Ukucushwa kwe-Firewall: umhlahlandlela ophelele wokuvikela inethiwekhi yakho

I-Informatec Digital » Izinsiza » Ukucushwa kwe-Firewall: umhlahlandlela ophelele wokuvikela inethiwekhi yakho

Kunoma iyiphi inethiwekhi yesimanje, kusukela ku -Wi-Fi yasekhaya kuya kwingqalasizinda yebhizinisi elikhulu, i- firewall iyindlela yokuqala yokuzivikela ekuhlaselweni, ukufinyelela okungagunyaziwe, kanye nokuvuza kwedatha. Ngaphandle kokucushwa okufanele, kufana nokushiya umnyango wakho wangaphambili uvulekile: akukho lutho olungenzeka… kuze kube yilapho lwenzeka.

Noma kunjalo, abasebenzisi abaningi ngisho nezinhlangano ezithile zinezithiyo zomlilo ezisebenza ngezilungiselelo ezizenzakalelayo, ngaphandle kokuqonda ngempela ukuthi zenzani noma ukuthi zingazilungisa kanjani . Lapha uzothola umhlahlandlela ophelele futhi owusizo kakhulu wokuthi iyini i-firewall, ukuthi ungayilungiselela kanjani ku-Windows, macOS, Linux, routers, kanye nezindawo zeseva, kanye nemikhuba emihle ethuthukisiwe (i-NGFW, ukuhlukaniswa, ukugawulwa kwezincwadi, amathuluzi engeziwe) ukuze ukwazi ukwenza ngokwezifiso izinga lokuvikelwa endaweni yakho ngaphandle kokukhungatheka.

Iyini i-firewall futhi kungani ibaluleke kangaka?

I-firewall uhlelo oluhlaziya ithrafikhi engena futhi iphuma kunethiwekhi noma kudivayisi yakho bese inquma ukuthi yini okufanele iyivumele nokuthi yini okufanele iyivimbele ngokusekelwe kusethi yemithetho. Le thrafikhi iqukethe amaphakethe edatha ahamba kusetshenziswa amaphrothokholi ahlukene (i-TCP, i-UDP, i-ICMP, njll.) kanye nama-port.

Umqondo ulula: i-firewall isebenza njengesihlungi kanye nesithiyo phakathi kwedivayisi noma inethiwekhi yangaphakathi kanye ne-inthanethi . Ihlola ukuthi iphakethe livelaphi, liyaphi, lisebenzisa yiphi i-port, nokuthi liphethe uhlobo luni lokuqukethwe. Uma lihambisana nomthetho ovunyelwe, liyalivumela ukuthi lidlule; uma kungenjalo, liyalivimba. Lo mqondo unikeza izinzuzo ezicacile: ukuphepha okukhulu, amathuba aphansi okutheleleka nge-malware, kanye nokulawula okukhulu kokungenayo nokuphumayo.

Cabanga ngodonga lwakho lomlilo njengomnyango wangaphambili wendlu yakho yedijithali : unquma ukuthi ubani ovumela ukuthi angene, ubani ogcina ukuthi angene, nokuthi yiziphi izindawo zendlu lapho isivakashi ngasinye singavakashela khona. Ngaphezu kwalokho, udonga lomlilo alugcini nje ngokumisa ukuhlaselwa; futhi lukuvumela ukuthi ukhawulele ukufinyelela kumawebhusayithi athile noma izinhlelo zokusebenza, nakuba zingenalo unya, ongafuni zisetshenziswe (isibonelo, izinkundla zokuxhumana endaweni yenkampani).

Ezweni langempela, sithola izinhlobo ezimbili eziyinhloko zama-firewall: ama-firewall esofthiwe (ahlanganiswe ohlelweni lokusebenza noma afakwe njengohlelo) kanye nama-firewall ehadiwe (amadivayisi anikezelwe, avame ukufakwa kuma-router ochwepheshe noma ebhizinisi). Ngaphezu kwalokho, kune -firewall yesizukulwane esilandelayo (ama-NGFW) , ahlanganisa izendlalelo eziningana zokuphepha okuthuthukisiwe, ukuhlolwa kwephakethe elijulile, i-IPS, kanye nezici zokuhlukanisa izinhlelo zokusebenza kanye nokulawula.

Izinhlobo ze-firewall ongase uhlangane nazo

Ngaphakathi kwesambulela "se-firewall" kukhona ubuchwepheshe obuningana obunezindlela ezahlukene. Ukubuqonda kukusiza ukuthi wazi ukuthi ubheke ini uma uhlola ukucushwa kwe-router yakho, uhlelo lwakho lokusebenza, noma i-NGFW yebhizinisi.

Iqembu lokuqala lakhiwe ngama -firewall okuhlunga amaphakethe . Lawa adala amaphuzu okulawula kuma-router noma kuma-switch futhi enza ukuhlola okulula kwephakethe ngalinye ngokusekelwe ekhelini le-IP lomthombo, ikheli le-IP yendawo, i-port, kanye nephrothokholi. Ayashesha, kodwa awahlaziyi okuqukethwe ngokujulile.

Bese kuba nezingodo zomlilo zesango lesifunda , ezigxila ekuvumeni noma ekwenqabeni ukuxhumeka ngokusekelwe esimweni seseshini, ngaphandle kokuhlola iphakethe ngalinye ngokuningiliziwe. Zisebenza kahle kakhulu, kodwa azisebenzi kahle ekutholeni izinsongo eziyinkimbinkimbi.

