Ingabe isivalo sokuphuthuma se-UFW sivimba i-VPN yakho? Vumela umlingani

Ulandele uhlu lokuhlola: nqaba ukuphuma, vumela umhubhe, vula ufw. Bese iklayenti ilinda ekuxhawuleni futhi ayixhumi neze, noma iyaxhuma futhi akukho khasi elilayishwayo. Kokubili ukwehluleka kuvela emgodini ofanayo. Umthetho ovumela umhubhe ukuthi ube khona awukho, ngoba umhubhe akusona isixhumanisi iphakethe lakho eliphuma kuso.

Kungani imvume ku-tun0 ekuqaleni ingafani nalutho

i-tun0 yenziwa iklayenti ngemva kokuba isikhathi sokuxhumana sikhona. Ama-datagram akha leso sikhathi ama-pakethe e-UDP ajwayelekile aqondiswe kumhlinzeki kuphothi 1194, futhi aphuma nge-wlan0 noma i-eth0 nekheli lomthombo lomzimba. allow out on tun0 lifana kuphela nethrafikhi isixhumanisi sokuphuma sayo eyi-tun0, ngakho phakathi kokuxhawula akifani nalutho.

Beka default deny outgoing phezulu futhi amapakethe angaphandle ayaphonswa ngaphambi kokuba isixhumanisi sivele. Iklayenti lizama futhi, isikhathi siyaphela futhi libika ukwehluleka kwe-TLS noma kokuxhawula, okuthumela abantu ukuba bafune kuma-certificate kanye ne-MTU ngesikhathi umdwebo womlilo udla uxhumano buthule. Umthetho okwakufanele uvimbe ithrafikhi yakho uwona ovimbela leyo thrafikhi ukuba ivinjwe.

Isixazululo esisheshayo senza ukuvuza kube unomphela. sudo ufw allow out on wlan0, noma ukubuyisela okumisiwe ekumvumeleni, kukhuphula umhubhe futhi kushiye umshini ungenaso isivalo: ngokuzayo lapho umhubhe uwela khona, konke kuqhubeka nge-adaptha yomzimba. Ngilahlekelwe yintambama yonke kulelo pheya lezinguquko ngaphambi kokuthola ukuthi iyiphi iphakethe engangiyihlunga ngempela.

Okudingwa amaqoqo amabili amapakethe

Ithrafikhi yakho iwela umdwebo womlilo kabili, ngezimo ezimbili. Iphakethe langaphakathi lihamba lisuka ekhelini lomhubhe liphume nge-tun0. Iphakethe langaphandle lihamba lisuka ekhelini lomzimba liye kumlingani, futhi yilokho kuphela okubonakala ocwecweni. Umthetho owodwa ngesimo ngasinye:

sudo ufw allow out on tun0
sudo ufw allow out to 203.0.113.10 port 1194 proto udp
sudo ufw allow out to 203.0.113.10 port 443 proto tcp comment 'tcp fallback'

Shintsha ikheli nephothi ngalawo asesigabeni sakho. Omlangani be-WireGuard ngokuvamile baphendula ku-51820/udp; amasigaba e-OpenVPN ahamba nge-TCP 443 adinga leyo phothi esikhundleni salokho. Imininingwane iyahluka, isimo asihlukani: imithetho yomibili incane, futhi ndawonye ichaza izindawo kuphela umshini ongafinyelela kuzo ngesikhathi umhubhe uwile.

Ukulandelana kuyindaba yesibili. Nge-iptables eluhlaza ufunda uchungechunge ukusuka phezulu kuye phansi futhi ucabanga ukuthi umuphi umthetho onqobayo. I-ufw ayisona sikhwama esincane sokuzungeza uhlu olulotshile; ihlanganisa imithetho yakho emaketangeni ayo futhi ikhetha izindawo zokufaka. ufw status iyayiprinta ngokulandelana kwe-ufw, hhayi okwakho. Lapho umthetho ubonakala unganakwa, qhathanisa ufw show added neqoqo elihlanganisiwe elivela iptables -S | grep ufw ngaphambi kokubhala kabusha noma yini.

Okuhlukile kumele kuhlale kubanzi bekhono elilodwa

Umthetho womlingani ulungile kuphela ngesikhathi usho ikheli iklayenti elishaya kulo. Abahlinzeki bashintsha izindawo zokugcina, futhi isigaba esixazulula igama lomsingathi sizolandela ushintsho lwe-DNS siye ekhelini elisha ngesikhathi umthetho usakhomba kwelidala. Lapho umhubhe osebenze izinyanga uyeka ukuphakama, qhathanisa ikheli elisemthethweni nalelo iklayenti elilifunayo ngaphambi kokunweba noma yini.

