Ukufinyelela kusuka ku-VPN kuye ku-VLAN: yakha i-matrix ngaphambi kwemithetho
Izindima ngakolunye uhlangothi, izinsizakalo ngakolunye. Ukuhlola okuhlanu kuguqula umklamo ongacacile wokufinyelela kusuka ku-VPN kuye ku-VLAN ube yithebula umnikazi we-firewall angayisebenzisa.
Qala nge-matrix, hhayi nge-syntax ye-firewall. Ithebula elinezindima ngakolunye uhlangothi nezinsizakalo ngakolunye lingabuyekezwa umnikazi wohlelo lokusebenza, lixoxwe umnikazi wezokuphepha futhi lisetshenziswe noma ngubani ophethe i-gateway. Lokho kubuyekeza kushibhe kakhulu kunokuxazulula imithetho okungekho muntu ovumelene ngayo.
Ihora lokuyibhala lisindisa iviki lokumba imithetho kamuva. Umklamo ukhuluma ngokuthi ubani ufinyelela kuphi, futhi yilokho okuyohlala ngemva kokubhalwa kabusha kwezinombolo.
Isinyathelo 1: qamba izindima ngaphambi kwamanethiwekhi
Qala ngabantu, hhayi nge-switch. Bhala iqembu ngalinye elixhuma kude kanye nomusho owodwa ochaza okwenziwa yilelo qembu, njengabasebenzi basendlini yokugcina impahla abafunda amazinga esitoko noma usonkontileka ogcina ukuhlanganiswa okukodwa. Uma amaqembu amabili engathola ukufinyelela okufanayo, ayindima eyodwa ngale njongo.
Misa lapha uma indima ikhona ngenxa yeshadi lenhlangano kuphela. Indima engenasidingo sayo sesevisi iba umugqa wamangqamuzana afanayo, futhi imigqa efanayo iheha othile ukuba kamuva anikeze yonke i-subnet ukuze kube lula. Hlukanisa ngokwenziwa ngabantu, hhayi ngokuthi ubani usayina izindleko zabo. Izindima eziyisithupha zivame ukuba ziningi kakhulu ehhovisi elincane futhi ezintathu zivame ukulunga.
Isinyathelo 2: guqula ingqamuzana ngalinye libe isitatimende sesevisi
Ingqamuzana elibhalwe «Izinhlelo zokusebenza» alinakuhlolwa. Ingqamuzana elibhalwe «HTTPS kusiya ku-host ye-ERP ku-443, kusuka eqenjini labasebenzi» lingahlolwa. Shintsha igama ngalinye lenethiwekhi ngendawo okuyiwa kuyo, iphrothokholi kanye nechweba, bese wengeza ukuncika okungenakwenzeka ngaphandle kwaso isevisi, njengesixazululi sangaphakathi noma umhlinzeki wobunikazi.
| Check | Passes when | Stop if |
|---|---|---|
| Destination named | Host and port appear in the cell | Cell names a VLAN or a subnet |
| Direction stated | Initiator and responder are both clear | Cell implies two-way access |
| Dependency listed | DNS or identity path is explicit | Whole infrastructure range is granted |
| Negative case written | At least one denied pair is recorded | Only allow rules exist |
Ikholamu yokuqondisa ibamba amaphutha abiza kakhulu. Imvume yokuthi abasebenzi bavule uhlelo lokusebenza ayisho ukuthi amaseva ezinhlelo avunyelwe ukuvula ukuxhumana okubuyela kumalaptophi abasebenzi, futhi umthetho onesimo ovumela ukuqondisa kokuqala uvame ukufundwa sengathi uvumela owesibili.
Isinyathelo 3: ncika lapho ubunikazi buba umgomo khona
Othile kufanele aguqule iseshini eqinisekisiwe ibe yindima i-gateway engayiphoqelela. Izinketho ezisekelwe zihlanganisa inqubomgomo yeqembu enikezwa yi-backend yokuqinisekisa, izici zeseshini ezithenjwayo, noma amachibi amakheli ahlukene endima ngayinye. Zontathu ziyasebenza; ilebula elithunyelwa yiklayenti alisebenzi. Khetha indlela ebhalwe yi-gateway yakho, hhayi leyo echazwa okuthunyelwe kwiforamu.
Ukunikeza ikheli elibonakala sengathi lingelinye le-VLAN yimpendulo engeyona efanayo egqokweni elihlukile. Umhlahlandlela we-Netgate mayelana nemithetho ye-firewall ye-OpenVPN wenza lokho kwehlukanisa kucace: ukuvumela ithaneli ukuba inyuke kuyisinqumo esihlukile kunokuvumela ithrafikhi ukuba idlule kuyo.
Bhala ukuthi iyiphi indlela oyikhethile nokuthi ihlelwe kuphi. Uma indima ishintsha, leyo nophawu iwumehluko phakathi kokuhlela okukodwa nokucinga ezindaweni ezintathu zokuxhumana. Iphinde itshele umhloli ukuthi abheke kuphi kuqala.
Isinyathelo 4: qaphela ikheli lomthombo elibonwa yindawo okuyiwa kuyo
Inqubomgomo yokudlulisa kumele ihambisane nomthombo wangempela emngceleni. Uma i-gateway ihumusha amaklayenti e-VPN aye kwikheli layo, i-firewall ngayinye engezansi ibona umthombo owodwa futhi ilahlekelwe amandla okunquma ngokwendima. Uma igcina ikheli leklayenti, indlela yokubuya kumele ibe khona kulelo chibi.
Hlola izindlela zombili ngaphambi kokubhala imithetho yokugcina, bese ubhala umthombo obonwe eduze kwengqamuzana ngalinye. Sebenzisa lokho kuhlola kusuka ezindimeni ezimbili ezihlukene bese uqhathanisa umphumela. Uma zombili zikhombisa ikheli le-gateway, ukuhlukaniswa kwezindima sekulahlekile. I-matrix ethatha ukuthi amakheli agciniwe ngenkathi i-gateway yenza ukuhumusha komthombo yehluleka ku-ACL yokuqala engezansi.
Isinyathelo 5: hlola ingqamuzana ngalinye ngaphambi kokukhipha
Guqula ingqamuzana ngalinye elivunyelwe libe umsebenzi oyedwa omele, futhi ingqamuzana ngalinye elinqatshiwe libe icala elingalungile. Sebenzisa kokubili kusuka kuklayenti elisendimeni yangempela, hhayi kusuka kukhonsoli ye-gateway, ngoba ikhonsoli idlula indlela oyihlolayo.
# allowed: staff role reaches the ERP endpoint
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 5 https://erp.internal.example/health
# denied: the same role must not reach a management host
nc -vz -w 3 10.30.5.11 22
# observed source address at the destination
sudo tcpdump -ni any 'tcp port 443 and host 10.30.20.15'Icala elingalungile elixhumayo liwukutholakala, hhayi izehlakalo, futhi indawo yalo ku-matrix iyingqamuzana ehlulekile kuze kube umthetho ulungisiwe. Gcina imiyalo yokuhlola eduze kwethebula ukuze umhloli olandelayo ayisebenzise futhi esikhundleni sokwakha kabusha ukucabanga.
Ithebula eliqediwe liphila isikhathi eside kune-gateway elibhalelwe yona. Imithetho iyashintsha ne-firmware nomhlinzeki, kuyilapho umugqa othi usonkontileka ufinyelela insizakalo eyodwa yephrojekthi uhlala uyiqiniso kuze kube lowo msebenzi ushintshile.