Ama-firewall okuhlola aqinile ahlanganisa ulwazi lwephakethe nokulandelela ukuxhumeka kwe-TCP. Agcina ithebula lamaseshini asebenzayo futhi aqinisekisa ukuthi ithrafikhi ihambisana nokugeleza okuvunyelwe, okunikeza ukuvikelwa okuqinile kakhulu kunokuhlunga okulula okungaguquki.

Siphinde sibe namasango asezingeni lesicelo noma ama-firewall e-proxy . Lawa asebenza kungqimba yesicelo futhi ahlola i-HTTP, i-FTP, kanye neminye ithrafikhi, okuvumela izinqubomgomo eziyinkimbinkimbi kakhulu ezisekelwe ohlotsheni lwesicelo noma ngisho nokuqukethwe. Le ndlela yakha isisekelo sama-firewall amaningi amafu kanye namathuluzi okuhlola ithrafikhi ejulile.

Ama-firewall esizukulwane esilandelayo (ama-NGFW) ahlanganisa ukuhlolwa okujulile, ukulawula uhlelo lokusebenza, imisebenzi yesistimu yokuvimbela ukungena (i-IPS), ukuhlunga isigaba sewebhu, ukuhlaziywa kwamafayela okuthuthukisiwe, kanye namakhono asekelwe ku-AI. Angasetshenziswa njengemishini ebonakalayo, imishini ebonakalayo, noma izinsizakalo zamafu.

Ngaphezu kwalokho, ngokusekelwe endaweni yazo, singakwazi ukuhlukanisa phakathi kwama-firewall esofthiwe (ku-PC ngayinye, iseva, noma idivayisi) kanye nama-firewall ehadiwe (izinto zikagesi ezinikezelwe ku-network perimeter). Ngaphezu kwalokho, kune -firewall yamafu , esebenza njenge-proxies enkulu ekwazi ukukala ukuvikela izindawo nezinhlangano ezisatshalaliswe ngabasebenzisi nezindawo eziningi.

I-Firewall ku-router: umugqa wokuqala wokuzivikela kunethiwekhi yakho

I-router onayo ekhaya noma ehhovisi ivame ukuba ne- firewall eyakhelwe ngaphakathi kanye ne-NAT/PAT . Lokhu kusho ukuthi, ngokuzenzakalelayo, akekho ongavula uxhumano oluqondile oluvela ku-inthanethi oluya kumadivayisi akho angaphakathi ngaphandle kokuthi kukhona ukudluliselwa kwe-port, i-DMZ esebenzayo, noma amaphrothokholi angalungiselelwe kahle njenge-UPnP.

Inqubomgomo evamile ku-router yesimanje "ukwenqaba yonke ithrafikhi engenayo ngaphandle kokuthi kuvunyelwe ngokucacile ." Lokhu kuqiniswa yi-IPv4 NAT/PAT: amadivayisi angaphakathi asebenzisa ama-IP ayimfihlo, futhi i-router ihumusha ukuxhumana kwawo okuphumayo kube yi-IP yomphakathi. Noma yimuphi umzamo wokuqala ukuxhumana kusuka ku-inthanethi ngaphandle kwe-port evulekile noma umthetho okhona uzokwenqatshwa.

Yingakho kuyingozi kakhulu ukuvula i-DMZ kwi-PC kunethiwekhi yendawo engenayo i-firewall yayo ehlelwe kahle: leyo khompyutha izovezwa ngokuphelele kwi-inthanethi, wonke amachweba afinyeleleka ngaphandle kwalawo aqondiswe komunye umshini.

Izindlela eziyisisekelo ezinhle kakhulu zama-firewall e-router zifaka phakathi ukungavuli ama-port angadingeki kakhulu, ukugwema ukusebenzisa i-DMZ ngaphandle kwamadivayisi athile kakhulu (njenge-game console), kanye nokukhubaza i-UPnP njalo ukuvimbela amadivayisi ukuthi avule ama-port ngokwawo. Ukuvula ama-port ngesandla kukunikeza ukulawula okuphelele kwalokho okuveziwe.

Kunconywa futhi ukuhlola ngezikhathi ezithile ukuthi yimaphi ama-port avuliwe, ukuvala lawo angasasetshenziswa, bese ukhawulela, lapho kungenzeka, ama-IP angafinyelela izinsizakalo ezibucayi (isibonelo, ukuvumela i-SSH kuphela kusuka ku-IP ethile yokuphatha hhayi kusuka ku-inthanethi yonke).

Izinketho ezivamile zomlilo kuma-router asekhaya nawathuthukile

Kuye ngohlobo lwe-router yakho, izinketho zokucushwa kwe-firewall zingahluka, kodwa indlela enengqondo iyafana: iphrofayili yokuphepha, imithetho, kanye nokuhlunga okwengeziwe . Ake sibheke ezinye izibonelo ezimele.

Ama-router e-ASUS

Ama-router e-ASUS ahlanganisa i -firewall esekelwe ku -iptables . Kusukela ku-interface yewebhu, kumenyu ethi "Firewall", ungavumela noma ukhubaze i-firewall ye-IPv4 ne-IPv6 (ivulwa ngokuzenzakalelayo, njengoba kufanele ibe njalo) bese ulungiselela izinyathelo zokulwa ne-DoS ezivimba amakheli omthombo enza imizamo eminingi yokuxhumana.

