Ukuvikela inethiwekhi yakho ngama-Iptable - Ummeleli - I-NAT - IDS: INGXENYE 2

@Jlcmux

Imizuzu ye-5

Eposini elidlule, sibone indlela yokumisa ama-IPTables ukuze asebenze njenge-firewall. Manje sesiyabona ukuthi singawakha kanjani amaskripthi ukuze asebenzise imithetho ngokuzenzakalelayo lapho uhlelo luqala, kanye nendlela yokususa noma yokumisa leyo mithetho okwesikhashana.

Ngaphambi kokwenza iskripthi futhi sikubonise ukuthi sibukeka kanjani, ake sikhulume kancane nge-NAT nomqondo walokho esifuna ukukwenza ngalo mshini.

I-NAT nokuqukethwe kwesibonelo.

Uma sikhuluma nge-NAT, singakudida lokhu ngomzila, ngoba bobabili baphethe ukuxhuma amanethiwekhi amabili ahlukene komunye nomunye. Umehluko wangempela ukuthi ukuhanjiswa kusetshenziswa ukusuka kwinethiwekhi yendawo kuya kwenye futhi le nethiwekhi ingaxhuma ku-router bese iphuma iye kwi-Intanethi.

Ngenkathi, uma sikhuluma nge-NAT, sikhuluma ngokuhambisa amaphakethe kusuka kunethiwekhi yendawo noma yangasese kwinethiwekhi yomphakathi noma kwi-Intanethi. Lokhu ikwenza ngokufihla amaphakethe ngokubeka i-IP yomphakathi ehamba ngayo kwi-Intanethi. Lokho wukuthi, asidingi i-router, ngoba i-IP yomphakathi ibanjwe ngqo yikhompyutha ene-GNU / Linux.

ubusuku

Lokhu sizokusebenzisa ngesiqubulo esithi sisebenzisa i-Linux yethu njenge-router / firewall ukuphuma ku-Intanethi kusuka kunethiwekhi yendawo. Kepha lapha kungavela izimo ezimbili.

  • Ukuthi iLinux yethu iphakathi komzila womhlinzeki wesevisi nenethiwekhi yendawo.

Kulesi simo, kuzoba nenethiwekhi eyodwa phakathi kwe-router kanye nesistimu yethu ye-Linux, kanye nenethiwekhi ehlukile phakathi kwesistimu ye-Linux kanye nenethiwekhi yendawo. Lokhu kusho ukuthi i-router yethu ngeke idinge ukwenza i-NAT kanjalo; ukuqondisa okulula kwethrafikhi, njengoba kuchaziwe kokuthunyelwe kwangaphambilini, kwanele.

  • Ukuthi iLinux yethu inesixhumi esibonakalayo esixhunywe kunethiwekhi yasendaweni futhi ngesinye isikhombimsebenzisi sithola ngqo i-IP yomphakathi ezulazula ngayo.

Lokhu kusho ukuthi iLinux yethu kufanele yenze i-NAT ukuze amaphakethe afinyelele kwi-Intanethi.

Ngokwezinhloso zale laboratory encane ngaleso sikhathi, sizothi iLinux yethu ithola i-IP yomphakathi ngqo futhi ngaleyo ndlela ikwazi ukuhlola imiphumela yeNAT.

Ukwenza i-NAT sisebenzisa i-syntax

 iptables -t nat -A UKUDLULA -O eth1 -j MASQUERADE

Lapho i-eth1 isikhombimsebenzisi lapho sithola khona i-ip yomphakathi, okungukuthi, lapho siya khona kwi-Intanethi.

I-MASQUERADE isetshenziswa lapho i-ip isesidlangalaleni kepha ingahluka ngokuhamba kwesikhathi (inamandla). Ngaphandle kwalokho singasebenzisa i-SNAT -to-source ip

Ukwakha iskripthi se-iptables

Ake sithi-ke: 172.26.0.0 yinethiwekhi yethu yasendaweni futhi i-81.2.3.4 iyi-IP yomphakathi esiya kuyo kwi-Intanethi. (iyi-static ip). Ngine-interface eth0 (Inethiwekhi yendawo)

eth1 (Inethiwekhi yomphakathi).

