Ungayihlela kanjani i-Router VPN Rollback ngaphambi koshintsho olukude

Usuzohlela umhubhe ophethe iseshini yakho, ukuze umsebenzi okusindisayo wenzeke ngaphambi koshintsho, hhayi phakathi nengxabano ngemva kwalo. Inetha yokuphepha ayikho ekhasini le-VPN: isikrini sokubuyisela, ikhonsoli, noma indlela yesibili engadluli kudivayisi oyihlelayo. Ngihlela bobathathu kusixhumi esibonakalayo serutha engizosihlela, futhi ngisebenzisa indlela kanye ngenkathi yonke into isasebenza. Lona uhambo engilulandelayo, ngokulandelana.

Hamba ukugeleza kokubuyisela ngaphambi kokukudinga

Vula ikhasi elizohlehlisa ushintsho lwakho. Ku-pfSense okungukuthi Ukuxilonga > Isipele & Buyisela; ku-OpenWrt yiSistimu > Isipele / I-Flash Firmware; ku-OPNsense uhlelo > Ukucushwa > Izipele, ezigcina nezibuyekezo zangaphambilini ongabuyela kuzo ngaphandle kwefayela. Awubuyiseli lutho okwamanje. Uhlola ukuthi ingabe lelo khasi liyavuleka yini endleleni ozoba nayo ngesikhathi soshintsho, noma lifuna ukuqalisa kabusha ngemva kwalokho, nokuthi liyayinqaba yini ingobo yomlando ebhalwe ukukhishwa kwe-firmware okuhlukile. I-Netgate ibhala okwayo ukuthekelisa futhi ibuyisele ukugeleza ku docs.netgate.com.

Ukubuyisela kushintsha konke ukucushwa, ngakho akukona ukuhlehliswa komthetho owodwa. Ingobo yomlando iphethe abasebenzisi, izitifiketi, okhiye be-VPN, imithetho ye-firewall, nezilungiselelo zokusebenzelana zomlawuli ezinquma ukuthi ubani ongangena. Yingakho ngithumela ngokushesha ngaphambi koshintsho futhi ngiqambe ifayela nosuku nesilungiselelo esisodwa engihlose ukusithinta. Ukubuyisela ifayela elinenyanga endala kuphinde kubuyisele umhubhe onenyanga nokhiye onenyanga ubudala.

Uma inkundla ilayisha kuphela izingobo zomlando kusukela ekukhishweni okufanayo, kuqaphele manje: ukuthuthukiswa kwe-firmware kanye nokuhlelwa kwe-VPN efasiteleni elilodwa kukushiya ubambe ifayela umzila ongeke wamukele.

Fakazela indlela kulokho kweqa umhubhe

Iseshini yesibili ye-SSH ukusuka kukhompuyutha ephathekayo efanayo ukuya ekhelini lomphakathi elifanayo akuyona indlela yesibili; bobabili bafa kanyekanye. Indlela ezimele ingenye yalezi: i-serial noma ikhonsoli ye-KVM, i-hypervisor noma ikhonsoli yamafu, i-VLAN yokuphatha efinyelelekayo kumsingathi ongekho ngemuva komhubhe, imodemu yesibili ye-WAN noma ye-LTE enomthetho wayo wokuphatha, noma umuntu osesayithi.

Hlola indlela ekhethiwe ngenkathi irutha iphilile. Ngena phezu kwayo, vula ikhasi le-VPN, bese ume ngaphambi kokulondoloza. Uma umthetho wokukhiya uyivumela kuphela ukuthi ifinyelele kudeshibhodi, usenesikhathi sokulungisa lokho, futhi ukulungisa kufanele kuhlale ngaphezu komthetho wokuphika kuhlelo lomthetho.

Amarutha amaningi abophezela insizakalo yomqondisi kusixhumi esibonakalayo noma emndenini wamakheli, ngakho umzila ongaphandle kwebhendi kufanele ufike lapho leyo sevisi ilalela khona. Ukunweba ukubophezela kwewindi kuyasebenza, kodwa ngokwakho kuwushintsho endleleni oncike kuyo.

Khipha ifayela bese ubhala i-trigger

Hambisa okuthunyelwayo ku-router futhi ukususe emshinini ongase ulahlekelwe umhubhe wawo. Ikhophi yasenqolobaneni egcinwe kusistimu yefayela ye-router iyanyamalala ekuhlulekeni okuhlelela kona, futhi umuntu ohlezi kukhompuyutha ephathekayo esezolahlekelwa ukuxhuma akangcono neze.

Phatha lelo fayela njengesiqinisekiso. Iphethe okhiye abayimfihlo, izimfihlo ezabiwe kusengaphambili, okokusebenza kwesitifiketi, nama-hashi ephasiwedi, ngakho-ke ibethele noma igcine ngokunakekela okufanayo nokungena kumzila.

Bese ubhala umusho owodwa: uma ngingakwazi ukuvula iseshini entsha yokuphatha ukusuka ku-PATH phakathi nemizuzu engu-N yoshintsho, ngibuyisela FILE futhi ngiqalise kabusha. Umusho uphoqa isikophu ukuthi sehle siye kokuguquguquka okukodwa. Ukuhlelwa komzila, i-DNS, ne-firewall okwenziwe ndawonye kuyashesha ukulondoloza futhi kuyaphuza ukuhlukanisa kabili uma uthola omunye umzamo.

