Isivikelo sokuphepha sisavimba ukuhamba ngemuva kokuqhawuka kwe-VPN

Umhubhe awusekho, isithonjana senethiwekhi sibukeka sijwayelekile, futhi akukho okulayishwayo. Uqamule i-VPN, wayikhipha noma waqala kabusha, futhi isivimbelo okwakufanele sikuqinisekise ngesikhathi sokunqamuka sisamile. Iwindi leklayenti alikwazi ukuchaza, ngoba akuyona iklayenti evimbayo: isinqumo sabhalwa ku-kernel egameni lakho, futhi akukho okwasala ukusisusa. Ku-Windows leso simo siku-Windows Filtering Platform; ku-Linux kuyiqoqo lemithertho ku-iptables noma nftables, ngokuvamile nesithombe esiphindwa ukusetshenziswa lapho kuqalwa. Okulandelayo ukuhleleka engikushicilelayo: funda isimo, susa into encane kunazo zonke echaza ukwehluleka, bese uthola noma yini eqhubeka nokuyibuyisela.

Isivikelo sokuphepha yisimo se-kernel, hhayi isilungiselelo

Amaklayenti e-desktop avimba ngokwengeza izihlungi ezenqaba ukuhamba ngaphandle komhubhe. Ku-Windows lezo izihlungi ze-WFP ezigabeni ze-connect-redirect ne-transport, futhi ezinye zihlala njalo: zibhalwa endaweni yokugcina inqubomgomo ye-Base Filtering Engine futhi zibuyiselwa lapho umshini uqalwa, ngaphambi kokuthi noma iyiphi isofthiwe ye-VPN isebenze. Amaklayenti ahlukana ngesikhathi sokuhlanza. Amanye asusa izihlungi lapho kunqanyulwa, amanye kuphela lapho kuphuma kahle, futhi amanye kuphela uma isivikelo sivalwa kuqala. Khipha ngaphakathi ngesikhathi isivimbelo sisebenza, noma bulala inqubo, futhi izihlungi zihlala.

Okufanayo ku-Linux umthetho we-drop noma we-reject endleleni yokuphuma, kwesinye isikhathi umthetho we-forwarding, kwesinye isikhathi inqubomgomo yeketanga eshintshiwe. Leyo mithertho iphila isikhathi eside ukudlula inqubo eyiyengezile ngoba iyisimo se-kernel: bulala iklayenti, yenze ihluleke, noma unqamule ugesi, futhi i-kernel iqhubeka nokulahla amaphakethe futhi akukho okusalayo ukukuhoxisa. Iphakethe lokuqinisekisa lengeza isendlalelo sesibili sokuqinisekisa ngokuthatha isithombe seqoqo lamanje lemithertho nokulibuyisela lapho kuqalwa, ngakho ukuqala okulandelayo kuqala ngokuvimbela okusekufakiwe.

Funda isimo se-WFP ngaphambi kokususa noma yini

I-Windows iza namathuluzi owadingayo. Vula iphrompthi yomlawuli futhi ukhiphe isimo seplathifomu; umphumela uzofika njenge-wfpstate.xml kuhla lomsebenzi.

netsh wfp show state
netsh wfp show filters
Get-Service bfe

Funa ku-XML igama lomhlinzeki osukile, isenzo se-Block, nesendlalelo. Izihlungi ku-connect-redirect ne-transport yizona ezihliphaza ukuhamba okujwayelekile; isihlungi esigabeni se-receive-accept ngokuvamile akusiyo imbangela yakho. Uma i-Base Filtering Engine ingasebenzi nhlobo, funa kwenye indawo, ngoba akukho okunye okungasebenzisa lezo zihlungi.

Hlola nombono ojwayelekile we-firewall, ngoba iningi labantu lihlola okukodwa kokubili:

netsh advfirewall show allprofiles
Get-NetFirewallProfile | Select-Object Name,Enabled,DefaultInboundAction

Lapho amaphrofayili akhelwe ngaphakathi evuliwe futhi kungekho mthetho ohambisana nokuhamba okuhlulekayo, ukuvimbela kuvela kumhlinzeki wangaphandle, hhayi ku-Windows Firewall. Lowo mehluko unquma ukuthi iyiphi ithuluzi ozolisebenzisa ekulungiseni.

Funda imithetho ye-Linux ngendlela ozosusa ngayo

iptables -S ishicilela imithetho ngendlela efanayo naleyo eyengezwe ngayo, ngakho umphumela ungasetshenziswa futhi ngqo ekususeni. iptables -L -v -n ingeza izibali zamaphakethe, futhi lezo zibali zitshela ukuthi umthetho uhambisana ngempela nezikhalo zakho ezihlulekile noma uhleli nje eketangeni.

sudo iptables -S
sudo ip6tables -S
sudo iptables -t nat -S

Funda izinqubomgomo zamaketanga, hhayi imithetho kuphela: -P OUTPUT DROP ivimbela ukuhamba ngisho kungekho mthetho ohambisanayo. Hlola i-IPv6 ngokwehlukile, ngoba iklayenti elifaka zombili izinhlobo lingashiya ukuvimbela kwe-IPv6 lapho ngemuva kokunyamalala kwemithetho ye-IPv4, futhi uphawu lube seluncika ekutheni uhlelo lukhetha uluphi uhlobo. Lapho kusetshenziswa i-nftables, sebenzisa futhi i-nft list ruleset; amathuluzi womabili ahlala ndawonye ngosendlalelo lokuhambisana, futhi uhlu olulodwa alubonisi ngempela yonke imithetho engalahla iphakethe.

