i-ufw allow 443 ayizange isize isevisi engemuva kwe-VPN

I-ping iyaphumelela kusukela kuklayenti ye-VPN, isevisi ye-TCP iyaphelelwa isikhathi, futhi ufw allow 443/tcp ayishintshi lutho nhlobo. Lapho uhlelo lusebenza kumphathi ongemuva kwesango hhayi esangweni ngokwalo, leyo mvume yayibhalelwe umzila wethrafikhi okungewona. Iphakethe alilukiwe kwi-firewall futhi alinikezwa kunqubo yasendaweni, ngakho imithetho yokungena ayilokothi iliyibone. Isixazululo umthetho wendlela oqondise ekugelezeni okudluliswayo, futhi ubufakazi balokho sebukukhona kurekhodi.

Nquma ukuthi indawo okuyiwa kuyo yasendaweni noma idlulisiwe

Funda iphakethe ngendlela i-kernel elibona ngayo. Ithrafikhi elethwa kwisevisi esangweni ingukufaka kwasendaweni. Ithrafikhi isango eliyidlulisela komunye umphathi iyadluliswa, futhi i-UFW igcina amaqoqo emithetho ahlukene emizileni yomibili. Umehluko unqunywa ikheli lendawo okuyiwa kuyo kanye nokusesha komzila, hhayi isixhumanisi iphakethe elafika ngaso.

Umugqa werekhodi okhombisa isixhumanisi esifanayo kuzo zombili izinkambu ze-IN ne-OUT usengachaza iphakethe elihambiswe ngomzila, ngoba ithunjana elithwala amaklayenti lingene liphume kudivayisi eyodwa libukeka kanjalo impela. Ikheli lendawo okuyiwa kuyo lixazulula lo mbuzo ngokushesha kunamagama ezixhumanisi. Ukubona igama elifanayo kabili akubufakazi bokulethwa kwasendaweni, futhi ukusungula isixhumanisi sethunjana okungakaze kusidalwe ukusetshenziswa akusizi futhi.

Funda ibhlokhi ngaphambi kokwengeza noma yimuphi umthetho

Phinda wenze umzamo owodwa wokuxhumana ogunyaziwe futhi urekhode umthombo, indawo okuyiwa kuyo, iphrothokholi kanye nechweba lendawo okuyiwa kuyo njengoba isango likurekhodile. Qhathanisa lawo manani amane nokufakwa kwerekhodi kanye nendawo yangempela yesevisi. I-ping eyaphumelela ngaphambili ifakazela kuphela ukuthi ukushintshana kwayo uqobo kwakugunyaziwe, futhi i-firewall ingase iphathe i-TCP SYN eya kuhlelo ngendlela ehluke ngokuphelele.

sudo dmesg | grep "UFW BLOCK" | tail -n 5
sudo ufw status numbered

Umyalo wokuqala ubuyisela isinqumo kanye nezinkambu zawo, kanti owesibili ukhombisa ukuthi yini esivele ilayishiwe nangokulandelana kwakho. Funda kokubili ngaphambi kokuhlela noma yini, ngoba ukunqatshwa kwangaphambili okungaphezu komthetho wakho kuchaza uphawu olufanayo ngaphandle komthetho ongekho.

Bhala umthetho womzila omncane kakhulu ofanele

Kulesi sibonelo amaklayenti afika ku-tun0 esuka ku-172.20.8.0/24, isevisi ilalela ku-10.30.0.15 echwebeni 8443, futhi isango liphuma nge-ens5. Lawo manani akhethwa ukuze angafani neze nokungagqagqani kwe-VPC yasefu eziyi-10.0.0.0/16 noma inethiwekhi yasekhaya eyi-192.168.0.0/16, futhi i-8443 igcina isibonelo kude nesilaleli se-443 sesango uqobo.

sudo ufw --dry-run route allow in on tun0 out on ens5 proto tcp from 172.20.8.0/24 to 10.30.0.15 port 8443

Ukusebenza okomile kuphrinta iqoqo lemithetho elingase libe khona, futhi yileyondlela eshibhile yokubona ukuthi umthetho wakho uwela ngaphambi noma ngemuva kokunqatshwa okukhona. Qinisekisa amagama ezixhumanisi namakheli angaphakathi ngokumelene nokusetshenziswa hhayi ngokumelene nesibonelo, futhi khumbula ukuthi lapho i-NAT yendawo okuyiwa kuyo isebenza kuqala, isihlungi sibona indawo okuyiwa kuyo esihunyushiwe.

Gcina indlela yokubuya inesimo

I-UFW ilandelela ukuxhumana okuvunyelwe, ngakho izimpendulo zokugeleza okudluliswayo okuvunyelwe zamukelwa ngaphandle komthetho ophambene osobala. Ukwengeza umthetho ongenamingcele endleleni ephambene ukuze izinto zisebenze kwandisa inqubomgomo kude nesevisi eyodwa futhi akudingeki ekushintsheni okujwayelekile kwesicelo nempendulo. Gcina indlela yokubuya icashile futhi iqoqo lemithetho lifundeka.

Sebenzisa umthetho kuphela lapho ukusebenza okomile kuhambisana nenhloso yakho, bese uqinisekisa ukuthi uhlu oluhleliwe lukhombisa wona endaweni elindelekile. Gcina isilaleli se-VPN nemithetho yokuphatha njengezindaba ezihlukene, ngoba ukuzishintsha kuyisinqumo esihlukile ekugunyazeni uhlelo olulodwa. Bhala ushintsho endaweni efanayo lapho kubhalwe khona itopoloji, ukuze unjiniyela olandelayo angaphindi awuthole futhi kusuka ekubanjweni kwamaphakethe.

sudo ufw route allow in on tun0 out on ens5 proto tcp from 172.20.8.0/24 to 10.30.0.15 port 8443
sudo ufw status numbered

Hlola lokho i-UFW engakwazi ukukuphoqelela

Umthetho olungile usadinga ukudluliswa kwe-kernel kanye nomzila ofinyelela kwisevisi. Qinisekisa kokubili ngaphambi kokusola i-firewall okwesibili.

sysctl net.ipv4.ip_forward
ip route get 10.30.0.15

Bese ubheka ngaphandle komphathi. Kusimo sefu, inqubomgomo ye-UFW yesivakashi ayithathi indawo yamaqembu okuphepha, ama-ACL esizindamininingi noma ukucushwa kokudlulisa komhlinzeki uqobo, ngakho ukuvinjwa kwasendaweni kuwubufakazi mayelana nongqimba olulodwa hhayi ubufakazi bokuthi zonke ezinye izingqimba zivumela isevisi.

Qeda ngokuhlola ukuxhumana okusha ngenkathi i-firewall ivuliwe, kusukela emthonjeni ovunyelwe nakomunye ongahlobene. Ukukhubaza i-UFW kususa uphawu futhi kubhubhisa ubufakazi ngomyalo ofanayo, ngakho kufanele kube ukuhlolwa kokugcina hhayi kokuqala.