Ukunweba kuyo yonke i-subnet, noma kuyo yonke indawo kuphothi 1194, kubuyisela inqubomgomo emuva ekubeni umdwebo womlilo onomgodi. Okuhlukile yisivalo sokuphuthuma; uma sesibanzi, akukho okusele okokucisha. Kugcine ekhelini elilodwa futhi ushiye umbhalo osho isigaba nomhlinzeki esingeyakho, ngoba emva kwezinyanga eziyisithupha ikheli lizobonakala lingaqondile.

Ukuxazululwa kwamagama kufanele kube nomugqa wakho. Ukusesha kwenzeka ngaphambi kokuba umhubhe ube khona, ngesixhumanisi somzimba, ngakho inqubomgomo eqinile yokunqaba ukuphuma ingase ishiye iklayenti lingakwazi ukuthola iseva yalo. Vumela iphothi 53 ekhelini lesixazululi sakho, noma xazulula kanye bese ubophelela ikheli esigabeni. Ukuvumela i-DNS kuzo zonke izixhumanisi isinqumo, hhayi okumisiwe.

Yakha inqubomgomo ngaphambi kokuba umhubhe udingeke

ufw enable isebenzisa yonke inqubomgomo ngesikhathi esisodwa futhi ilayisha kabusha amaketanga ayo, futhi ukushintsha inqubomgomo emisiwe kumdwebo womlilo osebenzayo nakho kuyawalayisha kabusha. incwadi ye-ufw ixwayisa ukuthi lokhu kungawisa ukuxhumana okukhona njenge-SSH. Ngakho imiyalo ihamba ngalokhu kulandelana, nomthetho we-SSH ngaphambi kokuvula kanye nesikhathi sekhonsoli esivuliwe:

sudo ufw default deny incoming
sudo ufw default deny outgoing
sudo ufw allow out on tun0
sudo ufw allow out to 203.0.113.10 port 1194 proto udp
sudo ufw allow 22/tcp
sudo ufw enable
sudo ufw status verbose

ufw reset ishiywe ngamabomu ngaphandle kwalelo qoqo. Isusa wonke umthetho futhi ikhulisa umdwebo womlilo, futhi kumsingathi okude ukwenza okulandelayo ukusebenza yikho okulahla isikhathi sakho. Uma usabuyisela kabusha, engeza umthetho we-SSH futhi uqinisekise indlela yesibili yokubuya ngekhonsoli ngaphambi kokuqhubeka.

Ukulandelana akusona isihlobiso. Imithetho engezwe ngesikhathi i-ufw isebenza ayikhiphi lutho, kodwa ngomzuzu wokuguqula inqubomgomo emisiwe amaketanga ayaphinda alayishwe, futhi isikhathi esivunyelwe inqubomgomo endala sihamba nawo. Yenza okumisiwe, izimvume kanye nokuvula ngokuhamba kanye, ngesikhathi usanendlela yokungena engancikile emshinini.

Hlola isimo esivinjiwe, futhi gcina ukubuyisela emuva

Isivalo esingahloliwe siwukuqagela. Nqamula iklayenti ngamabomu bese uzama ukulayisha ikhasi: kumele kwehluleke. Xhuma futhi, futhi kumele silulame ngaphandle kokuthinta umthetho. sudo ufw status verbose iqinisekisa okumisiwe kanye nesimo sokuloga, futhi ufw status numbered ikhombisa ukuthi umuphi umthetho wokuhlola okufanele ususwe uma udlula inhloso yawo.

Gcina umbhalo obuyela emuva eceleni kwalowo oya phambili. Umshini onokunqaba ukuphuma nomhubhe ofile awukwazi ukulanda ukuzilungisa kwawo, ngakho ukubuyisela emuva kumele kube kudiski futhi kufundwe ngekhonsoli:

sudo ufw reset
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable

Yisebenzise lapho umhubhe usuwile futhi imithetho kumele isuswe, hhayi njengesinyathelo esijwayelekile. Ngaphambi kokuba uvale itheminali, izinto ezine kumele zibe yiqiniso: umthetho womlingani usho ikheli elilodwa ngqo, i-DNS inokuhlukile okushiwo ngegama, ukuvula kweza ngemva kwezimvume, futhi ukudonsa umhubhe kubulala ithrafikhi evamile ngaphandle kokubulala iklayenti unomphela.