Enye inketho evamile ukuvimba izicelo ze-ping (izicelo ze-ICMP Echo) ku-interface ye-WAN, ukuze i-router yakho ingaphenduli (imodi yokucasha). Ezindaweni ze -IPv6 , i-firewall ilungiselelwe ngenqubomgomo yokungena ekhawulelwe kakhulu : idivayisi ngayinye inekheli layo le-IP lomphakathi, kodwa ukuxhumana okungenayo okungalindelekile kuyavinjelwa, kuyilapho ukuxhumana okuphumayo kuvunyelwe ngokujwayelekile.

I-ASUS iphinde inikeze izici "zesihlungi se-LAN kuya ku-WAN", ezikuvumela ukuthi uvimbele ithrafikhi kusuka ku-LAN yakho iye kwi-inthanethi ngokusekelwe ekhelini le-IP lomthombo, ikheli le-IP yendawo oya kuyo, kanye namachweba. Ngaphezu kwalokho, ukuhlunga i-URL kanye namagama angukhiye kusekelwa ngaphakathi yi-firewall ukuze kuphoqelelwe imikhawulo.

Ama-Router e-Livebox (i-Livebox Fiber, njll.)

Kuma-router e-Livebox, avame ukusetshenziswa abahlinzeki bezinsizakalo ze-inthanethi, i-firewall iphathwa kusukela kumenyu ethi "Izilungiselelo Ezithuthukisiwe > Izilungiselelo Zomlilo". Lapho ungakhetha kusuka kumazinga amaningana: aphansi, aphakathi nendawo, aphezulu, kanye nangokwezifiso.

Izinga lokuhlunga "eliphansi" alinikezi cishe ukuhlunga (ngale kwalokho okubalulekile ku-NAT) futhi lenzelwe abasebenzisi abathuthukile ababeka phambili ukuguquguquka kunokuphepha. Izinga lokuhlunga "eliphakathi", okuvame ukuba yilo elizenzakalelayo, lilahla konke ukuxhumana okungenayo futhi livumela ithrafikhi ephumayo ngaphandle kwezinsizakalo ezithile kakhulu njenge-NetBIOS.

Iphrofayili "ephezulu" iyona enemingcele kakhulu: ivumela kuphela ukuxhumeka okuphumayo kumasevisi ajwayelekile achazwe kahle futhi ivimba ukuxhumeka okungenayo okungalindelekile. Imodi "yezifiso" ivumela umsebenzisi ukuthi abeke imithetho ethile futhi ihloselwe abaphathi abaziyo ukuthi benzani; ngokulungiselelwa okubi, ungavimba izinsizakalo ezisemthethweni noma ushiye ubuthakathaka obukhulu.

Ama-router e-AVM FRITZ!Box

Amadivayisi e-FRITZ!Box anesivikelo somlilo esibanzi impela. Kumbono othuthukisiwe, ngaphansi kwemenyu ethi "I-inthanethi > Izihlungi", ungenza kusebenze imodi eyimfihlo ukuze ugweme ukuphendula kuma-ping ku-WAN futhi uvimbele amachweba abucayi njenge-25 (i-SMTP engabethelwe ngekhodi), i-NetBIOS, noma i-Teredo uma ingasetshenziswa.

Ezindaweni ze-NAT, kubalulekile ukubuyekeza njalo izilungiselelo zokudlulisela imbobo bese uvala noma yiziphi ezingasadingeki ukuvimbela izinsizakalo eziphelelwe yisikhathi ekubeni izindawo zokungena. Izinsizakalo zokuphatha kude ze-FRITZ!Box nazo kufanele zikhutshazwe uma zingabalulekile; kunalokho, kuphephile kakhulu ukufinyelela i-router nge-VPN futhi, uma usungene kunethiwekhi, uyiphathe usebenzisa ikheli layo le-IP eliyimfihlo.

I-FRITZ!Box iphinde inikeze ukufinyelela okukude okusekelwe ku-IPsec kanye nokuxhumeka kwe-VPN kusuka endaweni kuya kwenye. Lena indlela enhle yokugwema ukudalula izinsizakalo ngqo kwi-inthanethi nokuphoqa konke ukufinyelela okukude ngesiteshi esibethelwe nesilawulwayo.

Izicishamlilo zesizukulwane esilandelayo (NGFW) kanye nokuphepha okuthuthukisiwe

Ezindaweni zezinkampani, ama-firewall esizukulwane esilandelayo, njengobubanzi be-FortiGate, adlula kakhulu ukuhlunga amachweba okulula. Lawa madivayisi ahlanganisa izici zokuxhumana ezithuthukisiwe kanye nokuphepha okujulile epulatifomu eyodwa, okunciphisa isidingo samadivayisi amaningi ahlukene.

Isibonelo, iFortiGate isekelwe ohlelweni lokusebenza lweFortiOS futhi ifaka phakathi i-SD-WAN, i-ZTNA (Zero Trust Access), ukuhlanganiswa kwe-WLAN ne-LAN, ukuhlolwa okujulile kwethrafikhi ebethelwe, i-IPS , ukuhlunga kwesigaba sewebhu, kanye namakhono okuhlaziya asekelwe ku-AI ngezinsizakalo zeFortiGuard.

