I-VPN engathenjwa ingamakhona amathathu ahlukene, hhayi elilodwa

«Angiyethembi le VPN» ngokuvamile yizitatimende ezintathu ezigqoke umusho owodwa. Ontanga abakude kuloyo nethiwekhi bangafinyelela izinsizakalo kuhosti yakho, umqhubi ophethe umhubhe angabona ukuhamba okudlula kuwo, futhi isofthiwe yeklayenti oyifakile ingashintsha inqubomgomo yenethiwekhi yomshini wakho. Inkolelo efanele ukulungiswa iwukuthi umthetho we-firewall, umshini wobuciko noma ukukhetha ngokucophelela kwesistimu yokusebenza kuphendula kuzo zontathu. Isinyathelo ngasinye siphendula kokukodwa kuzo ngqo.

Inganekwane: ukulawula okukodwa kumboza yonke ingozi

Umbono ojwayelekile wukuthi ukujoyina inethiwekhi engathenjwa yisinqumo esisodwa nokunciphisa okukodwa. Abantu bakhetha ukulawula abase bekwethemba, bakusebenzisa futhi bacabanga ukuthi ingozi isiphelile: i-firewall ivuliwe, indawo yokusebenza iyalahlwa, iklayenti livela kumdayisi ohlonishwayo.

Lokhu kulawula akuhlangani ngendlela umbono oyisikisela ngayo. I-firewall yasehosti ikhawulela okungafinyelelwa untanga okude, futhi ayenzi lutho mayelana nomqhubi oqeda i-TLS yakho. Umshini wobuciko uhlukanisa indawo yokusebenza namafayela asehosti yakho, futhi awenzi lutho mayelana nengxenye yeklayenti evunyelwe ukuhlela kabusha isiteki senethiwekhi ngaphansi kwakho kokubili. Ukuqamba umngcele okhiqizwa ukulawula ngakunye ngempela yiwona msebenzi wonke.

Ukwehlukanisa kwabo kukutshela futhi ukuthi iyiphi ingozi oyikhethile ukuyamukela. Izinqumo eziningi zangempela zinciphisa umngcele owodwa futhi zibekezelela omunye, futhi lokho kulungile inqobo nje uma irekhodi loshintsho lisho ukuthi yimuphi umuphi.

Untanga okude angafinyelela ini ngempela

Qala ngezinsizakalo ezilalelayo. Isixhumanisi somhubhe esithathwa njengesethenjwayo kabanzi ngoba amaphakethe aso afike ekhodiwe iyiphutha elijwayelekile, futhi lenza isilaleli ngasinye sendawo sibe yithagethi engaba khona kunoma ubani omunye kuloyo nethiwekhi. Ukubhala ngokuyimfihlo kuvikela ucingo phakathi kweziphetho ezimbili; akusho lutho mayelana nenhloso yontanga ngakolunye uhlangothi.

ss -tulpn
sudo nft list ruleset
ip -br addr

Bopha izinsizakalo ekhelini ezilidingayo hhayi isixhumanisi ngasinye, futhi uvumele kuphela imisebenzi edingwa umsebenzi ogunyaziwe. Gcina ukudlulisela, ukuxhumanisa ngelebhu kanye nommeleli wezinhlelo kucacile, ngoba ukuxhumana kwamanethiwekhi amabili akukhiqizi indlela yokudlula ngokwako, kodwa umthetho wommeleli angakwenza impela.

Indawo yokusebenza elahlekayo egunyaziwe inciphisa okungafinyelelwa inethiwekhi ekude, kodwa kuphela lapho ukuhlela kwayo kokwabelana kuhambisana nesimangalo. Amafolda abiwe, ukuhlanganiswa kwebhodi lokunamathisela, ama-ejenti emininingwane yokufakazela kanye neziteshi zokuphatha konke kuwela umngcele okwakufanele indawo yokusebenza iwukhiqize. Ilebula lendawo yokusebenza alifakazeli lutho mayelana nokuthi yikuphi kwalokho okuvuliwe.

