iptables ku-Linux: umhlahlandlela osebenzayo, ophelele, futhi oqondile

I-Informatec Digital » Linux » ama-iptables ku-Linux: umhlahlandlela osebenzayo, ophelele futhi oqondile

Uma uphatha ukusatshalaliswa kwe-Linux ukuze uvikele ukuphepha kwakho kanye nobumfihlo , ngokushesha noma kamuva kuzodingeka ubhekane nama-iptables. Lolu hlelo lokuhlunga amaphakethe luyinhliziyo ye-firewall yakudala ku-GNU/Linux , olukwazi ukunquma ukuthi iyiphi ithrafikhi engena, ephumayo, noma ethunyelwa phakathi kwamanethiwekhi. Uma ihlelwe kahle, kufana nokuba nomnyango onekhono elikhulu emnyango wakho wenethiwekhi, ophoqelela imithetho yakho ngendlela engenaphutha nangokunemba kokuhlinzwa.

Emigqeni elandelayo, uzothola umhlahlandlela ophelele nosesikhathini ohlanganisa izinto ezibalulekile: imiqondo ye-firewall , i-Netfilter, amatafula namaketanga, ukugeleza kwamaphakethe, imiyalo eyisihluthulelo, izandiso zomthetho, kanye nezinhloso ezithuthukisiwe , kanye nezimo ezisebenzayo njenge-NAT, ukuqondisa kabusha, izinqubomgomo ezizenzakalelayo, kanye ne-DMZ esebenzayo. Konke kuchazwa ngolimi olucacile kodwa oluqinile, ukuze ukwazi ukukusebenzisa engqalasizinda yakho ngokushesha.

I-Firewall in Context: Kusukela kuma-Nightclub Bouncers kuya ku-DMZ

I-firewall empeleni iyisihlungi phakathi kwamanethiwekhi asebenzisa imithetho ukunquma isiphetho sephakethe ngalinye. Cabanga ngakho njengomuntu oqaphayo ekilabhini yokuzijabulisa enohlu lokuhlola : uma iphakethe lihlangabezana nezindinganiso, liyadlula; uma kungenjalo, liyajikiswa. Lesi singathekiso sisiza ukuqonda ukuthi okubalulekile ukuqonda kwemithetho kanye nohlelo oluhlolwa ngalo.

Ngaphakathi komklamo wenethiwekhi, ezinye izindawo ziphephile kakhulu kunezinye. I-DMZ (indawo engenampi) iyinethiwekhi ephakathi nendawo ebamba izinsizakalo zomphakathi (njengewebhusayithi noma iseva ye-FTP), ezihlukanisa ne-LAN yenkampani. Kungani? Ngoba uma umhlaseli ebengalimaza iseva yomphakathi, ukuhlukaniswa kwezindawo kuvimbela ekufinyeleleni ngqo kuyo yonke inethiwekhi yangaphakathi.

I-Linux njenge-firewall: I-Netfilter nama-iptables

I-kernel ye-Linux ifaka i-Netfilter, uhlaka olunezingwegwe zokuvimba nokuphatha amaphakethe . Esikhaleni somsebenzisi, i-iptables iyithuluzi elichaza imithetho ezosetshenziswa yi-kernel kuthrafikhi. Lokhu kuhlukaniswa kwe-kernel/umsebenzisi kuvumela ukusebenza okuphezulu nokuguquguquka okukhulu.

Kuwusizo ukuhlukanisa phakathi kwezinsiza ngephrothokholi: i-iptables (IPv4), i-ip6tables (IPv6), i-arptables (ARP), kanye ne-ebtables (amafreyimu e-Ethernet) . Ku-kernel, imodyuli evamile yi-x_tables, ehlanganyela ngendlela yokucabanga yokufanisa izandiso kanye nezinhloso. Inothi lomlando: ama-iptables athathe indawo yama-ipchains, kanti ama-nftables, nawo, athathe indawo yama-iptables ku-kernel 3.13 , yize ama-iptables esasetshenziswa kabanzi ezinhlelweni eziningi.

Ukuze usebenze, uzodinga amalungelo omlawuli. Qalisa ama-iptables njengempande (noma nge-sudo), imvamisa ukungena /usr/sbin/iptables (Debian/derivatives) noma /sbin/iptables (Isigqoko Esibomvu/okuphuma kuyo). Imibhalo esemthethweni iku man iptables naku-netfilter.org.

iptables isakhiwo: amatafula, amaketanga kanye nemithetho

I-Iptables ihlela i-logic yayo ibe amathebula ahlanganiswe ngamaketanga agcwele imithetho . Umthetho ngamunye ucacisa izimo ezifanayo kanye nenhloso okufanele isetshenziswe lapho iphakethe lifana.

