Umzila we-VPN noma umthetho we-firewall: yikuphi okulahla iphakethe?

Izinqumo ezimbili ezizimele zenzeka ngephakethe elilodwa, futhi noma yisiphi sazo singaqeda isicelo buthule. Ukusesha komzila kukhetha i-interface kanye ne-hop elandelayo, bese isihlungi samaphakethe sinquma ukuthi leyo nhlanganisela ivunyelwe yini. Ukuphela kwesikhathi kukutshela ukuthi okukodwa kwalezi zimbili kunqabile, hhayi ukuthi yikuphi. Landela izigaba ngokulandelana futhi ukulungisa ngokuvamile kuyeka ukuba ukuqagela.

Izinqumo ezimbili, iphakethe elilodwa, abanikazi ababili

Ukusesha komzila kubonisana nemithetho yenqubomgomo kuqala, bese kuba ithebula abakhomba kulo, futhi kukhetha isiqalo esicacile kakhulu esihambisana nendawo. Iklayenti elifake umzila wethenele linomnikazi waleso sinqumo, futhi akukho lutho emthethweni we-firewall ongayifaka esikhundleni salo. Uma ukusesha kukhomba endaweni engalindelekile, isigaba ngasinye esilandelayo sisebenza ngephakethe elingalungile.

Ukuhlunga kwehlukile. Kusibungu se-Linux, izingwegwe ze-netfilter zihlukanisa ithrafikhi ngokuthi iphakethe lingelani: okukhiphayo kuyashiya umshini, okungenayo kuphela kuwo, ukudluliswa kudlula kuwo. Isango elamukela amaklayenti e-VPN futhi liwadlulisela ku-LAN lidinga indlela yokudluliswa, futhi yilolo chungechunge izilungiselelo eziningi eziyimfundo eziyishiya ingenalutho.

Ukukhethwa komthombo kuyingxenye yesinqumo esifanayo, futhi yilapho iningi lokungahambisani licashile khona. I-kernel ikhetha ikheli lomthombo kusuka ku-interface ephumayo ngaphandle uma umzila usho elinye, ngakho umthetho wesihlungi obhalelwe i-subnet ye-LAN awusoze wahambisana nephakethe eliphuma nekheli lethenele.

Funda ukuthi ukusesha kwakhetha ini ngempela

Phrinta isinqumo esikhundleni sokusiqagela. Umyalo ongezansi uxazulula umzila i-kernel engawusebenzisa kuleyo ndawo, kuhlanganise ne-interface kanye nomthombo engawukhetha:

ip route get 10.8.0.5
ip route get 10.8.0.5 from 192.0.2.44
ip rule show
ip route show table all | sed -n '1,40p'

Amaklayenti e-VPN avame ukufaka imithetho yenqubomgomo kumazinga angaphansi kwethebula eliyinhloko, ngakho ithebula eliyinhloko elihlanzekile alidelisi lutho ngokwalo. Qhathanisa amazinga emithetho namathebula ewakhethayo, futhi uhlole ukuthi umzila wethenele uyasinda yini ngemva kokuxhuma kabusha esikhundleni sokwengezwa ngesandla kanye.

I-IPsec esekelwe kunqubomgomo yengeza isigaba sesithathu sokufanisa umzila ongakumbozi, njengoba amanothi okudlulisa e-strongSwan echaza ngezilungiselelo zethenele nokuthutha. Inqubomgomo yokuphepha ikhetha ithrafikhi ngesiqalo nange-protocol, kuyilapho umzila unquma kuphela ukuthi iphakethe elingavikelwe liyaphi. I-subnet edluliswayo kodwa engenaso isikhethi esihambisanayo ihlala ingavikelwe noma iyalahlwa, kuye ngesilungiselelo, futhi asikho isiphumo esibukeka njengenkinga ye-firewall. Phrinta inqubomgomo bese uqhathanisa izikhethi zayo neziqalo obukulindele ukuthi ithenele lizithwale.

Ukuhlunga kusebenza kugwegwe, hhayi emzileni

Umthetho ovumela isilaleli se-VPN uwumthetho mayelana nethrafikhi eqondiswe kusango uqobo. Awusho lutho ngamaklayenti afinyelela amasibungu angemuva kwalelo sangu, ngoba ithrafikhi edlulisiwe idlula kukholunye uchungechunge. Ukufunda isethi yemithetho njengohlu olulodwa oluyisicaba yisizathu esivamile sokuthi umthetho obukeka ulungile ungaze ugqame.

