Kungani i-Port-Share yenza zonke izivakashi zewebhusayithi zibonakale njenge-localhost

Wonke umugqa kulogi yokufinyelela ukhombisa ikheli elifanayo le-loopback, ngenkathi ikhasi ngokwalo lilayisha futhi isitifiketi siqinisekiswa ngendlela efanele. Akukho okonakele ngomqondo wokungafinyeleleki, futhi yingakho lesi simo sihlala izinyanga. Okonakele ukwabiwa: ingemuva lewebhu lirekhoda ikheli lesinyathelo esidlulisele ukuxhumana, futhi zonke izinqumo ezalandela ezathemba ilogi zazuza ifa elifanayo elingalungile.

Izinhlelo zokuhlola ezingezansi zihamba kusukela kukhebula ngaphakathi. Yima kuleso sokuqala esichaza inani olibonayo, ngoba isinyathelo ngasinye esilandelayo sithatha ukuthi esedlule sezivele zilungile. Akukho kuzo okudinga ukuqagela ukucushwa kwengxenye yangaphambili.

Landela ukuxhumana okubili, hhayi umugqa welogi

I-Port-Share ihlanganisa izinqubo ezimbili kumlaleli oyedwa we-TCP. OpenVPN ihlola amabhayithi okuqala okuxhumana okungenayo, iyigcina uma ibonakala ifana nenqubo yayo, bese idlulisela konke okunye endaweni yesibili. Leyo ndawo ngokuvamile iyiseva yewebhu kusihambisi esifanayo, ngakho isokhethi eyamukelwa yiseva yewebhu inomsebenzi we-OpenVPN njengomlingani wayo.

ss -ltnp 'sport = :443'
ss -tnp 'dport = :8080'

Umyalo wokuqala ukhombisa ukuthi umlaleli womphakathi ungowakabani. Owesibili ukhombisa ukuxhumana okufika eport yengemuva, futhi ikheli lomlingani wabo yilona elizonyatheliswa yilogi yokufinyelela. Uma lowo mlingani eyi-loopback, ilogi inembile futhi ulwazi lwalahleka ngongqimba owodwa ngaphambili. Ukushintsha igama lensimu yelogi noma ukunika amandla imojuli ye-IP yeklayenti ngeke kubuyisele ikheli ukuxhumana okungakaze kuliqhube.

Lolu wukuhlola okunquma konke okunye. Uma umlingani wengemuva eyikheli lesiphequluli, ukwabelana ngeport akuyona inkinga yakho futhi ifomethi yelogi iyona.

Ukudlulisela kwengqalasizinda akukona ukufaka isihloko

Isidluliseli sihambisa amabhayithi. Asihlaziyi i-HTTP, ngakho asikwazi ukufaka isihloko esicelweni esingakaze sifundwe njengesicelo, futhi asikwazi ukwengeza lutho kumsele we-TLS esiwudlulisa ungangeniwe. Imojuli elindele isihloko se-proxy izoqhubeka ilindele esingekho ingxenye eyikhiqizayo.

Izindlela ezimbili zingathwala ikheli lokuqala, futhi zombili zidinga isivumelwano ezinhlangothini zombili. Iphrothokholi ye-PROXY yengeza isihloko esincane ekuqaleni kokuxhumana, futhi ingemuva kufanele licushwe ukulilindela; ingemuva elingalilindeli lizothatha lawo mabhayithi njengokuqala kwesicelo bese lihluleka ngendlela edidayo. Izihloko ze-proxy ezithembekile njenge-X-Forwarded-For zisebenza lapho i-proxy eqonda i-HTTP izibeka futhi ingemuva litshelwa ukuthi yimaphi amalingani avunyelwe ukuziqinisekisa.

Akukho kokubili okuzenzakalelayo, futhi akukho kokubili okuphephile ngokuzenzakalela. Ingemuva elikholwa yinoma isiphi isihloko esidluliselwe esingenayo livumela iklayenti ukuthi lizikhethele ikheli lalo, okuguqula ukungaqondi kahle elogini kube yindlela yokweqa ukulawulwa kokufinyelela. Gijimisa umboniso kanye kusihambisi sokuhlola ngaphambi kokuthemba noma isiphi isihloko endleleni yokukhiqiza.

curl -sS -H 'X-Forwarded-For: 127.0.0.1' https://site.example.com/health
grep -F '127.0.0.1' /var/log/nginx/access.log | tail -n 3

Ividiyo yemephu yomthombo engakhethiwe

Ukwabelana ngeport kunengxoxo yevidiyo engakhethiwe erekhoda imephu phakathi kwekheli lomthombo lwangempela nokuxhumana kokudlulisela, kumapulatifomu lapho lesi sici sisetshenziswa khona. Ingxenye yewebhu ilindeleke ukuthi ibheke leyo mephu; akusona isihloko, futhi ayifakwa esicelweni.