Lawa ma-NGFW ngokuvamile athembele kusakhiwo se -ASIC esenziwe ngokwezifiso , okwenza ukusebenza okuphezulu kakhulu kanye nokusebenza kahle kwamandla okuthuthukisiwe, ngisho nalapho kuhlolwa inani elikhulu lethrafikhi ebethelwe. Ngaphezu kwalokho, ahlanganiswe kulokho okwaziwa ngokuthi "Indwangu Yokuphepha": i-mesh yokuphepha ehlanganisa amanethiwekhi, ama-endpoints, namafu, ngezinqubomgomo ezihlanganisiwe ezilawulwa kusuka kumapulatifomu afana ne-FortiManager.

Isihluthulelo sale ndlela ukuthi yonke indawo yenethiwekhi imbozwe yizinqubomgomo ezihambisanayo : kusukela emngceleni kuya ekugcineni, kufaka phakathi izindawo ezihlanganisiwe nezamafu. Lokhu kwenza kube lula ukuphendula ngokushesha ezinsongweni ezivelayo, kuhlukanise amanethiwekhi abe yinkimbinkimbi, futhi kunikeze ukubonakala okuphelele kwezehlakalo zethrafikhi nezokuphepha.

Izinyathelo zokuklama nokulungiselela i-firewall yenethiwekhi ehlelwe kahle

Uma sikhuluma ngama-firewall kumanethiwekhi ebhizinisi (angokoqobo noma angokoqobo), akwanele ukumane uxhume imishini bese ushiya izilungiselelo ezizenzakalelayo. Ukucushwa kwangaphambilini kwezindawo , amakheli e-IP, kanye nezinqubomgomo kuyadingeka ukuze kuvunyelwe ukulawulwa kwethrafikhi okulungisiwe.

Dizayina izindawo zomlilo kanye nohlelo lokuthumela ikheli le-IP

Isinyathelo sokuqala ukuhlonza izimpahla zenethiwekhi (amaseva, izinhlelo zokusebenza ezibalulekile, izindawo zokusebenza, amadivayisi e-IoT, izinhlelo ze-POS, i-VoIP, njll.) bese uwahlanganisa ngokwemisebenzi yawo , izinga lokuzwela, kanye nezidingo zokufinyelela . Esikhundleni senethiwekhi eyodwa, eyisicaba lapho konke kuxhumene khona, kwakhiwa izingxenye noma izindawo.

Kujwayelekile ukuchaza i -DMZ (indawo engenampi) yamaseva avulekele i-inthanethi, njengewebhu, i-imeyili, i-VPN, noma amaseva e-API yomphakathi. Kulezi zindawo, ukufinyelela i-inthanethi kukhawulelwe kuphela kulokho okudingekayo ngempela. Amaseva angaphakathi, njengezizindalwazi, izinhlelo zokuphatha, izindawo zokusebenza, kanye namadivayisi ezwi noma okutholakala kuwo, abekwa ezindaweni zangaphakathi ezinezinqubomgomo zokuphepha eziqinile.

Uma usebenzisa i-IPv4, kubalulekile ukusebenzisa amabanga amakheli ayimfihlo kuwo wonke amanethiwekhi angaphakathi futhi ulungiselele i-NAT ukuze amadivayisi angaphakathi akwazi ukufinyelela i-inthanethi uma kudingeka. Njengoba kwakhiwa ingqalasizinda, amaswishi anokusekelwa kwe-VLAN asetshenziselwa ukugcina ukuhlukaniswa okunengqondo kwe-Layer 2 phakathi kwezingxenye.

Uma isakhiwo sendawo kanye nohlelo lokuxhumana lwe-IP sekucacile, izindawo ezihambisanayo zakhiwa ku-firewall futhi zabelwe kuma-interface angokoqobo noma ama-subinterface . Lokhu kumephu kuyisihluthulelo sokuqinisekisa ukuthi imithetho ye-firewall isetshenziswa kahle phakathi kwezindawo.

Lungiselela uhlu lokulawula ukufinyelela (ama-ACL)

Njengoba izindawo sezichaziwe manje, sekuyisikhathi sokudala imithetho elawula ukuthi yini engaxhumana nokuthi yini . Le mithetho isetshenziswa njenge-ACL (uhlu lokulawula ukufinyelela), lapho ithrafikhi evunyelwe (noma enqatshelwe) phakathi kwezindawo ichazwa ngemininingwane eminingi ngangokunokwenzeka.

Uhlu Lokulawula Ukufinyelela (ama-ACL) lusetshenziswa ngesixhumi esibonakalayo se-firewall noma i-subinterface, futhi kungcono ukulungisa ikheli le-IP lomthombo, ikheli le-IP lendawo oya kuyo, kanye nama-port ngokunembe ngangokunokwenzeka . Ngamanye amazwi, kungcono ukuvumela "le seva kule port kule database" kunokuthi "le nethiwekhi yonke iye kuzo zonke ama-port kwenye inethiwekhi."

Umthetho obaluleke kakhulu "ukuphika konke" ekugcineni kwe-ACL ngayinye. Le nqubomgomo evimbelayo iqinisekisa ukuthi noma iyiphi ithrafikhi engamboziwe ngokucacile ivinjiwe . Ngemuva kwalokho, ama-ACL angenayo naphumayo asetshenziswa ku-interface ngayinye, kulungiswa ukuziphatha ngokuya ngesiqondiso sethrafikhi.

