Kungani isango le-firewall elixhumene nesimo se-VPN lingewona umthetho we-ping ngomhubhe kuphela

Cabanga ngomthetho we-firewall ovula i-ICMP echo ekhelini lomphakathi leseva njalo lapho iphrofayela ye-VPN enegama ixhunyiwe. Lokhu kufundwa ngokuthi «ping ngomhubhe kuphela», futhi lokho kufunda kungalungile ngendlela ebalulekile. Umthetho awukhawuli ukuthi ubani angafinyelela kusibungu; ushintsha ukuthi isixhumanisi somphakathi siphendula ini ngesikhathi olunye uxhumano lusebenza ngengozi. Lezi izinqubomgomo ezimbili ezihlukene, futhi enye yazo yandisa ukuchayeka ngokuthula.

Umthetho ocabanga ukuthi wawubhala

Imfuneko ehlosiwe ivamise ukuba mncane: uhlelo lokubheka, noma umphathi oyedwa ku-VPN, kufanele ukwazi ukuqinisekisa ukuthi iseva iyaphila. Uma kubhalwa njengomusho, kuzwakala njengokulawula ukufinyelela emhubheni. Uma kubhalwa njengento ye-firewall, kuba isibopho kuphrofayela yomphakathi, ngoba yilapho isicelo se-echo sifika khona.

Uma isibopho sesiba yisimo soxhumano hhayi ikheli lomthombo, iqoqo labathumeli abavunyelwe alisalona iqoqo lezilingani ze-VPN. Noma ubani ongafinyelela ikheli lomphakathi angathumela isicelo se-echo ngesikhathi isango livuliwe. Umhubhe awuzange ube yindlela; umhubhe waba yisishintshi.

Abakhuthaza lo mbono ngokuvamile abaqambi amanga ngomphumela ababewufuna. Babedinga ukuhlolwa okuphendula kuphela lapho isixhumanisi siphilile, futhi impilo yesixhumanisi yayibonakala kalula nge-VPN. Iphutha ukuthatha uphawu lokutholakala njengesinqumo sokufinyelela, bese kwenziwa umshini.

Isango lilawula ini ngempela

Lo mklamo uhlanganisa izinto ezimbili ezizimele, futhi ukuzihlukanisa ingxenye enkulu yokulungisa. Eyokuqala indawo: yikuphi ikheli lasendaweni, yikuphi amakheli akude, yiluphi uhlobo lwezivumelwano naluphi uhlobo lwe-ICMP. Eyesibili isibopho: ingabe into yomthetho ivuliwe ngalesi sikhathi. Indawo yilokho i-firewall ekuhlola ngephakethe ngalinye; isibopho yilokho okubhalwa iskripthi kusitore yezinqubomgomo, futhi kokubili kudidiyelwa ngamawashi ahluke ngokuphelele.

Uma imfuneko iyizilingani ze-VPN kuphela ngempela, indawo iyiphendula ngaphandle kwanoma yiluphi uhlobo lomqondo wesimo soxhumano: bopha umthetho ekuxhumaneni komhubhe noma ebangeni lamakheli omhubhe, khawulela amakheli akude eqoqweni lamaklayenti, futhi ukhombe uhlobo lwe-echo esikhundleni se-«ICMP». Lowo mthetho uhlala ulungile uma kungekho VPN, futhi iphrofayela engahlobene ayikwazi ukuwuvula.

Uma imfuneko iyisango lomphakathi ngempela, shono lokho embhalweni wenqubomgomo, ngoba imigomo yokwamukela iyashintsha. Isango lomphakathi kufanele lisho iphrofayela eqondile, lichaze ukuthi «ixhunyiwe» kusho ukuthini, futhi limemezele ukuthi abathumeli bomphakathi basendaweni ngokomklamo. Iningi lokudideka linyamalala ngesikhathi othile ephoqeleka ukubhala lowo musho.