• Hlunga ithebula (okuzenzakalelayo, ukuhlunga okumsulwa)
  • INPUT: ithrafikhi eqondiswe emshinini ngokwawo.
  • PHAMBILI: ithrafikhi edlula ezintweni zokusebenza (umzila).
  • UHLELO: ithrafikhi ekhiqizwa endaweni.
• Nat itafula (ukuhunyushwa kwekheli; kuhlolwe ekuxhumaneni okusha)
  • PREROUTING: ngaphambi kokunquma ngomzila; ilungele i-DNAT/ukudlulisa ngembobo.
  • UHLELO: amaphakethe asuka endaweni ngaphambi komzila.
  • I-POSTROUTING: ngemva komzila; okujwayelekile kwe-SNAT/MASQUERADE.
• Itafula lomhlume (ukulungiswa kwesihloko esihle: i-TOS, i-TTL, ukumaka, njll.)
  • I-PREROUTING, OKUFAKAYO, PHAMBILI, KOKUPHUMA, UKUTHUMELA: iyatholakala yonke indlela.
• Itafula elingahluziwe (ukulawula kokulandela umkhondo/ukuxhumana)
  • PREROUTING y UHLELO: ukumaka ithrafikhi okufanele yeqiwe yi-contrack.

Uma iphakethe lifika kuchungechunge, liqhathaniswa ngokulandelana ngokumelene nomthetho ngamunye ; uma lifana, inhloso yalo iyasetshenziswa bese ukuwela kuyama. Uma lifika ekugcineni ngaphandle kokufanisa noma yimuphi umthetho futhi uchungechunge luchazwe kusengaphambili, inqubomgomo yochungechunge oluzenzakalelayo yalolo chungechunge iyasetshenziswa.

Ukugeleza kwephakethe: lapho adlula khona futhi nini

Ukuqonda indlela yethrafikhi kubalulekile ekusebenziseni imithetho ngendlela efanele. Iphakethe elishiya i-LAN yakho liye kwi-inthanethi livame ukucutshungulwa kanje: okokuqala UKUQHUBEKA NGOKUQALA (mhlawumbe i-DNAT/mangle), bese kuba yi-FORWARD (ukuhlunga ezokuthutha), futhi ngaphambi kokushiya idivayisi, lidlula ku-POSTROUTING (SNAT/MASQUERADE uma kusebenza).

Ngakolunye uhlangothi, uma indawo okuyiwa kuyo kuyi-firewall uqobo, umzila uzoba yi-PREROUTING → INPUT ; uma uvela emshinini wendawo, umzila uzoba yi-OUTPUT → POSTROUTING . Lolu hlaka lwengqondo lukusindisa ezinhlungwini lapho okuthile kungahambi kahle.

Imiyalo eyisisekelo: uhlu, sula, dala, nezinqubomgomo ezizenzakalelayo

Ukuhlola isimo samanje, usa iptables -L (ngokuzithandela -v ngemininingwane futhi -n (ukungaxazululi amagama). Ungakha futhi ususe amaketango nge -N y -X ngokulandelana, futhi usethe izinqubomgomo ezizenzakalelayo nge -P.

Lapho udinga ukuqala kusukela ekuqaleni, imithetho ehlanzekile nge -F (flush) futhi, uma kusebenza, izibali. Khumbula ukuthi ungacacisa amathebula nge -t namaketango athile; Ngokwesibonelo, iptables -F -t nat okwe-NAT.

Lapho uchaza imithetho, izinketho ezivame kakhulu ziqondile: -A idada, -I faka, -R ibuyisela futhi -D sula. Bese wengeza abakhethi like -p (iphrothokholi), -s/-d (imvelaphi/indawo), -i/-o (izixhumi ezibonakalayo) kanye nethagethi nge -j (isb., YAMUKELA, YEHLISA noma YENQABA).

I-Las izinqubomgomo ezizenzakalelayo chaza ukuthi kwenzekani uma kungekho mithetho ehambisanayo. Isikimu esiqinile esijwayelekile kumsingathi singaba INPUT DROP, FORWARD DROP, OUTPUT ACCEPT, ukuvimbela yonke into engenayo ngaphandle kwalokho okuvunyelwe ngokusobala nokuvumela okuphumayo.