Kungumqondo omuhle ukukhubaza ukufinyelela komphakathi kuzixhumi zokuphatha ze-firewall futhi uqiniseke ukuthi awuhloli nje kuphela ukuthi izinhlelo zokusebenza ziyasebenza, kodwa nokuthi ithrafikhi engafuneki ivinjiwe ngempumelelo . Isibonelo, kufanele uqinisekise ukuthi izici zokulawula ezingeni lesicelo (ukuvimba isigaba sewebhu, ukuhlaziywa kwamafayela okuthuthukisiwe, i-IPS, njll.) zisebenza njengoba kulindelekile.

Lungiselela izinsizakalo ezengeziwe namalogi

Ama-firewall amaningi akuvumela ukuthi unike amandla izinsizakalo ezengeziwe njenge-DHCP, i-NTP, noma i-IPS ngqo kudivayisi. Nika amandla kuphela lawo masevisi ozowasebenzisa ngempela; khubaza okusele ukuze unciphise indawo yakho yokuhlasela.

Esinye isici esibalulekile ukucushwa kwelogi. Ukuze kuhambisane nemithetho efana ne- PCI DSS , i-firewall kumele ithumele amalogi anemininingwane kuseva yelogi noma i-SIEM, ehlanganisa izici ezifana nokuthi ubani ofinyelela uhlelo, ukusuka kuphi, kuya kuyiphi insizakalo, nokuthi umphumela unjani. I-PCI DSS, isibonelo, ibeka izidingo ezithile ezigabeni 10.2 kanye no-10.3 mayelana nokuqukethwe kwala malogi.

Ubuningi bamalogi bungaba phezulu, kodwa yindlela kuphela yokuhlola ukufinyelela nokuthola amaphethini okuhlasela noma izinto ezingavamile . Kunconywa ukuchaza izinqubomgomo zokugcina, ukujikeleza, nokuqapha lezi zenzakalo ukuze ukwazi ukuphendula ngokushesha lapho kukhona okungahambi kahle.

Hlola ngokuphelele ukucushwa

Ngaphambi kokusebenzisa ukucushwa okusha kwe-firewall, noma ngemva koshintsho olukhulu, kubalulekile ukuqinisekisa ukuthi kuvimbela lokho okufanele futhi kuvumele lokho okudingekayo . Lokhu kufaka phakathi ukuskena kwe-port, ukuhlolwa kobungozi, kanye nokuhlolwa kokungena.

Kubalulekile futhi ukuba namakhophi okusekelayo okucushwa endaweni ephephile nokuhlola inqubo yokubuyisela emuva. Ngaphambi kokwenza noma yiziphi izinguquko ezibalulekile, bhala phansi izinguquko ezihleliwe bese uqinisekisa ukuthi uyazi ukuthi ungayibuyisela kanjani i-firewall uma kukhona okungahambi kahle ngesikhathi sewindi lokulungisa.

I-Firewall kumanethiwekhi eseva ebonakalayo (ifu langasese noma lomphakathi)

Kumapulatifomu eseva yamafu, kuvamile ukuba ne-firewall yezinga lenethiwekhi elungisekayo kusuka kuphaneli yokulawula, ngaphezu kwe-firewall yesistimu yokusebenza kanye nanoma yimaphi ama-firewall aphakathi. Ukuqonda indlela lezi ezisetshenziswa ngayo kusiza ukugwema ukungqubuzana kwemithetho.

Ngokuvamile, amaphakethe angenayo aqala adlule ku-firewall yenethiwekhi (ephethwe yipulatifomu), bese edlula ku-firewall yeseva (isibonelo, ama-iptables ku-Linux noma ku-Windows Firewall), bese ekugcineni edlula kunoma yimaphi ama-firewall engeziwe asekelwe kusofthiwe. Ithrafikhi ephumayo ilandela indlela ephambene.

Kulolu hlobo lwephaneli, ukucushwa kuvame ukusekelwe emithethweni enegama, isenzo (ukuvumela noma ukwenqaba), umthombo nendawo oya kuyo (i-IP, ububanzi, i-CIDR, "noma yikuphi", "kwangaphakathi", "kwangaphandle"), imithombo nendawo oya kuyo (imbobo ethile, ububanzi noma "noma yikuphi") kanye nephrothokholi (i-TCP, i-UDP, kokubili noma i-ICMP).

Imininingwane ebalulekile ukulandelana kwemithetho : uma umthetho uphezulu ohlwini, kulapho ukubaluleka kwawo kuphakeme. Umthetho "wokwenqaba" obekwe ngaphambi komthetho "wokuvumela" wethrafikhi efanayo uzokwenza ukuthi lowo mgwaqo uvinjwe. Yingakho ngokuvamile bekuvumela ukuthi uhlele kabusha imithetho ngokuhudula nokulahla, ukuze ulungise izinto eziza kuqala.

Uma i-firewall ikwimodi yokuvala, wonke amaphakethe ayangena futhi aphume ngaphandle kokuhlunga. Kumodi esebenzayo, ukuziphatha okuzenzakalelayo kuvame ukuba "ukuvumela noma yini engahambisani nanoma yimuphi umthetho," yize kuphephile kakhulu ukusetha inqubomgomo yokuphika okuzenzakalelayo nokuvumela kuphela okudingekayo , ikakhulukazi ezindaweni ezinedatha ebucayi.

