I-NAT yomthombo ifihla amakheli amaklayenti kwi-firewall yakamuva

Uma i-NAT gateway ibhala kabusha amakheli amaklayenti, i-firewall ephezulu ayikwazi ukuphoqelela imithetho yomthombo ngeqembu ngalinye. Thola iphuzu lokugcina lapho ubunikazi busekhona.

Umgomo obhalelwe amaklayenti abasebenzi naselebhu uyiswa ku-firewall entsha yomphetho, futhi uhambisana buthule nakho konke noma lutho. Isizathu sitholakala phezulu: i-gateway isivele yabhala kabusha amakheli amaklayenti, ngakho umgomo ubona ikheli elilodwa lokudlula esikhundleni samaqembu amabili. Ukwengeza idivayisi akubuyiseli ulwazi olwasuswa indlela. Thola iphuzu lokugcina lapho umehluko usekhona ngaphambi kokubhala inqubomgomo.

Kungani umgomo womphetho ubona ikheli elilodwa

Ukuhumusha okuningi-kuya-kukodwa kuxhumanisa zonke izithombe zekheli ne-port zangaphakathi nekheli langaphandle elabiwe eline-port eyabelwe. Izingxoxo zihlala zihlukaniseka kumhumushi ngalezo zibopho ze-port, kodwa idivayisi engezansi eyenza ukuqhathanisa okulula kwe-prefix yomthombo ibona kuphela ikheli elabiwe. Lokho kwanele ukwenza amaqembu amabili afane emgomweni. Amaphakethe asafika; ukuhlukaniswa kwamaqembu akufiki.

Hlola ukuthi i-interface ye-firewall ibona ngempela ini, hhayi lokho okuthenjiswa umdwebo. Kokubili kuyahluka kaningi kunalokho umuntu ongakulindela.

Thola ubunikazi bokugcina obungaphoqelelwa

Qala endaweni yokuphoqelela bese uhlehla uze kuvele i-prefix yokuqala. Imiyalo emibili ivamise ukuthola umngcele.

iptables -t nat -L POSTROUTING -n -v
conntrack -L -s 10.90.0.2 | head

Ithebula le-NAT libonisa ukuthi yikuphi ukuxhumana okuhunyushwayo nangamuphi umgomo, kuyilapho uhlu lwe-conntrack lubonisa izingqikithi zokuqala nezihunyushiwe zemifudlana esebenzayo. Lapho i-firewall ephezulu ibona kuphela ikheli elihunyushiwe, imithetho yomthombo ngeqembu ayikwazi ukusebenza lapho, noma ibhalwe kanjani. Hamba phambili noma emuva endleleni uze ufinyelele idivayisi lapho ama-prefix amabili amaklayenti ahlala ehlukene. Rekhoda umthombo esigabeni ngasinye esikhundleni sokuthemba ilebula langaphakathi noma langaphandle.

Izindawo ezintathu kanye nezindleko zazo

Inqubomgomo ingahlala ku-gateway ehumushayo, lapho imithombo yokuqala isabonakala khona. Ingahlala ku-firewall ephezulu uma ukudlula kuba ngumzila esikhundleni sokuhunyushwa, okusho ukwengeza imizila yokubuya nokususa ukubhalwa kabusha komthombo. Noma ingaphoqelelwa kubunikazi esikhundleni samakheli, ngokulawula okuqinisekisiwe okwazi umsebenzisi noma idivayisi. Ukukhetha ngakunye kunomnini kanye nendlela yokwehluleka, futhi ikabili yokuqala kuphela egcina umgomo ukhuluma ngamakheli omthombo kuphela.

Noma yikuphi okukhethayo, bhala inqubomgomo kanye nekheli elihambisana nayo. Umgomo ozindlela zekheli zashintsha buthule umubi kunokungabi nawo umgomo, ngoba uqhubeka uhambisana nokuxhumana ngesikhathi uvikele okunye ngokuphelele.

Ukwamukela: iklayenti elilodwa elivunyelwe nelilodwa elinqatshiwe

Hlola ngamaklayenti amabili, elilodwa eqenjini ngalinye, futhi rekhoda ukuthi yiliphi lifinyelela kanjani endaweni yokuphoqelela. Gcina zombili izingqikithi eceleni komphumela womgomo, ukuze ubufakazi bubonise ukuthi umehluko wasinda hhayi ukuthi kukhona enye i-firewall. Phinda ukuhlola ngemuva koshintsho lwe-NAT noma lomzila, ngoba ikheli elethulwayo yilona ngxenye ephuka buthule. Gcina ukuqinisekisa kuyo yonke indawo lapho abantu kufanele bahlukkaniswe khona, ngoba ikheli lomthombo liwukufakwa kwenqubomgomo, akulona ubufakazi bobunikazi.

Bhala indawo yokuphoqelela, umthombo obonakele kanye nomgomo kuthikithi. Uma kungenjalo unjiniyela olandelayo uzokwengeza i-firewall yesibili kanye nomgomo ofanayo.

Izihloko ezihlobene