Izimpawu ze-nftables nokuhlelwa kwemizila ye-VPN: umthetho wamuphi onqobayo ngempela

Uphawu olubekwe ku-nftables kufanele ludlulise isigaba esisodwa se-traffic ngomhubhe, kodwa i-traffic iqhubeka iphuma nge-interface yangempela. Iqoqo lemithertho libonakala lilungile uma lizodwa. Okuvame ukwenzeka ukuthi okunye okuthile kwabhala uphawu olufanayo, noma umthetho wokuhlela imizila uhambisana ne-mask i-value entsha engasayigcwalisi.

Ukuhlola 1: funda umthetho i-kernel ehambisana nawo

Qala ngomthetho we-policy hhayi nge-firewall. I-kernel ibheka imithertho ngokulandelana kwe-priority futhi ukuhambisana kokuqala kuqoka i-table. Funda i-value ye-fwmark ne-mask kuwo umthetho uqobo, bese uqinisekisa ukuthi i-packet enophawu olubekile lihambisana nawo ngempela. Umthetho olindele i-value ephelele yama-32-bit ngeke uhambisane ne-packet ethwele ibhithi elilodwa kuphela.

Bese uqinisekisa ukuthi lowo mthetho ukhetha iyiphi i-table nokuthi i-table iqukethe ini. Umthetho okhomba ku-table engenalutho udala ukwehluleka kokusesha, okusho ezinhlelweni eziningi ukuthi i-packet iwela kumthetho olandelayo futhi iphume nge-interface yangempela.

Imiyalo emibili iqeda lokhu: uhlu lwemithertho, nokusesha komzila wendawo okuyiwa kuyo kuleyo table.

Ukuhlola 2: uphawu lwe-packet noma uphawu lokuxhumana

I-nftables ingabeka uphawu ku-packet nophawu ku-entry yokulandelela ukuxhumana, futhi lezi zinto ezihlukene. Uphawu lwe-packet luphila ngesikhathi sokuqhubeka kokucutshungulwa kwe-packet, kuyilapho uphawu lokuxhumana luhlala kukho konke ukugeleza futhi kufanele lukopishwe ngamabomu. Ukubeka okunye bese ulindela okunye iyisisombululo esingaphelele esivamile.

Uma umthetho wokuhlela imizila uncike ophawini lwe-packet, ukubuyisela uphawu lokuxhumana kamuva endleleni akwenzi lutho kuleso sinqumo, ngoba isinqumo sesivele sithathiwe.

Nquma ukuthi iyiphi into ephethe isignali yokuhlela imizila, bese uyibeka endaweni lapho kuthathwa khona isinqumo sokuhlela imizila.

Ukuhlola 3: ngubani omunye obhala lolo phawu

Amathuluzi e-WireGuard uqobo abeka uphawu kuma-packet awo e-UDP ukuze ukuthutha okubethelwe kungaphinde kuqhutshwe emuva kumhubhe elikuyo. Uma iqoqo lakho lemithertho linikeza i-value engahlobene kuyo leyo field, lokho kukhipha kuyanyamalala futhi i-traffic yangaphandle yomhubhe izama ukungena kuwona uqobo. Uphawu ukuthi umhubhe uyasungulwa bese uyeka ukudlulisa i-traffic.

Izimpawu zisetshenziswa futhi namanye amathuluzi e-firewall, inethiwekhi yama-container kanye nokuhlela imizila nge-policy ngezinye izinhloso, ngakho ukuthi amasistimu amabili abhale yonke i-field kungukungqubuzana ngisho noma ngayinye ilungile ngokwayo.

Bhala uhlu lwababhali ngaphambi kokwengeza omunye.

Ukuhlola 4: i-mask inquma lokho okugcinayo

Uphawu i-field yama-32-bit, futhi ama-mask ayindlela abanikazi abaningi abayihlukanisayo. Ukubeka i-value nge-mask kugcina amabhithi akuwona awakho; ukubeka yonke i-field kubhubhisa awabanye bonke. Funda i-mask kuwo wonke umthetho othinta i-field, kuhlanganise nalawo ongawabhali.

Bhala phansi ukwabiwa kwamabhithi eceleni kweqoqo lemithertho.

Uma kungenjalo umuntu olandelayo uzophinda asebenzise i-value esinomnikazi, futhi ukungqubuzana lapha kubonakala njengephutha lokuhlela imizila kuyilapho kuyiphutha lekheli. Idokhumenti ye-nftables mayelana ne-metadata ye-packet ichaza imisebenzi yophawu uqobo.

Ukuhlola 5: qinisekisa ngokugeleza kwangempela, hhayi ngokusesha

Ukusesha komzila okuvamile akuthwali uphawu, ngakho kungabonisa indlela ehlukile kune-packet yangempela. Khiqiza i-traffic okhathalele yona bese ubheka izibali, i-entry yokulandelela ukuxhumana kanye ne-interface ephuma ngayo ngempela. Hlola kokubili isigaba esifakiwe nesigaba esikhishiwe, ngoba uphawu olubanzi kakhulu lwephula ukukhishwa kuyilapho lubonakala luphumelele. Uma isigaba esifakiwe sisebenza nesigaba esikhishiwe naso singena emhubheni, uphawu lubanzi kakhulu hhayi lincane kakhulu.

Gwema ukusula isimo sokuxhumana ukuze uphoqele ukusha kabusha phakathi neseshini ephilayo, ngoba ukugeleza okusha nokukhona kungathatha izindlela ezihlukene ngokusemthethweni.

Bhala uphawu, i-mask ne-table endaweni eyodwa, khona-ke ukuhlela okulandelayo kuzobuyekezeka.