I-Firewall ohlelweni lokusebenza: iWindows, i-macOS ne-Linux

Ngaphezu kwe-firewall ye-router kanye nanoma iyiphi i-firewall yenethiwekhi esekelwe efwini, zonke izinhlelo zesimanje ziqukethe ungqimba lwazo lokuvikela. Ukuyilungiselela kahle kunikeza indlela yokuzivikela ejulile , ikakhulukazi ewusizo uma noma iyiphi isevisi ivezwe ku-inthanethi noma uma umhlaseli ethola ukufinyelela kunethiwekhi yendawo.

I-Windows Firewall: Ukucushwa Okuyisisekelo Nokuthuthukisiwe

Ku-Windows, i-firewall eyakhelwe ngaphakathi (i-Windows Defender Firewall noma i-Microsoft Defender Firewall) ihlunga ithrafikhi ngokusekelwe emithethweni echazwe ngaphambilini kanye neyangokwezifiso . Ungayibuka futhi uyiphathe kusuka kuhlelo lokusebenza lwe-Windows Security, ngaphansi kwesigaba esithi "Ukuvikelwa kwe-Firewall kanye nenethiwekhi".

Isinyathelo sokuqala ukuhlola iphrofayela yenethiwekhi esebenzayo: isizinda, esiyimfihlo, noma esisesidlangalaleni. Inethiwekhi yangasese (njengenethiwekhi yakho yasekhaya) ithatha indawo ethembekile futhi ivumela ukuxhumana okwengeziwe okungenayo, kuyilapho inethiwekhi yomphakathi (njenge-Wi-Fi yesitolo sekhofi) inemithetho eqinile futhi ivimba cishe yonke into evela ngaphandle.

Kusukela kulesi sixhumi esibonakalayo, ungavumela noma ukhubaze i-firewall yohlobo ngalunye lwenethiwekhi, yize ukuyikhubaza akuyona umqondo omuhle ngoba kwandisa ubungozi bokufinyelela okungagunyaziwe . Uma uhlelo lokusebenza olusemthethweni lungasebenzi ngoba luvinjiwe, indlela efanele ukudala okuhlukile noma ukuvula imbobo ethile yalo, hhayi ukuvala yonke i-firewall.

Izilungiselelo ezithuthukisiwe zilawula imithetho engenayo nephumayo , enquma ukuthi yikuphi ukuxhumana okuvunyelwe. I-Windows ihlukanisa le mithetho ibe izinhlobo ezine: imithetho yohlelo (evumela noma evimba i-executable ethile), imithetho ye-port (elawula ama-port athile e-TCP/UDP), imithetho echazwe kusengaphambili (enikezwa uhlelo), kanye nemithetho yangokwezifiso (eguquguqukayo kakhulu, ekuvumela ukuthi uhlanganise uhlelo, i-port, iphrothokholi, kanye nekheli).

Ngaphezu kwalokho, kukhona inketho yokuvimba konke ukuxhumana okungenayo , kufaka phakathi lokho okusohlwini oluvunyelwe. Lokhu kuyasiza uma udinga ukuphepha okuphezulu, yize kungabangela ukuthi izinsizakalo ezibalulekile (amafayela abiwe, ideskithophu ekude, njll.) ziyeke ukusebenza.

Izinhlangano eziningi zisebenzisa amathuluzi okuphatha ahlanganisiwe, njenge- Ivanti Endpoint Security Solution Agent Configuration . Lawa mathuluzi avumela abasebenzisi ukuthi bakhe inqubomgomo ye-Windows Firewall futhi bayithumele ngobuningi kumadivayisi asebenzisa izinguqulo ezahlukene ze-Windows (XP/2003, Vista, kanye nezakamuva), echaza imithetho engenayo/ephumayo, okuhlukile, kanye nokusebenza/ukuvala ukusebenza kwe-firewall njengengxenye yemisebenzi yokumisa noma yokulungisa.

Usizo, izinsiza, kanye nezincazelo zokuphepha ku-Windows Firewall

Ukucushwa okuningiliziwe kungaba yinkimbinkimbi kancane, ngakho-ke kukhona amathuluzi enza imisebenzi yansuku zonke ibe lula. I-TinyWall , isibonelo, isebenza njengesendlalelo sokuphatha phezu kwe-firewall ye-Windows futhi ikuvumela ukuthi ushintshe izindlela zokusebenza (ezinomkhawulo kakhulu noma ezincane), ubonise ukuxhumana okusebenzayo, udale uhlu olumhlophe, futhi uvimbele i-firewall uqobo ekuvimbeleni izinhlelo zokusebenza ozidingayo.

Esinye isibonelo yi- Windows Firewall Control , ehlanganisa ithreyi yesistimu futhi inikeza amaphrofayili asheshayo (aphezulu, aphakathi nendawo, aphansi, angenawo ukuhlunga) kanye nesixhumi esilula sokuphatha imithetho, ukungenisa/ukuthumela ukucushwa, kanye nokusebenzisa imodi yokufunda ethola izinhlelo ezisayinwe ngedijithali ukuze kudalwe imithetho ngokuhlakanipha kakhudlwana.