Izibali zinquma umbuzo ngokushesha. Umthetho onesibalo samaphakethe esiyiqanda awukaze ufinyelelwe, lokhu okukhomba uchungechunge olungalungile, i-interface engalungile noma ukulahlwa kwangaphambili. Umthetho onesibalo esikhulayo ngaphansi kwenqubomgomo yokulahla yiwo umngcele obuwufuna, futhi iphakethe liyalahlwa esikhundleni sokudluliselwa ngendlela engalungile.

Thumela uphenyo ngomzila osethenziswa yiklayenti

Izivivinyo eziqhutshwa kusango uqobo zidlula ekukhipheni nasekungeneni, nekheli lomthombo lesango uqobo. Leyo iyindlela ehlukile kunokucela okudlulisiwe kweklayenti, ngakho i-curl yasendaweni ephumelelayo ifakazela okuncane kunalokho okubonakala. Vivinya kusuka kumshini ohlulayo, noma ugxilise i-interface nomthombo ngokucacile.

nc -vz -w 3 10.8.0.5 443
ping -c 3 -W 1 10.8.0.5
tcpdump -ni any host 10.8.0.5 and port 443
iptables -vnL FORWARD --line-numbers
nft list ruleset | sed -n '1,60p'

Ukubamba kuzo zombili iziphetho kuhlukanisa izimo ezisele. I-SYN eshiya iklayenti futhi engafiki neze isho ukudluliswa, ukubethela noma uhlu lokufinyelela olungaphezulu. I-SYN efikayo futhi engatholi mpendulo isho insizakalo noma isihlungi sayo sasebungwini, futhi ithenele lalingeke lube yinkinga.

Ithrafikhi ebuyayo ifanele ukubukwa kwayo. Ukudluliswa okungalingani kanye nokuhlungwa komzila ophambene kulahla izimpendulo ezifika ku-interface engalungile, lokhu okubonakala njengokuxhumana kohlangothi olulodwa esikhundleni sechweba elivaliwe. Hlola inani le-sysctl ngaphambi kokusola i-firewall ngophawu engalubangile.

Ukuloga kusebenza njengombono wesibili, hhayi isinyathelo sokuqala. Isitatimende selogi lesikhashana kuchungechunge lokudlulisa sisho i-interface namakheli okushaye, futhi kulula ukusisusa kamuva. Uma usishiya unomphela usuke wakha inkinga yomthamo welogi esikhundleni sempendulo.

Beka ngayinye inguquko lapho izosinda khona ngemva kokuxhuma kabusha

Umzila owengezwe nge-ip route add uphila kuze kwehle i-interface. Ugcine kusiphrofayili sokuxhumana esikhundleni salokho: i-NetworkManager yamukela imizila eyengeziwe kuxhumano, futhi i-netplan iyigcina phakathi kokuqalisa. Umthetho ofanayo usebenza kokuhlukile kwe-firewall ohlangothini lweklayenti, okunyamalala ngemva kokulayisha kabusha okulandelayo.

Imithetho yohlangothi lweseva ingeyefayela lesilungiselelo esilayishwa insizakalo lapho iqala, hhayi iseshini esebenzisanayo ephela lapho uyivala. Bhala umthetho, layisha kabusha, futhi uqinisekise ukuthi isibali sishukume, ngoba ukulayisha kabusha okunqabile isintaksi kushiya buthule isethi yemithetho endala endaweni yayo.

Bese uphinda isicelo sokuqala sohlelo kusukela ekuqaleni kuze kube sekugcineni futhi ubhale ukuthi yiluphi ungqimba olwashintshayo. Ukulungisa komzila obekudinga noshintsho lwesihlungi kusazohluleka, futhi ukuhluleka kwesibili kufundeka kalula kakhulu uma wazi ukuthi okokuqala akusekho. Bhala usuku kanye nenguqulo yeklayenti eceleni komphumela, ngoba izimfundo zokudluliswa nokuhlunga zombili zishukuma phakathi kwezinguqulo. Gcina lowo mbhalo kwithikithi ukuze umuntu olandelayo aqale lapho wena uyeke khona esikhundleni sokuphinda uhambo lwezigaba ezimbili.