Susa into encane kunazo zonke echaza ukwehluleka

Ku-Windows isinyathelo sokuqala siseyindlela yomhlinzeki yokususa: sebenzisa isifaki kabusha futhi usebenzise i-repair noma i-uninstall, noma usebenzise ithuluzi lokuhlanza uma umhlinzeki elishicilela. Amasevisi asele nemisebenzi ehleliwe kuvamile, futhi umsebenzi oqala iklayenti lapho kungena uzofaka kabusha izihlungi zaso ekugaleni okulandelayo. Ukukhipha okwehluleka lapho kufundwa ukhiye werejista weklayenti ngokuvamile kusho ukuthi isevisi noma umsebenzi usayibambile, hhayi ukuthi irejista yonakele.

Get-ScheduledTask | Where-Object TaskName -like '*vpn*'
Get-Service | Where-Object DisplayName -like '*vpn*'

Izihlungi ezihlala njalo ziyindlela yokugcina. Zingaphansi kwe-HKLM\SYSTEM\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent\Filter, inani elilodwa isihlungi ngasinye elikhiyiwe nge-GUID. Khipha ukhiye kuqala, bhala ama-GUID owakususayo, susa kuphela amanani eklayenti elisukile, bese uqala kabusha ukuze injini yakhe futhi isimo sayo. Ungasusi wonke ukhiye futhi ungakhubazi i-Base Filtering Engine: i-Windows Firewall ne-Defender zincike kuwo, futhi uzoshintsha ukuphazamiseka okukodwa nokubi kakhulu.

reg export "HKLM\SYSTEM\CurrentControlSet\Services\BFE\Parameters\Policy\Persistent" C:\temp\bfe-backup.reg

Ku-Linux thatha umugqa oshicilelwe yi-iptables -S bese ushintsha i--A nge--D. Ukususa umthetho owodwa okuwutholile kungcono kunokukhipha iketanga lonke, ngoba inqubomgomo yakho ihlala ingathintekile.

sudo iptables -D OUTPUT -p udp -j REJECT

Uma i-drop iseketangeni elichazwe umsebenzisi, qala ngokususa ukugxuma kulelo ketanga bese ususa iketanga nge--X. Ukusetha inqubomgomo yeketanga ku-ACCEPT kusekhona imithetho ye-drop kusiza kuphela amaphakethe afinyelela esinqumweni senqubomgomo. Ukukhipha zonke amathebula kuyindlela yokugcina: kususa nemithetho oyengeze ngezinye izizathu, futhi uma i-ufw ivuliwe kushiya isevisi sicabanga ukuthi siphethe amaketanga angasekho.

Thola umnikazi oyibuyiselayo

Ngemuva kokulungisa okusheshayo, funa noma yini engabuyisela isimo. Ku-Linux hlola ukuthi iyunithi yokuqinisekisa ivuliwe yini, ukuthi iklayenti linokulungiselela kokubuyisela i-firewall lapho kungena yini, nokuthi kukhona yini ifayela lemithertho eligciniwe ngaphansi kwe-/etc. Ku-Windows hlola futhi izinto zokuqala, amasevisi nemisebenzi ehleliwe, bese uqala kabusha futhi ufunda isimo ngemiyalo efanayo neyangaphambili.

Uma ukuvimbela ibuya, ukususa kwakungesona isisombululo; umnikazi uyena. Bhala ukuthi iyiphi iklayenti noma isevisi eyifakayo bese ukhubaza isici lapho, esikhundleni sokulwa nayo endaweni ye-firewall ngemuva kokunqamuka ngakunye.

Qinisekisa ngokuhamba kwangempela, hhayi i-ping eyodwa

Hlola ukuxazululwa kwegama, ukuxhumana kwe-TCP nesikhathi esisha sesiphequluli, bese uqala kabusha futhi uphinda lezo zinto ezintathu zokuhlola. I-ping esebenzayo ngesikhathi i-HTTPS ihluleka ikhomba isihlungi sendlalelo ye-transport hhayi inethiwekhi, futhi ukuvimbela okubuya kuphela ngemuva kokuqala kabusha kukhomba umnikazi ongakamtholi.

Gcina ubufakazi: ukhiye we-BFE okhishiwe, noma umphumela we-iptables -S othathwe ngaphambi koshintsho. Ngaphambi kokusho ukuthi kulungisiwe, qinisekisa isendlalelo owakususa kuso into, umnikazi ongayifaka futhi, isimo ngemuva kokuqala kabusha okuhlanzekile, nokuthi ukuphequlula okuvamile kuyasebenza ngaphandle kwenqubo ye-VPN. Ikhasi lemanuwali le-iptables(8) linendlela eqondile yokususa nenqubomgomo uma ubhala ukuhlanza njenge-skripthi.