Lowo mklamo ufanele waziwe ngoba uchaza ukuthi kungani ezinye izifakwa zibika amakheli angempela kanti ezinye azikwenzi, ngokucushwa kwengxenye yangaphambili okubonakala kufana. Umehluko usohlangothini olwamukelayo, futhi ngokuvamile uhlala kumojuli noma kusichibiyelo esingavulwa ngokuzenzakalela yiziseva eziningi zewebhu ezifakiwe. Funda imibhalo yeseva yakho yewebhu mayelana nehuku eliqondile elinikezwayo, futhi uqinisekise ukuthi imojuli ilayishiwe esikhundleni sokucabanga.

Uma uthatha le ndlela, yithathe njengokuhlanganiswa kwezingxenye ezimbili: imephu ebhalwa isidluliseli kanye nokusesha okwenziwa ingemuva. Qinisekisa kokubili, futhi uqinisekise ukuthi ividiyo isinda ukuqala kabusha futhi ayikhuli ngokungenamkhawulo kumlaleli omatasa.

Nquma ukuthi iyiphi ingxenye eqinisekisa ikheli

Ngaphambi kokushintsha ukucushwa, shono igama lengxenye evunyelwe ukuqinisekisa ikheli leklayenti kanye nezingxenye ezivunyelwe ukukholwa yiko. Impendulo eyodwa ebhaliwe ivimbela ukukhukhuleka okuvamile, lapho izingqimba ezintathu ezihlukene zithemba umthombo ohlukene.

Imiklamo emithathu ihlanganisa izidingo eziningi. Gcina umlaleli womphakathi nomlaleli wewebhu behlukene, ukuze iseva yewebhu ibone amalingani angempela futhi kungabikho nkinga yokwabiwa. Beka i-proxy ephambene eqonda i-HTTP phambili, qeda noma hlaziya isicelo lapho, futhi uyeke ibeke isihloko esidlulisiwe sengemuva elithemba leyo proxy kuphela. Noma gcina ukwabelana ngeport futhi wamukele ukuthi amalogi akhombisa isinyathelo, nemithetho yokufinyelela ebhalwe ngokumelene nobuwena bohlelo hhayi ikheli.

Okungasebenzi ukuthatha ikheli le-loopback elidlulisiwe njengobufakazi bokuthi isicelo saqala kulo mshini. Leso siphetho siphambene ngqo: ikheli likhona ngoba ingxenye yasendaweni yadala ukuxhumana. Umthetho obhalwe kanjalo wamukela noma ubani ongafinyelela kumlaleli.

Hlola umthetho, hhayi ikhasi

Ikhasi elilayishwayo likhombisa ukuthi indlela yokudlulisela iyasebenza futhi alisho lutho ngokwabiwa. Hlola umsebenzisi wekheli: umthetho wokufinyelela, umkhawulo wejubane, umbhalo wokucwaninga, ukusesha kwendawo.

curl -sS -o /dev/null -w '%{http_code}\n' https://site.example.com/
tail -n 5 /var/log/nginx/access.log
grep -c '' /var/log/nginx/access.log

Qhathanisa isicelo sangaphandle esigunyaziwe namarekhodi engxenye yangaphambili nengemuva, futhi uqinisekise ukuthi umthetho okufanele wenqabe usaqhubeka wenqaba futhi lowo okufanele wamukele usaqhubeka wamukela. Uma umugqa welogi ulungile kodwa umthetho usaziphatha sengathi wonke umuntu ungowasendaweni, umthetho ufunda insimu ehlukile kuleyo oyilungisile.

Qeda ngokubhala uchungechunge lokwabiwa kumanothi okufakwa: umlaleli muni, isidluliseli sini, isihloko noma imephu ini, futhi iyiphi ingemuva ecushwe ukulithemba. Umuntu olandelayo ozofunda umugqa welogi uzodinga konke kune, futhi ukungabikho kwalelo nothi yikho okwenza ithikithi elifanayo livulwe futhi ngemuva konyaka. Gcina kuseduze nokucushwa hhayi ochungechungeni lwengxoxo.