Kungani umthetho wokuvimba iklayenti le-OpenVPN ungafinyeleli ku-FORWARD

Amaklayenti amabili kuseva ye-OpenVPN eyodwa angafinyelelana ngisho nangemva kokuba ufake umthetho we-DROP wendawo yabo. Umthetho ukhona ochungechungeni lwe-FORWARD, ithrafikhi igeleza ngokucacile, kodwa isibali salowo mthetho sihlala siku-zero. Isiphetho esingokwemvelo ukuthi i-firewall yephukile. Kaningi iphakethe alizange lingene ochungechungeni ngisho nancane.

Kunezindlela ezimbili iphakethe longqingili engahamba ngazo kuseva ye-OpenVPN, futhi zinqunywa ukumiswa, hhayi i-firewall. Ukwazi ukuthi iyiphi indlela esetshenziswayo kukutshela ukuthi umthetho weseva ukhona endaweni efanele yini.

Izindlela ezimbili iphakethe longqingili elingahamba ngazo

Lapho inketho yokudlulisa kwangaphakathi ivaliwe, iphakethe elivela kuklayenti A lifika kusixhumanisi se-tunnel linendawo yokuyisa engaphakathi kwekheli elinikezwe iklayenti B. Ithebula lomzila leseva liyibuyisela ngaphandle ngosixhumanisi se-tunnel esifanayo, ngoba umzila oya ekhelini lika-B ungoweseva. Lokhu kuwukugeleza kokungena nokuphuma kudlula kuseva, futhi indlela yokudlulisa ye-IPv4 iyayihlola.

Lapho inketho yokudlulisa kwangaphakathi ivuliwe, inqubo yeseva ihlanganisa iphakethe neklayenti elixhunyiwe bese ilibhala libuyela kuyo kanye leyo klayenti. Iphakethe lisingathwa ngaphakathi kwe-daemon futhi aliphinde lingene kudivayisi ye-tunnel, ngakho indlela yokudlulisa yeseva yeqiwa ngokuphelele. Incwadi ye-OpenVPN 2.6 ichaza le nketho njengokudlulisa kwangaphakathi kusuka kuklayenti kuya kuklayenti, futhi yiso lesi isizathu sokuthi umthetho we-firewall weseva awukwazi ukuwubona.

Kunohlobo lwesithathu ekusetshenzisweni okudlulisela isiteshi sedatha kumojuli ye-kernel. Isinqumo sokudlulisa nokubethela kuphuma endaweni yomsebenzisi, futhi ukuthi i-netfilter iyawubona yini umfudlana kuncike ekutheni indlela yokudlulisa yakhiwe kanjani. Ungalokothi ucabange ukuthi isethi endala yemithetho iziphatha kuseva edlulisiwe njengoba yayenzela kuseva esendaweni yomsebenzisi. Qinisekisa imodi kusukela ekumisweni okusebenzayo, hhayi kunguqulo yephakheji.

Lapho isibali singanyakazi nakancane

Isibali esingu-zero sisho ukuthi iphakethe alizange lihambisane nalowo mthetho kulelo phuzu, futhi izizathu ziningi. Esokuqala ukweqa okungenhla: ithrafikhi ayizange ifinyelele ochungechungeni. Esokubili ukungahambisani kusixhumanisi, endleleni, emthonjeni noma endaweni yokuyisa, okuvamile lapho iqembu selinikezwe izinombolo kabusha futhi umthetho usabiza isiqalo sakudala.

Esokuthathu indawo. Umthetho ongaphambili ochungechungeni ungamukela umfudlana ngaphambi kokuba i-DROP yakho ihlolwe, futhi umthetho ongemuva kungaba yiwona onquma umphumela ngempela. Funda uchungechunge ngokulandelana izibali zibonakala, bese uhlola ukuthi isibali somuphi umthetho esikhulayo lapho uphinda ukuhlola.

