Lungisa i-DNS yesivakashi se-libvirt evinjwe i-firewall ye-VPN esekelwe kumaka

I-firewall ye-VPN esekelwe kumaka ilahla i-DNS yezivakashi ngaphambi kokuba uchungechunge lwezihlungi luyibone. Umthetho owodwa wezinga le-mangle umaka umbuzo nempendulo yawo, ngaphandle kokuvula i-LAN yakho.

Izivakashi kwinethiwekhi ezimisiwe ye-libvirt zixazulula amagama ngokuphelele kuze kube yilapho kuvela isixhumi esibonakalayo se-WireGuard, bese kuthi konke ukusesha kume endaweni efanayo. dnsmasq isalalele ku- 192.168.122.1:53, isivakashi sisenalo lelo kheli njengesixazululi, futhi umbuzo usafika. Okushintshile ukuthi umbuzo ophezulu wompheki uqobo, noma impendulo yawo, manje ulahlwa umthetho ohlolwa ngaphambi kwanoma yiluphi uchungechunge lwezihlungi ongacabanga ukuluhlela. Indlela yokuphuma uphawu olubekwe ngokushesha okwanele, kuxhumano impendulo eyithola njengefa.

Izivakashi zilahlekelwa i-DNS ngesikhathi umhubhe unyuka

Qinisekisa isimo ngaphambi kokushintsha noma yini. Yehlisa umhubhe, sebenzisa dig @192.168.122.1 example.com kusuka kusivakashi bese ubona ukuthi uyaphendula. Nyusa umhubhe, phinda, bese ubona ukuthi uphelelwa isikhathi. Lolo hlangothi lwemiphumela lususa inethiwekhi ye-libvirt ephukile, ikheli lesixazululi elingalungile kanye ne-dnsmasq efile ngisinyathelo esisodwa.

Bese ubheka uhlangothi lompheki. Uma i-dnsmasq ibhala umbuzo nokudluliswa kwawo phezulu, iphakethe lifikile futhi ukwehluleka kusekuphumeni. Uma i-dnsmasq ingabhali lutho, umbuzo wesivakashi ulahlwa ekungeneni futhi okuhlukile kufanele kube kwelinye ihhuku hhayi lelo elimakwa yilesi sihloko.

Kungani umthetho we-accept ochungechungeni olulandela ungasebenzi neze

I-firewall ye-VPN esekelwe kumaka inquma ngokubheka uphawu lwephakethe noma uphawu loxhumano, hhayi ikheli lakho lomthombo. Noma yini efika kusixhumi esibonakalayo esibonakalayo ngaphandle kophawu olulindelekile iyenqatshwa, futhi lokho kunqatshwa kwenzeka kusethi yemithetho ephethe ukuhlolwa kophawu. ip saddr 192.168.122.0/24 accept umugqa owengezwe kunoma yiluphi uchungechunge olulandela awukaze ubhekwe kulelo phakethe, yingakho umthetho osobala ubonakala ulungile futhi ungalushintshi lutho.

Ukwukhulisa kuze kube yilapho okuthile kusebenza kuwugibe lwesibili. Ukwamukela yonke i-subnet ye-libvirt endleleni yokufaka yompheki kuvulela izivakashi zonke izinsizakalo zompheki, kuyilapho isidingo sangempela siyimbobo eyodwa.

Indlela eyenza okuhlukile okuncane kube nokwenzeka ukulandelela uxhumano. Uma ubeka ct mark kuyiphakethe, inani ligcinwa ekufakweni kwe-conntrack hhayi ephethethini kuphela, ngakho yonke iphakethe kulolo xhumano iyayithwala ngemuva kwalokho, kuhlanganise nempendulo esuka kumpheki ibuyela kusivakashi. Lelo yiqhinga lonke: maka isicelo kanye, futhi indlela yokubuya isivele imakiwe.

