Izindawo ze-Shorewall zemizila emibili yamaphakethe e-OpenVPN
Hlukanisa ukuthuthwa kwe-OpenVPN okubethelwe kusuka kuthrafikhi yeklayenti ekhululiwe, nikeza umhubhe indawo yawo, futhi uvumele kuphela isevisi eyodwa edingwa yiklayenti.
Imigudu emibili yamaphakethe idlula isango le-Shorewall eliqeda OpenVPN, futhi munye kuphela wabo obethelwe. Owokuqala ukuthuthwa kweklayenti kusiya kusilaleli se-VPN kusixhumanisi esibheke ku-inthanethi. Owesibili isicelo esikhululiwe esiphuma kusixhumanisi somhubhe siya kuseva yasehhovisi noma isevisi esangweni. Dweba kokubili ngaphambi kokuhlela inqubomgomo, ngoba umthetho owanelisayo owokuqala awenzi lutho kowesibili.
Dweba imigudu emibili ngaphambi kokuhlela inqubomgomo
Bhala imigudu njengemigqa enomthombo, indawo okusiya kuyo, iphrothokholi kanye nechweba. Emzileni wangaphandle, umthombo ikheli lomphakathi leklayenti futhi indawo okusiya kuyo yichweba lokulalela lesango; i-Shorewall ikuthatha njengethrafikhi esuka ku-inthanethi iya kudonga lomlilo. Emzileni wangaphakathi, umthombo ububanzi bamakheli omhubhe futhi indawo okusiya kuyo iyisevisi egunyaziwe. Imigqa emibili inabanikazi abehlukene ngisho noma umqondisi oyedwa enakekela kokubili.
| Flow | Zone relationship | What to constrain |
|---|---|---|
| Encrypted OpenVPN transport | Internet to the firewall host | The listener's actual protocol and port |
| Decrypted request to a LAN service | VPN clients to the LAN zone | One approved server and service |
| Decrypted request to the gateway | VPN clients to the firewall host | Only the local services required |
| Request to another VPN client | VPN clients to VPN clients | Denied unless deliberately required |
Engeza umugqa kuphela uma isicelo siphela esangweni uqobo, njengokufinyelela kusixazululi noma ekuphathweni. Isevisi kumsingathi ilandela inqubomgomo yokufaka yomsingathi, hhayi umzila odlulisiwe. Ukuxuba kokubili yikho okwenza umthetho womhubhe omncane ekugcineni udalule isixhumanisi sokuphatha.
Yabela indawo yomhubhe kanye nobubanzi besixhumanisi
Indawo yomhambi imenyezelwa ku-/etc/shorewall/zones, isixhumanisi somhubhe sixhunywa ku-/etc/shorewall/interfaces, futhi ukuxhumana kwangaphandle kuchazwa ku-/etc/shorewall/tunnels. Vumelana ne-syntax yohlelo olufakiwe, ngoba ukulandelana kwamakholomu namagama ezinketho kushintshile phakathi kwezinguqulo ezinkulu. Ichweba lesibonelo kumhlahlandlela akusona isizathu sokuvumela ichweba elihlukile kunalelo i-daemon elalela kulo ngempela. I-TCP ne-UDP azishintshani ngoba nje izinombolo ziyafana.
Umhlahlandlela uhlanganisa izixhumanisi nge-tun+. Kumsingathi onemihubhe engaphezu kwesisodwa, lowo mkhombandlela ungabeka i-VPN yesibili enezinga lokwethemba elihlukile endaweni efanayo. Buyekeza ububanzi ngokuqhathanisa nezixhumanisi ezikhona ngempela, futhi gcina ukuqanjwa ngaphansi komjikelezo wokuphila womphathi wokuxhumana esikhundleni sokuhlela amagama ezixhumanisi ngesandla.
Umhlahlandlela womlando uqukethe izibonelo zokucushwa kwe-OpenVPN ezindala kakhulu, futhi izeluleko zayo ze-crypto akufanele zikopishwe ekusetshenzisweni kwamanje. Boleka imodeli yezindawo nemigudu esikhundleni salokho. Thatha isisekelo se-cryptographic kunqubomgomo ye-OpenVPN yesango enakekelwayo.
Vumela kuphela umzila oyihlukanisile
Ukwamukela okubanzi kusuka endaweni ye-VPN kuya ku-LAN kuwumdwebo wokuqala, hhayi inqubomgomo eqediwe. Bhala umthombo weklayenti ovunyelwe, ikheli langempela lesevisi, iphrothokholi kanye nechweba. Bese ufunda imithetho engaphezulu kwayo kanye nokumisiwe kwendawo, ngoba isengezo esincane asichithi imvume ebanzi esivele ihambisana. Ithrafikhi eya kumsingathi wesango iyisihlobo esihlukile kusuka kuthrafikhi edluliswa kulo.
Ithrafikhi phakathi kwamaklayenti idinga isinqumo sayo. I-client-to-client ye-OpenVPN ne-routeback ye-Shorewall zombili zithinta ukuthi amaklayenti angafinyelelana yini, futhi akukho kokubili okufanele kuvulwe kuphela ukuze uhlelo lokusebenza lwe-LAN olulodwa lusebenze. Nquma ukuthi ukwehlukanisa kusetshenziswa kuphi ngaphambi kokukuhlola.
Gcina umzila wempendulo kusuhlelo olufanayo. Isevisi noma i-router yayo kufanele yazi ukuthi ingabuyisela kanjani ithrafikhi kububanzi bomhubhe, noma ukwakheka kufanele kuhumushe umthombo ngamabomu nangaphakathi kobubanzi obuhlosiwe.
Qinisekisa, bese ufakazela imigudu yomibili
Qinisekisa ukucushwa ngaphambi kokuqalisa kabusha noma yini, futhi gcina isikhathi sokuphatha esizimele sivulekile uma inqubomgomo entsha inephutha.
shorewall checkNgemva kokuhlolwa okuhlanzekile, sebenzisa ukucushwa futhi ufunde lokho i-Shorewall ekulayishile. Lokhu kufunda kuchaza inqubomgomo esebenzayo hhayi lokho ifayela elibonakala likusho.
shorewall show zones
ip route get 192.168.10.20Hlola isicelo esisodwa esisha esivunyelwe kanye nesicelo esisodwa esenqatshwe ngamabomu kusuka kuklayenti elifanayo. Ukuxhawulisana kwe-OpenVPN okuphumelelayo kufakazela kuphela ukushintshana kwangaphandle; isevisi evunyelwe kanye nensiza enqatshiwe kufakazela inqubomgomo yangaphakathi oyayihlose. Bese uxhuma kabusha iklayenti futhi uphindaphinde, ngoba igama nekheli lesixhumanisi somhubhe kungashintsha phakathi kwezikhathi. Uma umphumela uhlukile, lungisa ububanzi bendawo esikhundleni sokwandisa umthetho.