Isiza se-NGINX se-VPN kuphela: isilaleli, udonga lomlilo kanye nohlu lwemvume ye-HTTP

Izinqumo ezintathu ezizimele zimi phakathi kwesiza esiyimfihlo ne-inthanethi: iyiphi isokhethi eyamukela uxhumano, iyiphi indlela engayiletha, futhi yibaphi amaklayenti e-HTTP isiphakeli esikhethiwe esibaphendulayo. Ibhlokhi yesiphakeli ithatha isinqumo sokuqala kuphela. Phatha ezinye ezimbili njengezilawuli ezihlukene, kungenjalo isiza sizobonakala siyimfihlo ngenkathi umnyango wakudala uvulekile. Iningi lokwehluleka kwe-NGINX ye-VPN kuphela livela ekuhloleni ingqimba yokuqala kuphela.

Isibonelo sisebenzisa isango le-Linux OpenVPN ku-10.90.0.1 ku-tun0, amaklayenti ku-10.90.0.0/24, imithombo egciniwe kanye ne-TCP 8443 ebekelwe le ndawo yokungena. Lungisa amanani, gcina izingqimba.

Qala ngesokhethi, hhayi igama lomgcini womkhathi

Bopha isilaleli se-HTTPS ekhelini lethunge lomhubhe kanye nechweba elikhethiwe. Ikheli elithile kulula ukucabanga ngalo kune-sokhethi yewildikhadi kanye nokuhlolwa kwegama, ngoba i-kernel ngeke inikeze ichweba kulelinye ikheli lendawo.

server {
    listen 10.90.0.1:8443 ssl;
    server_name admin.corp.example;

    ssl_certificate     /etc/nginx/tls/admin-fullchain.pem;
    ssl_certificate_key /etc/nginx/tls/admin-key.pem;

    root /srv/private-site;

    allow 10.90.0.0/24;
    deny all;

    location / {
        try_files $uri $uri/ =404;
    }
}

Isitifiketi kufanele sisho igama lomgcini womkhathi wesevisi elibhalwa amaklayenti, futhi umbono we-DNS oyimfihlo kufanele uxazulule lowo mgcini womkhathi ebhekiswe ekhelini eliboshiwe. I-server_name ikhetha kuphela umgcini womkhathi ongokoqobo; ayiqinisekisi muntu. Ukuntuleka komugqa we-DNS kukhiqiza iphutha lesitifiketi elibonakala njengokuhluleka kwe-TLS. Hlola igama ngaphambi kokushintsha isitifiketi.

Funda ukucushwa okusebenzayo ngaphambi kokwengeza ifayela. Okufakiwe kanye nezilaleli zewildikhadi kungasebenza ingcambu efanayo kwenye indawo, futhi isiphakeli esizenzakalelayo singaphendula izicelo ibhlokhi elisha elingakaze libone.

Vala sonke esinye isilaleli salokho okuqukethwe

Bhala imiyalelo ye-listen futhi uqhathanise izimpande ezizisebenzayo. Ibhlokhi elengezwe kwenye uhlelo lokusebenza lingadlulisa ku-upstream efanayo, futhi isiphakeli esidala esizenzakalelayo singaqhubeka siphendula ngemva kokufakwa kwesisha. Lokho okukhiphayo wuhlu lwangempela, hhayi ifayela osanda kulihlela. Qhathanisa yonke impande esebenza okuqukethwe okufanayo.

sudo nginx -T | grep -n "listen\|server_name\|root\|proxy_pass"

Hlola zombili izinhlobo zamakheli. Ukubopha kwe-IPv4 kushiya isokhethi ye-IPv6 ingathintwanga, futhi irekhodi elisha le-A alihoxisi impendulo endala ye-AAAA esabonisa indlela yomphakathi.

Susa umgcini womkhathi ongokoqobo wakudala njengoshintsho oluhlukile. Ukususa iwele lomphakathi lebhlokhi elisha ngokuvamile yisinyathelo esivala ngempela umnyango; isilaleli esiyimfihlo sengeza kuphela lokho okuhlosiwe.

Linganisa ububanzi bendlela engenayo kumgcini womkhathi

Ikheli lokulalela likhawulela isokhethi, hhayi isixhumi esibonakalayo sokungena. Iphakethe eliqondiswe kulelo kheli lisuka kwenye indawo lisafika njengokufakwa kwendawo, ngakho udonga lomlilo lomgcini womkhathi ludinga isitatimende salo mayelana nokuthi uxhumano lungaqhamuka kuphi. Yingakho ukubopha kukodwa akuvamisile ukwanelisa ucwaningo.