Ngokuyisisekelo iqukethe ukudala iskripthi esingabizwa kusuka ku- /etc/init.d/firestop (ngokwesibonelo). futhi kusuka kulo mbhalo singaqala, simise noma sihlole isimo sokumiswa kwethu, njengoba senza nganoma iyiphi i-daemon yohlelo.

Ake sithi imithetho yami ye-IPTABLES IYI:

#! / bin / bash # I-Firewall yasekhaya lami. # Igama lefayela / njll / firewall_on # NguJlcmux Twitter: @Jlcmux # # Inqubomgomo eyisisekelo. iptables -P INPOUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # #NAT to share Internet from eth0 to eth1 iptables -t nat -A POSTROUTING -O eth1 -j SNAT - to-source 81.2.3.4
# # Vumela ukuxhumana okungenayo okuqaliswe ama-iptables ami -I-FORWARD -m state --state ESTABLISHED, RELATED -j ACCEPT # # iptables traffic ephumayo egunyaziwe -A FORWARD -i eth0 -o eth1 -p tcp --dport 80 -j ACCEPT iptables -A PHAMBILI -i eth0 -o eth1 -p tcp --dport 443 -j ACCEPT iptables -A FORWARD -i eth0 -o eth1 -p udp --dport 53 -j ACCEPT
Masingakhohlwa ukunikeza izimvume zokwenza

Ukuchazwa:

Iskripthi ngokuyisisekelo senza okulandelayo:

  1. Okokuqala khawula konke ukuzulazula, ukuxhumeka nethrafikhi. (Izinqubomgomo Eziyisisekelo ze-Firewall)
  2. Ngemuva kwalokho dala i-NAT nge-eth1 okuyiwa kuyo. okukhombisa ukuthi sine-static yomphakathi ip «81.2.3.4»
  3. Ivula amachweba adingekayo ukuthola amaphakethe wokuxhuma aqalwe yimina.
  4. Yamukela ithrafikhi ephumayo ye-HTTP, i-HTTPS, ne-DNS.
Imithetho yenzelwe ukuhambela phambili kwe-FORWARD ngoba sisebenzisa iLinux yethu njengeRouter, ngakho-ke izinqubomgomo zisetshenziselwa ithrafikhi EDLULA ngeLinux, okungukuthi, isebenza njengomxhumanisi. Lokhu kusho ukuthi i-Linux yethu ayikwazi ukuzulazula noma ukuthola noma iyiphi idatha ngqo. Isebenza kuphela kumakhompyutha axhumeke kuyo, kodwa hhayi yona uqobo

Uma besifuna ukusebenzisa imishini yethu ukuzulazula kufanele siphinde imigqa bese sishintsha PHAMBILI siye ku-INPUT noma ku-OUTPUT njengoba kufanele.

Khansela iskripthi.

Manje sizokwakha iskripthi esidlula konke lokhu okungenhla futhi sishiye ikhompyutha ihlanzekile kukho konke lokhu. (Ngezinhloso zokuhlola noma sifuna nje ukuvala i-firewall).

#! / bin / bash # I-Firewall yasekhaya lami. # Igama lefayela / njll.

Izenzakalelayo.

Manje sidinga ukudala iskripthi ngaphakathi kwe- /etc/init.d/ ukuze isevisi iqale ngokuzenzakalelayo futhi sikwazi ukuyiphatha kalula.

#! / bin / bash # I-Firewall yasekhaya lami. # Igama lefayela /etc/init.d/ firewall # NguJlcmux Twitter: @Jlcmux icala $ 1 ekuqaleni) / etc / firewall_on ;; misa) / etc / firewall_off ;; isimo) iptables -L ;; *) echo "I-syntax engalungile. Kuvumelekile = /etc/init.d/ firewall start | stop | status ;; esac

Ukuchazwa:

Sibeka lesi skripthi sokugcina ku- /etc/init.d/ enegama elithi "firewall" . Ngemuva kwalokho, uma sifuna ukuphatha i-firewall, singasebenzisa umyalo othi /etc/init.d/firewall start. Singawumisa noma sihlole isimo sawo ngendlela efanayo.

Manje sizohlela ifayela le-/etc/rc.local bese sengeza into efana nalokhu: /etc/init.d/firewall start ukuze liqale ngohlelo.

Kanjalo. Le yingxenye yesibili. Ngiyethemba liletha okuthile kini nonke. Kokulandelayo sibona i-Proxy ne-IDS.


Engeza njengomthombo okhethwayo ku-Google