Yenza ukushintshana okulawulwayo okukodwa phakathi kwamaklayenti amabili okufakazele amakheli awo angempela kusukela esimweni seseva uqobo, hhayi emalini yokuqasha oyikhumbulayo. Uma isibali esifanele singakanyaki, solisa indlela ngaphambi kokubhala kabusha ukuhambisana. Uma sinyaka kodwa ukuxhumana kusaphumelela, ukuvinjwa kuyeqiwa kamuva futhi inkinga ukulandelana. Leyo mpendulo inquma ukuthi ukulungiswa ukushintshwa komthetho noma ukushintshwa kwesakhiwo, ngakho yithole ngaphambi kokuhlela noma yini.

Ukukhetha umngcele ongakwazi ukuhlunga

Uma inqubomgomo kufanele ihlale ku-firewall yeseva, bheka ithrafikhi lapho i-firewall ingayibona khona. Ukuvala ukudlulisa kwangaphakathi yiyo indlela esekelwayo yokwenza ithrafikhi yongqingili idlule kusixhumanisi se-tunnel nasendleleni yokudlulisa, ngenani lokuthi yonke iphakethe longqingili lidlula kusitaki seseva.

Bese uhlanganisa umfudlana ngokunemba. Ithrafikhi ifika kusixhumanisi se-tunnel futhi iphuma kusixhumanisi se-tunnel, kuzo zombili izinhlangothi, ngakho imithetho ebheka kuphela isixhumanisi esibonakalayo ngeke ihambisane. Imithetho esekelwe kumakheli idinga iqembu lamanje, futhi kufanele icabangele indlela yokubuya njengoba yenza eyokuya.

Ukusetshenziswa okuningi kusizakala kangcono ngokuhlunga ezingeni leklayenti noma leqembu, lapho ubunikazi baziwa khona futhi inqubomgomo ilandela umsebenzisi esikhundleni sekheli elishintsha lapho kuxhunyaniswa kabusha. Lona kuwuhlelo olwehlukile kuchungechunge lweseva, futhi kokubili akufanele kuxutshwe ngaphandle kwesizathu esicacile.

Ungalidlulisi isethi yemithetho yesakhiwo sakudala ngokuthuthuka ngaphandle koshintsho. Amaqembu amakheli, amagama ezixhumanisi namamodi okudlulisa konke kunomthelela ekutheni umthetho uhambisana yini, futhi umthetho okopishiwe owawusebenza ngaphambilini uwuhlobo lobufakazi obuduka kakhulu. Qala emfudlaneni ofuna ukuwuvumela bese ubhala umthetho ohambisana nawo.

Ukuhlola ukwehlukana esikhundleni sokwethemba umthetho

Hlola icala elingavunyelwe necala elivunyelwe ekusebenziseni okukodwa. Qala ukuxhumana okusha kusuka kwelinye iklayenti kuye kwelinye bese uqinisekisa ukuthi kuyehluleka, bese uqinisekisa ukuthi ukuxhumana obekufanele kuvunyelwe kusasebenza. Uma kuhlolwa okokuqala kuphela, i-firewall evimba konke ibonakala njengempumelelo.

Phinda ngemva kokulayisha kabusha ukumiswa kweseva nangemva kokuba iklayenti lixhumane kabusha, ngoba ukudlulisa kwangaphakathi nokwabiwa kwamaqembu kuyisimo sesikhathi sokusebenza. Hlola izibali kuzo zombili izinhlangothi, ngoba umthetho ohambisana nohlangothi olulodwa kodwa hhayi impendulo udala ukwehlukana okwengxenye okunzima ukukuqaphela ekuhloleni okusheshayo.

Ukwehlukana umphumela obonwayo emngceleni othwala umfudlana ngempela. Umthetho we-DROP endaweni ethile kuseva akusona ubufakazi; ukuxhumana okwehlulekile kanye nesibali esinyakazile somthetho obangele lokho kungubufakazi.