I-URL eyodwa yehhovisi ne-VPN? Kungani inganekwane yohlu lwemvume yehluleka

Xhuma umhubhe, vula uphawu lokubhuka olufanayo, futhi isayithi evunyelwe iphendula ngendlela efanayo ncamashi nendawo eyaphendula ngayo isuka ehhovisi. Lona umcabango izinhlelo eziningi zokufinyelela kude ezincike kuwo buthule, futhi uhlala kuphela uma izinto ezintathu ezihlukene zihlala ziyiqiniso ngasikhathi sinye. Akukho kukodwa kwazo okuyisici seklayenti le-VPN, futhi awekho umbhalo we-DNS onganikeza noma yikuphi kwazo. Uma uphawu lokubhuka luhluleka ekhaya, isiphequluli sikunikeza iphutha elilodwa elijwayelekile, noma ngabe imbangela iwumzila ongekho, ikheli lokuphuma elingavunyelwe noma iproxy eshintshe umthombo ekubika ngawo. Ukuthatha lezo zinto ezintathu njengenkinga eyodwa iyona ndlela okusho ngayo ukuthi ukulungiswa okuncane komgomo kube yisonto lokwandisa uhlu lwemvume.

Idizayini ehlala isikhathi eside lapho ihlangana nenethiwekhi yangempela yehhovisi incane kunomcabango: ithebula lezinqumo elinemigqa emithathu elicacile, indawo eyodwa yokuphoqelela engenakugwenywa, kanye nokuhlolwa kokunqaba okufakazela okuthile. Ukuhlakaza umcabango kuza kuqala, ngoba konke okulandela kuncike ekwazini ukuthi yiluphi ungqimba olubeka umthombo ngendlela engalungile.

Inganekwane: ukuxhuma akukhona ukuhambisa umzila

Kusungulwa umhubhe, futhi iklayenti lifaka imizila yezinqamuleli ezithile. Ukuxhuma kwenza lokho kuphela. Ukuthi isicelo se-HTTPS esingahlobene sihamba ngomhubhe yini, nokuthi sibonakala sivela kuyiphi ikheli lomphakathi lapho sifika, yizinqumo ezithathwa kamuva ezinye izingxenye: ithebula lomzila likhetha indlela, futhi ukuphuma kukhetha umthombo.

Yingakho ihhovisi netafula lasekhishini kuhluka ngekhompyutha ephathekayo efanayo, iphrofayela yesiphequluli efanayo kanye nophawu lokubhuka olufanayo. Ehhovisi isicelo siphuma ngekheli lomphakathi elinakekelwayo okwavunyelwana ngalo ngumqhubi wesayithi. Ngomhubhe ogcwele singaphuma ngokuphuma kwe-VPN, okuyikheli elihlukile futhi, kuze kube umuntu uyengeza, elingavunyelwe. Ngomhubhe ohlukanisiwe singase singene nhlobo emhubheni. Imizila emibili kuphela kuleyo emithathu eyake yaba yingxenye yesivumelwano nomnikazi wesayithi, futhi eyesithathu ayisona isici okufanele silungiswe ngomugqa we-allow owengeziwe.

Izimo ezintathu zesicelo, ukuphuma okubili okuvunyelwe

Bhala i-matrices ngaphambi kokuthinta i-firewall, ngoba ithebula yidizayini futhi umthetho uwukusetshenziswa kwayo okukodwa. Amakheli angezansi yizigaba zemibhalo; washintshe ngamavelu akho anakekelwayo futhi uwagcine endaweni umnikazi wesayithi angayihlola kuyo.

Umugqa ophakathi yiwona lapho izinhlelo eziningi zihluleka khona. Okubalulekile yikheli elibonwa idivaysi yokuphoqelela, hhayi ikheli langasese ikhompyutha ephathekayo elibamba ngaphakathi komhubhe futhi hhayi ikheli layo le-LAN. Inani elifana ne-10.8.0.6 alisho lutho esayithini yomphakathi, futhi ne-192.168.1.44 alisho. Ikheli lomhubhe luyimininingwane yokukhethwa kwamakheli komhubhe, hhayi isiqinisekiso isayithi engasihlola.

Uma i-VPN yakho ingakwazi ukunikeza ukuphuma okuzinzile okubhalisiwe, i-matrices ayinawo umugqa ophakathi ovumelekile futhi akukho nani lohlu lwemvume oluzoqamba owodwa. Izinketho ezithembekile ngaleso sikhathi isayithi langasese elifinyelelwa ngemizila yangasese ecacile, noma isango lokufinyelela elazi ubunikazi phambi kohlelo lokusebenza. Zombili zinesivumelwano esihlukile kunohlu lwemvume lomphakathi, futhi zombili kulula ukuzichaza kumhloli kunohlu olwakhula kwaze kwaba yilapho lusebenza ngengozi.

