I-VPN ixhunyiwe kodwa i-firewall isavimba: ungazi kanjani ukuthi iyiphi

Ikhasimende lithi ixhunyiwe, insiza isala namanje, futhi isinyathelo esilandelayo esivamile ukucima okuthile. Izilawuli ezimbili kulo musho zenza imisebenzi ehlukene: i-VPN yakha indlela yethrafikhi ehlanganisiwe, futhi i-firewall inquma ngokuxhumana ngakunye ukuthi ithrafikhi ingadlula yini. I-tunnel esebenzayo enomgomo onqabayo ibonakala njenge-tunnel ephukile esihlalweni somsebenzisi, ngakho umsebenzi uwukuthola ukuthi isiphi isigaba esiphendulayo. Nansi indlela engiyilandelayo, kanye nokufunda okukutshela ukuthi ume.

Ihlukanise indlela nomgomo

Qala ngesimo sokuhluleka, ngoba lolo ulwazi lwamahhala. Ukushona kwephakethe kubangela isikhathi sokulinda: ikhasimende lizama futhi, akukho okubuyayo, futhi umyalo ulenga kuze kube yilapho unikezayo. Ukunqatshwa kubangela ukunqatshwa noma ukusethwa kabusha: okuthile kuphendule futhi kwathi cha. Insizakalo engalaleli yala kusibungu ngokwaso, ngaphandle kwayo yonke i-firewall.

Le miphumela emithathu ikhomba ezigabeni ezahlukene. Isikhathi sokulinda sisho ukuthi kwenye indawo umgomo ulahla buthule, noma indlela ayiphumi neze emshinini. Ukunqatshwa kusho ukuthi ufike kusibungu futhi isiteki saso noma i-firewall yaso yasendaweni yala. Ukuthula okuphelele, ngesixhumi se-tunnel sikhona futhi kungekho ndlela eya endaweni ekuhloswe kuyo, kusho ukuthi indlela ayilungile futhi awukho umthetho we-firewall ozoyilungisa.

Funda indlela ngokuhamba okukodwa

Qinisekisa ukuthi i-tunnel ihlanganisa indawo ekuhloswe kuyo ngaphambi kokubheka umthetho owodwa. I-tunnel ehlukanisiwe ethwala kuphela inethiwekhi encane yehhovisi ngeke iqondise isicelo kububanzi obunye, futhi lapho ukuhluleka kubonakala njengokuvinjwa kwe-firewall okungeyona:

ip route get 10.20.4.15
ip -brief address show
wg show
sudo ipsec statusall

Umphumela wendlela usho isixhumi iphakethe elizophuma ngaso kanye nekheli lomthombo elizoluthwala. Uma leso sixhumi kungeyona i-tunnel kodwa ikhadi lakho lenethiwekhi lomzimba, inkinga isekuhlelweni kwendlela noma ezinhlakeni ezivunyelwe ze-tunnel, futhi ingeyokuhlelwa kwe-VPN hhayi eye-firewall.

Isicupho esisodwa esiqondene ne-VPN sifanele ukuhlolwa kwaso. Ku-WireGuard, AllowedIPs yezingane iyindlela futhi isihlungi sokubethela ngesikhathi esisodwa: iphakethe elikheli lomthombo lalo elingahambisani nesethi evunyelwe yezingane liyaphonswa ngaphambi kokuba noma yimuphi umthetho we-firewall ubhekwe. Ngakho i-firewall yesibungu elungile ngokuphelele ingaba ngemuva kokulahla okuthule okubonakala njengomgomo, futhi isixazululo umugqa wokuhlelwa kokhiye hhayi umthetho.

Funda umgomo esigabeni esiphendulayo

Uma indlela ilungile, hamba nomgomo usuka esibungwini uye ngaphandle futhi ubheke isigaba esisodwa kuphela esinyakaza izibali zaso:

ss -ltn | grep ':443'
sudo nft list ruleset
sudo iptables -S INPUT
sudo ufw status verbose

Isokhethi elalelayo iphendula umbuzo ohlukile kunemitherho. Uma kungenasikhulumayo kuphothi, i-kernel iyala ukuxhumana futhi awukho umthetho wokungena ofanele. Uma isokhethi ikhona futhi ukuxhumana okuvela kukhasimende elikude kuphelelwa isikhathi, ukulahla kwenzeka endaweni ethile endleleni, futhi izibali zemitherho zikutshela ukuthi kwenzeka lapha yini.