Ezixazululweni zokuphepha kwebhizinisi njenge-Ivanti Endpoint Security, izinsongo zokuphepha ezithile ezihlobene ne-Windows Firewall ziyachazwa (isibonelo, i-ST000102 ye-Windows Firewall ku-XP/2003). Lezi zincazelo zifaka phakathi iziguquguquko ezingenziwa ngokwezifiso ezikuvumela ukuthi ulandelele ukuthi ukucushwa kwe-firewall yangempela kuyafana yini nenqubomgomo oyifunayo, futhi uma kungenjalo, maka ikhompyutha njengesengozini bese uqalisa imisebenzi yokulungisa ukuze kuqinisekiswe izilungiselelo ezifanele.

I-Firewall ku-macOS

Ku-Mac, i-firewall ihlelwe kusukela ku-"Izilungiselelo Zesistimu" (noma "Izintandokazi Zesistimu" ezinguqulweni ezindala), ngaphakathi kwesigaba seNethiwekhi kanye ne-Firewall . Lapho ungayivula bese ufinyelela izinketho ezithuthukisiwe ukuze unqume ukuthi uzosingatha kanjani ukuxhumana okungenayo.

Phakathi kwezinye izinto, ungavimba ukuxhumana okungacelwanga , uvumele izinhlelo zokusebenza ezibalulekile kanye nezinsizakalo kuphela, ulawule ukuthi yiziphi izinhlelo zokusebenza ezithile ezingamukela ithrafikhi, futhi unike amandla ukwengeza okuzenzakalelayo kwezinhlelo zokusebenza ezithembekile ohlwini oluvunyelwe. Luhlelo olulula kune-Windows ngokwemininingwane yembobo, kodwa lusebenza kahle kakhulu kumsebenzisi ojwayelekile.

Ezindaweni zezinkampani, lokhu kuvame ukuhambisana nezinqubomgomo zokuphepha eziphethwe ngumphakathi, eziqinisekisa ukuthi yonke imishini ye-Mac ilandela imithetho efanayo mayelana nezinsizakalo eziveziwe kanye nezinhlelo zokusebenza ezivunyelwe ukuthola ukuxhumana.

I-Firewall ku-Linux: I-UFW njengenketho elula

Ku-Linux, ikakhulukazi ekusakazweni okufana no-Ubuntu, kuvamile ukuphatha ama-iptables (noma ama-nftables) kusetshenziswa amathuluzi asebenziseka kalula. Enye ethandwa kakhulu yi -UFW (Uncomplicated Firewall) , enikeza imiyalo eqondile yokusebenzisa i-firewall kanye nemithetho yokuchaza.

Ukufakwa kwenziwa ngomphathi wephakheji (isibonelo, “sudo apt-get install ufw”), futhi yize i-UFW ivame ukukhutshazwa ngokuzenzakalelayo, kuyalulekwa ukuhlola isimo sayo nge-“sudo ufw status” ngaphambi kokuyivumela. Ungayivumeli ngaphandle kokuchaza imithetho eyisisekelo kuqala , njengoba lokhu kungavimba konke ukuxhumana okungenayo futhi ungalahlekelwa ukufinyelela okukude.

Imithetho ejwayelekile ifaka phakathi ukuvumela i-SSH (“sudo ufw allow ssh”) ukuthi igcine ukufinyelela okukude, ukuvula i-HTTP kanye ne-HTTPS (“sudo ufw allow http”, “sudo ufw allow https”) kumaseva ewebhu , bese kungezwa ama-port njengoba kudingeka. Uma imithetho eyisisekelo isisethiwe, i-firewall ivulwa nge-“sudo ufw enable” futhi isimo sayo sihlolwa nge-“sudo ufw status”, ekhombisa uhlu lwezinsizakalo nama-port avunyelwe.

Njengoba i-Linux isivele iyisistimu eqinile, ukulungiselelwa kwe-UFW kunikeza isendlalelo esengeziwe sokuphepha esinconywa kakhulu , ikakhulukazi kumaseva atholakala kwi-inthanethi.

Ukuhlukaniswa kwenethiwekhi, izinqubomgomo, kanye nokuvimbela ukwebiwa kweziqinisekiso

Enye yamasu asebenza kahle kakhulu okuthuthukisa ukuphepha ukuhlukaniswa kwenethiwekhi . Ngokuhlukanisa inethiwekhi ibe yizingxenye (ngokomsebenzi, uhlobo lwedivayisi, izinga lengozi), ithrafikhi evela kwesinye isigaba ayibonakali kwenye, okunciphisa umthelela wanoma yisiphi isigameko.

Lokhu kubaluleke kakhulu ngamadivayisi e-IoT, avame ukusebenza ezinhlelweni ezindala nezisengozini. Ukuwabeka kuma -VLAN noma ezindaweni ezihlukanisiwe nokunciphisa ukufinyelela kwawo kunciphisa ingozi yokwehluleka kwekhamera ye-IP noma inzwa ebeka engcupheni yonke inethiwekhi yenkampani.

Enye inkinga ebalulekile ukwenza ngcono inqubomgomo ye-firewall . Ukwengeza imithetho ngaphandle kokuyibuyekeza kuholela ekwakhekeni kwezinkinga, izingxabano, kanye ne-firewall ecishe ingalawuleki. Okungcono kakhulu, kufanele usuke emithethweni esekelwe echwebeni uye emithethweni esekelwe kuhlelo lokusebenza, ngokubonakala okucacile ukuthi yiziphi izinsizakalo ezivunyelwe noma ezinqatshwayo, futhi uzibuyekeze njalo ukuze ususe okufakiwe okudala.

