I-banaction eyodwa, izindlela ezimbili: ukulungisa i-jail ye-fail2ban ye-VPN

Akukho lutho ku-fail2ban olahla iphakethe lodwa: lona lishaya umyalo we-action, futhi yilowo action ocacisa iprotocol kanye neport. Lapho i-jail ibika ukuthi kuvinjelwe kanti i-daemon isaqhubeka nokwamukela ukungena, ukunqatshwa ngokuvamile kuyiqiniso futhi kuncane kunalokho okushiwo yilog. Iklayenti elixhuma kabusha ngolunye uhlobo lokuthutha alisoze lahlangabezana nomthetho owafakiwe. Qhathanisa lokho i-action ekufakile nalokho i-daemon ekulalelayo ngaphambi kokuthi ushintshe noma yini, ngoba ubufakazi bukhona ku-chain ye-firewall eyabhalwa yi-action, hhayi kuluhlu lwe-jail.

Funda i-chain, hhayi isifinyezo se-jail

I-fail2ban ifaka eyayo i-chain ngaphambi kwe-chain yesevisi, ngakho uhlu lwezibaluli lukhombisa ngqo lokho okukhona. I-chain eqanjwe ngegama le-jail, ephethe umthetho owodwa okholamu yawo yeprotocol ethi udp, iyincazelo ephelele yokungena kwe-TCP okuqhubekayo. Yimiphakethe ye-UDP kuphela evela kumthombo ovinjelwe enqatshwayo. Isevisi ino-listener we-TCP, futhi akukho lutho kuleyo chain oluthinta wona.

Bheka nomphumela we-jail engumakhelwane. Ihhosti eyodwa ingabonakala ihlelwe kahle ngokuphelele nje ngoba enye i-jail ihlinzeka ngengxenye engekho, futhi ukwakhiwa okufanayo akwenzi lutho lapho leyo jail ingafakiwe.

I-action icacisa iprotocol eyodwa, futhi yilapho iphuka khona

I-banaction ngayinye iyisifanekiso somyalo we-firewall, futhi iprotocol isendaweni eyodwa yezikhala zayo. Ukuncane kwayo kungenhloso, ngoba i-jail yewebhu ne-jail ye-DNS akukho msebenzi wokuvimba amaport afanayo. Kuba ugibe lapho isevisi ilalela izindlela zokuthutha ezingaphezu kweyodwa, okuyinto ama-daemon e-VPN akwenza njalo. Isihlungi singabheka ukungena okuhlulekile okuvela kuzo zombili izindlela kuyilapho i-action ihlanganisa eyodwa kuphela.

Ukusetshenziswa kwe-SoftEther ne-OpenVPN ngokuvamile kulalela i-UDP ne-TCP ngesikhathi esisodwa, futhi ngenxa yokuthi umugqa welog ubukeka ufana kuzo zombili, isihlungi sibheka zombili. Ukungalingani akusoze kubonakale embikweni we-jail uqobo. I-fail2ban ibale ukwehluleka ngendlela efanele yabe isifaka umthetho osebenza engxenyeni eyodwa yethrafikhi okwavela kuyo lokho kwehluleka.

Yenza ukunqatshwa kuhlanganise izindlela zombili zokuthutha

Kulungise encazelweni ye-jail esikhundleni salokho; imithetho ebhalwe ngesandla izoshabalalaliswa ukulayishwa kabusha okulandelayo. Chaza ama-action amabili, awodwa kuyiprotocol ngayinye:

action = %(banaction)s[name=%(__name__)s-tcp, actionname=%(__name__)s-tcp, protocol="tcp", port="%(port)s", chain="%(chain)s"]
         %(banaction)s[name=%(__name__)s-udp, actionname=%(__name__)s-udp, protocol="udp", port="%(port)s", chain="%(chain)s"]

Ungazami ukuwufushanisa nge-protocol = all. I-banaction ezenzakalelayo iyi-action ye-multiport, futhi inwebeka ibe -p <protocol> -m multiport --dports <port>; ngaphandle kweprotocol ye-L4 akukho okumele ukufanisa kwephothi kukuhlole, ngakho i-iptables iyawenqaba umthetho kuyilapho i-jail isabika ukunqatshwa okuphumelelayo. I-action yamaphothi onke efana ne-iptables-allports noma i-nftables-allports iyamukela okukodwa, kodwa ivimba wonke amaphothi kulo mthombo, okuyisinqumo esihlukile futhi esidinga izizathu zaso. Shiya iprotocol ku-tcp noma ku-udp futhi wamukele okubili.

Fakazela ukuthi umthetho ukhona esikhundleni sokuthembela ekuhlelweni, ngoba ukuhlelwa kuchaza inhloso kuze kube yilapho i-chain iwubamba khona:

iptables -S f2b-vpn-tcp
iptables -S f2b-vpn-udp

I-chain ngayinye kufanele ibale umthetho owodwa, kube no--p tcp kweyokuqala no--p udp kweyesibili, kokubili kucacisa ikheli elivinjelwe. Bese uqinisekisa ukuthi lelo kheli lifanayo liyenqatshwa kuzo zombili izindlela zokuthutha. Ukunqatshwa ongakaze ukubone ku-chain kuyithemba nje, futhi umbiko olandelayo wophawu olufanayo uzophinda ubize ihora elifanayo.

Lokho ukunqatshwa okusakushiyayo, kanye necala elilandelayo

Lokho i-action ekwenzayo ukuvimbela umthombo owodwa, futhi kuphela kumaphothi akulethwe kuyo. Akwenzi lutho mayelana nomhlaseli oshintsha amakheli, futhi ayikwazi ukwehlukanisa umshini onolaka nokuphuma kwe-NAT yezinga lomhlinzeki okwabelwana ngamakhulu abasebenzisi, lapho ukunqatshwa okukodwa kuvalela ngaphandle abantu abanganzanga lutho. Qinisekisa ukuthi isihlungi sifunda ikheli iklayenti elinalo ngempela, hhayi isihloko esidlulisiwe noma ikheli le-proxy. Gcina iwindi lifushane ngokwanele ukuba iphutha liphele lodwa.

Akukho kulokho okuthethelela ukweqa ukulungiswa kweprotocol; kukuthethelela ukubamba imibono emibili ngesikhathi esisodwa. Ukunqatshwa kuncane kunalokho okushiwo isifinyezo se-jail, futhi ngisho ukunqatshwa okuphelele kuncane kunosongo. Beka i-chain ye-firewall eceleni kohlu lwabalaleli be-daemon futhi uqhathanise iprotocol ngeprotocol, ngoba lezo zinhlu ezimbili zinquma ukuthi ukunqatshwa kungafinyelela yini kusevisi nhlobo.

Gcina umyalo wokulayisha kabusha kanye nohlu lwe-chain ku-runbook eduze kwe-jail. Umuntu olandelayo uzodinga kokubili, futhi isifinyezo se-jail ngeke sibatshele lutho.