Izandiso zokufanisa (-m): i-TCP, i-UDP, i-ICMP, i-MAC, i-stateful, ne-multiport

I-Iptables inweba izihlungi zayo ngamamojula afanayo asebenzisa -m. I-TCP eyodwa ivumela ukushunwa ngamachweba namafulegi: --dport/--sport y --syn ngokuvuleka kokuxhumana okusha, isibonelo.

Ku-UDP, ungakhawulela futhi amachweba omthombo kanye nendawo oya kuyo . Isibonelo esijwayelekile: ukuvula ichweba 80/443 kuseva yewebhu noma ukuvumela imibuzo ye-DNS ephumayo kuchweba 53/UDP.

Nge-ICMP, --icmp-type ikuvumela ukuthi ubandlulule izinhlobo (isb., isicelo se-echo y impendulo ye-echo ngama-pings). Lokhu kuyasiza ukuvumela ukuxilonga ngaphandle kokushiya umnyango uvulelwe ku-ICMP egcwele.

Kukhona futhi module mac ukuhlunga ngekheli le-MAC con --mac-source. Iwusizo uma ufuna ukugunyaza ikhompuyutha ephethwe ene-IP eguqukayo ukuthi ifake i-firewall ngaphandle kokuthembela ku-IP.

Futhi, mhlawumbe okubaluleke kakhulu ezingeni lokusebenza, imojuli state (noma phikisana) ne --state NEW, ESTABLISHED, RELATEDLokhu kuvumela izimpendulo ezivela ekuxhumekeni osekuvele kumisiwe ukuthi zivunyelwe, kunciphisa kakhulu inani lemithetho edingekayo.

Ukuhlanganisa amachweba, multiport engeza --sports y --dports ngohlu oluhlukaniswe ngokhefana. Kulula ukuvula i-HTTP, i-HTTPS ne-SSH ngomthetho owodwa.

Okuqondiwe ngale kwe-ACCEPT/DROP: NAT kanye nenkampani

Ngaphezu kokwamukela noma ukwenqaba, ama-iptables angabhala kabusha amakheli nama-port ukuze axhume amanethiwekhi azimele kwi-inthanethi noma ukukhangisa izinsizakalo zangaphakathi.

I-MASQUERADE (e POSTROUTING etafuleni nat) ithatha indawo ye-IP yomthombo nge-IP ephumayo ye-firewall, ekahle uma i-IP yomphakathi inamandla (DHCP). Lena i-NAT evamile ephumayo kuyo yonke i-LAN.

I-SNAT (futhi naku- POSTROUTING) isetha ngokusobala umthombo we-IP/port ngawo --to-source. Isetshenziswa uma une-IP yomphakathi emile futhi ufuna ukulawula ukuhumusha ngokunembile.

I-DNAT (e PREROUTING o OUTPUT) shintsha i-IP yendawo nge --to-destination. "Ingamachweba avulekile" adumile: Uthola ithrafikhi ku-IP yomphakathi futhi uyiqondise kabusha kuseva ku-DMZ, isibonelo iwebhusayithi yangaphakathi kokuthi 192.168.1.2.

Isibonelo esilula: ukuhlunga ithrafikhi phakathi kwamanethiwekhi amabili

Cabanga ngomshini osebenza njengerutha/i-firewall phakathi kwama-subnet amabili. Uma ufuna ukusingatha B kuphela ukukhuluma no-C futhi kuphela nge-TCP, itafula liyoba filter futhi umucu olungile uthi FORWARD, ngoba ithrafikhi idlula ezintweni zokusebenza.

Okokuqala, uzosebenzisa inqubomgomo ye-DROP ezenzakalelayo ku-FORWARD bese ugunyaza ngokusobala ithrafikhi ye-B→C ku-TCP (futhi, uma kusebenza, i-C→B). Le patheni "yokwenqaba ngokuzenzakalelayo futhi uvumele ubuncane obungenalutho" iyisisekelo sokuma okuqinile kokuphepha.

Amacala ansuku zonke ku-catwalk: imithetho ejwayelekile

Isango elinokuxhumana okubili, isibonelo I-eth1 (LAN) ne-eth0 (WAN), ngokuvamile idinga ukudlulisa amaphakethe ukusuka ku-LAN kuya ku-inthanethi. Ukwenza lokhu, kuyanezela FORWARD -i eth1 -o eth0 -j ACCEPT, futhi ivumela ngokuhlehla kuphela ESTABLISHED,RELATED con -m state.

Ku-firewall ngokwayo, kuhle ukugunyaza ithrafikhi engenayo eyimpendulo ekuxhumekeni okuphumayo con INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT, futhi njalo uvumele i-loopback: INPUT -i lo -j ACCEPT.

