Umthetho omusha we-UFW, uxhumano oludala: isimo esimisiwe siyanqoba

Ukufaka umthetho wokwenqatsha bese ubona ukulanda okuvuliwe kuqhubeka akulona iphutha le-UFW. Umthetho owufakile utholakala ngemva kwemithetho eseyamukele lowo mfudlana, futhi uxhumano olwasungulwa ngaphambilini luyaqhubeka nokuhambisana nayo. Ukulungisa lokho kusho ukufaka endaweni efanele nokuqonda lokho okuthenjiswa imithetho yangaphambilini. Ingxenye encane yalolo shintsho ilandelayo.

Ukulandelana kuyanquma, hhayi ukuba khona komthetho

I-UFW iyingxenye engaphambili ebhala imithetho ye-netfilter ngezigaba: ingxenye yohlaka ehamba ngaphambi kwemithetho yomsebenzisi, bese kuba yimithetho yomsebenzisi uqobo, bese kuba yingxenya ehamba ngemva kwayo. Imithetho yangaphambili ejwayelekile yamukela ithrafikhi yoxhumano olusimisiwe noluhlobene, futhi leyo mithetho ihlolwa ngaphambi kwanoma yini oyifaka nge-allow noma i-deny ejwayelekile. Incwadi yemiyalo ye-UFW ibhala indlela yokufaka kanye nombono wesimo onezinombolo okuncike kuwona lolu shintsho.

Lokho kulandelana kuchaza isimanga. Umthetho wakho omusha ungokoqobo futhi usetafuleni elifanele, kodwa awusona isinqumo sokuqala i-pakethe elihlangana naso. Uxhumano oselulandelelwa njengolusimisiwe awufinyeleli kuwona nhlobo.

Sebenzisa imithetho ye-route kulo msebenzi, ngoba i-pakethe lidluliselwa ngesango hhayi ukuthi libhekiswe ezinsizeni zesango uqobo. Umthetho wokungenayo ubuzohlunga ithrafikhi engalungile futhi ubonakale sengathi awenzi lutho.

Faka ngaphezu kwemvume ebanzi

Buka ukufaka ngaphambi kokukusebenzisa, futhi uqinisekise ukuthi umthetho awukho kwenye indawo ohlwini. Ukuphindaphinda inqubomgomo efanayo kwenza ukususwa kamuva kungaqondakali, futhi lowo osusa ikhophi engalungile ngeke akubone lokho amasonto.

sudo ufw --dry-run route insert 1 deny in on tun0 proto tcp from 10.88.0.55/32 to 192.0.2.88/32

Uma umbono wangaphambili ubonisa umthetho owodwa ngqo endaweni oyilindele, sebenzisa umyalo ofanayo ngaphandle kwefulegi le-dry-run. Indawo 1 iwubeka ngaphezu kwezimvume zomsebenzisi ezibanzi, hhayi ngaphezu kwemithetho yohlaka okukhulunywe ngayo ngaphambilini. Qinisekisa ukuthi igama le-interface lihambisana nedivayisi yomhubhe kulesi sango, ngoba umthetho oboshelwe ku-interface engasekho uzohlala ohlwini ubonakale ulungile kuyilapho ungahambisani nalutho. Shintsha igama lesethenjwa sedivayisi ngaphambi kokusebenzisa, hhayi ngemva kokuba ukuhlolwa kwehlulekile.

Awukho umgudu wendawo ekuyiwa kuyo kulo mthetho, ngakho wenqaba yonke imigudu ye-TCP kulelo kheli hhayi i-HTTPS kuphela. Uma inhloso iwukusiza okukodwa, shono umgudu; umthetho obanzi kunqubomgomo uyisigameko esizayo esilindele umfundi waso wokuqala.

Nciphisa umthombo ekhelini elilodwa kuphela uma lelo kheli liboshelwe ubunikazi obuhlosiwe. Ichibi le-VPN elabela ngokushintshayo linganikeza ikheli elifanayo kwelinye iklayenti kusasa, futhi ukwenqaba kuzolandela ikheli hhayi umuntu.

Imifudlana esimisiwe iyasinda kulo mthetho omusha

Ukulandelela ukuxhumana yikho okwenza iseshini ekhona iqhubeke. Uma umfudlana usubhalwe njengosimisiwe, imithetho yangaphambili yamukela amaphakethe awo ngaphambi kokuba ukwenqaba kwakho kubhekwe, futhi ukudluliswa kuphela sengathi akukho okushintshile. Ngakho ukuhlola ngesiphequluli esisebenzisa kabusha uxhumano oluvuliwe akukutsheli lutho ngenqubomgomo entsha. Ukwenqaba kungabonakala kungenamsebenzi ngemva kwemizuzu embalwa yokusetshenziswa futhi kube nempumelelo ephelele kumsebenzisi olandelayo oxhumayo.

Uma imfuneko ihlanganisa ukunqamula ithrafikhi ebukhoma, lolu shintsho lomthetho womsebenzisi alunakukunikeza lokho. Ukuhoxisa isimo esilandelelwe kuyisenzo esihlukile esinomkhawulo waso womthelela, futhi kungokomnikazi we-firewall hhayi lowo owengeza umthetho. Ukukhipha konke ukuxhumana esangweni ukuze iseshini eyodwa inyameke kuwuhlobo lokulungisa oludala isigameko sesibili.

Khumbula nemikhawulo. Lo mthetho awusho lutho nge-ICMP, i-UDP noma i-IPv6, ngakho i-ping ephumelelayo ayibona ubufakazi bokuthi ukwenqaba kwehlulekile. Ikheli elilodwa le-IPv4 nalo akulona iwebhusayithi: igama lingaxazululeka emakhelini amaningi, futhi kumbozwa kuphela lelo okushilo.

Hlola ngomfudlana omusha

Funda imithetho yomsebenzisi enezinombolo kanye nombono oluhlaza osebenzayo, bese uvula uxhumano olusha kusuka kuklayenti ekhethiwe:

sudo ufw status numbered
sudo ufw show raw
# from 10.88.0.55, a new TCP connection to 192.0.2.88 should fail

Umbono oluhlaza ubalulekile ngoba i-status ishiya imithetho yohlaka ebhalwe ngesandla, ngakho ukulandelana kungabonakala kwehlukile kwalokho okuphoqelelwa i-kernel. Qhathanisa kokubili ngaphambi kokuphetha ngokuthi umthetho usendaweni engalungile.

Bese uhlola izilawuli ezimbili ezibonisa ukuthi umthetho mncane hhayi ubanzi: indawo ekuyiwa kuyo evunyelwe kusuka kuklayenti elifanayo isasebenza, futhi iklayenti lesibili lisafinyelela endaweni ekuyiwa kuyo enqatshiwe uma inqubomgomo yalo ivuma. Ukwenqaba okwephula zombili izivivinyo ukushintsha kwenqubomgomo, hhayi isinyathelo esiqondisiwe.

Uma ukuhlolwa sekuphelile, susa kuphela umthetho owengezile, ngokuwuphinda ngqo. Uma inqubomgomo injalo unomphela, yethula kumnikazi we-firewall kanye nobunikazi beklayenti, umnikazi wendawo ekuyiwa kuyo kanye nosuku lokubuyekezwa, ukuze ikheli lomhubhe elabelwe kabusha lingashiyi ukwenqaba okuphelelwe yisikhathi.