Isakhiwo sokungathembi lutho se-NIST sisho isimiso esingemuva kwakho konke lokhu: indawo yenethiwekhi iyodwa ayinikezi ukwethenjwa okusithekile. Ukuqinisekiswa kwemithombo kusenomsebenzi ngemuva kokwamukelwa komhubhe, futhi nombuzo wokuthi ubani omunye owabelana naleyo nethiwekhi nawo unomsebenzi.

Umqhubi osendleleni angabona ini

I-VPN ihambisa ukuhamba kwakho endaweni enye endleleni; ayinezi ukubhala ngokuyimfihlo kwezinhlelo. Uma umhlinzeki eqeda i-TLS yakho, angafunda lokho isiphequluli sakho obekuzovikela, futhi awukho umthetho we-firewall wendawo oshintsha lokho.

Gcina ukuqinisekiswa kwesitifiketi okujwayelekile endaweni yokugcina yangempela futhi uqonde indlela yesixazululi nemethadatha, ngoba umbuzo we-DNS ungambula okungaphezu komthwalo oyandulelayo. Imethadatha kuphela, okungukuthi yikuphi amakheli oxhumana nakho futhi nini, ivamise ukuphendula umbuzo womqhubi ngaphandle kwesidingo sokufunda okuqukethwe. Yingakho «ukuhamba kubhaliwe ngokuyimfihlo» kanye «ukuhamba kuyimfihlo» kuyizimangalo ezihlukene.

Uma lokho kubonakala kungamukeleki emsebenzini, impendulo isakhiwo esinye esigunyaziwe hhayi ukuhlunga kwendawo okuningi. Ukuhlunga kwendawo akukwazi ukususa umqaphi endleleni esahlezi kuyo.

Iklayenti lendawo lingashintsha ini

Lona umngcele abantu abawuphuthelayo, futhi yiwona owenza eminye emibili ingabi nancazelo. Ku-Linux, CAP_NET_ADMIN ihlanganisa ukuhlelwa kwesixhumanisi, ukuphathwa kwe-firewall kanye nezinguquko zomzila ngaphakathi kwesimo sayo senethiwekhi. Isofthiwe ephethe lelo khono ingabhala kabusha inqubomgomo oyibhale khona manje.

getcap /usr/sbin/openvpn
systemd-analyze security vpn-client.service
ip netns list

Isikhala samagama senethiwekhi singumngcele wangempela wesimo senethiwekhi futhi simbi kukho konke okunye: asihlukanisi uhlelo lwamafayela noma isitolo semininingwane yokufakazela. Kuthatha njengongqimba olulodwa hhayi njengesitsha senkinga yonke.

Thola iklayenti nokuhlelwa kwalo emthonjeni ogcinwayo, buyekeza igunya elikucelayo, futhi gcina izingxenye ezinamalungelo ngaphansi kokulawulwa umlawuli. Umshini wobuciko ungaba yingxenye yomngcele wokuhlola ofanelekayo ngaphandle kokuba imvume yokuqalisa isifaki esingachazwanga eceleni kwemininingwane yokufakazela eyigugu. Isifaki sisebenza nganoma yiliphi igunya olinikezayo, futhi lelo gunya liwumngcele.

Bhala ukuthi yimuphi umngcele owamukele

Qeda ngomusho oqamba izinto ezine: ikhodi yendawo ethenjwayo, ukufinyelela kude okuvunyelwe, idatha yohlelo evikelwe kanye nobudlelwano bomqhubi obusele. Lowo musho ubaluleke ukwedlula isimangalo esijwayelekile sokuthi i-VM, isistimu yokusebenza noma umkhiqizo wokulwa namagciwane wenza inethiwekhi enobutha yaphepha.

Bese uqinisekisa ukuthi umsebenzi omncane uyasebenza futhi ukwenqatshwa okudingekayo kusaqhubeka, ngisho nangemva kokuwa komhubhe. Umngcele okhona kuphela ngesikhathi umhubhe uphakeme awuwona umngcele owubhalile.

Akukho ukuhlolwa okufakazela ukuthi zonke izintunjambila azikho, futhi ukubuyekezwa okusho okuhlukile kweqisa. Umphumela othembekile uqamba ingozi eseleyo kanye nomuntu oyemukele.