I-UFW ilahla iseva ye-DNS ye-VPN ngokushesha lapho umhubhe ukhuphuka
Umgomo wokwenqaba okuzenzakalelayo we-UFW uhlanganisa ne-interface yomhubhe. Hlela ithrafikhi ngendlela, vumela i-resolver eqhutshwayo ku-tun0, bese uvula indlela yangaphandle.
Amagama ayeka ukuxazululwa ngaso leso sikhathi lapho i-VPN ixhuma khona, kuyilapho i-ping eya ekhelini lomphakathi isaphendula futhi isimo se-firewall asibonisi lutho olubonakala lungalungile. Akukho okushintshile kumgomo; okushintshile ukuthi kwavela i-interface entsha, futhi ukwenqaba okuzenzakalelayo kuyambozo kusukela kupakethe lokuqala. I-UFW inquma ngendlela nange-interface, ngakho umthetho obhalelwe ukuxhumana okungenantambo awusho lutho ngethrafikhi ephuma emhubheni. Ukulungisa kuyiqembu elincane lemithertho emincane esetshenziswa ngokulandelana okuthile.
Uphawu luvela kuphela ngemva kokuba umhubhe ukhuphukile
Umgomo wokwenqaba okuzenzakalelayo wenza ngqo lokho okushiwo kuwo: noma yini engenawo umthetho ohambisanayo iyenqatshwa, kuyo yonke i-interface ekhona. Umhubhe wawungekho ngesikhathi kubhalwa imithertho, ngakho awukho nowodwa ongawubamba, futhi ukwenqaba obekulokhu kukhona manje kusebenza ekuxazululweni kwamagama. Ithrafikhi eqondile eya ekhelini elingokoqobo isengasebenza lapho imvume ebanzi iyihlanganisa, yingakho i-ping eya ku-resolver yomphakathi iphumelela kuyilapho ukusesha igama kwehluleka. Isikhala umthetho we-interface umgomo ongakaze uyibone.
Lokho futhi kuchaza ukuthi kungani ukwehluleka kuphenduka ngokuhlanzekile: susa umhubhe futhi amagama ayaxazululwa futhi, ngoba umbuzo ubuyela ku-interface enemithertho. Umgomo ohlulekayo kuphela lapho umhubhe ukhuphukile awuyona inkinga ye-DNS, futhi ukulungisa i-resolver uqobo kuchitha isikhathi esiningi lapha. Funda uhlu lwama-interface ngaphambi kokufunda ukumiswa kwe-resolver.
Izindlela ezintathu, amasethi amathathu ahlukene emithertho
Iseshini eyodwa ithinta imithertho ezindlelani ezingaphezu kweyodwa, futhi umhubhe wengeza i-interface yesibili cishe kuzo zonke. Ukuhlela ithrafikhi ngendlela nange-interface kuqala kwenza okunye kube ngumshini, ngoba umugqa ngamunye ngezansi udinga umthetho wawo endaweni yawo. Izibonelo zisebenzisa i-tun0 kanye nechibi le-10.8.0.0/24, ngakho shintsha amagama nezinkambu ngalokho okukukhulumayo okuphumayo kuklayenti uqobo.
| Direction | Example packet | Rule that admits it | Written on |
|---|---|---|---|
| Client to the pushed resolver | A DNS query to 10.8.0.1 | Destination port 53 over the tunnel | The client's tun0 |
| Client to the VPN server | A handshake to the server's public address | Server address and port on the physical link | The client's physical interface |
| Server to a service | SSH from the pool to port 22 | Source pool, destination port, tunnel interface | The server's tun0 |
| Anyone to the listener | The VPN listener itself | 1194/udp on the public side | The server's public interface |
Imigqa emibili ivame ukudidaniswa ngoba yomibili ikhuluma ngomhubhe. Umthetho we-resolver uvumela ithrafikhi ekuthunyelwa iklayenti emhubheni, kuyilapho umthetho we-SSH uvumela ithrafikhi etholwa iseva kuwona; bahlala emishinini ehlukene futhi bahluleka ngokuzimela. Umugqa okhohlakala kakhulu ngowesibili, ngoba iklayenti alikwazi ukwakha umhubhe nhlobo kuze kube yilapho ithrafikhi yalo eya ekhelini lomphakathi leseva ivunyelwa. Sebenza kusuka phezulu kuye phansi futhi ukwehluleka ngakunye kunesizathu esisodwa esingaba khona.
