Awekho tun0? Qondanisa i-IPsec ekhululiwe ku-nftables nge-meta ipsec

Ulindele isixhumi somhubhe, uyasifuna, futhi akukho okungaqondaniswa kuso ku-firewall. Lokhu kujwayelekile kugesi elisekelwe kumgomo: ukushintshana okubethelwe kufika kusixhumi esibonakalayo, futhi iphakethe langaphakathi elikhululiwe elidluliswa kamuva libonakala lifika kuleso sixhumi esifanayo. Awekho tun0 ngoba akukho okwakha elilodwa.

Isicelo sangaphakathi siseyiphakethe elihlukile elinomthombo walo, indawo ekuyiwa kuyo kanye nensiza yalo, futhi i-kernel iyazi ukuthi liphume kuyiphi inhlangano yokuphepha. Lolo lwazi yilona umthetho we-firewall ongaluqondanisa.

Amaphakethe amabili, isixhumi esisodwa

Cabanga ngendlela engenayo. Iphakethe eligoqiwe nge-ESP noma i-UDP liyafika, i-kernel ithola umgomo ohambisanayo, iyalikhulula futhi inikeza iphakethe elicacile endleleni yokudlulisa. Umthetho obheka kuphela igama lesixhumi awukwazi ukuhlukanisa lelo phakethe kunanoma yikuphi okunye ukuhamba okufika kulolu cingo olufanayo.

Okulihlukanisayo ingqikithi yendlela yokuphepha engenayo enanyathiselwe ephepheni. I-nftables iveza lokho njenge-meta ipsec exists, okuyiqiniso lapho iphakhathi lifike ngendlela yokuphepha ye-IPsec. Hlanganisa lokho neqembu lamakhasimende, indawo ekuyiwa kuyo kanye nensiza, umthetho uba okhethekile ngokwanele ukuthi uphephe.

Ukushiya ingqikithi iyiphutha elijwayelekile, futhi iyiphutha lokuphepha hhayi lobuhle. Umthetho owamukela noma yini evela eqenjini lamakhasimende nawo wamukela iphakethe lokukhohlisa elivela kunethiwekhi yasendaweni ngentshiseko efanayo, ngoba ikheli lomthombo ngokwalo aliyona ubufakazi bakho konke. Ingqikithi yendlela yokuphepha iyindlela eshibhile yokwenza umthombo ube nencazelo. Bhala umthetho nayo kusukela ekuqaleni esikhundleni sokuyengeza ngemuva kokuhlolwa.

Bhala umthetho wokudlulisa

Ake sithi kunensiza yokufinyelela ekude ye-IPv4 eqinisekisiwe enamakhasimende ku-10.90.0.0/24 kanye nendawo eyodwa ekuyiwa kuyo egunyaziwe ku-203.0.113.40. Ucezu lomthetho lalokho kugeleza lubukeka kanje.

meta ipsec exists ip saddr 10.90.0.0/24 \
  ip daddr 203.0.113.40 tcp dport 443 \
  oifname "eth0" counter accept

Amakheli kanye nesixhumi kuyizibonelo okufanele zishintshwe. Beka okulingana okubuyekeziwe kumgomo wokudlulisa ngaphambi komthetho obekuzokwenqaba ukugeleza, futhi ungakhulisi isethi yemithetho ekhona ukuze uyifake; igesi akuwona umcwaningi wendlu ehlanzekile.

Igama elithi oifname kufanele ligcinwe. Libhala isinqumo sokuphuma futhi livimbela umthetho ukuthi ungahambisani endleleni obungayihlosile, futhi lokho kubalulekile egesini elinemizila eminingi eya ku-inthanethi. Ebhokisini lokuhlola elinokuxhumana okukodwa okuphezulu igama libonakala lingadingeki, futhi yikho kanye okwenza lisuswe ngaphambi kokuba ibhokisi lithole ukuxhumana kwesibili.

Izimvume zokushintshana kwangaphandle zihlukile. Indlela yokungena yegesi idinga izimbobo ze-IKE ne-ESP noma zokugoqa ze-UDP ezizisebenzisayo ngempela, futhi lezo zimvume azivumeli lutho mayelana nephakethe elikhululiwe elingaphakathi. Ukuhlanganisa kokubili kuyindlela igesi elisebenzayo eligcina ngokuba ne-firewall edlulisa konke.

