Kuteteza netiweki yanu ndi Iptables - Proxy - NAT - IDS: GAWO 1

Chotsatirachi chikuyesa kufotokoza pang'ono za momwe ma netiweki amagwirira ntchito komanso momwe tingasinthire zida zathu za Linux kukhala Router yomwe imatsimikizira maukonde athu, kaya kunyumba kapena bizinesi. Chifukwa chake tiyeni tichite bizinesi:

Kuyendetsa ndi kusefa

Kuti mulankhule ndikumvetsetsa zamayendedwe, titha kudziwa tanthauzo la rauta? Pachifukwa ichi titha kunena kuti rauta, kuwonjezera pakupanga netiweki ndikuloleza kulumikizana ndi zida zina (podziwa kuti titha kuchita izi ndi AP, switch, Hub kapena ena) amatha kulumikiza ma netiweki awiriwa.

Monga tikuonera pachithunzichi, pali netiweki yakomweko "10.0.1.0" yomwe imapangidwa ndi rauta, ndikufikira chimodzi mwanjira zake ziwiri. Kenako rauta pamawonekedwe ena, ili ndi netiweki ina, yomwe ili ndi IP yapagulu yomwe ingalumikizane ndi intaneti. Ntchito yoyendetsera ntchitoyo ndiyofunika kukhala mkhalapakati pakati pa ma netiweki awiriwa kuti athe kulumikizana.

Linux ngati rauta.

Mwachilengedwe, Linux Kernel ili ndi kuthekera koti "kupita patsogolo", koma mwachisawawa ndi yolumala, kotero ngati tikufuna kuti Linux yathu ichite ntchitoyi tiyenera kupita kufayiloyi.

/proc/sys/net/ipv4/ip_forward

Pamenepo tiona kuti ndi fayilo yomwe imangokhala ndi zero "0", zomwe tiyenera kuchita ndikusintha kukhala "1" imodzi kuti titsegule khalidweli. Izi mwatsoka zimachotsedwa tikayambitsanso kompyuta, kuti siyiyike itayikidwa mwachisawawa tiyenera kugwiritsa ntchito lamulo ili:

sysctl net.ipv4.ip_forward=1

Kapena sungani fayiloyo mwachindunji /etc/sysctl.conf. Kutengera magawidwe kasinthidweka kangakhalenso mu fayilo mu  /etc/sysctl.d/.

Mwachikhazikitso Linux yathu iyenera kukhala ndi tebulo loyendetsa, lomwe nthawi zambiri limakhala kasinthidwe ka network yathu ndi kulumikizana ndi rauta. Ngati tikufuna kuwona njira iyi titha kugwiritsa ntchito malamulo awiri:

route -n

o

netstat -nr

Malamulo onsewa ayenera kubwerera chimodzimodzi.

Mwambiri, kukonzekera kumeneku ndikokwanira kuti Linux yanu ikhale ngati Chipata ndipo makompyuta ena amatha kuyenda pa kompyuta yathu. Tsopano, ngati tikufuna kuti Linux yathu ilumikizane ndi ma netiweki awiri kapena kupitilira apo, kaya ndi akomweko kapena ayi, titha kugwiritsa ntchito njira za static.

Tiyerekeze kuti Linux yanga ili ndi ma network awiri, yoyamba ili ndi intaneti yomwe netiweki yake ndi 172.26.0.0 ndipo yachiwiriyo (10.0.0.0) ili ndi makompyuta ena kuchokera pa netiweki ina yakomweko. Ngati tikufuna kuyendetsa mapaketi kulumikizano ina titha kugwiritsa ntchito:

route add -net 10.0.0.0 netmask 255.0.0.0 gw 172.26.0.8

Mwambiri ndi:

route add -net REDDESTINO netmask MASCARA gw IPDELLINUX

ngati tipereka njira -n mosasamala kanthu kuti netiweki iyi ilipo kapena ayi, kuyendetsa uku kudzakonzedwa patebulo lathu.

Ngati tikufuna kuthetsa mayendedwe omwe titha kugwiritsa ntchito

route del -net 10.0.0.0 netmask 255.0.0.0

Zolankhula.

Kwenikweni iptables imagwiritsidwa ntchito kusefa mapaketi, otuluka, obwera kapena ena, izi zimapangitsa kukhala chida chothandizira kuwongolera kuchuluka kwama network. Chabwino, iptables, monga momwe zimatilolera kusefa magalimoto pamakompyuta omwewo, zimatithandizanso kusefa magalimoto omwe amadutsamo. (Kutumiza). Zolemba zimatha kugawidwa m'matawuni, unyolo, ndi zochita.

