Ukuvikela inethiwekhi yakho ngama-Iptable - Ummeleli - I-NAT - IDS: INGXENYE 1

Lokhu okuthunyelwe kuzama ukucacisa okuncane mayelana nokuthi amanethiwekhi asebenza kanjani nokuthi angayiguqula kanjani imishini yethu yeLinux ibe yiRouter eqinisekisa inethiwekhi yethu kancane, kungaba sekhaya noma sebhizinisini. Ngakho-ke ake siye ebhizinisini:

Umzila nokuhlunga

Ukukhuluma nokuqonda ngomzila singaqala ngokuchaza ukuthi yini umsebenzi we-router? Ngalokhu singasho ukuthi i-router, ngaphezu kokudala inethiwekhi nokuvumela ukuxhumana neminye imishini (ukwazi ukuthi singakwenza lokhu nge-AP, switch, Hub noma abanye) inamandla okuxhuma amanethiwekhi amabili ahlukene komunye nomunye.

Njengoba sikwazi ukubona esithombeni, kukhona inethiwekhi yendawo "10.0.1.0" eyenziwe i-router, futhi ifinyelela kwesinye sezixhumi zayo ezimbili. Ngemuva kwalokho i-router kwenye i-interface yayo, inenye inethiwekhi, ene-IP yayo yomphakathi engaxhuma ngayo kwi-Intanethi. Umsebenzi womzila ngokuyisisekelo usebenza njengomxhumanisi phakathi kwalezi zinethiwekhi ezimbili ukuze bakwazi ukuxhumana.

I-Linux njenge-router.

Ngokwemvelo, iLinux Kernel isivele inekhono lokwenza "ukudlulisa", kepha ngokuzenzakalela ikhutshaziwe, ngakho-ke uma sifuna iLinux yethu yenze lo msebenzi kufanele siye kufayela.

/proc/sys/net/ipv4/ip_forward

Lapho sizothola ukuthi yifayela eliqukethe kuphela u-0 "1", okumele sikwenze ukulishintsha libe ngu- "XNUMX" ukuze kusebenze lokhu kuziphatha. Lokhu ngeshwa kuyasuswa lapho siqala kabusha ikhompyutha, ukuyishiya isebenze ngokuzenzakalela kufanele sisebenzise umyalo:

sysctl net.ipv4.ip_forward=1

Noma uyihlele ngqo kufayela /etc/sysctl.conf. Ngokuya ngokusatshalaliswa lokhu kulungiselelwa kungabuye kube kufayela ku-  /etc/sysctl.d/.

Ngokuzenzakalelayo i-Linux yethu kufanele ibe netafula lokuhambisa umzila, okuvamise ukumiswa kwenethiwekhi yethu ye-lan nokuxhumeka ku-router. Uma sifuna ukubona lo mzila singasebenzisa imiyalo emibili:

route -n

o

netstat -nr

Yomibili le miyalo kufanele ibuye efanayo.

Ngokuvamile, lokhu kulungiselelwa kwanele ukuthi i-Linux yakho isebenze njengeSango kanye namanye amakhompyutha angazulazula kwikhompyutha yethu. Manje, uma sifuna iLinux yethu ixhume amanethiwekhi amabili noma ngaphezulu, noma ngabe asendaweni noma cha, isibonelo, singasebenzisa imizila emile.

Ake sithi i-Linux yami inezindawo ezimbili zokuxhumana, eyokuqala ine-inthanethi lapho inethiwekhi yayo ingu-172.26.0.0 bese eyesibili (10.0.0.0) inamanye amakhompyutha avela kwenye inethiwekhi yendawo. Uma sifuna ukuhambisa amaphakethe kuleyo enye inethiwekhi esingayisebenzisa:

route add -net 10.0.0.0 netmask 255.0.0.0 gw 172.26.0.8

Ngokuvamile kunjalo:

route add -net REDDESTINO netmask MASCARA gw IPDELLINUX

uma sinikela umzila -n noma ngabe le nethiwekhi ikhona noma cha, lo mzila uzolungiswa etafuleni lethu.

Uma sifuna ukuqeda umzila osetshenzisiwe singasebenzisa

route del -net 10.0.0.0 netmask 255.0.0.0

Ama-Iptable.

Ngokuyinhloko ama-iptables asetshenziselwa ukuhlunga iphakethe, ukuphuma, ukungena noma abanye, lokhu kukwenza ithuluzi elihle lokuphatha ithrafikhi yethu yenethiwekhi. Yebo, ama-iptables, njengoba nje esivumela ukuhlunga ithrafikhi kukhompyutha eyodwa, futhi kusivumela nokuhlunga ithrafikhi edlula kuyo. (Ukudlulisela phambili). Ama-Iptable angahlukaniswa ngamatafula, amaketanga, nezenzo.

