iptables: vumela amaklayenti e-VPN ukuthi afinyelele i-hosti eyodwa kuphela

Amathikithi amabili okusekelwa abonakala engahlobene ekugcineni abelana imbangela eyodwa. Kwelokuqala, umphathi ufuna iseva yamukele ukuxhumana okuvela emhubeni kuphela; kwelesibili, abasebenzisi be-VPN kufanele bafinyelele i-hosti eyodwa yangaphakathi hhayi okunye. Zombili izinqubomgomo zise-FORWARD, futhi zombili zivame ukuzanywa ku-INPUT. Umphumela ubukeka njengodonga lomlilo kodwa uziphatha njengesibambi sikhashana.

Iluphi uchungechunge oluphendula umbuzo wakho

Amaphakethe akleyenti ye-VPN ewathumela ku-hosti eku-LAN, noma eqhubeka eya ku-inthanethi, umongo uwadlulisa futhi ahlolwa ku-FORWARD. I-INPUT ne-OUTPUT zibona kuphela uhambo oluphela kuseva uqobo noma oluvela kuyo. Ngakho-ke ukwenqaba konke okungafiki ku-tun0 kuvikela izilaleli zeseva uqobo, futhi kuzophinde kuqede isikhathi sakho se-SSH ngaphandle uma ukugeleza okusunguliwe kuvunyelwa kuqala. Lokhu akushintshi lutho mayelana nokuthi amaklayenti angaya kuphi.

Qala ngokuqamba umbuzo: ubani angafinyelela iseva, noma amaklayenti angaya kuphi. Amanethiwekhi amaningi adinga zombili izimpendulo, emichungeni ehlukene.

Kuqala isimo, bese kuba imvume, bese kuba ukwenqaba

Uhlu lwemvume lusebenza kuphela uma imvume ethile ihlezi ngaphezu kokwenqaba okujwayelekile futhi uma uhambo olubuyayo luvunyelwa ngaphezu kwakho kokubili. Faka imithetho ezindaweni ezicacile, bese ukhipha uchungechunge nge-iptables -S FORWARD ukuze ukulandelana kubonakale kunokuba kucatshangwe.

POOL=10.99.0.0/24
iptables -I FORWARD 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -I FORWARD 2 -s "$POOL" -d 172.31.20.15 -p tcp -m multiport --dports 443,3389 -j ACCEPT
iptables -I FORWARD 3 -s "$POOL" -j REJECT

Imininingwane emibili inquma ukuthi lokhu kuzokhuthazela yini ekuhlanganyeleni nokugeleza kwangempela. Ngaphandle komthetho wesimo, izimpendulo ezimayelana nokuxhumana okuvule kanye nokuvumela zihlolwa ngokwazo ngokumelene nokwenqaba futhi ziyalahlwa. Umthetho we-LOG ongenamkhawulo ungagcwalisa ingxenye encane ngokushesha lapho ukuskena kuyithinta okokuqala, ngakho-ke engeza -m limit --limit 10/min ngaphambi kokuqhubeka nokuloga. I-REJECT ibuyisela iphutha ngokushesha, okunobungani kakhulu ngesikhathi ulungisa uhlu; i-DROP yalahla buthule, ngakho-ke wonke amaphutha abonakala njengesikhathi esiphelile. Khetha eyodwa ngamabomu bese ubhala ukukhetha kwakho kurekhodi loshintsho.

Ukudlulisela kanye ne-NAT kufanele kube sekuvele kusebenza

Ukuhlunga akukwazi ukufakazela ukuthi ikhona indlela. Qala ngokuqinisekisa ukuthi umongo udlulisela noma cha, futhi wenze lesi silungiselelo sibe ngapheleli esikhathi eside kunokuba kube umyalo wesikhathi esisodwa ku-shell. Isihlungi siyingqimba yokugcina, hhayi eyokuqala.

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -s "$POOL" -o eth0 -j MASQUERADE

Lapho i-masquerade kufanele ibe khona kuncike ekutheni amaklayenti aphuma kuphi. Uma ephuma ngomhubo eya kunethiwekhi ekude, umthetho we-NAT uhlala kuleso sixhumi hhayi esixhumini se-WAN. Bese ubheka izibali: uma isibali se-POSTROUTING singanyakazi nakanye ngesikhathi inani lokwamukeleka ku-FORWARD likhuphuka, indlela yokubuya yephukile futhi isihlungi silungile. Lokho kufunda kusindisa intambama yokubhala kabusha imithetho eyayingeyona inkinga.

Isivimbelo se-imeyili sisechungeni elilodwa ngaphezulu

Ukuvimbela iphothi 25 ku-INPUT kumisa kuphela i-imeyili eqondiswe kuseva ye-VPN. Iklayenti elihlaselwe elithumela i-imeyili ngomhubo liyadluliselwa, ngakho-ke isivimbelo kufanele sibe ku-FORWARD eceleni kwe-465 ne-587. Uma uhlelo olulodwa ludlulisa i-imeyili ngokomthetho, beka indawo yalo kanye nephothi ngaphezu kwalowo mthetho.

iptables -I FORWARD 2 -s "$POOL" -p tcp -m multiport --dports 25,465,587 -j REJECT

Vumela isibali sokwenqaba sisebenze iviki ngaphambi kokuba uqinise okunye. Inombolo eyeka ukukhuphuka iwukugeleza okusemthethweni okuyephule kanye.

Funda futhi, bese ufakazela kusukela kuklayenti

Funda isethi yemithetho ngendlela umongo ekubika ngayo, hhayi ngendlela iskripthi sakho esiyibhalile. Qala nge-iptables -S FORWARD, bese ithebula le-NAT nge-iptables -t nat -L POSTROUTING -n -v, bese ingeno ye-conntrack yokugeleza okuhlolayo. Gcina umyalo wokuhlehlisa noma ukusula okuhleliwe isikhathi sonke umsebenzi uqhubeka. Yonke into efonelwayo idinga i--w, ngaphandle kwalokho abaphathi ababili bazoshayisana esikhiyeni se-xtables. Akukho kulokhu okuyisihloko phakathi kwefasitela loshintsho.

Qeda ngokuhlola kusukela kuklayenti elingaphakathi kwesethi nakwelinye elingaphandle kwayo. Umthetho osebenza kuphela kusukela emshinini owuwubhale kuwo awuwona umgomo.