Vula ukuloga kwephrofayela noma uchungechunge okusolayo esikhundleni sokuqagela ngaphandle. Ukulahla okukodwa okurekhodiwe okusho umthombo, indawo ekuyiwe nephothi kubonisa isigaba nomthetho, futhi kufakazela nokuthi iphakethe lafika, into okungekho ukuhlolwa ohlangothini lukakhasimende okungayiqinisekisa.

Funda isinqumo segedi uma i-tunnel iphela lapho

Egedini lesayithi-kuya-sayithi noma lokufinyelela kude, i-VPN iqinisekisa umsebenzisi futhi umgomo ugunyaza insiza, futhi leyo izigunyazo ezihlukene. Umsebenzisi ovunyelwe ukungena ku-tunnel akavunyelwa ngokuzenzakalela kuyo yonke isibungu sangaphakathi, futhi ukunqatshwa kuvame ukuvela kumthetho wokudlulisela ngesikhathi i-tunnel ngokwayo iphilile. Ukwehlukaniswa okufanayo kuvela ku-IPsec, lapho umgomo wokuphepha okhetha ithrafikhi uhlukile kusihlungi esiyivumelayo, futhi yingakho kokubili kubhalwe njengezindlela ezahlukene ku-RFC 4301.

Hlola indlela yokubuya ngokucophelela okufanayo nendlela yokuhamba. Ukuhlunga kwesimo kudinga ukubona impendulo, ngakho ukuhlelwa kwendlela okungalingani ngokusebenzisa i-tunnel ngakolunye uhlangothi nokuyizungeza ngakolunye kukhiqiza ukulahla okubonakala kungahleliwe futhi okuphindaphindeka kuphela kumakhasimende athile. Uma ithrafikhi ifika egedini futhi ima, funda umthetho wokudlulisela kanye nendlela yokubuya ndawonye ngaphambi kokunweba noma yini.

Igedi futhi yindawo lapho umthetho we-NAT noma wokufihla ungafihla khona umthombo wangempela. Uma izibungu zangaphakathi zibona ikheli legedi esikhundleni sekhasimende, imithetho yazo ye-firewall yesibungu okufanele ihambisane neqoqo lamakhasimende ayisoze yahambisana, futhi isixazululo singesegedi hhayi sesiseva ngayinye.

Shintsha isigaba esincane kakhulu, bese uqinisekisa

Mela ukulungiswa okubanzi. Ukucima i-firewall yesibungu, ukwengeza umthetho ovumela konke, noma ukuphoqa zonke izixhumi ukuba zingene kuphrofayela ethenjwayo ngakunye kususa isilawuli ebesisebenza, futhi ushintsho luhlala ngemuva kwesigameko. Umthetho olinganiselwe kububanzi bomthombo nakuphothi okukhulunywa ngalo kulula ukuwubuyekeza, kulula ukuwususa, futhi ushiya umgomo osele womshini unganakiwe.

Qinisekisa ngokuhlolwa okufanayo okwahluleka, kusukela kukhasimende elifanayo, bese kuba kanye futhi ngemuva kokuxhuma kabusha, ngoba umthetho owawuhambisana ngaphambi kokuba i-tunnel ixoxe kabusha ungase uyeke ukuhambisana ngemuva kwalokho:

nc -vz 10.20.4.15 443
curl -v --max-time 5 https://10.20.4.15/

Ngaphambi kokuvala:

• Indlela eya endaweni ekuyiwe iphuma ngesixhumi se-tunnel, futhi ikheli lomthombo lihambisana nalokho okulindelwe umgomo.
• Kukhona okulalelayo kuphothi, futhi ukunqatshwa noma isikhathi sokulinda kuthiwe kumthetho oqanjiwe hhayi ukucatshangwa.
• Igedi lidlulisela nhlangothi zombili, futhi indawo ekuyiwe ibona umthombo okwakubhalelwe wona imithetho yakho.
• Akukho silawuli esacinywa ukuze ukuhlolwa kudlule, futhi ushintsho olwenzile lusho ububanzi bomthombo obukodwa nephothi elilodwa.