Amaqembu amabili amaklayenti, iseva eyodwa: kuphi okufanele kuphoqelelwe khona inqubomgomo

Ukubeka amaqembu amabili amaklayenti kuma-subnet ahlukene kubonakala njengokuhlukanisa, futhi akusikho. Amakheli achaza ukuthi iphakethe libonakala livela kuphi, kuyilapho imvume iyisinqumo esithathwa yilokho okulidlulisayo. Lowo mbuzo uphendulwa ukucushwa hhayi imaski, ngakho nquma ukuthi iyiphi ingxenye edlulisa ithrafikhi phakathi kontanga ngaphambi kokubhala noma yimuphi umthetho.

I-subnet iyilebula, akuwona umthetho

Ukunikeza ichibi elilodwa iqembu ngalinye kukunikeza amakheli afundekayo futhi akukho okunye. Iklayenti elamukela umzila owengeziwe lithole ukufinyeleleka, futhi ukufinyeleleka akuyona imvume. Imvume yokukhuluma isesinqumweni sokudlulisa, esingase sihlale ku-daemon noma ku-kernel kuye ngokuthi iseva icushwe kanjani.

Ubunikazi bekheli yikho okwenza isiqalo sisebenziseke njengesikhethi seqembu. Wonke umazisi oqinisekisiwe kufanele uhambisane nekheli noma ibanga elilindelekile, futhi lokho kuhambisana kuyahluleka ngokushesha lapho amadivayisi amaningi abelana ngobufakazi obulodwa nokwabiwa okukodwa. Xazulula umazisi kanye nokwenzeka kanyekanye ngaphambi kokuthembela kwisiqalo somthombo, ngoba inqubomgomo eqagela ukuthi iyiphi imishini efonayo igunyaza okungalungile ngesikhathi esibi kakhulu.

Khetha indlela ethwala ithrafikhi phakathi kontanga

Lapho i-daemon idlulisa amaphakethe ontanga ngaphakathi kwesigaba sayo, lawo maphakethe awafiki neze kuhaka lokudlulisa lesibungazwa, ngakho umthetho we-kernel awakwazi ukuwabona. Vala lokho kudlulisa kwangaphakathi, i-kernel iba yindawo yokudlulisa, lapho imithetho evamile yokudlulisa isebenza khona.

# peer forwarding inside the daemon: enforce with per-group policy instead of FORWARD rules
client-to-client
# kernel forwarding path: remove the line above, then filter in the forward chain

Amashaneli edatha alayishiwe kanye namaseva aphethwe umkhiqizo ashicilela amamodeli awo okusebenzisa, ngakho qinisekisa ukuthi iyiphi oyisebenzisayo esikhundleni sokucabangela ukuziphatha komphakathi. Ukwehluleka okufanele kugwenywe umthetho obonakala ulungile ekubuyekezweni futhi ongalokothi ubuze ngesikhathi sokusebenza.

Bhala i-matrix ngaphambi kwemithetho

I-matrix emfushane kulula ukuyibuyekeza kunengeqo yemithetho, futhi iyisivumelwano okufanele ukusetshenziswa kusigcwalise: ontanga beqembu elifanayo bavunyelwe, ontanga phakathi kwamaqembu benqatshiwe, womabili amaqembu avunyelwe enkonzweni eyodwa ehlanganyelwe ebizwayo, konke okunye kunqatshiwe. Bhala leyo mikhathi emine ngaphambi kokuvula isihleli se-firewall. Umhloli ongafundi inqubo yemithetho usengayihlola i-matrix. Khona-ke ukusetshenziswa kufanele kuphela kuhambisane nemikhathi.

Hlukanisa izigaba ezintathu zendawo ekuyiwa kuyo lapho ubhala. Insizakalo kusibungazwa se-VPN ingukufaka kwendawo, elinye iklayenti ukudlula kontanga, futhi umshini ongemuva kwesango uyindlela ehlukile yokudlulisa. Umthetho owodwa onesandla esivulekile ungase unikeze zontathu ngephutha, futhi yilapho inqubomgomo yeqembu iba inethiwekhi eyisicaba enezinyathelo ezengeziwe. Bhala isigaba eceleni komugqa ngamunye ukuze inhloso isinde ekuhleleni okulandelayo.

Beka imithetho lapho izohlala khona

Engeza izinqumo endaweni efanayo lapho kunakekelwa khona enye ingxenye ye-firewall, ngaphambi kwanoma yimuphi umthetho ovumelayo ongase uwagwinye. Ukulandelana kwemithetho kuyingxenye yenqubomgomo, futhi umthetho olungile obekwe ngemuva kokwamukelwa okubanzi awuphoqeleli lutho. Qopha izinombolo zemithetho ngaphambi nangemuva koshintsho. Inqubomgomo ekhona kusihleli kodwa engekho eqoqweni lemithetho elisebenzayo iwuhlelo, hhayi ukulawula.

Nquma ukuthi kwenzeka nini emithonjeni esivele ikhona lapho inqubomgomo ishintsha, ngoba isikhathi esivulwe ngaphambi koshintsho singaqhubeka ngemuva kwaso. Uma ilungu elihambayo kufanele liphulukane nokufinyelela ngokushesha, iqoqo lemithetho lidinga indlela yokuqeda leso simo esikhundleni sokulinda ukuthi uxhumano luzivala ngokwalo.

Yenza imithetho ihlale njalo ngomshini ongumnikazi wenye ingxenye ye-firewall, futhi qopha i-matrix eceleni kwayo. Inqubomgomo engaqoshiwe iphinde itholakale kusukela enkumbulweni ngesigameko esilandelayo, ngokuvamile ngumuntu ogijimayo.

Fakazela kuzinhlangothi zombili

Hlola ukufinyeleleka ngaphakathi kweqembu elifanayo, ukwehluleka phakathi kwamaqembu kanye nensizakalo ehlanganyelwe kusuka kuklayenti eyodwa eqenjini ngalinye. Ukuhlolwa okukodwa kusuka kuklayenti elilodwa kufakazela uhhafu we-matrix, futhi uhhafu oshiywe ngemuva ngokuvamile uwona ongalungile. Phinda isiqondiso sokwenqaba kabili, ngoba isikhathi esigcinwe kusiqukathi singafihla iphutha lokusebenzisa. Qopha ukuthi yiluphi ugwele oluhlolile ukuze umuntu olandelayo angakuphindi.

Phinda ukuhlola ku-IPv6 uma umhubhe uyithwala, futhi gcina ukuqinisekiswa kwezinhlelo ezijwayelekile. Isiqalo somthombo akusona i-akhawunti, ngakho ukudlula inqubomgomo yenethiwekhi akusho ukuthi insizakalo kufanele ithembe ofonayo.