I-firewall ye-VPS: vula kuphela imbobo ye-VPN, bese ukufakazela

I-firewall evumela kuphela imbobo ye-VPN ayiwona umthetho owodwa. Yizinqumo ezintathu ezihlukene ezithinta ngezinga elifanayo inombolo yembobo: uchungechunge lokungenayo lunquma ukuthi yini engafinyelela inqubo yasendaweni, uchungechunge lokudlulisela lunquma ukuthi yini engadlula kusibungazwa egameni lamaklayenti omhubhe, futhi ithebula le-NAT libhala kabusha ikheli lomthombo lapho liphuma. Uma wehluleka kwenye yazo, umphumela akuvamisile ukuba ube ukuphazamiseka okuhlanzekile. Uthola isibungazwa esamukela amaklayenti kodwa singalayishi lutho, noma isibungazwa esibonakala sivaliwe kuze kube umuntu ufunda ukulandelana kwemichilo.

Imbobo eyodwa engenakuvinjwa

Isilaleli se-VPN kufanele samukele ukuxhumana okuvela kumakheli ongakwazi ukuwaqagela, ngakho-ke ngokwencazelo siwumsebenzi womphakathi. Lona ukuphela okukodwa umklamo osekelwe phezu kwako: imbobo eyodwa ye-UDP ye-OpenVPN, imbobo eyodwa ye-UDP ye-WireGuard, imbobo eyodwa ye-TCP ye-SSL VPN. Konke okunye kungaphansi komhubhe, okusho ukuthi izinsizakalo zezinhlelo kufanele zibophe kukheli lomhubhe noma ku-loopback, hhayi kuzo zonke izixhumanisi.

Kodwa ukubopha akusikho ukuphoqelela. Inqubo eboshelwe ku-0.0.0.0 iyafinyeleleka kuphela uma umthetho uyivumela, futhi inqubomgomo yokuzenzakalela iyindawo yokugcina yethrafikhi engafaniswanga nawuwo umthetho, hhayi umthetho olawula imbobo. Ukwamukela okubekwe ngaphezu kokunqaba kwakho kuseyikho ukwamukela, futhi ukususa insizakalo ekhelini lomphakathi kuwukuthuthuka okuzimelayo, hhayi indawo yochungechunge.

Okungenayo, ukudlulisela ne-NAT kuphendula imibuzo ehlukene

Ithrafikhi yokungenayo iqondiswe kusibungazwa ngokwaso, ngakho-ke isilaleli se-VPN nendlela yokuphatha zihlala lapho. Ithrafikhi yokudlulisela idlula kusibungazwa, futhi amaklayenti omhubhe ayayidinga kanye ne-net.ipv4.ip_forward=1. Ukuhlelwa kwakudala okugqashukile uhhafu kuvumela ukugeleza okuphumayo kodwa kukhohlwa indlela yokubuya, ngakho iklayenti liqeda ukuxhawulana bese kungalayishwa lutho; umthetho we-conntrack wethrafikhi esunguliwe nehlobene uhlanganisa leyondlela.

I-NAT umbuzo wesithathu. Ngaphandle kokubhala kabusha ku-postrouting, amaphakethe adlulisiwe aphuma nomthombo oyimfihlo womhubhe futhi alahlwa phezulu, ngoba akukho nethiwekhi ngale kwesibungazwa eyazi ukuthi ingayihambisa kanjani ipaki ibuyele emuva. Isiqalo somthombo kulo mthetho kufanele sihambisane nepheku le-VPN, hhayi ikheli lesibungazwa ngokwaso, futhi kuyafana nasemthethweni wokudlulisela ogagula isethi engaphansi yamaklayenti.

I-IPv6 inqubomgomo yesibili, hhayi umcabango wakamuva. Isibungazwa esinochungechunge oluqinile lwe-IPv4 kanye nenqubomgomo evulekile ku-ip6tables asivalanga lutho; izinsizakalo zisafinyeleleka ngenye imindeni. Noma khombisa isethi yemitherho nge-ip6tables, noma vala i-IPv6 ngamabomu kusixhumanisi somphakathi, futhi bhala ukuthi ukhethe okukuphi.

