Yenza umthetho we-ip uhlale ukhona ngemva kokuxhuma kabusha ne-systemd-networkd

Engeza umthetho wenqubomgomo nge-ip rule futhi usebenza kuze kube yilapho uxhumano lunyamalala; ngaleso sikhathi awukho nje. Akukho okwahluleka ngomsindo: isimo se-kernel sashintsha, futhi akekho umnikazi wokulungiselelwa owayazi ukuthi umthetho kwakufanele ube khona. Lowo umahluko wonke phakathi komthetho ohlala ukhona nalowo ongahlali. Kusokhethi ene-systemd-networkd, isisombululo ukunikeza umthetho umnikazi, hhayi ukuphinda ugijime umyalo ngemva kokuxhuma kabusha ngakunye.

Umthetho ukhona kuphela uma othile uwuphethe

Inqubomgomo yokuhambisa yase-kernel iyisimo, hhayi ukulungiselelwa. Ihlala kusistimu esebenzayo, futhi noma yini ediliza isixhumanisi encike kuso ingayithatha ihambhe nayo. Umyalo we-shell ushintsha leso simo futhi awushiyi mhlangano womqondo.

Abaphathi benethiwekhi basebenza ngokuphambene: bafunda ukulungiselelwa, bakusebenzise futhi bakusebenzise futhi lapho isigameko soxhumano senza isimo sangaphambilini singasebenzi. Umthetho omenyezelwe ekulungiseleleni kwabo wakhiwa kabusha, kuyilapho umthetho owengezwe eceleni kwabo uyinto yangaphandle engenawo umnikazi.

Lowo mahluko unegama ku-networkd, futhi kufanele ufundwe ngaphambi kokuvula noma yini. Imithetho yangaphandle isuswa ngokuzenzakalela kumaversini akamuva, lokhu kumangaza labo ababelindele ukuthi amafayela abo wesandla azoqhubeka akhona.

Funda inguqulo ngaphambi kokuthemba isilungiselelo

Ukuziphatha kobunikazi kulawulwa yisilungiselelo esiku-networkd.conf, futhi leso silungiselelo asikho kumaversini amadala e-systemd. Hlola inguqulo efakiwe ngaphambi kokuklama ngakho, ngoba isokhethi endala iziphatha ngendlela ehlukile kunemibhalo oyifundayo.

Amanani amabili abalulekile. Elinye linquma ukuthi imithetho engamenyezelwanga ekulungiseleleni kwe-networkd iyasuswa yini, kanti elinye lenza okufanayo emizileni. Womabili amayelana nobunikazi hhayi nokuqukethwe kwenqubomgomo, futhi womabili ngokuzenzakalela akhetha ukuziphatha okuqinile kumaversini amanje. Ukuwacisha emhlabeni wonke kugcina wonke umthetho wangaphandle ukhona, okuyisinqumo esibanzi kakhulu kunokumemezela inqubomgomo eyodwa ye-VPN ehlosiwe.

systemctl --version | head -1
networkctl --version | head -1
grep -R "ManageForeign" /etc/systemd/ /usr/lib/systemd/ 2>/dev/null

Leyo grep ikutshela ukuthi yini ebekwe endaweni kanye nokuthi yini okuzenzakalelayo komhlinzeki. Ukungabikho nakho kuwulwazi, ngoba kusho ukuthi kusebenza okwakhiwe okuzenzakalelayo. Bhala okuzenzakalelayo emibhalweni yakho ukuze umuntu olandelayo angadingi ukukuthola kabusha.

Memezela umthetho kanye nethebula ewukhomba

Umthetho kufayela le-.network ubiza ithebula, futhi yilokho kuphela okwenziwa yigama. Awudali imizila engaphakathi kwalelo thebula futhi awuhloli ukuthi iyavumelana yini. Ukumemezela umthetho ngaphandle kwemizila kukhiqiza inqubomgomo ehambisana nethrafikhi bese iyilahla.

Memezela imizila kulelo fayela, nemigqa elandelayo efinyelelekayo kanye nethebula elifanele. Gcina ukubaluleka kumthetho omenyezelwe ukuze wehlele lapho ulindele khona ohlwini oluhleliwe. Umthetho ofinyelela ithebula elingalungile ngaphambi kwesikhathi esihlosiwe ushintsha ithrafikhi eningi kunesevisi obufuna ukuyilungisa. Funda isiqephu esingezansi njengomumo hhayi njengefayela eliphelele, ngoba ubunikazi besixhumanisi nokunye ukuxhumana kusafanele kube khona.

[RoutingPolicyRule]
Family=ipv4
IPProtocol=tcp
SourcePort=443
Table=100
Priority=1000

[Route]
Destination=10.80.0.0/24
Gateway=10.80.0.1
Table=100

Bese ulayisha kabusha futhi ufunde isimo se-kernel esikhundleni sefayela. Ukulungiselelwa okuhlaziywe ngokuhlanzekile kungase kukhiqize umthetho ongawuhlosanga, futhi imibono yomibili iyavumelana kuphela lapho isimemezelo sasiphelele.

Khetha umnikazi oyedwa wesixhumanisi

Abaphathi ababili kumhubhe owodwa badala ingxabano ebonakala njengephutha kubo bobabili. Ukungenisa ukulungiselelwa kwe-wg-quick okukhona ku-networkd wukufuduka hhayi ukwengeza, futhi ukusebenzisa kokubili kushiya isixhumanisi nemithetho yaso ngaphansi kwabaphathi ababili.

Yenza ukufuduka ngasikhathi sinye: misa iyunithi endala, yicishe, memezela isixhumanisi nemizila yaso ku-networkd, bese ulayisha kabusha. Hlola ukuthi iyunithi endala ayikwazi ukubuya lapho kuqalwa. Iyunithi esele evuka futhi ngemva kokuqalwa kabusha ibhala phezu kwesimo osanda kusimemezela. Gcina ifayela lokulungiselelwa elidala kuze kube yilapho elisha likwazi ukubekezelela ukuxhuma kabusha, bese uyelisa umhlalaphansi.

Ubunikazi bophawu nawo bufanelwe ukunakekelwa okufanayo: uma umthetho uhambisana nophawu lwe-firewall, kufanele kube khona okubeka lolo phawu. Umthetho okhomba ophawini okungekho muntu olubekayo uwukulungiselelwa okufile okubonakala ngathi kwenziwe ngamabomu.

Zilolonge izigameko zomjikelezo wokuphila

Ukulungiselelwa kuhle ngokulingana nokuziphatha kwako kuzo zonke izigameko. Yehlisa uxhumano, luphakamise, qala kabusha isevisi futhi uvuselele ikheli. Ngemva kwakho ngakunye, funda uhlu lwemithetho kanye nokuqukethwe kwethebula.

sudo networkctl reload
ip rule show
ip route show table 100
sudo systemctl restart systemd-networkd

Umphumela ohlosiwe ukuthi inqubomgomo efanayo enomnikazi yakhiwe kabusha futhi isimo esidala sethulwe umhlalaphansi, okuqinile kunokwengeza kabusha umthetho we-shell ngemva kokuxhuma kabusha ngakunye. Gcina umugqa owodwa kurekhodi yezinguquko obiza ifayela eliphethe umthetho kanye nenguqulo eyisekelayo. Lapho-ke unjiniyela olandelayo angawuthola inqubomgomo ngaphandle kokucinga umlando we-shell. Umthetho ongenaye umnikazi uwumthetho ozophinde ulahleke.