I-iptables host ye-VPN kuphela: qamba idivayisi ye-tun, hhayi tun+

Ukubhala -o tun+ kubonakala njengomyalo oqondile futhi empeleni kuwuphawu olujwayelekile oluhambisana nayo yonke imigudu enayo i-kernel. Iklayenti lesibili le-VPN, ibhuloho lekhonteyina noma isixhumi esishiywe yiseshini ephukile konke kuyayifeza, futhi i-host ibe isivumela ithrafikhi inqubomgomo eyayihlose ukuyivimbela. Inqubo engezansi ibeka igama elilodwa ledivayisi, ihlela ukukhululwa ukuze umgudu ukwazi ukwakheka ngempela, futhi ikushiyele indlela yokubuyela emuva uma imithetho iwela kabi. Isinyathelo ngasinye sifushane ngokwanele ukuba sihoxiswe sisodwa.

Isinyathelo 1: bhala phansi imithetho onayo manje

Ngaphambi kokushintsha inqubomgomo ezenzakalelayo, gcina isimo samanje ukuze ukubuyela emuva kube umyalo hhayi isikhumbuzo. iptables-save > /root/iptables.pre ibhala ithebula ngalinye efayeleni ongakwazi ukulibuyisela, futhi itheminali yesibili eneseshini ye-root evuliwe akukhona ukwesaba ngokweqile lapho inqubomgomo ozoyisetha inqamula uxhumo oluyithwalayo. Uma usebenza kude, hlela futhi i-flush njengeswishi yezimo eziphuthumayo.

Bese ufaka ohlwini izixhumi, ngoba igama olucabangele yigama obekufanele ukuthi walifunda: ip -br link ikhombisa okukhona manje, futhi umgudu ngeke uvele kuze kube uphakamile. Bhala phansi amagama amadivayisi njengoba uwafunda.

Isinyathelo 2: nika umgudu igama lawo

OpenVPN yamukela dev tun_work ekucushweni kweklayenti, bese i-Linux yakha isixhumi esinegama elinjalo ngqo esikhundleni sokwaba tun0. Igama lihlala lizinze phakathi kokuxhumeka kabusha inqobo nje uma kungekho okunye okulifunayo, futhi yikho okwenza umthetho oqamba idivayisi ube nencazelo.

Lapho igama lingalawuleki, fanisa ikheli lomgudu noma uphawu lwephakethe esikhundleni salokho. Kokubili kuyasebenza, kokubili kunzima ukukufunda, futhi kokubili kwehluleka ngokuthula kakhulu lapho umgudu ubalwa kabusha. Noma kunjalo, fanisa into eyodwa futhi usho ngokucacile ukuthi iyiphi.

Isinyathelo 3: bhala inqubomgomo ngokubeka ukukhululwa kwe-endpoint kuqala

I-host ene-VPN kuphela iyihost yokwenqaba okuzenzakalelayo enohlu olufushane lokukhululwa, futhi ukukhululwa okubaluleke kakhulu yikho okuvumela umgudu ukuba ube khona. Yakha ngalokhu kuhleleka, umthetho we-endpoint ngaphambi komthetho wedivayisi yomgudu, ukuze ukuxhawulana kube nendawo yokuya:

# allow the tunnel to be built, then everything the tunnel carries
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -d 198.51.100.7 -p udp --dport 1194 -j ACCEPT
iptables -A OUTPUT -o tun_work -j ACCEPT
iptables -A INPUT  -i tun_work -j ACCEPT
iptables -A INPUT  -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Ikheli le-endpoint elingokoqobo kanye nechweba kungokomhlinzeki wakho, hhayi leli khasi. Uma i-endpoint iyigama le-host, xazulula kanye bese uqinisa umphumela, ngoba umthetho awukwazi ukusesha igama futhi impendulo ejikelezayo izophula inqubomgomo ngokuthula ngemva koshintsho olulandelayo lwe-DNS. Hlola nechweba futhi, ngoba abahlinzeki abakuhambisela ku-TCP 443 bazodinga umthetho ongabhalwanga muntu uma kungenjalo. Umgudu osebenza kuphrothokholi eyodwa kuphela ngokuvamile yilokhu okushiywe ngaphandle, hhayi ukwehluleka kwe-firewall.

Ku-router isimo esifanayo singena kuchungechunge lwe-FORWARD lwamaklayenti angemuva kwayo, futhi ithrafikhi yerouter uqobo idinga imithetho yayo. Iqoqo lemithetho elihlanganisa amaphakethe adluliselwe kuphela lishiya i-SSH ne-DNS endleleni endala, futhi yileyo ndlela i-router eba ngokungafinyeleleki ngayo ngesikhathi umgudu uphakama.

Isinyathelo 4: hlola ukuhleleka, hhayi ukuba khona kuphela

Imithetho ihlolwa ngokulandelana, ngakho i-ACCEPT eza ngaphambili imane ifihla i-REJECT oyengeze ngemuva. Ukufana kwe-established ne-related yikho okwenza izimpendulo eziya emicabangweni yakho ephumayo zibuye ngaphandle kokuvula indlela evamile yokungena, futhi ukuyibeka ngemva kokwamukelwa komgudu kusho ukuthi umgudu owile usadlulisa ithrafikhi yokubuyela esixhumini sawo.

Gcina inani lemithetho lincane ngokwanele ukuba lifundwe esikrinini esisodwa. Iqoqo lemithetho ongakwazi ukulihlola yilo oyokulungisa ngokwengeza ukukhululwa phezulu, futhi yileyo ndlela inqubomgomo yokwenqaba okuzenzakalelayo ethola ngayo kancane kancane umkhawulo wokuvumela okuzenzakalelayo. Bala ama-ACCEPT ngaphambi nangemva koshintsho.

Isinyathelo 5: yenza ikwazi ukudlula ukuqalisa nomndeni wamakheli

Imithetho efakwe ngesandla iyanyamalala lapho kuqaliswa kabusha, ngakho ilayishe kusuka kusevisi ye-firewall yokusabalalisa noma ku-unit esebenza ngemva kokuba isixhumi somgudu sikhona. Ukubhekisela ku-tun_work kusikripthi esisebenza ngaphambi kokuba i-OpenVPN iqale kuyindlela evamile yokwakha umjikelezo wokuqalisa wethrafikhi elahliwe.

Bese uhlola i-IPv6 ngokwehlukana, ngoba inqubomgomo enhle yokwenqaba okuzenzakalelayo ye-IPv4 ayisho lutho ngomunye umndeni. ip -6 route izokutshela ukuthi i-host inomzila ongathwala ithrafikhi ezungeza umgudu osebenza nge-IPv4 kuphela noma cha, futhi i-ip6tables noma i-nftables idinga imithetho yayo efanayo. Hlola ngendawo eziyiwa kuyo ye-IPv6-only esikhundleni sokuthemba ukulingana kweqoqo lemithetho.

Isinyathelo 6: qinisekisa futhi ube usukulungele ukubuyisela

Phakamisa umgudu, qinisekisa ukuthi isevisi oyihlosile iyasebenza, bese uzama into inqubomgomo okufanele iyinqabe. Buyisela nge-iptables-restore < /root/iptables.pre uma impendulo ikumangaza, futhi ngemva kwalokho kuphela qala ukuhlela imithetho. Ukubekezela kanye nendlela yokubuyisela ehloliwe yikho okwenza lokhu kube ushintsho ongakwenza kabili.