• Amabhodi:  ngokuyisisekelo kungaba namatafula amabili, hlunga, ukuhlunga amaphakethe kanye  ubusuku ukuhumusha amakheli, okungukuthi, ukusuka kwinethiwekhi eyodwa kuya kwenye.
• Amaketanga: Iketanga lisho uhlobo lwethrafikhi esifuna ukuluhluza noma ukubhukuda, okungukuthi, sizosebenzisa amatafula kumuphi umgwaqo? futhi zingaba:  INPUT: Izimoto ezingenayo, UMPHUMELA: ithrafikhi ephumayo noma PHAMBILI: Ithrafikhi edlula kuyo, kepha akuyona ukuxhumana okufanele.
• Kungabonakala futhi UKUDLULA, esetshenziselwa ukwelapha iphakethe ngendlela ethile ngemuva kokuhanjiswa.
• Izenzo: Izenzo empeleni isenzo okufanele senziwe ngeketanga. Lesi senzo singaba I-DROP, lokho kucekela phansi leyo traffic noma YAMUKELA. lokho kuvumela ithrafikhi ukwenza leso senzo.

Imithetho ye-IPTABLES iyagcinwa futhi yenziwe ngendlela edalwe ngayo, futhi uma umthetho ususa umthetho wangaphambilini, umthetho wokugcina ku-oda uhlala usetshenziswa.

Izinqubomgomo ze-Firewall.

Ngokuvamile, ama-firewall ngokwemvelo asebenza ngezindlela ezimbili:

1. Vumela wonke umgwaqo ngaphandle, noma
2. Ungavumeli noma iyiphi ithrafikhi ngaphandle ...

Ukufaka izinqubomgomo, sebenzisa IPTABLES - P ISENZO CHAIN

Lapho intambo imele uhlobo lwethrafikhi (INPUT, OUTPUT, PHAMBILI, POSTROUTING ...) futhi isenzo sithi DROP NOMA WAMUKELE.

Ake sibheke isibonelo.

Lapha sibona ukuthi ekuqaleni ngikwazile ukubamba, ngabe sengitshela i-IPTABLES ukuthi wonke umgwaqo we-OUTPUT yi-DROP noma awuvunyelwe. Ngibe sengitshela i-IPTABLES ukuthi ikwamukele.

Uma sizokwakha i-firewall kusuka ekuqaleni kufanele ngaso sonke isikhathi sisebenzise imithetho ye (Ungavumeli noma yimuphi umgwaqo ngaphandle kwalokhu ...

iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P PHAMBILI DROP

Ukubuyela sibhala okufanayo bese sishintsha i-DROP nge-ACCEPT.

Kuleli qophelo, njengoba wonke umgwaqo wenqatshiwe, siqala ukutshela ama-IPTABLES ethu ukuthi angaba namuphi umgwaqo.

I-syntax yile:

iptables -A cadena -s ip_orgigen -d ip_destino -p protocolo --dport puerto -j acción

Kuphi:

Intambo = OKOKUFAKA, OKUPHUMAYO noma PHAMBILI

Umsuka_ip = Umsuka wamaphakethe, lokhu kungaba yi-IP eyodwa noma inethiwekhi futhi kulokhu kufanele sicacise imaski).

ukuphela_ip = lapho amaphakethe aya khona. le kungaba yi-IP eyodwa noma inethiwekhi futhi kulokhu kufanele sisho imaski).

umthetho = kukhombisa umthetho olandelwayo osetshenziswe ngamaphakethe (icmp, tcp, udp ...)

itheku = indawo okuyiwa kuyo yomgwaqo.

isenzo = DROP noma YAMUKELA.

Isibonelo:

ZONKE izinqubomgomo ezikhawulelwe ziyasebenza.

Ngemuva kwalokho sifaka imithetho ukuze sikwazi ukuthola ithrafikhi nge-port 80 HTTP kanye ne-443 HTTPS, ngenqubo ye-TCP. Ngemuva kwalokho i-port 53 Isetshenziselwa iklayenti le-DNS ukuxazulula izizinda, ngaphandle kwalokho ngeke uzulazule. Lokhu kusebenza nge-udp protocol.

Ulayini:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Kungenxa yalokhu okulandelayo: Uma wenza isicelo se-HTTP ngokwesibonelo, uxhuma ethekwini 80 yeseva, kepha iseva ukubuyisa imininingwane idinga ukuxhuma kuwe nganoma iyiphi imbobo. (Ngokuvamile mkhulu kune-1024).

Njengoba wonke amachweba ethu evaliwe lokhu ngeke kuzuzwe ngaphandle kokuthi sivule wonke amachweba aphakeme kuno-1024 (Umbono omubi). Lokhu kusho ukuthi yonke imigwaqo engenayo evela ekuxhumekeni engizenzele yona iyamukelwa. Ngisho, ukuxhumana engikuqalile ngokomthetho.

Ngithemba ukuthi uluthandile lolu lwazi. Kokulandelayo ngizokhuluma nge-NAT, Ummeleli kanye nezikripthi zeFirewal.