Yakha into kanye, bese uyishintsha

Hlela kusengaphambili umthetho oyedwa onesazisi esizinzile, uvuliwe, futhi vumela isilawuli ukuthi sishintshe isimo sokusebenza kuphela. Ukwakha imithetho ngokwegama elibonisiwe ekugijimeni ngakunye yindlela isitore yezinqubomgomo egcina ngayo izinto ezinhlanu ezicishe zifane futhi ngaphandle kwendlela ethembekile yokuzisusa.

New-NetFirewallRule -Name "VpnGateEchoV4" -DisplayName "Public echo gated on VPN state" -Direction Inbound -Action Allow -Protocol ICMPv4 -IcmpType 8 -LocalAddress 203.0.113.10 -RemoteAddress Any -Enabled False
Set-NetFirewallRule -Name "VpnGateEchoV4" -Enabled True

Igama yisihlonzi esihlala njalo; igama elibonisiwe umbhalo ongasuswa umuntu. Didiyela ku--Name futhi iskripthi siyeka ukukhiqiza amakhophi. Isimo somyalo ofanayo sihlanganisa icala le-IPv6 nge--Protocol ICMPv6 -IcmpType 128, kepha lowo ngumthetho ohlukile ngoba izinombolo zohlobo lwe-echo ziyahluka phakathi kwemindeni emibili.

Gcina umndeni wamakheli kanye nohlobo lwe-ICMP kucaca ngesizathu sesibili: i--Protocol ICMPv4 ngaphandle kohlobo ivumela zonke izaziso ze-ICMPv4 eziyimvume yephrofayela, kuhlanganise nalezo obungakaze uhlose ukuzamukela. Ukusho uhlobo 8 kunciphisa umthetho kusicelo se-echo, futhi yikho kuphela okuthunyelwa ukuhlolwa kokufinyeleleka.

Lapho umshini uphikisana nenhloso

Ukubuza iphrofayela yeklayenti njalo ngemizuzu embalwa akukwazi ukwakha umngcele osheshayo. Phakathi kokwehla koxhumano nokubuza okulandelayo umthetho usaphendula ekhelini lomphakathi; phakathi kokukhuphuka koxhumano nokubuza okulandelayo awuphenduli. Ukuvuma lokho kubambezeleka kuyiqiniso, kodwa ukuthi umklamo uphoqa okungaguquki okuqinile akulona iqiniso.

Kunogibe lwendawo ekuhlolweni kwesimo ngokwako. I-Get-VpnConnection ibika amaphrofayela eklayenti ahleliwe emshinini, ngokwemvelo kumsebenzisi wamanje nakuwo wonke abasebenzisi nge--AllUserConnection. Ayibiki abasebenzisi abakude abaxhumeke ku-RRAS server okwamanje; lokho ukubheka okunye ngomyalo ongenye. Isango elakhiwe kulokho okungalungile asixhunyiwe nanoma yini.

Bese kumboza izimo okungekho muntu ozibhalelayo iskripthi: ukuqala ngomthetho osuvele uvuliwe kusukela ekugijimeni kwangaphambilini, ukuwa kwesilawuli ngesikhathi isango livuliwe, nokuqedwa kwephrofayela kuyilapho umthetho wayo usaphila. Ngayinye idinga okwemvelo okuchaziwe, futhi okwemvelo okuphephile kwemvume yomphakathi kungukuvulwa. Uma imfuneko ingenakukwazi ukubekezelela iwindi lokubuza, umthetho obophele esimweni uyithuluzi elingalungile futhi ukuphoqelela kungokwemhubhe, hhayi okwesixhumanisi somphakathi.

Ekugcineni, hlola isicelo somphakathi kabili, kanye lapho uxhumano olukhethiwe lukhona nokanye luphelile, kusuka kusibungu esingekho ku-VPN. I-ping ephumelelayo ngaphakathi komhubhe ayifakazi lutho ngalo mgomo, futhi yilokho kukala okweqiwa ukusetshenziswa okuningi.