Gcina inqubomgomo ye-nftables izinzile ngenkathi kuvela isixhumi se-VPN

Imithetho ye-nftables esekelwe egameni iyasinda emhubheni ovelayo onyamalale, kodwa imizila nemifudlana ekhona ayilandeli ngokuzenzakalela. Hlukanisa abanikazi.

Imihubhe yeyokusetshenziswa kanye; inqubomgomo akumele ibe njalo. Esangweni le-Linux, umthetho we-nftables ohlangana nesixhumi somhubhe ngokwegama ungasetshwa kanye futhi uqhubeka usebenza njalo lapho leso sixhumi sivela. Isixhumi sisanawo umjikelezo wokuphila: siyadalwa, siyanyamalala, futhi imizila nezinguquko ezizungezile zilandela uhlelo lwazo. Ukuhlukanisa labo banikazi yikho okugcina ukufinyelela kuzinzile ngesikhathi sokuxhuma kabusha.

Ukuhlangana kwegama kuphila isikhathi eside kunesixhumi

nftables inikeza ukuhlangana kwenkomba yesixhumi ngezinombolo kanye nokuhlangana kwegama okuguquguqukayo iifname kanye ne-oifname. Imithetho esebenzisa la magama isetshwa ngokuhlanzekile ngisho nalapho idivayisi yomhubhe ingakadalwa, okuyikho kanye okudingwa yiqoqo lemithetho ngesikhathi sokuqala. Ukuhlangana kuyama uma isixhumi siqanjwa kabusha futhi kuqhubeka lapho isixhumi esisha sithatha lelo gama. Inkomba yezinombolo ayinayo ley mpawu, yingakho uhlobo lwegama luwukuzikhethela okuvamile emhubheni.

Igama liwukhiye wokuhlangana, akubona ubufakazi bokuthi ngubani ngaphesheya. Ukuqinisekiswa koqabanye kuhlala kuwumsebenzi we-VPN.

Funda uchungechunge ngaphambi kokwengeza imithetho

Bheka ukuthi iqoqo lemithetho linakho manje futhi umthetho omusha uzohlala kuphi, ngoba ukulandelana kunquma umphumela.

nft list ruleset
nft -c -f /etc/nftables.conf

Uhlu lubonisa uchungechunge, imithetho kanye nezibambo, futhi imodi yokuhlola iqinisekisa ifayela eliyisicelo ngaphandle kokulilayisha. Imvume yomhubhe kuphela ebekwe ngemuva kokwamukelwa kwangaphambili kombudlalo ofanayo ayishintshi lutho, ngoba umthetho wokuqala ohlanganayo uyawina. Yingakho umthetho ofike sekwephuzile ungabonakala ulungile kodwa ungenamphumela. Funda uchungechunge ngokulandelana futhi uqinisekise ukuthi ukuvinjelwa kokuhanjiswa kusuka kuklayenti kuye kuxhumo lwaphezulu kusandulela noma yini ebanzi.

Imizila, ukuhumusha nemifudlana kunabanye abanikazi

Ukuba khona kwesixhumi akudali mizila futhi akuqinisekisi oqabanye. Lokho kungokomphathi we-VPN, kanti ukuhumusha kunomjikelezo wokuphila wesithathu.

conntrack -L -s 10.20.0.0/24 | head
ip route show dev vpn0

Uhlu lwe-conntrack lubonisa imifudlana ekhona namabanga ayo okuqala nahunyushiwe, futhi uhlu lwemizila lubonisa lokho umphathi akufake esixhumi. Imithetho ye-NAT isungula isimo sokulandelela uxhumo kupakethe lokuqala, ngakho umfudlana osunguliwe ugcina ukuhumusha kwawo ngisho ngemuva kokushintsha komthetho. Yingakho umthetho oqhubeka ubuyekezwa kanye nomfudlana osebenzisa indlela entsha kuyizitatimende ezimbili ezihlukene. Nquma ukuthi yiziphi izikhathi zokuxhumana okufanele zixhume kabusha futhi ushiye imifudlana engahlobene.

Amukele ukuqala okubandayo, ukulahlekelwa kanye nokululama

Hlola isango ngomhubhe ongekho ngesikhathi sokuqala, bese ukhona, bese kuba ngemuva kokunqamuka nokubuya. Qinisekisa ukuthi ukwedlulisela okunqatshelwe kuyaqhubeka kunqatshelwe ngenkathi umhubhe ungekho, ukuthi umfudlana omusha ovunyelwe uyasebenza ngemuva kokuqinisekiswa koqabanye, nokuthi ukululama akudingi ukusula isimo esingahlobene. Ungasuli lonke uchungechunge lwe-POSTROUTING noma yonke ingeno ye-conntrack njengesenzo sokumisa iphrofayili eyodwa, ngoba ezinye izinsizakalo zabelana ngazo. Bhala ukuthi yisiphi isigaba esishintshe isixhumi, umzila kanye nenqubomgomo, hhayi kuphela ukuthi ihokhi yokuqala iphume ngoziro.

Inqubomgomo esinda ekuxhumweni kabusha yileyo enabanikazi abashiwo futhi imithetho yayo ihlolwe nomhubhe uphansi naphezulu. Ihokhi ebika impumelelo ifakazela kuphela ukuthi ihokhi isebenzile.

Izihloko ezihlobene