I-firewall yokwabiwa kwe-Linux ingavimba i-VPN traffic yakho

Umhubhe uyaphuma, ilogi ithi ixhunyiwe, kanti uhlelo olulodwa alukwazi ukufinyelela lutho. Ku-client ye-Linux lokhu ngokuvamile kusho ukuthi i-firewall yokwabiwa ihluza indlela i-client ye-VPN engakaze iyiphatha. Abaphathi ababili bangasebenza ngesikhathi esisodwa, ngamunye nemibono yakhe mayelana ne-interface, indawo kanye nendlela ye-traffic. Ukukhomba umnikazi ngaphambi kokushintsha noma yini kushesha kunokuzama imithetho kuze kusebenze okuthile.

Thola umphathi kanye ne-backend

Qala ngalokho okulayishiwe ngempela, hhayi ngalokho okufakiwe. Ukwabiwa kungahlinzeka nge-firewalld, ufw kanye nensizakalo evamile ye-nftables, futhi kube eyodwa kuphela yazo ephethe isethi yemithetho esebenzayo. Amaphakheji ahlala ndawonye ngokuthula, futhi umthetho ofakwe nge-frontend engalungile awufinyeli i-kernel. Funda insizakalo esebenzayo, bese ufunda isethi yemithetho eyikhiqizile.

I-backend ibalulekile njenge-frontend. Ukufakwa kwe-firewalld kungashayela i-nftables noma i-backend endala ye-iptables kuye nge-version nokucushwa, futhi zombili zikhiqiza umphumela wokuhlola ohlukile. Bhala ukwabiwa, i-version kanye ne-backend kwithikithi ngaphambi kokuqhathanisa uhlelo lwakho nanoma yimuphi umhlahlandlela.

Qondanisa indlela kanye ne-interface

Isicelo se-client esiphumayo, isilaleli esingenayo kanye nephakethe elidlulisiwe kudlula kumahuku ahlukene, futhi umthetho wokukodwa awukubandakanyi okunye. Indawo evumela i-LAN yendawo ngokuvamile ayifaki i-interface yomhubhe noma ichibi lamakheli e-VPN. I-interface yomhubhe ngokuvamile ihlala endaweni ezenzakalelayo, evamise ukuba lukhuni kunendawo okukuyo i-adaptha yenyama. Lokho kungafani kuchaza ukuthi kungani ukuphequlula kusebenza ku-LAN futhi kuma ngesikhathi umhubhe uphuma.

Buza ukuthi iyiphi indlela ehlulekile ngaphambi kokukhetha umthetho. Uhlelo olungakwazi ukuxhuma ngaphandle ludinga indlela yokuphuma, kanti insizakalo engenayo idinga indlela yokungena ku-interface yomhubhe. Ukwengeza umthetho kuketanga okungalungile kukhiqiza ushintsho olubonakala lusetshenzisiwe futhi olungenzi lutho.

Gcina abanikazi bomthetho bevumelana

Ihuku le-client ye-VPN, indawo yokusebenza yama-container kanye nensizakalo yokwabiwa konke kungashintsha inethiwekhi, futhi azihlangani ndawonye. Imithetho efakwe ngesandla iyanyamalala ekulayisheni okulandelayo, futhi imithetho efakwe kuketanga yomphathi ingahlolwa ngokulandelana obekungakuhlosile. Sebenzisa ukucushwa okuhlala njalo komphathi futhi uhlole isethi yemithetho eholekile esikhundleni sefayela olibhalile. Ukucima yonke i-firewall ngoba insizakalo eyodwa ayifinyeleleki kushintsha inkinga encane ngenkulu.

Izibali ezimfishane ziyindlela eshibhile yokuthola ukugeleza okwenqatshiwe. Umthetho wokuloga okhawulelwe endaweni eyodwa kanye ne-port eyodwa ukhombisa ukuthi ukulahla kwenzeka ngaphakathi ngaphandle kokubamba i-traffic yabanye. Susa umthetho wokuloga lapho uphenyo luphela, ngoba uwukuxilonga hhayi inqubomgomo, futhi idokhumenti yezindawo ye-firewalld ichaza ukuthi ama-interface nezinsizakalo zihlangana kanjani.

Qinisekisa ukulungiswa ngaphandle kokulahlekelwa ukuvalwa

Hlola isimo esisetshenzisiwe nomphathi onaso, usebenzisa imiyalo ehambisana ne-backend oyibhalile. Uhlu olungezansi lucabanga ukuthi i-firewalld inesibopho; faka okulingana kwe-nftables noma i-ufw esikhundleni sokusebenzisa konke. Ukuhlanganisa amathuluzi kuseshini eyodwa yikho okwenza umshini uphele nemisethi emibili yemithetho engqubuzanayo.

sudo firewall-cmd --get-active-zones
sudo firewall-cmd --zone=trusted --list-all
sudo nft list ruleset | head -40

Umyalo wokuqala usho izindawo kanye nama-interface awabelwe, okukhombisa ukuthi umhubhe wahlala kuphi ngempela. Owesibili uphrinta imithetho nezinsizakalo zendawo, ukuze ubone ukuthi i-interface ye-VPN ihlanganisiwe ngempela yini. Uhlu lwe-nftables luyiqiniso eliyisisekelo le-backend esetshenziswayo, futhi umthetho okhona efayeleni lokucushwa kuphela awubonakali lapho. Qhathanisa imiphumela emithathu nomthetho owengezile, futhi ukungafani ngokuvamile kuzibiza ngokwako.

Bese uphinda isicelo sokuqala kanye nokuziphatha kokwehluleka okukudingayo. Isiza esisanda kusebenza asanele uma ushintsho olufanayo lususe ukuvalwa kwe-client, ngakho hlola nendlela engavikelwe. Bhala umphathi, i-backend, i-interface kanye nenhloso yomthetho, ngoba ukubuyekezwa kwephakheji okuvusa umphathi wesibili kuzokwakha kabusha yonke inhlekelele.