Ngenqubomgomo yokungena yokwenqaba ngokuzenzakalelayo futhi ngaphandle kwemvume ebanzi yale sevisi, umthetho olinganiselwe usho ngokuhlanganyela umhubhe, ububanzi bomthombo, indawo ekuyiwa kuyo kanye nechweba:

sudo ufw allow in on tun0 proto tcp from 10.90.0.0/24 to 10.90.0.1 port 8443

Funda ukulandelana okusebenzayo kodonga lomlilo ngaphambi kokulusebenzisa. Ukwamukela okubanzi kwangaphambili kungase kunqobe umkhawulo, futhi ukulahlwa kokugcina kwangaphambili kungase kuvimbele ukufinyelela kule mvume. Ungasuli imithetho engahlobene futhi ungacishi udonga lomlilo ukuze isibonelo silingane.

Lowo mthetho uwukufakwa komgcini womkhathi, hhayi indlela eya komunye umshini we-LAN, futhi isilaleli sangaphandle se-OpenVPN sesango sihlala siyisevisi ehlukile. Uma isiza lalivulekile ngaphambili, hlela ukuthi umnyango wakudala ususwa kanjani nokuthi izikhathi ezikhona zisingathwa kanjani.

Gcina uhlu lwe-HTTP luphelele ngenkathi izindawo zishintsha

I-NGINX ihlola amagama e-allow ne-deny ngokulandelana, futhi uhlu lwezinga lesiphakeli ngenhla luvumela iqembu elimisiwe ngaphambi kwe-deny yokugcina. Imojuli yokufinyelela futhi iqopha ukuthi indawo echaza noma yikuphi ukufakwa kokufinyelela isebenzisa uhlu lwayo esikhundleni sohlu lomzali. Ukulandelana kubalulekile njengokufakwa uqobo.

Lokho kusetha kabusha ukuhlehla okuvamile. Indawo entsha yokulayisha, i-API noma impilo eyengeza ukufakwa okukodwa ishintsha ngokuthule umkhawulo wezinga lesiphakeli, futhi isiza siba sibanzi endleleni esanda kwengezwa.

Buyekeza yonke indawo, igama elihlukile kanye nebhlokhi ehlukile njengengxenye yenqubomgomo efanayo. Uma ukuhlolwa kwe-IP kuhlanganiswa nokuqinisekiswa kwe-NGINX, qonda satisfy: isilungiselelo se-any singavumela iklayenti ngesinye isixhumi kuyilapho esinye singakadluli. Faka uhlu lokufinyelela kuhlu lokuhlola lwezindawo.

Ukwenqatshwa kwe-HTTP kwenzeka ngemva kokuba uxhumano lwe-TCP lufinyelele ku-NGINX. Kunezela umkhawulo wenethiwekhi, futhi ukugunyazwa kohlelo lokusebenza uqobo kusasebenza kumsebenzisi ngamunye.

Qinisekisa indlela ekhona kanye nesimo sokwehluleka

Gijima umhlaziyi wokucushwa, hlola amasokhethi alalelayo, bese wenza isicelo esisha esiqanjwe kusuka kuklayenti elihlosiwe. Qinisekisa ukuthi isitifiketi siqinisekisa, igama le-DNS lixazululeka ekhelini eliboshiwe futhi impendulo ivela empandeni elindelekile.

Bese uhlola umthombo okhishiwe kanye nomnyango ohlukile. Isicelo esivunyelwe esisebenzayo asisho lutho ngezindlela obufuna ukuzivala, futhi kucwaningo olukhishiwe lapho isilaleli esisele noma ukwamukelwa okubanzi kodonga lomlilo kuvela khona.

Phinda isimo sokuqalisa noma sokubuyisela i-VPN. Uma i-NGINX iqala ngaphambi kokuba ikheli lomhubhe libe khona, ukubopha kungase kwehluleke ngisho nangefayela eliphelele. Xhumanisa ukulungela kwekheli futhi ugcine indlela yokubuyisela yendawo ngaphambi kokushintsha isiphakeli sewebhu esabiwe.

Rekhoda isokhethi, ichweba, ububanzi bomthombo kanye nohlu lwe-HTTP oludlulile. Ushintsho olulandelayo lwe-VPN noma lwe-DNS lungasusa noma yikuphi kulokho, futhi amanani amane aqanjiwe kulula ukuwaqhathanisa kunethebhu yesiphequluli esisebenzayo.