• Matabwa:  kungakhale magome awiri, fyuluta, kusefa mapaketi ndi  nat kumasulira ma adilesi, ndiye kuti, kuchoka pa netiweki imodzi kupita kwina.
• Unyolo: Unyolo umatanthauza mtundu wamagalimoto omwe tikufuna kusefa kapena kusambira, ndiye kuti, tiika magome pamsewu uti? ndipo akhoza kukhala:  MuzifunsaMagalimoto omwe akubwera, Zotsatira: kuchuluka kwa magalimoto kapena PATSOGOLO: Magalimoto omwe amadutsamo, koma si kulumikizana koyenera.
• Zitha kuwonekeranso KULAMBIRA, yomwe imagwiritsidwa ntchito pochizira paketiyo mwanjira ina itatha.
• Zochita: Zochita ndizochita zomwe ziyenera kuchitidwa ndi unyolo. Izi zitha kukhala WOPANDA zomwe zimangowononga magalimoto amenewo kapena Landirani. zomwe zimalola magalimoto kuchita izi.

Malamulo a IPTABLES amasungidwa ndikuchitidwa mwanjira yomwe adalengedwa, ndipo ngati lamulo lichotsa lamuloli, lamuloli limagwiritsidwa ntchito nthawi zonse.

Malamulo a Firewall.

Nthawi zambiri, zotchingira moto zimagwira ntchito m'njira ziwiri:

1. Lolani magalimoto onse kupatula, kapena
2. Musalole magalimoto aliwonse kupatula ...

Kuti mugwiritse ntchito mfundo, gwiritsani IPTABLES - P MITU YA NKHANI

Komwe chingwe chikuyimira mtundu wamagalimoto (INPUT, OUTPUT, FORWARD, POSTROUTING ...) ndipo chochitikacho ndi DROP OR ACCEPT.

Tiyeni tiwone chitsanzo.

Apa tikuwona kuti poyamba ndimatha kuthana, kenako ndidauza IPTABLES kuti magalimoto onse a OUTPUT anali DROP kapena sanaloledwe. Kenako ndidauza IPTABLES kuti avomere.

Ngati tikufuna kupanga firewall kuyambira pachiyambi nthawi zonse tiyenera kugwiritsa ntchito malamulo a (Osalola magalimoto aliwonse kupatula ... Pazomwezi ndiye kuti tikugwiritsa ntchito malamulowo

iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P PAKATI PA DROP

Kubwerera timalemba zomwezo ndikusintha DROP ndi ACCEPT.

Pakadali pano, popeza magalimoto onse akukanidwa, timayamba kuuza athu IPTABLES mtundu wamagalimoto omwe angakhale nawo.

Mawu omasulira ndi:

iptables -A cadena -s ip_orgigen -d ip_destino -p protocolo --dport puerto -j acción

Kumeneko:

Chingwe = Lowetsani, linanena bungwe kapena patsogolo

chiyambi_ip = Chiyambi cha mapaketi, iyi ikhoza kukhala IP imodzi kapena netiweki ndipo pamenepa tiyenera kufotokoza chigoba).

malo_ip = komwe mapaketi akupita. iyi ikhoza kukhala IP imodzi kapena netiweki ndipo pankhaniyi tiyenera kufotokoza chigoba).

protocol = ikuwonetsa protocol yomwe imagwiritsidwa ntchito ndi mapaketi (icmp, tcp, udp ...)

doko = doko lofika pamsewu.

kanthu = Dontho kapena Landirani.

Chitsanzo:

Malamulo onse oletsedwa amagwiritsidwa ntchito.

Kenako timawonjezera malamulowo kuti tikhale ndi magalimoto kudzera pa doko 80 HTTP ndi 443 HTTPS, ndi protocol ya TCP. Kenako port 53 Ikugwiritsidwa ntchito kwa kasitomala wa DNS kuti athetse madambwewo, apo ayi simungayende. Izi zimagwira ntchito ndi udp protocol.

Mzere:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Ndi chifukwa cha izi: Mukapanga pempho la HTTP mwachitsanzo, mumalumikiza ku doko 80 la seva, koma seva kuti ibwezeretse chidziwitsochi iyenera kulumikizana nanu kudzera padoko lililonse. (Nthawi zambiri kuposa 1024).

Momwe madoko athu onse amatsekedwa izi sizingachitike pokhapokha titatsegula madoko onse kuposa 1024 (Maganizo Oipa). Zomwe izi zikunena ndikuti magalimoto onse obwera kuchokera kulumikizano yomwe ndidakhazikitsa ndokha amavomerezedwa. Ndikutanthauza, kulumikizana komwe ndidayamba.

Ndikukhulupirira kuti mudakonda izi. Potsatira ndidzakambirana za NAT, Proxy ndi zolemba za Firewal.