Sebenzisa isibali sikhathi sokuzibophezela lapho ingxenyekazi inaso

Izinkundla ezimbalwa zizohlehlisela ushintsho uma wehluleka ukukuqinisekisa. I-RouterOS Safe Mode, efakwe ngo-Ctrl+X kutheminali, ibuyisela izinguquko ezenziwe kuleyo seshini lapho iseshini iwa. UJunos ubuyisela emuva isivumelwano esingaqinisekisiwe esiqinisekisiwe. Amapheya e-Cisco IOS alayisha kabusha ngokukhanselwa kokulayisha kabusha. Ama-firewall ebhizinisi ngokuvamile afaka izinguquko ezilindile ngesibali-sikhathi sokubuyisela ngokuzenzakalela. I-OpenWrt kanye ne-firmware eningi yabathengi ayinakho okulinganayo, ngakho-ke lapho isibali sikhathi kufanele sibe ngaphandle: ukubuyisela okuhleliwe, umsebenzi we-cron oshintshanisa ifayela emuva futhi uqale kabusha isevisi, noma uqalise kabusha ekucushweni kwangaphambilini.

Ungacabangi ukuthi isici esinegama elifanayo simboza isikophu esifanayo. Ukubuyisela okuzenzakalelayo komkhiqizo owodwa kungafaka imithetho yohlelo lokuvikela kuphela; enye ingase ihlanganise konke ukucushwa, okuhlanganisa nomthetho wokuphatha osanda kuwushintsha ukuze uzigcine ufinyeleleka. Funda ukuthi isibali sikhathi sibuyela ini ngaphambi kokuthi uthembele kuso.

Isibali sikhathi asithatheli indawo ifayela elithunyelwe. Iyahluleka esimweni esibaluleke kakhulu lapha: iseshini iyasinda, indiza yabaphathi ayifuni, futhi akukho okuke kubangele ukuhlehla.

Hlola uxhumano olusha, hhayi oluvuliwe

Iseshini esunguliwe ivame ukuqhubeka nokusebenza ngezinguquko ezivimba konke ukuxhawulana okusha, ngoba isimo sayo sesivele sikhona futhi inqubomgomo iyahlolwa uma ukuxhumeka kudaliwe. Ngemuva koshintsho, dala ukuxhumana okusha ukusuka ohlangothini olukude: iseshini entsha ye-SSH, ukuxhawulana kwe-VPN okusha kusuka kuklayenti, ukulayisha kwekhasi elijwayelekile ekhelini le-LAN yerutha.

# run these from the remote machine, in a new shell
ssh -o ConnectTimeout=8 admin@"$ROUTER_WAN"
nc -vz "$ROUTER_WAN" 443
dig +short example.internal "@$ROUTER_LAN"

Bese uhlola ezansi komhubhe kunomhubhe ngokwawo: ukulungiswa kwegama, uxhumano lwe-TCP kusevisi yangaphakathi, kanye nohlelo lokusebenza olisebenzisayo ngempela. Umhubhe osungula kodwa ongakhiphi i-DNS esebenzisekayo ubukeka unempilo esimweni seklayenti futhi uphukile esipheqululini, futhi lowo mehluko unquma ukuthi uyalibuyisela ifayela noma ulungisa umthetho owodwa.

Phinda ngemva kokunqanyulwa okuphoqelekile futhi uxhume kabusha, futhi futhi ngemva kokuqalisa kabusha uma inkundla iphinda ifaka isicelo sokuqalisa. Okunye ukucupha kudlula zonke izivivinyo ezibukhoma futhi kuhluleke ebhuthini yokuqala ngemithetho emisha ekhona.

Vala iminyango oyivulele iwindi

Susa umthetho wesikhashana womlawuli womthombo wanoma yimuphi umthombo, i-akhawunti yokulahla, ukubophezela okunwetshiwe, umthetho we-DNS ovumelayo, nokuloga kokulungisa iphutha. Lokho kususwa ngokwakho kuwushintsho endleleni othembele kuyo, ngakho phinda wenze ukuhlolwa kokuxhumeka okusha ngemva kwakho, kusukela ohlangothini olukude.

Gcina ifayela elikhishiwe kuze kube yilapho ushintsho lusinda ekuqaliseni kabusha futhi iklayenti langempela lixhumeka kabusha, bese uzungezisa noma yini owabelane ngayo ngenkathi iwindi livuliwe. Ukucushwa okusebenza kuze kuqaliswe okulandelayo kuyindlela ethule yokulahlekelwa irutha ngemva kweviki, lapho kungekho muntu okhumbulayo ukuthi yimuphi umthetho obungowesikhashana.

Bhala ushintsho lapho umuntu olandelayo ebukeka khona: yini ehanjisiwe, yiliphi ifayela elihlehlisayo, iyiphi indlela efinyelela kukhonsoli, nokuthi yimuphi umthetho obe ngowesikhashana.

Ngaphambi kokuthi uvule ikhasi le-VPN, kufanele kube khona izinto ezine: ukugeleza kokubuyisela okuhlolile, indlela yesibili oyiqinisekisile, ifayela elithunyelwe ongalifinyelela ngempela, kanye ne-trigger ebhaliwe. Uma kukhona oshodayo, lungisa lokho kuqala. Ushintsho lungalinda ihora; ukukhiya akukwazi.