Funda umthombo lapho kuthathwa khona isinqumo

Beka umkhawulo kudivaysi eqeda isicelo, futhi qinisekisa ukuthi awekho umzila wemvelaphi ohlukile owudlulayo. Imojuli yokufinyelela ye-Nginx ihlola imiyalo ye-allow ne-deny ngokulandelana, ukufana kokuqala kuyanqoba, futhi imithetho ezuzwe njengefa kubhloku elizungezile isasebenza ngaphakathi kwe-location. I-allow emincane eduze kwe-allow ebanzi endaweni efanayo ngokuvamile isho ukuthi ebanzi iyona enqumayo. Funda konke ukulungiselelwa okusebenzayo kwaleyo location ngaphambi kokuhlela ngisho umugqa owodwa wayo.

server {
    listen 443 ssl;
    server_name intranet.example.com;

    set_real_ip_from 10.20.0.10;
    real_ip_header X-Forwarded-For;
    real_ip_recursive on;

    location /app/ {
        allow 203.0.113.24;    # office public exit
        allow 198.51.100.77;   # approved VPN egress
        deny  all;
        proxy_pass http://app_backend;
    }
}

Ngemuva kwesilinganisi somthwalo noma iproxy ephambene, lowo mthetho ubona iproxy ngaphandle uma ushilo okunye. Buyisela ikheli lomshayeli kuphela ngesu le-proxy ethembekile elisekelwayo, ngohlu olucacile lwamakheli e-proxy. Isihloko sesicelo esithi ikheli livunyelwe akusona ubufakazi bokuthi umshayeli unalo, futhi kumlaleli womphakathi isihloko esidluliswe singaqinisekisiwe senza uhlu lwemvume lube umhlobiso.

Bese uhlola omunye umndeni wamakheli. Iqoqo lemithetho elihlanganisa i-IPv4 kuphela liyisinqumo esingaphelele ngegama lomsingathi eliphendula futhi ku-AAAA, futhi iklayenti eline-IPv6 esebenzayo lizofinyelela uhlelo lokusebenza olufanayo ngomzila ongakaze uwuhlole.

Umhubhe ohlukanisiwe: isicelo esingangeni nhlobo

Umhubhe ohlukanisiwe uthwala izinqamuleli ezisohlwini lwawo kuphela. Amanethiwekhi angaphansi ehhovisi ngokuvamile angena kulolo hlu; isayithi yomphakathi ayingeni. Isiphequluli sixazulula igama, siqhathanisa ikheli elikhethiwe nethebula lomzila, futhi sisathola isango lokugcina lendawo elingaphambili laso.

Ngakho isicelo sifika kusuka kuxhumano lwasekhaya lomsebenzisi, senqatshwa, futhi umbiko uthi i-VPN yephukile kuyilapho umhubhe wenza khona kanye lokho owawulungiselelwe kona. Izilungiso ezimbili zisemthethweni: hambisa leyo ndawo ngomhubhe futhi uvumele ukuphuma okuvunyelwe ukuthi kuyithwale, noma vuma ukuthi isayithi lifinyelelwa ngqo bese unikeza abasebenzisi abakude omunye umzila ovunyelwe njengesango lokufinyelela. Ukwandisa uhlu lwemvume lomphakathi lwesayithi kuze kube ikheli lasekhaya lingena ngengozi akusiko kokubili, futhi kususa umngcele okwakufanele idizayini iwuphoqelele. Okubili kokuqala kugcina i-matrices ithembekile; okwesithathu kususa buthule umugqa kuyo.

Fakazela ukunqaba, bese kuba ukubuyisela

Hlola ngesicelo esisebenzisa isinqumo sangempela, kusuka kuklayenti emi kuwona wonke umugqa wethebula. Ukuhlola ukufinyeleleka kuya kunoma yiliphi ikhasi elingahlobene elibonisa ikheli akufakazeli lutho, ngoba leyo ndawo ingase ihamba ngomzila ohlukile kunohlobo lokusebenza.

curl -sS -o /dev/null -w 'status=%{http_code}
' https://intranet.example.com/app/login
# repeat with the tunnel up, then with it down
tail -f /var/log/nginx/access.log | grep ' /app/'

Qhathanisa irekhodi lokufinyelela emngceleni nalokho okwabikezelwa ithebula. Bese wehlisa umhubhe futhi wenze isicelo esisha okufanele senqatshwe; ikhasi eselilayishiwe, noma uxhumano eseluvuliwe, akuhloli lutho nhlobo. Uma kungabonakali kunqaba, indawo yokuphoqelela ayikho lapho ocabanga khona.

Gcina ukuqinisekiswa kohlelo lokusebenza ngemuva kokwamukelwa kunethiwekhi, ngoba ukuphuma kwehhovisi nokuphuma kwe-VPN ngakunye kumele abantu abaningi futhi akukho okukodwa okukhomba umuntu oyedwa. Imiyalo yabasebenzisi ihlala imifushane: phakamisa umhubhe ovunyelwe, bese uzama futhi. Yikho okugcina i-URL eyodwa ilula ngenkathi umthetho womthombo uhlala uyisinqumo hhayi ukuqagela.