I-resolver eqhutshwayo idinga umthetho wayo
Ukuthi umhubhe uthwala i-DNS kuncike kulokho okuthunyelwa iseva. Iseva eqhuba inketho ye-resolver ifaka ikheli langasese ekumisweni kweklayenti, futhi lelo kheli lihamba ngomhubhe kuphela. Uma iseva ingathumeli lutho, iklayenti ligcina i-resolver elalikade linayo futhi imithertho engezansi ayinalutho lokuvumela. Hlola isimo esiqhutshiwe kanye nomphumela wamanje wombuzo ngaphambi kokubhala noma yini:
dig +short @10.8.0.1 example.com
resolvectl status tun0
sudo ufw status numberedUmphumela wesimo usho i-resolver esetshenziswayo kanye noxhumano eliboshelwe kulo, futhi ukusesha komzila ngemuva kwawo kubonisa ukuthi iyiphi i-interface ezoqhuba umbuzo kulelo kheli. Lapho i-resolver ihlezi kolunye uxhumano, inkinga ingaphambi kwe-firewall futhi awukho umthetho ozo siza. Lapho kokubili kuvumelana ngomhubhe, kudingeka imithertho emibili, ngoba i-UDP ithwala iningi lemibuzo futhi i-TCP ithatha indawo lapho impendulo inqanyulwa. Bhala kokubili amanani, ngoba yiwona imithertho ezoqamba wona:
sudo ufw allow out on tun0 to 10.8.0.1 port 53 proto udp comment 'pushed resolver'
sudo ufw allow out on tun0 to 10.8.0.1 port 53 proto tcp comment 'truncated answers'Vula indlela yangaphandle ngaphambi kwengaphakathi
Iklayenti kufanele lifinyelele ikheli lomphakathi leseva ngaphambi kokuba umhubhe ube khona, ngakho umthetho walokho uhlezi kuxhumano lomzimba futhi kufanele ube sendaweni yawo kuqala. Umgomo ovumela i-resolver kodwa ukhohlwa iseva ushiya iklayenti lingakwazi nhlobo ukwakha umhubhe, futhi lolo phawu luvame ukubekwa ku-kill switch. Bese uvumela izinsizakalo owawuzifuna ngempela ngomhubhe, umthetho omncane ngamunye ngesikhathi, esikhundleni sokuvula i-interface yonke. Imithertho emincane iyisizathu sokuthi ukwenqaba kungahlala endaweni yako.
sudo ufw allow out to 198.51.100.10 port 1194 proto udp comment 'vpn server'
sudo ufw allow out on tun0 to any port 443 proto tcp comment 'web through tunnel'Ukulandelana kubalulekile ngesikhathi sokuhlola, ngoba umthetho wokuqala yiwo ovumela umhubhe ukuthi ukhuphuke nhlobo. Wengeze, xhuma, futhi qinisekisa ukuthi umhubhe ukhuphukile ngaphambi kokwengeza umthetho wensizakalo, ngoba ukwenza kokubili ngesikhathi esisodwa kusho ukuthi ukwehluleka akukutsheli lutho ngokuthi yiluphi uhlangothi olungalungile. Shintsha ikheli ledokhumenti elingenhla ngephuzu lokugcina iklayenti elilungiselelwe lona.
Qeda uhlangothi lweklayenti ngokunqamula uxhumano ngamabomu. Ukwenqaba kufanele kusenqabe ithrafikhi oyikhiphe ngamabomu, ngoba i-resolver ephendula lapho umhubhe ukhuphukile ihlanganisa ingxenye eyodwa kuphela yomgomo onqaba lapho kukhona ukungabaza.
Iklayenti elixhumayo alikamukelwa
Iseva inendlela yayo okufanele icatshangelwe, futhi iklayenti eliqeda ukuxhawulisana alikafinyeleli lutho olusebenza kuseva kuze kube yilapho iseva ilimukela. Umthetho wesilaleli somphakathi uvumela umhubhe ukuthi ube khona kuphela; awungenisi ithrafikhi yomhubhe. Kuseva lokho kuyimithertho emibili kanye nokuhlola okukodwa kokuthi insizakalo ilalela ngempela:
sudo ufw allow 1194/udp comment 'openvpn listener'
sudo ufw limit in on tun0 from 10.8.0.0/24 to any port 22 proto tcp comment 'admin over tunnel'
ss -ltn | grep ':22'Ichibi elisemthethweni kufanele lilingane nenkambu eyabelwa iseva, futhi inombolo yomhubhe kufanele ihambisane naleyo eyadalwa iseva, ngoba umthetho we-interface ehlukile awukwazi ukuhlukaniswa nokungabikho komthetho. limit kwenziwe ngamabomu kumbobo yokuphatha, ngoba kunciphisa ukuxhumana okuphindaphindayo esikhundleni kokukwamukela ngaphandle komkhawulo. Ukuhlola kwesilaleli kuhlukanisa umbobo ovaliwe kupakethe elahliwe, okubonakala kufana kusuka kuklayenti. Imithertho enezinombolo nayo ayisona isithombe esiphelele: imithertho ye-before ye-UFW kanye nanoma yimuphi umugqa we-nftables obhalwe ngesandla kuhambisana ngaphambili futhi kusengase kwenqabe ipakethe uhlu olubonakala luluvumela.