Amanye ama-firewall athuthukile afaka izici zokuvimbela ukwebiwa kweziqinisekiso zenkampani . Askena imizamo yokungena ngemvume (igama lomsebenzisi nephasiwedi) bese ebhekisela kuzo ngohlu lwangaphakathi lwama-akhawunti enhlangano, evimba ukusetshenziswa kwawo kumasayithi angaphandle njengezokuxhumana noma izinsizakalo ezingahlobene nebhizinisi. Angabonisa futhi izixwayiso kumsebenzisi ezichaza izingozi zokusebenzisa kabusha iziqinisekiso zomsebenzi.

Lezi zinhlobo zokulawula azigcini nje ngokuvimbela ukuhlaselwa okuqondile, kodwa futhi zisebenza njengethuluzi lokuqwashisa ngokuphepha , okwenza umthelela wemikhuba yokusebenzisa iphasiwedi ngaphandle kwendawo yenkampani ubonakale kakhulu kubasebenzi.

Kwenzekani uma ukhubaza i-firewall (nokuthi kungani kungafanele uyikhubaze)

Kuvamile ukuthi umuntu onezinkinga ngohlelo lokusebenza noma umdlalo oku-inthanethi azame ukukhubaza i-firewall "ukuze abone ukuthi lokho kuyayilungisa yini ." Futhi yebo, ngezinye izikhathi kuyayixazulula inkinga esheshayo, kodwa kuvula umnyango wezingozi eziningi ezingabonakali ngokushesha.

Ngaphandle kwe-firewall, uhlelo luvezwa ezinsongweni zangaphandle ezifana ne-malware, ama-Trojans, amagciwane, nokunye ukuhlaselwa okungafakwa ngaphandle kwesithiyo. Abahlaseli bangazama ukuskena ama-router ports futhi, uma imithetho ye-NAT nayo ingakhululekile, bathole izinsizakalo ezingavikelekile kahle futhi bazisebenzise njengezindawo zokungena.

I-firewall ilawula nedatha ephumayo : ngaphandle kwayo, noma yiluphi uhlelo lokusebenza olunobungozi lungaba namandla okuthumela ulwazi olubucayi ezweni langaphandle. Ngaphezu kwalokho, izinhlelo zokusebenza eziningi zithembele ku-firewall ekuhlaseleni nge-buffer port scanning noma ukuhlaselwa okuncane kwe-DDoS; ukuyikhubaza kususa leyo buffer.

Uma uhlelo lokusebenza lungasebenzi ngenxa ye-firewall, ikhambi lochwepheshe akukhona ukuyicisha, kodwa ukudala umthetho othize ovumela ithrafikhi edingekayo , hlola ukuthi i-router idinga ukuvula noma yimaphi ama-port, bese uvumelanisa imithetho ukuze kungabikho ukungqubuzana phakathi kwe-firewall yendawo kanye ne-firewall yemishini yenethiwekhi.

Ukuhlalisana kwe-firewall eziningi: i-router ne-PC ngesikhathi esisodwa

Uma une-firewall ku-router yakho kanye nenye ku-PC yakho (isibonelo, i-Windows firewall), yonke ithrafikhi engenayo idlula ku-router kuqala bese idlula kukhompyutha yakho. Lokhu kuphepha okunezingqimba ezimbili, uma kulungiselelwe kahle, kwandisa ukuphepha okuphelele ngoba ukwehluleka kwengqimba eyodwa kungakhokhelwa ngenye.

Noma kunjalo, kufanele uqaphele ngemithetho engaguquki . Uma i-router ivimba imbobo evunyelwa yi-firewall ye-PC, noma okuphambene nalokho, ungathola izinsizakalo ezingasebenzi futhi ungaqiniseki ukuthi iyiphi kulezi zingqimba ezimbili ebangela inkinga.

Empeleni, indlela ehlakaniphile kakhulu ukuthi i-firewall ye-router isebenze njengesithiyo esiyinhloko somngcele , ivumela kuphela lokho okudingeka kungene kusuka ku-inthanethi, kuyilapho i-firewall ye-PC ilawula ithrafikhi phakathi kwamadivayisi ku-LAN nanoma yikuphi ukuxhumana okusolisayo okuphumayo. Lokhu, kuhlanganiswe ne-NAT elungiselelwe kahle kanye nokugwema ukusetshenziswa ngokweqile kwe-DMZ kanye ne-UPnP, kunikeza izinga eliqinile lokuvikela ikhaya noma indawo encane yehhovisi.

Ekugcineni, ukuqonda ukuthi ama-firewall ahlukene (i-router, isistimu yokusebenza, ifu, i-NGFW yenkampani) asebenza kanjani futhi axhunywe kanjani ndawonye kukuvumela ukuthi wenze izinqumo ezinolwazi oluthe xaxa: yiziphi izinsizakalo okufanele uziveze, ukuthi uzihlukanise kuphi, yiziphi izingodo okufanele uzigcine, nokuthi ungayilungisa kanjani imithetho ukuze ugcine ibhalansi phakathi kokuphepha kanye nokusebenziseka kalula kunethiwekhi yakho nakumadivayisi.