Kungani i-hook ye-firewall ye-VPN ingeza umthetho ofanayo kabili

Ukuxhumana kabusha kungase kuqalise i-hook yakho futhi, ngakho klama isimo esifiselekayo: amaketanga aphethwe nguye, ukuhlola ngaphambi kokufaka, ushintsho olulodwa oluhleliwe kanye nokudilizwa okuncane.

I-hook isebenza okokuqala, futhi ngemva kokuxhumana kabusha kathathu iketanga ligcina amakhophi amathathu omthetho ofanayo. Akukho okuhluleke ngokuzwakalayo; iskripthi senze nje lokho esikutshelwe ngaso sonke isikhathi lapho sisebenza. I-hook ye-VPN iwumsebenzi wokumisa ongasebenza izikhathi ezingaphezu kwesisodwa, ngakho idinga umnikazi, isimo esifiselekayo kanye noshintsho oluhleliwe. Landela lolo hlelo futhi izimpinda ziyoma.

Nikeza imithetho umnikazi ngaphambi kokubhala noma eyodwa

Nquma ukuthi yiliphi iketanga noma ithebula eliphethwe yilokhu kuhlanganiswa ngaphambi kokubhala ngisho umthetho owodwa. Iketanga elikhethekile elidalwa futhi elikhishwe yi-hook liyindlela ecacile kakhulu yobunikazi, ngoba ukuhlanza kungabe sekususa lelo ketanga ngaphandle kokuthinta inqubomgomo yomunye umuntu. Uma kufanele ungeze imithetho eketangeni elabiwe, yimake ngombhalo ukuze usesho lwakamuva luthole eyakho ngqo. Ubunikazi yibo obenza ukudilizwa kuphephe, futhi ukudilizwa yingxenye ehluleka buthule.

iptables -N VPN_HOOK 2>/dev/null || true
iptables -C INPUT -j VPN_HOOK 2>/dev/null || iptables -I INPUT -j VPN_HOOK
iptables -S VPN_HOOK

Umbhalo lapha awusona isihlobiso. Umehluko phakathi kokususa umthetho wakho nokususa umthetho obonakala ufana ngephutha, futhi uhlala kusethi yemithetho egciniwe. Bhala umbhalo kanye kusiguquli bese usebenzisa umucu ofanayo kuwo wonke umyalo ongezayo, ohlolayo noma osusayo.

Hlola isimo esifiselekayo esikhundleni sokuphinda ungeze

Bhala lokho okufanele kube khona ngesikhathi umhubhe uphakeme: yiziphi izixhumi, imuphi umthombo nendawo ekuyiwa kuyo, imuphi umthetho wokuxhumana kanye nembobo. Bese uveza umthetho ngamunye njengokuhlola okulandelwa ukufakwa, ukuze ukusebenza kwesibili kuthole umthetho futhi kungenzi lutho. Umyalo wokuhlola uphuma nguziro lapho umthetho ukhona, futhi yilokho kanye isignali iskripthi esiyidingayo. I-ncwadi ye-iptables ichaza izinhlobo zokuhlola, zokwengeza nezokufaka ezisetshenziswe lapha.

iptables -C VPN_HOOK -i tun0 -p tcp --dport 443 -j ACCEPT ||
  iptables -A VPN_HOOK -i tun0 -p tcp --dport 443 -j ACCEPT

Qaphela indawo. Ukuhlola umthetho nokuwufaka phezulu kungase kuhambise imvume phambi kokunqatshwa ngamabomu obekade kuza kuqala, ngakho ukusebenza kwesibili kushintsha ukuziphatha yize kungenzi lutho. Engeza ekugcineni ngaphakathi kweketanga lakho, futhi lawula ukulandelana ngendawo okukuyo ukugxuma kulelo ketanga. Uma ukulandelana ngaphakathi kweketanga kubalulekile, yakha kabusha iketanga kusukela ohlwini olwaziwayo esikhundleni sokulifaka izixazululo umthetho ngomthetho.

Yima uma umthetho okuwudingayo ungasavezwa njengokuhlola okuzinzile. Lokho ngokuvamile kusho ukuthi isimo esifiselekayo asikacaci.

Hlela ushintsho esikhundleni sokuthemba ukuthi luzohlala

Izingcingo ezimbili ze-hook zingagqagqana, futhi zombili zingabona umthetho ongekho ngaphambi kokuba enye iwengeze. Inketho yokulinda ye-xtables yenza umyalo ulinde isikhiya, kodwa ayenzi ukulandelana kokuhlola-bese-wengeza kube yinto eyodwa kuyo yomibili imiyalo. Hlela wonke umsebenzi ngesikhiya sakho, noma sebenzisa umphathi osebenzisa iqoqo elimisiwe njengokuthengiselana okukodwa. I-nftables ingenza lokhu kokugcina, futhi lesi ngesinye sezizathu zokuyikhetha kumakhasimende lapho itholakala khona.

flock /run/vpn-hook.lock /usr/local/sbin/vpn-firewall-apply
nft -f /etc/nftables/vpn-hook.nft

Noma iyiphi indlela oyikhethayo, gcina isigaba esibalulekile sifushane futhi usenze sifinyeleleke futhi: i-hook ehluleka phakathi kufanele iphephe ukuphinda isebenze. Bhala umphumela ukuze ukusebenza okuphindiwe kubonakale kujenali esikhundleni sokucatshangwa kusukela enanini lemithetho. Uma abaqaphi ababili abahlukene bengacela i-hook, lungisa lokho kuqala; asikho isikhiya esilungisa abanikazi ababili.

Diliza kuphela lokho okungokwakho

Ukudilizwa kufanele kwehlukanise ukuxhumana okungena esikhundleni nalokho okuthathwe umhlalaphansi, futhi kufanele kumelane nomcimbi ongakaze uthole ukuhlanza okuhlelekile. Susa ngezikhombisi ezifanayo ezasetshenziswa ekwengezeni, futhi ungayikhishi neze iketanga elabiwe ukuze wenze ukuhlanza kube lula. Ngemva kokuma okuqinile, sebenzisa umjikelezo wokubuyisana ekuqaleni okulandelayo esikhundleni sokucabanga ukuthi i-hook yaphansi isebenzile.

iptables -D VPN_HOOK -i tun0 -p tcp --dport 443 -j ACCEPT
iptables -F VPN_HOOK
ip -brief link show type tun

Isikhathi sokuphila sesixhumi naso siyingxenye yokuklama. Ukuxhumana kabusha kungakha idivayisi enegama elihlukile, ngakho umthetho obhala ngokuqinile igama lomhubhe wesibili uyaphelelwa yisikhathi ngenkathi usabonakala uvumelekile. Khetha ubunikazi obudalulwa ukuxhumana uqobo, futhi uwufunde kabusha njalo lapho usebenza. Hlola izehlakalo ezintathu ngokwahlukana: ukuxhumana okuphindiwe, ukuxhumana okungena esikhundleni nokuvalwa. Ithrafikhi evunyelwe kufanele imelane nazo zontathu ngaphandle kwezimpinda, futhi izinsizakalo ezingahlobene kufanele zihlale zingathintwanga.

Ukuhamba kuphela lapho i-hook inomniki, ukuhlola kwawo wonke umthetho ewengezayo, indlela eyodwa ehleliwe kanye nokudilizwa okususa isimo salo kuphela. I-hook ephephe ukusebenza kabili inenani elingaphezu kwe-hook ehlakaniphile kanye.

Izihloko ezihlobene