nftables: faka umthetho wemvume ye-VPN ngaphambi kwesibambi sokulahla

Beka umthetho wemvume endaweni engalungile futhi uzoziphatha njengokungathi awukho umthetho. Ku-nftables ukukhetha phakathi kwe-insert ne-add kunquma ukuthi isitatimende esisha sizohlala ohlangothini luni lomthetho okubhekiselwa kuwo, futhi isibambi sibiza umthetho kusethi yemithetho ephilayo hhayi inombolo yomugqa wawo. Uma indawo ingalungile, iphakethe lizofika ku-drop kuqala.

Ukuqhathanisa okungezansi kusebenzisa i-peer eyodwa engaguquki kanye nokushintshana kwezilaleli zangaphandle okukodwa. Kuncane ngamabomu; ukushintsha iketanga lonke kungenye inguquko enephrofayela ehlukile yengozi.

Izindawo ezimbili, imiphumela emibili ehlukene

insert ibeka umthetho ngaphambi komthetho okubhekiselwa kuwo. add iwubeka ngemva kwawo. Uma umthetho okubhekiselwa kuwo kuwukulahla kokugcina kokugeleza, le mikhakha emibili inikeza imiphumela ephikisanayo ngisho noma umbhalo womthetho ufana.

Ukushiya indawo kunokuziphatha kwayo okuzenzakalelayo, okungesinye isizathu sokungakopishi umyalo kusizindalwazi ngaphandle kokufunda ukuthi ubambelele kuphi. Isibophezelo yisona sinqumo sonke. Bhala uhlangothi oluhlosiwe ngaphambi kokuthayipha umyalo. Efayeleni, i-insert ne-add zihluke ngegama elilodwa.

Indawo ihlobene nomthetho okuketangeni ethile. Ukuhambisa isitatimende esifanayo kwelinye iketanga noma komunye umkhakha wokubaluleka we-hook kushintsha ukuthi yimaphi amaphakethe ewabonayo, ngisho noma uhlelo lolimi lomthetho lubonakala lulungile.

Isibambi sikhomba umthetho, hhayi inombolo yomugqa

Isibambi esinjengo-42 yisihlonzi esimweni samanje sesethi yemithetho. Akuwona umthetho wamashumi amane nambili, futhi asizinzile phakathi kwabasingathi, ukwakhiwa kabusha noma umphathi olayisha kabusha ukucushwa kwakhe.

Thola iketanga nokulahla kokugcina kwangempela ngaphambi kokukhetha isibophezelo. Bese uqinisekisa isibambi kulo mthetho ohlwini olufanayo olubonisa ukulahla, ukuze inombolo nomthetho kufundwe ndawonye. Isibambi esifundwe ohlwini oludala kungenzeka sesivele singesomunye umthetho. Sifunde futhi kuseshini ezosebenzisa ushintsho.

iptables --version
nft -a list ruleset

Inguqulo ye-iptables ibika ukuthi iyiphi i-backend esetshenziswayo. Isethi yemithetho ye-iptables-nft netafula lomdabu elilawulwa ngokuzimela kungaba khona ndawonye, ngakho uhlu olusuka ku-frontend eyodwa alusona ngokuzenzakalela isithombe esiphelele sokuhlunga. Hlola zombili izimo ngaphambi kokukhetha iketanga.

Thola iketanga nomthetho okwenza ngempela i-drop

Funda i-input hook, ukubaluleka kweketanga nomthetho onqabayo lokhu kugeleza kwezilaleli. Itafula le-inet lingathwala zombili izinhlobo zamakheli, kodwa umthetho owodwa usengasebenza kuphela ne-IPv4.

Thatha i-peer eyodwa egunyaziwe, usebenzisa u-198.51.100.25 osukwini lwemibhalo njengesibonelo. Ifayela lomdabu elibuyekezwe lingabeka imvume yangaphandle ngaphambi kwesibambi 42:

insert rule inet filter input handle 42 iifname "eth0" ip saddr 198.51.100.25 udp dport { 500, 4500 } counter accept

Ngemva kokuhlola shintsha umndeni, itafula, iketanga, isibambi, i-interface yokungena ne-peer. Isibonelo sisebenzisa uhlobo lwendawo-yesibambi olubhalwe ku-nft 1.0.9, futhi lolu hlobo luwela kufayela lokufaka; ukucaphuna kwabakaki kuyindaba ehlukile lapho umyalo uthayipha ngokuxhumana.

Gcina umnikazi wokucushwa ecacile. Umphathi owakha kabusha imithetho yakhe angabhalela phezulu ukuhlela kwesikhathi sokusebenza, futhi iskripthi sokuqalisa esibhala ngokuqinile isibambi esidala sizohluleka noma sinamathele emthethweni ongafanele.

Imvume inomkhawulo, i-drop yeyokugcina

Isinqumo semvume siqeda ukuhlolwa endleleni yaso yamanje, kodwa iketanga eliyisisekelo elisebenza kamuva lisengalahla iphakethe. Isinqumo se-drop seyokugcina. Yingakho isibali semvume esikhulayo singesona ubufakazi bokuthi ukugeleza kuphumelele.

Hlola zonke izimo zokubaluleka ze-hook ezifanele esikhundleni seketanga elilodwa ngokwehlukana. Iphakethe lingadlula isihlungi sokufaka futhi linqatshwe i-hook yetafula elinye ekubalulekeni okuhlukile. Bhala wonke amaketanga ayisisekelo angabona ukugeleza.

Lowo mthetho uhlanganisa kuphela ukushintshana kwezilaleli zangaphandle. I-ESP ehlanganiswe kwezokuthutha, i-ESP yomdabu, ama-peer e-IPv6 kanye nokugcwala okususiwe ngaphakathi kwethuneli konke kudinga izinqubomgomo zako. Lokhu akusona isivikelo somlilo se-VPN sesiza esiphelele.

Hlola ifayela, bese uqinisekisa umphumela ophilayo

Ngaphambi kokulisebenzisa, qalisa ukuhlola kohlelo lolimi nokwenziwa kwesivumelwano efayeleni elibuyekezwe. Imodi yokuhlola ibika ukuthi i-nft ingahlaziya futhi ilungiselele ushintsho; ayilusebenzisi futhi ayifakazeli ukuthi enye i-hook izovumela iphakethe. Ifayela lihlala liyisiphakamiso kuze kube umnikazi ulisebenzisa:

nft -c -f reviewed-vpn-rule.nft

Lisebenzise ngohlelo olulawulwa umnikazi futhi gcina ukufinyelela kokubuyisela. Uma umthetho ungalungile, i-drop obuzama ukudlula kuyo ingase futhi inqamule indlela oyisebenzisayo ukuyilungisa.

Ngemva koshintsho, qaphela umzamo omusha we-peer evunyelwe futhi uhlole ukuthi imithombo engaphandle kwe-peer egunyaziwe isanqatshwa. Hambisa umthetho ohlala njalo kumphathi ongumnikazi wesethi yemithetho, ngoba izibambi zesikhathi sokusebenza zithola izinto zamanje esikhundleni sokuzikhomba phakathi kokuqalisa.