Imithertho ye-firewall ye-NEW kuphela ayivali wonke umzila we-WAN

Ukwenqaba ukuxhumana okusha okuphumayo ku-WAN kubonakala njengenqubomgomo evala lapho kwehluleka, kodwa isithembiso esincane kunalokho okubonakala. Amaphakethe engxenye yemifudlana esivele ikhona awahambisani nayo, futhi nezimpendulo eziningi azihambisani. Lesikhala kulula ukusigeja ngoba umthertho ufundwa sengathi uhlanganisa i-interface hhayi isimo esisodwa sokuxhumana kuyo. Futhi ukufunda ukufana kwesimo njengesinqumo yikho okudala umuzwa ongamanga wokuvalwa.

Isimo siyisimo sokufana, akusona isinqumo

Ukulandelela ukuxhumana kuhlukanisa amaphakethe ngokwalokho i-firewall esekubonile, hhayi ngokwalokho okukholelwa uhlelo lokusebenza. Umfudlana obonwe kuzo zombili izinhlangothi usunguliwe, futhi amaphakethe awo akamuva ahlala esunguliwe ngisho nomzila ongaphansi ushintsha usuka emhubheni uya kumzila ojwayelekile ophezulu. Impendulo ekuxhumaneni okungena nayo ingaba umgudu osunguliwe. Lawo maphakethe awaphindi abe matsha futhi.

Yingakho umthertho obhekise ekuxhumaneni okusha kuphela ungeke ufakazele ukuthi wonke amaphakethe avikelwe avinjiwe. Ushiya ezinye izimo kulokho okwenziwa yingxenye esele yemithertho ngazo, futhi lokho kungaba imvume ebekwe ngaphambili kuchungechunge.

Funda umthertho endaweni yawo

Imvume ebanzi yomgudu osunguliwe nohlobene ebekwe ngaphambi kokuvinjelwa ivumela iphakethe ukuba lidlule ngaphambi kokuba ukuvinjelwa kuhlolwe nhlobo. Ukususa isimo sombandela kumthertho wakamuva ngeke kushintshe lokho, ngoba ukuhlola akufinyeleli lapho. Ukulandelana kunquma umphumela, futhi ukufana kwesimo kunquma ukuthi yimaphi amaphakethe afinyelela kuleso silandelaniso.

Hlola isethi yemithertho esebenzayo hhayi ifayela olisusile, kufaka phakathi ukugxuma ukuya kwamanye amachungechunge kanye nakho konke okukhiqizwa ipulatifomu. Ku-router elawulwa nge-iptables, ukubala uchungechunge kukhombisa izincazelo zemithertho, futhi amachungechunge ekubhekisela kuwo nawo kumele alandelwe. Uhlelo lwendabuko lwe-nftables ludinga ukuhlolwa kwesethi yalo yemithertho kanye nokubaluleka kwama-hook, ngoba i-firmware ayivamisile ukukhiqiza amachungechunge afanayo.

Izibali zitshela ukuthi yiwuphi umthertho owafana ngempela, futhi ngokuvamile zinokwazisa okungaphezu kokubanjwa kwamaphakethe okwenziwe ngemva kwesinqumo. Umthertho onesibali esinguqanda awukafinyelelwa, noma ngabe isikhundla sawo sikhombisani.

Veza ukwenqatshwa ngaphandle kokuncika esimweni

Uma iqembu lamaklayenti kungafanele lize lifinyelele i-inthanethi ngaphandle komhubhe, shono lokho ngqo esikhundleni sokukulinganisa ngesimo esisodwa. Umthertho kumele ukhethe ngomthombo, indlela yokuphuma kanye nendawo okuyiwa kuyo ngaphandle kokuncika esimweni sokuxhumana, futhi kumele uhlale lapho kungekho mvume yangaphambili engawedlulayo. Khona-ke ukufinyelela kokuphatha kanye nezimo ezingafakwanga zenethiwekhi yasendaweni zithola imithertho yazo ecacile, ngakho inhloso iyabonakala kunqubomgomo.

Ukukhetha i-reject esikhundleni se-drop kushintsha indlela umgudu ofanayo ohluleka ngayo, futhi akukhulisi isethi yamaphakethe akhethwa umthertho. Ukuxhumana okwenqatshwe kanye nokuphela kwesikhathi okuthule kuyizimpawu ezihlukene ezikhomba ekukhetheni okufanayo.

Inqubomgomo evumela ngamabomu izimpendulo ekufinyeleleni okuqalwe kude nge-WAN iyavikeleka. Kumele nje ichazwe kanjalo esikhundleni sokwethulwa njengokwehlukaniswa okuphelele ngomhubhe kuphela.

Hlola ukuthi ngempela ubani oseqembini

Isibonelo sihlanganisa umgudu we-IPv4 odluliswayo usuka kwisandulela esisodwa uphuma ku-interface eyodwa. Asisho lutho nge-IPv6, ngomzila wesibili ophezulu, noma ngomgudu okhiqizwa yi-router uqobo. I-router esebenza njengesixazululi se-DNS ithumela imibuzo yayo ephezulu, futhi leyo ayidluli nhlobo kuchungechunge lwe-forward.

Qinisekisa ukuthi amaklayenti avikelwe asenamakheli ngaphakathi kwesandulela esikhethiwe, ngoba idivayisi ephume ngaphandle kwaso ixhumana ngqo ngengozi hhayi ngenqubomgomo. Ukwandisa ukuvinjelwa kuyo yonke i-LAN ngaphandle kokubuyekeza umklamo wezimo ezingafakwanga nakho kuvame ukususa indlela yakho yokuphatha.

iptables -S FORWARD
iptables -L FORWARD -v -n
cat /proc/net/nf_conntrack | grep -c ESTABLISHED

Bese uzama umfudlana omdala eceleni komutsha. Umzamo wokuxhumana omutsha nokudluliswa kwezinhlangothi ezimbili okusuvele kusebenza kuziphatha ngendlela ehlukile ngaphansi kwalo mthertho, futhi ukuhlola kokubili kuphela okukhombisa ukuthi yikuphi inqubomgomo onayo ngempela.