Isisekelo esifundeka ngakanye

Qala ngokunqaba, bese wengeza kuphela lokho isibungazwa esikudingayo. Kuqala i-loopback nezimpendulo, bese kuba indlela yokuphatha, bese kuba isilaleli somhubhe, bese kuba inqubomgomo yokudlulisela yamaklayenti:

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
iptables -A INPUT -p udp --dport 1194 -m conntrack --ctstate NEW -j ACCEPT
sysctl -w net.ipv4.ip_forward=1
iptables -A FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Amagama ezixhumanisi, imbobo nephaku kuyizindawo zokubamba; zifunde kusiphakeli esikhundleni sokuzikopisha. Ukugcina umphumela kubalulekile njengokuwubhala, ngoba isethi yemitherho ephila emqondweni kuphela iyanyamalala ekuqaliseni okulandelayo futhi ivule isibungazwa futhi buthule. Yenza ihlale njalo ngomshini wokusabalalisa, futhi gcina ikhophi ngaphandle komshini ngosuku umshini ongeke uqale ngalo.

Ukuvala imbobo yokugcina ngaphandle kokulahlekelwa isibungazwa

Kunesicupho emklamweni. Uma i-SSH ikhona kuphela ngomhubhe, insizakalo ye-VPN ehlulekayo ihamba ne-SSH, futhi indlela eyodwa yokubuya ingase ibe ikhonsoli ongakaze uyivule. Ngaphambi kokuthi uvale imbobo yokugcina yomphakathi, qinisekisa ukuthi leyokhonsoli ikhona nokuthi uyikwazi ukuyisebenzisa ngempela, noma gcina indlela eyodwa emincane yokuphatha engancikile emhubheni: i-SSH kusuka kukheli elingaguquki, izikhiye kuphela, ukuqinisekiswa ngephasiwedi kuvaliwe.

Sebenzisa ushintsho kusuka kuseshini esivele isunguliwe, hhayi ngoxhumano osuzohlunga. Hlela ukubuyela emuva ukuze iphutha liphele esikhundleni sokuhlala njalo, isibonelo umsebenzi we-systemd-run --on-active=10min obuyisela isethi yemitherho yangaphambilini, futhi gcina iseshini yesibili ye-SSH ivuliwe ngenkathi uhlola eyokuqala. Bese uqinisekisa ukuthi umsebenzi wokubuyela emuva uyaziswa ngempela, ngoba ukubuyisela okungahloliwe kuyafana nokungabuyiseli.

Qinisekisa indlela, hhayi iskripthi

Funda imitherho elayishiwe, hhayi ifayela okwakufanele ilayishe. Kusuka kusibungazwa sangaphandle esigunyaziwe, qinisekisa ukuthi yizimbobo ezihlosiwe kuphela eziphendulayo; ngaphakathi komhubhe, qinisekisa ukuthi izinsizakalo obuzimisele ukuzishicilela ziyafinyeleleka. Inqubomgomo yokunqaba yokuzenzakalela evimba nethrafikhi yomhubhe ibonakala ifana nokuvalwa okusebenzayo kuze kube umuntu uzama ukuyisebenzisa.

iptables -S
iptables -t nat -S
ss -lntup
ip -4 addr show

Bhala phansi imbobo evunyelwe, ipheku lamaklayenti, isixhumanisi somhubhe, umthombo wokuphatha kanye nenqubo yekhonsoli eduze kokuhlelwa. Ushintsho olulandelayo kupheku noma egameni lesixhumanisi kufanele luhambisane kusihlungi nasemthethweni we-NAT, ngaphandle kwalokho isibungazwa sibuyela esimweni esivulekile uhhafu ngaphandle kokuthi othile akubone.

Umkhuba owodwa ubaluleke kakhulu kunesethi yemitherho: ngemva kwakho konke ukushintsha, fakazela indlela yokudlulisela ngesicelo sekhayenti nendlela yokubuyisela ngeseshini yesibili. Ukuvalwa ongakaze ukusebenzise kuwumbono nje.