Ingqikithi engenayo akuyona ingqikithi ephumayo

Umkhakha ofanayo wemisho uhlanganisa enye indlela nge-rt ipsec, echaza inhlangano yokuphepha ephumayo iphakethe elizoyisebenzisa. Iphendula umbuzo ohlukile: hhayi ukuthi leli phakethe livela kuphi, kodwa ukuthi lizovikelwa yini esigabeni salo esilandelayo.

Umehluko lowo ubalulekile egesini eliqeda umhubhe owodwa futhi lidlulise kwelinye ngasikhathi sinye. Iphakethe lingafika likhululiwe futhi kusamele liphume libethelwe, futhi ukwamukela okubhalelwe ingqikithi engenayo kuphela akusho lutho mayelana nesidingo sokuphuma. Uma umgomo udinga lokho kuvikelwa, isethi yemithetho kufanele ikuveze esikhundleni sokucabanga ukuthi umzila uzokubhekana nakho.

Gcina imibuzo emibili emthethweni ehlukile ukuze umfundi abone ukuthi yimuphi ogciniwe. Umthetho oyedwa ohlakaniphile ohlola kokubili kunzima ukuwubuyekeza futhi kunzima kakhulu ukuwulungisa lapho uhhafu wawo uyeka ukuhambisana. Imithetho emibili enezibali futhi ikutshela ukuthi yisiphi isidingo esihlulekayo, into umthetho owodwa ohlanganisiwe ongeke wakwenza.

I-NAT ayisona isinqumo se-firewall

Ukuhamba okuya ku-inthanethi okuvela eqenjini lamakhasimende angasese ngokuvamile kudinga ukuhunyushwa komthombo ukuze impendulo ithole indlela yokubuya. Kodwa ukuhamba okukhethelwe omunye umgomo we-IPsec ophumayo kufanele kugcine ukukhululwa okudingekayo, futhi ukufihla wonke umthombo wangasese ngaphandle kokucabanga ngesinqumo esilandelayo sokuvikela kuyaphula lokho.

Ukwamukela ngaphakathi kuketanga lwe-NAT nakho akuyona imvume evamile. I-NAT nokuhlunga kunemisebenzi ehlukile, futhi iketanga le-NAT alihloli wonke amaphakethe alandelayo okugeleza okusunguliwe, futhi yikho kanye okwenza ukuthembela kulo kwezokuphepha kuveze imithetho ebonakala isebenza ekuhloleni futhi yehluleka ngaphansi komthwalo.

Okuphambene nakho kuyiqiniso futhi kuyamangaza abantu: ukwamukela endaweni ethile kuketanga elilodwa eliyisisekelo lokuhlunga akunasisindo ngokumelene nokwenqatshwa kamuva kwelinye iketanga elisebenzayo. Umphumela unqunywa ukulandelana kanye nobubanzi beketanga, hhayi ukuba khona kokwamukela efayeleni.

Qinisekisa insiza yangaphakathi eqondile

Hlola indawo ekuyiwa kuyo kanye nembobo ethile oyigunyazile, kusuka kukhasimende langempela, futhi uqinisekise ukuthi impendulo iyabuya. Bese uhlola into ongayigunyazanga futhi uqinisekise ukuthi ayidluli, ngoba umthetho obanzi kakhulu udlula ukuhlolwa kokuqala ngendlela efanayo nomthetho olungile. Isicelo esingalokothi sishiye ikhasimende futhi asiwona umphumela we-firewall, ngakho funda izibali ukuze ubone ukuthi iphakethe lahlolwa nhlobo yini. Ukuhlolwa okubili nokufundwa kwezigaba okukodwa kuzokutshela okuningi kunentambama yonke yokufunda isethi yemithetho.

Incwadi yereferensi ye-nftables ibhala meta ipsec, rt ipsec kanye nemisho eqondene nendlela, futhi yilapho indawo yokuhlola i-syntax ngokumelene nenguqulo yakho efakiwe. Futhi gcina ububanzi bucacile: lesi isibonelo se-IPv4, asisho lutho nge-IPv6, futhi asenzi ukudluliswa kwembobo zomphakathi okungahleliwe kube yingxenye yensiza ye-VPN.