Ukuhlola izinguquko ze-firewall ngaphandle kokuzivalela ngaphandle
Hlela izindlela zakho zokubuyisela ngaphambi kokuba umthetho ungene, bese uqinisekisa ngokugeleza okufanele kukuhlole umgomo omusha, hhayi ngesikhathi esisindile.
Umthetho ungena, itheminali ovele unayo iyaqhubeka nokuphendula, futhi ukungena okulandelayo kuyanqatshwa. Lelo gebe yiyo yonke inkinga yokuhlola ushintsho lwe-firewall ngoxhumano olushintshayo. Ukulandelela ukuxhumana kunquma kanye bese kuyeka ukubuka, ngakho ukugeleza okusunguliwe ukuphela kokuhlola okungeke kukwazi ukubona umgomo omusha. Okulandelayo kuqhathanisa izindlela ezintathu zokubuyela emuva, bese kunquma ukulandelana okufanele kushintshwe futhi kuhlolwe ngakho imithetho.
Kungani isikhathi esisindile siwubufakazi obuthakathaka kunabo bonke
I-firewall enesimo ihlola iphakethe lokuqala lokugeleza futhi igcina leso sinqumo inqobo nje uma umbhalo uphila. Imithetho engezwa kamuva isebenza ekugelezeni okuqala kamuva, yingakho iwindi olibhalayo lihlala lisebenziseka kuyilapho bonke abanye benqatshwa. Lokho okufundayo kusichaza umgomo owawusebenza ngemizuzu embalwa edlule. Ngisho ukuthwebula okuthathwe kulokho kugeleza kubonisa isinqumo umshini osuwuthathile.
Thatha isikhathi esisebenzayo njengendlela yokuphuma ephuthumayo, hhayi njengesilinganiso. Konke ukuhlola okufanelekile kufanele kuvule ukugeleza okusha kusuka kumthombo umthetho omusha ozokuhlola, futhi ukuhlola kokuqala kufanele kube yilokho okungeke kuhlotshwe uma kwehluleka. Uma leso sikhathi siyiyo kuphela indlela yokungena, ushintsho alukakalungi ukwenziwa.
Izindlela ezintathu zokubuyela emuva, zihlelwe ngokuthi ngayinye incike kokuthini
Hlela izinketho ngokuthi zincike kangakanani kudivayisi ehlolwayo, ngoba yilokho kulandelana okuphatha uma umthetho ubonakala ungalungile. Ikhostolo engalokothi idlule kwi-firewall izimele, ukubuyiselwa emuva okuqeqeshiwe kucishe kube njalo, futhi isikhathi esivele sivuliwe asinjalo.
| Way back in | What it survives | Where it fails |
|---|---|---|
| out-of-band or hypervisor console | a policy that blocks new logins | needs separate access you have already tried |
| rollback rehearsed on that platform | a rule that breaks remote access | fails when nobody ever ran it |
| the session that is already open | the change itself | cannot show whether new flows work |
Ngaphambi koshintsho, ngena ngekhonsoli futhi ubonise ukuthi iyasebenza, ngoba indlela yangaphandle ongakaze uyisebenzise iwumdwebo hhayi indawo yokubuyela. Ukubuyiselwa emuva kuthola indawo yako kuphela ngemva kokuqeqeshwa kuleyo nkundla, ngalelo qoqo lemithetho, ngokulandela inqubo evunyiwe esikhundleni sokwenza ngokushesha emshinini ophilayo. Bhala izinyathelo futhi ucele omunye umuntu ukuba azifunde. Uma ukulandelana kudinga inkumbulo yakho ukuze kuqedwe, akuwona uhlelo.
Ushintsho olulodwa, bese kuba uxhumano okufanele luhlolwe
Gcina iqoqo lemithetho elisebenzayo kanye nefayela elinalo, bese wenza ukuhlela okukodwa okuncane. Ushintsho olulodwa ngokuhlola ngakunye kugcina umphumela ungabe unikezwa; ezimbili ngesikhathi esisodwa zikushiya ngomshini osebenzayo nangokungabi nolwazi ukuthi yikuphi ukuhlela okwenzile umsebenzi. Lapho inkundla ingakwazi ukuhlaziya ukucushwa ngaphandle kokukulayisha, kwenze lokho kuqala, ukuze iphutha lokuthayipha lihluleke kuyilapho kungekho lutho olusengozini.
nft list ruleset > /root/ruleset.before
nft -c -f /etc/nftables.confBese uqala isikhathi esisha kusuka kumthombo umthetho oshintshiwe ozohambisana nawo, kuyilapho ikhonsoli isaxhunyiwe. Kuphinde kanye uma kuphumelela, ngoba umzamo wokuqala ungase uhlale kumbhalo ithebula eliwugcinile kakade. Uma kwehluleka, usenayo indlela yokungena nesinqumo okufanele sibuyiselwe emuva, futhi lowo umphumela omubi oshibhile kunayo yonke okhona.
Izibali, isimo kanye nefayela ziphendula imibuzo ehlukene
Ngakunye kwalokhu okuthathu okubonwayo kungabonakala kukholisa kukodwa futhi kukudukise mayelana nezinye ezimbili. Izibali zibonisa ukuthi ukugeleza okusanda kudalwa kufinyelele kumthetho owuhlelile. Ithebula lesimo libonisa ukuthi imiphi imigelezo umshini ekholwa ukuthi isivele isunguliwe, futhi ngakho umthetho ophukile usengabonakala uphilile. Ifayela eligciniwe libonisa lokho idivayisi ezokwenza ngemva kokulayisha kabusha okulandelayo, futhi lokho kungenzeka kungabi yilokho iqoqo lemithetho elisebenzayo elikwenzayo manje.
ss -tn state establishedFunda izibali njengomehluko hhayi njengesamba, ngoba inombolo eyodwa ebalulekile yileyo eyanyakaziswa ukugeleza kwakho kokuhlola. Umthetho isibali sakhe esingalokothi sikhule awuhambisani, noma ubukeka ulungile kangakanani ephepheni. Qinisekisa nesimo sokunqaba: umgomo ongakaze unqabe lutho awukaze ubonise ukuthi unqaba lokho obuhlose ukukuvimba. Dabuza isixhumanisi esisodwa kuwo wonke umkhakha ingeniselo eliwuthwalayo ngempela, ngoba umthetho we-v4 awusho lutho ngokugeleza kwe-v6.
Buyisela kusuka kuqoqo lemithetho eligciniwe, bese wenza ifayela lihambisane
Uma ushintsho lwehluleka, layisha iqoqo lemithetho eligciniwe esikhundleni sokwengeza imithetho evumelayo kuze kube ukungena kusebenza futhi. Ukwenyuka ngakunye kokuvunyelwa kuthulisa uphawu futhi kushiya imbobo ehlala isikhathi eside kunesehlakalo nesikhumbuzo saso. Buyisela, xhuma futhi, bese ugcina ukuqhathanisa okwehlulekile eceleni kombhalo walokho oyizamile.
Ngemva koshintsho oluphumelelayo, yenza ifayela elikudiski lichaze iqoqo lemithetho elisebenzayo, futhi uqinisekise ukuthi ukulayisha kabusha kuyakukhiqiza futhi. Iqoqo lemithetho eliphilayo elisuke lehlukana nefayela lalo lokucushwa liwugibe obekelwe ukuqalisa kabusha okulandelayo.