Tabbatar da hanyar sadarwar ku tare da Abubuwan --ira - Wakili - NAT - ID: KASHI NA 1

Wannan sakon yana ƙoƙarin fayyace kaɗan game da yadda cibiyoyin sadarwa ke aiki da yadda ake juya kayan aikinmu na Linux a cikin na'ura mai ba da hanya tsakanin hanyoyin sadarwa wanda ke tabbatar da ɗan hanyar sadarwarmu, ko da kuwa gida ne ko ma kasuwanci. Don haka bari mu sauka zuwa kasuwanci:

Hanyar hanya da tacewa

Don magana da fahimta game da kwatance, da farko za mu iya bayyana menene rawar mai amfani da hanyar sadarwa? Saboda wannan zamu iya cewa na'ura mai ba da hanya tsakanin hanyoyin sadarwa, ban da ƙirƙirar hanyar sadarwa da kuma ba da damar haɗi tare da wasu kayan aiki (sanin cewa za mu iya yin hakan ta hanyar AP, Switch, Hub ko wasu) yana da ikon haɗa hanyoyin sadarwa biyu daban da juna.

Kamar yadda muke gani a cikin hoton, akwai hanyar sadarwa ta gida "10.0.1.0" wacce aka samo asali ta hanyar na'ura mai ba da hanya tsakanin hanyoyin sadarwa, kuma ta isa daya daga cikin hanyoyin biyu. Sannan na'ura mai ba da hanya tsakanin hanyoyin sadarwa ta hanyar amfani da ita, tana da wata hanyar sadarwar, tare da IP ta jama'a wacce zata iya amfani da ita ta Intanet. Aikin turawa shine asali don zama matsakaici tsakanin waɗannan hanyoyin sadarwar guda biyu don su iya sadarwa.

Linux a matsayin na'ura mai ba da hanya tsakanin hanyoyin sadarwa.

A dabi'ance, Linux Kernel ya riga yana da ikon yin "turawa", amma ta tsoho yana da nakasa, don haka idan muna son Linux ɗinmu suyi wannan aikin dole ne muje fayil ɗin.

/proc/sys/net/ipv4/ip_forward

A can za mu ga cewa fayil ne wanda kawai ya ƙunshi sifili "0", abin da dole ne mu yi shi ne canza shi zuwa "1" ɗaya don kunna wannan halayyar. Wannan abin takaici an share shi lokacin da muka sake kunna kwamfutar, don barin ta kunna ta tsohuwa dole ne muyi amfani da umarnin:

sysctl net.ipv4.ip_forward=1

Ko gyara shi kai tsaye a cikin fayil ɗin /etc/sysctl.conf. Dogaro da rarrabuwa wannan daidaitawar zata iya kasancewa cikin fayil a ciki  /etc/sysctl.d/.

Ta hanyar tsoho Linux ɗinmu dole ne su kasance suna da teburin sarrafawa, wanda gabaɗaya shine daidaitawar hanyar sadarwar lan mu da haɗi da na'ura mai ba da hanya tsakanin hanyoyin sadarwa. Idan muna son ganin wannan kwatance za mu iya amfani da umarni biyu:

route -n

o

netstat -nr

Duk dokokin biyu ya kamata su dawo iri ɗaya.

Gabaɗaya, wannan daidaitawar ya isa Linux ɗinku suyi aiki a matsayin wayofar andofar kuma sauran kwamfutoci na iya kewaya ta kwamfutarmu. Yanzu, idan muna son Linux ɗinmu ya haɗa cibiyoyin sadarwa biyu ko sama, ko na gida ne ko a'a, za mu iya amfani da hanyoyi masu tsayayye.

A ce Linux na da hanyoyin sadarwa guda biyu, na farko yana da haɗin Intanet wanda cibiyar sadarwar sa ta 172.26.0.0 sannan na biyu (10.0.0.0) yana da kwamfutoci daga wata hanyar sadarwa ta cikin gida. Idan muna son tura fakiti zuwa waccan hanyar sadarwar za mu iya amfani da:

route add -net 10.0.0.0 netmask 255.0.0.0 gw 172.26.0.8

Gaba ɗaya shi ne:

route add -net REDDESTINO netmask MASCARA gw IPDELLINUX

idan muka bayar hanya -n ba tare da la'akari da kasancewar wannan hanyar sadarwar ba ko babu, wannan hanyar za ta daidaita a teburinmu.

Idan muna son kawar da faɗin hanya za mu iya amfani da shi

route del -net 10.0.0.0 netmask 255.0.0.0

Abubuwan birgewa.

Ainihin ana amfani da kayan aiki don tace fakiti, mai fita, mai shigowa ko wasu, wannan ya sa ya zama babban kayan aiki don sarrafa zirga-zirgar sadarwar mu. Da kyau, kayan aiki, kamar yadda yake bamu damar tace zirga-zirga daga wannan kwamfutar, hakanan yana bamu damar tace zirga-zirgar da take bi ta ciki. (Ana turawa). Za'a iya raba abubuwan sarrafawa zuwa tebur, sarƙoƙi, da ayyuka.