Maka umbuzo ngaphambi kokuba ithebula le-VPN uwubone

Beka okuhlukile ethebuleni lalo siqu, ukuze umfundi olandelayo alithole ngaphandle kokuhlaziya imithetho ye-VPN:

table inet allowedLocal {
  chain guest_dns {
    type filter hook input priority mangle; policy accept;
    ip saddr 192.168.122.0/24 meta l4proto { tcp, udp } \
      th dport 53 ct mark set 0x00000f41
  }
}

priority mangle kubi, okubeka lolu chungechunge phambi kochungechunge olujwayelekile lwezihlungi iphakethe le-VPN elifaka ngokubaluleka kweziro. Ukulandelana kwama-hhuku yikho okwenza umthetho usebenze; umthetho ofanayo ochungechungeni oluhlela ngemuva kochungechunge lwe-VPN kuwumhlobiso nje.

Inombolo yophawu ngokwayo ayithwaleki. Thatha inani imithetho ye-VPN efakiwe eyamukelayo ngokwayo, liyifunde kusethi yemithetho esebenzayo, bese usebenzisa lona. Uphawu olungalungile lukhiqiza umthetho olayisha ngokuhlanzekile, ohambisana nawo wonke umbuzo futhi ongenisi lutho.

Gcina imbobo ibanzi njengembobo engu-53

Njengoba kubhaliwe, lokhu kuvumela i-DNS esuka ku-subnet ye-libvirt iya kumpheki nge-TCP noma i-UDP embotsheni engu-53 futhi akukho okunye. Akukuvumeli izivakashi ukufinyelela i-inthanethi ngaphandle komhubhe, futhi akukuvumeli umpheki ukuvula ukuxhumana ngasemva kwezivakashi. Uma isivakashi sidinga enye insizakalo yompheki kamuva, engeza umthetho ohlukile oqoka leyo mbobo yendawo esiya kuyo esikhundleni sokukhulula lo.

Thembeka ngalokho okushintshayo. Isivakashi esingafinyelela isixazululi singaphinda sishumeke idatha engacacile ngemibuzo ye-DNS, futhi lokhu kuhlukile kuyimbobo eyenziwe ngamabomu emngceleni we-VPN hhayi isitatimende sokuthi inethiwekhi yasendaweni ithembekile. Ukulinganisela umthombo ku- 192.168.122.0/24 kugcina leyo mbobo kude nayo yonke enye i-subnet yasendaweni, futhi ukubala imibuzo kulo mthombo kushibhile uma usongo lubalulekile kuwe.

Yenza ukuthi ihlale ngemva kokuqalisa kabusha futhi uqinisekise izingxenye zombili

Umthetho othayiphiwe ku-shell uyanyamalala ekuqaliseni okulandelayo, futhi umthetho olayishwa ngemva kokuba isixhumi se-VPN sesivele sidlulisa ithrafikhi uyahlulwa emncintiswaneni kuxhumano lokuqala. Beka ithebula kusimo esihlala njalo se-nftables sompheki, noma kuyunithi ehlelwe ngaphambi kwensizakalo ye-VPN, futhi uhlole ukulandelana esikhundleni sokukucabangela.

Ukuqinisekisa kudinga izimpendulo ezintathu ezihlukene. Qinisekisa ukuthi uchungechunge lulayishwe futhi luhlelwe kuqala, qinisekisa ukuthi ukufakwa kwe-conntrack kukhombisa uphawu kuzo zombili izinhlangothi, futhi qinisekisa ukuthi ukusesha kwesivakashi kubuyisela ikheli. Bese uqinisekisa enye ingxenye: ithrafikhi yewebhu evamile yesivakashi eya kumpheki womphakathi isahluleka ngesikhathi umhubhe uphansi noma uvimba. Uma i-DNS isebenza futhi konke okunye kuphuma, umthetho wakho ubanzi kunalowo ongenhla.

Uma ukusesha kusahluleka ngemva kokuba uphawu lubekiwe, vimbela isifiso sokukhulisa umthombo. Hlola ukuthi i-dnsmasq idlulisela kuphi, ukuthi isixazululi sesivakashi sikhomba ku- 192.168.122.1 noma kukheli lomphakathi othayiphwe umuntu, nokuthi umbuzo ufinyelela kumpheki yini. Ukumaka kungenisa iphakethe futhi akukho okunye, ngakho umfudlana ophezulu omubi noma inethiwekhi ebonakalayo ephukile kuhlala kuphukile kungakhathaliseki ukuthi wengeza imithetho emingaki.

Izihloko ezihlobene