I-VPN yendawo-kuya-endawo: ikuphi uhlangothi oludinga umthetho ngempela?

Zombili iziphetho zibika umhubhe osunguliwe, igatsha elikude liphendula livela esangweni, futhi uhlelo lokusebenza lusagcina isikhathi siphelile kubasebenzisi ohlangothini olulodwa. Iseluleko esivamile sithi engeza umthetho we-firewall kuzo zombili izinhlangothi. Ngezinye izikhathi lokho kulungile, ngezinye izikhathi kuphinda umthetho ovele ukhona, futhi ngezinye izikhathi umthetho wesibili yiwona ophula isimo. Ukuthi yisiphi isimo esisebenza kuncike ekutheni i-firewall ibona kuphi iphakethe.

Ithrafikhi yokubuya enesimo ishintsha inani

I-firewall enesimo iqopha isicelo futhi ivumela impendulo ngaphandle komthetho wesibili, ngakho umklamo odinga umthetho owodwa kuphela ujwayelekile. Uhlu lokufinyelela olungenasimo alunaso isikhumbuzo esinjalo, futhi impendulo kufanele ivunyelwe ngokucacile. Kokubili kulungile endaweni yazo, yingakho izeluleko ziphikisana.

Funda imibhalo yokudlulisa yendawo ephambi kwakho, futhi uhlole ukuthi ingabe inqubomgomo oyihlolayo inesimo lapho ibona khona iphakethe. Ukwenqatshwa okucacile kwethrafikhi esunguliwe, noma ukulandelana kwemithetho okuhlola impendulo ngaphambi kwethebula lesimo, kwenza umklamo osebenzayo ube yindida. Inani lemithetho liyincwadi yokusebenza, kuyilapho imfuneko iwukuthi izinhlangothi zombili zengxoxo evunyelwe zikwazi ukuqedwa.

Lapho i-firewall ibona khona amaphakethe asusiwe ocashazini

Emhubheni osekelwe kwinqubomgomo, i-firewall ingahlola iphakethe elicashaziwe ngaphambi kokususwa kocashazo kanye nephakethe elisusiwe ngemuva kwalokho, ezindaweni ezahlukene. Umthetho obhalelwe indawo engalungile ukhona, ulungile futhi awusoze wafana. Yileyo ndlela isethi yemithetho ekhotshelwe ekusetshenzisweni okusebenzayo engahluleka ngayo kuhadiwe elifanayo.

I-IPsec esekelwe emzileni kanye nokuningi kokusebenza kwesimanjemanje kunikeza indawo yomhubhe, ngakho iphakethe elisusiwe lifika lapho futhi kusebenza imithetho evamile yendawo. Qinisekisa ukuthi ukusetshenziswa kusebenzisa yiphi imodeli ngaphambi kokukhotshela isethi yemithetho emhlahlandleleni obhalelwe enye. Indawo yomhubhe futhi iyindawo okufanele ibhekwe kuyo lapho udinga ukwazi ukuthi iphakethe lasuswa ngempela yini.

Umzila ongalingani uphula umqagelo

I-firewall enesimo icabanga ukuthi ibona izinhlangothi zombili zengxoxo. Uma impendulo ibuya ngesango elihlukile, leyo divayisi ayinaso isimo sesicelo futhi iyilahla ngokwenqubomgomo yayo. Uphawu ukwehluleka kohlangothi olulodwa okungekho mthetho ohlangothini oluthumelayo ongakwazi ukuwulungisa. Landelela indlela yempendulo ngaphambi kokuhlela noma yini.

Hlola umzila wempendulo ngaphambi kokwengeza umthetho obanzi wokuvumela kuzo zombili izinhlangothi. Ukubekezelela konke kuyo yonke indawo kufihla iphutha lomzila futhi kwandise ukufinyelela ngesikhathi esifanayo, okuyisixhumanisi esibi kakhulu esitholakalayo.

Hlola izinhlangothi zombili ngamakheli womthombo angempela

Hlola ngekheli uhlangothi olukude olubonayo ngempela, ngoba ukuhumusha kungenza umthetho womthombo ungafani nalutho. Gijimisa ukuthwebula kuzo zombili izingosi ngesikhathi esifanayo.

tcpdump -ni any 'host 10.30.8.15 and tcp port 443'
nft list ruleset | grep -A 8 'chain forward'
ip route get 10.30.8.15
conntrack -L | grep 10.30.8.15

Isicelo esivela esangweni elikude ngekheli lomthombo elingalindelekile sichaza umthetho ongafani neze, futhi impendulo efika endaweni engalungile ichaza ukungafani kwesimo. Bese uhlola indawo eyodwa ngaphakathi kobubanzi obugunyaziwe kanye neyodwa ngaphandle, ukuze umngcele uboniswe kunokuba ucatshangwe.

Qopha ikheli lomthombo ngemuva kokuhumusha, indawo esetshenziswe iphakethe elisusiwe, nomthetho owafanayo. Lazo lezo zinto ezintathu ziphendula ithikithi elilandelayo ngaphandle kokuphinda uphenyo lonke.