• Alloli:  m akwai iya zama tebur biyu, tace, don tace fakiti kuma  nat don fassara adiresoshin, wato, matsawa daga wata hanyar sadarwa zuwa wata hanyar sadarwa.
• Sarƙoƙi: Sarkar tana nufin nau'in zirga-zirgar da muke son tacewa ko iyo, wato, wacce zirga-zirga za mu yi amfani da teburin? kuma zasu iya zama:  Input: Mai shigowa zirga-zirga, MULKI: fitowar mutane waje ko GABA: Motocin zirga-zirga da ke ratsa ta, amma ba haɗin kansa bane.
• Hakanan yana iya bayyana GASKIYA, wanda ake amfani dashi don magance fakiti ta wata hanya bayan an shawo kanshi.
• Ayyuka: Ayyuka sune ainihin aikin da za'a yi tare da sarkar. Wannan aikin na iya zama DARA, hakan kawai yana lalata wannan zirga-zirgar ko Yarda da. hakan yana ba masu zirga-zirga damar yin irin wannan aikin.

Ana adana dokokin IPTABLES kuma ana aiwatar dasu cikin tsari yadda aka ƙirƙira su, kuma idan ƙa'ida ta share ƙa'idar da ta gabata, ana amfani da ƙa'idar ƙarshe a cikin tsari koyaushe.

Manufofin Firewall.

Gabaɗaya, wutar wuta tana aiki ta hanyoyi biyu:

1. Bada izinin duk zirga-zirga banda, ko
2. Kada ku ba da izinin kowane zirga-zirga sai ...

Don amfani da manufofi, yi amfani da IPTABLES - P SARKIN AIKI

Inda kirtani yake wakiltar nau'in zirga-zirga (INPUT, OUTPUT, GABA, POSTROUTING ...) kuma aikin shine DUBU KO KARBATA.

Bari mu duba misali.

Anan zamu ga cewa da farko na iya ping, sa'annan na fadawa IPTABLES cewa duk zirga-zirgar JIMA yana KASHEWA ko ba'a yarda dashi ba. Sannan na fadawa IPTABLES su yarda dashi.

Idan za mu gina katangar bango daga tushe dole ne a koyaushe mu yi amfani da dokokin (Kada a bar duk wata zirga-zirga sai ... Saboda wannan to muna amfani da dokoki

iptables -P INPUT DROP iptables -P MUTANE DROP kayan aiki -P GABA DROP

Don dawowa zamu rubuta iri ɗaya kuma maye gurbin DROP da ACCEPT.

A wannan gaba, tunda an hana duk zirga-zirga, zamu fara gayawa IPTABLES ɗinmu zirga-zirgar da zata iya samu.

A tsari ne:

iptables -A cadena -s ip_orgigen -d ip_destino -p protocolo --dport puerto -j acción

Inda:

Kirtani = INTUTU, FITOWA KO GABA

asali_ip = Asalin fakiti, wannan na iya zama IP ɗaya ko hanyar sadarwa kuma a wannan yanayin dole ne mu saka abin rufe fuska).

makoma_ip = inda fakiti ke tafiya. wannan na iya zama IP ɗaya ko hanyar sadarwa kuma a wannan yanayin dole ne mu saka abin rufe fuska).

yarjejeniya = yana nuna yarjejeniyar da fakiti ke amfani da su (icmp, tcp, udp ...)

tashar jiragen ruwa = tashar jirgin ruwa na zirga-zirga.

aiki = SHA ko karɓa.

Alal misali:

DUKAN an iyakance manufofin.

Sa'annan mun ƙara dokoki don samun damar yin zirga-zirga ta tashar 80 HTTP da 443 HTTPS, tare da yarjejeniyar TCP. Sannan tashar jiragen ruwa 53 Ana amfani dashi don abokin cinikin DNS don warware yankuna, in ba haka ba baza ku kewaya ba. Wannan yana aiki tare da ladabin udp.

Layin:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Saboda haka ne: Lokacin da kake yin buƙatar HTTP misali, zaka haɗa zuwa tashar jiragen ruwa 80 na sabar, amma sabar don dawo da bayanin yana buƙatar haɗi tare da kai ta kowace tashar jiragen ruwa. (Gabaɗaya yafi 1024).

Da yake duk tasharmu ta rufe wannan ba zai samu ba sai dai idan mun bude dukkan tashar jiragen sama sama da 1024 (Mummunan ra'ayi). Abin da wannan ke faɗi shi ne cewa duk zirga-zirgar da ke shigowa daga haɗin da na kafa kaina karɓaɓɓe ne. Ina nufin, haɗin da tun asali na fara.

Ina fatan kun so wannan bayanin. A na gaba zanyi magana akan NAT, wakili da kuma rubutun Firewal.