilapho i-firewall isavumela kuphela i-TCP 443 kuya kumphathi oyedwa. Isisihlukanisi sixoxwa ngethubhu futhi sichaza okungangena kuso, hhayi okungasetshenziswa idivayisi ethile. Ungalokothi ukhulise umthetho we-firewall ngoba isisihlukanisi sibanzi.
iptables -A FORWARD -i tun0 -s 10.20.0.0/24 -d 10.10.5.10 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -i tun0 -j DROPI-NAT kanye nezinethiwekhi ezincane ezigqagqeneyo zishintsha imithetho
Lapho isango legatsha lihumusha umphathi ngamunye ekhilweni elilodwa ngaphambi kwethubhu, umugqa ngamunye osuselwa kumthombo uwela kulelo khili elilodwa. Yeka ukuhumusha ithrafikhi yethubhu, noma vuma ukuthi imithetho kufanele incike kokunye, njengekhili lomthombo lokuqala elaqoshwa ngaphambi kokuhumusha. Uhlangothi olukude lunenkinga efanayo, ngoba umphathi wendawo ubona ikhili langemva kwe-NAT hhayi elokuqala.
Izilinganiso ezigqagqeneyo zingolunye ugibe. Amahhovisi amabili asebenzisa womabili i-192.168.1.0/24 awakwazi ukuchazwa kuthebula elilodwa lenqubomgomo ngaphandle kokumaka uhlangothi olulodwa, futhi ukumaka akusikhathi esikhala ukuhlelwa kwekhili okungashayisani. Lungisa uhlelo ngaphambi kokubhala imithetho ozokhipha kamuva.
Fakaza ukwenqatshwa, hhayi impumelelo kuphela
Ukuhlola kuphela uhlelo oluvunyelwe kufakaza kancane kakhulu, ngoba umthetho othambile kwenye indawo phezulu uveza umphumela ofanayo.
Kusukela kudivayisi evamile yegatsha, fika kusevisi ehlosiwe futhi uqinisekise ukuthi yonke iseshini iyasebenza. Bese uzama indawo okufanele ihlale ivaliwe, njengechweba lokuphatha kuseva igatsha elingenandaba nayo, futhi ufunda isibali noma okufakiwe kuloji okukulahle. Ukucisha isethi yemithetho ukuze uhlole ukuthi iyasebenza kwenza isivivinyo singasebenzi futhi kushiya isango livulekile ngesikhathi ubuka.
Gcina uhlu luphila
Izinhlelo ziyathutha, futhi umthetho ophila isikhathi eside kunohlelo wawo uba yimbobo okungekho muntu ongumnikazi wayo. Namathisela usuku lokubuyekeza emugqeni, futhi ushintshe ubukhulu besisihlukanisi kanye nomthetho we-firewall esinyathelweni esisodwa sokunakekela lapho isevisi ishintsha ikhili.
Imikhawulo yezinga lomphathi isabalulekile ngemva kwethubhu: i-firewall yesva uqobo kufanele yamukele ububanzi begatsha kuphela kusevisi eyishicilelayo. Izendlalelo ezimbili ezivumelanayo kulula ukuzihlola kunezinga elilodwa elithenjwa ngokuphelele.