Ukuze uvumele amakhompyutha e-LAN ukuthi aphequlule, sebenzisa i-NAT ephumayo: -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j SNAT --to-source X.Y.Z.W (o MASQUERADE uma i-IP inamandla). Lokhu kuhumusha ama-IP ayimfihlo abe yi-IP yakho yomphakathi.

Indlela eyisisekelo yokuqinisa iwukuvimba amaphakethe e-WAN angenayo anama-IP omthombo angafanele (i-IP yakho yomphakathi, amabanga ayimfihlo angu-192.168.0.0/24, 127.0.0.0/8, njll.), njengoba ngokuvamile ekhombisa ukukhohlisa.

Ukuze udalule amasevisi ku-firewall (isb., i-SMTP 25, HTTP 80, HTTPS 443, noma i-SSH 22), ungakwazi vumela amaphakethe e-TCP anefulegi le-SYN kulawo machweba okuyiwa kuwo. Uma ufuna ukunciphisa nge-IP yendawo, engeza -d ku-IP yesevisi.

Izinsizakalo ezijwayelekile zengqalasizinda zifaka phakathi i-DHCP (ithrafikhi esuka kumachweba angu-68 kuya ku-67) ku-interface ye-LAN, kanye ne -DNS evela ku-authoritative resolver (UDP 53) uma ihlungwa ngomthombo. Lawa machweba avumela amaklayenti ukuthola amakheli e-IP nokuxazulula amagama.

Uma udinga ukuvimba ukufinyelela, THOLA i-SSH/Telnet engenayo ilula; ungaphinde wenqabe imiyalezo ephumayo kuma-IP avinjelwe kunethiwekhi yendawo ukuze umthumeli athole isaziso sokwenqatshwa.

Ukufaka nokuphatha isevisi ezinhlelweni zeRed Hat/CentOS

Ezimweni zefa nge-CentOS/RHEL 5/6, kwakwanele ukwenza kanjalo faka nge yum -y install iptablesYize ama-distros amaningi amasha namuhla ethanda ama-nftables, ama-iptable asekhona ezinhlelweni zokukhiqiza nezinto zikagesi.

Ukuhlanganisa ne Izinsizakalo ze-SysV kuvunyelwe ukuphatha nokuphikelela imithetho: service iptables start|stop|restart y service iptables save, ukulondoloza phakathi /etc/sysconfig/iptables. Ukuze unike amandla ku-boot: chkconfig iptables on emazingeni 2–5.

Ezinhlelweni zanamuhla, nakuba izimbozo zishintsha , umqondo uyaqhubeka: chaza imithetho, uyivivinye, bese uyiqhubekisela phambili ukuze isinde ekuqaliseni kabusha, kungakhathaliseki ukuthi ngamathuluzi esistimu noma izikripthi.

Ukufakwa kuhlu, ukususa, nokuhlela imithetho ngokunemba

Ukuze ubone isimo ngezinombolo zomthetho, usa iptables -L --line-numbers -n -v. Ngale ndlela ungasusa ngenkomba nge -D INPUT 3 noma esikhundleni saso -R ngaphandle kokudideka.

Uma udinga ukususa okukhethiwe, Hlanza kuphela iketango noma ibhodi elithintayo (-F FORWARD o -F -t nat). Gwema ukushanela komhlaba kude ngaphandle “kwenethi yokuphepha” noma ungase ulahlekelwe ukufinyelela kwe-SSH.

Njengomkhuba ojwayelekile, qala ubeke imithetho evumela iseshini yakho ye-SSH , usebenzise izinguquko kancane kancane, futhi ube nefasitela lokubuyela emuva (isibonelo, umsebenzi we-cron obuyisela imithetho ngemizuzu emi-5 uma ungazibophezeli).

Ukuphikelela nge-iptables-save kanye ne-iptables-restore

Ukuze ulondoloze izilungiselelo zakho, iptables-save > /ruta/backup/iptables.rules Ikhiqiza ukulahlwa okufundeka ngomshini kwawo wonke amathebula. Ilungele ukulawula ushintsho nokufuduka.

Ukuyishaja, sebenzisa iptables-restore < /ruta/backup/iptables.rulesUngakwazi ukubuyisela ibhuthi ngokuzenzakalelayo nge-systemd, init scripts, noma umsebenzi we-cron. @reboot, iqinisekisa ukuthi i-firewall ihlala isebenza ngemva kokuqalisa kabusha.

Engeza kulezi zinqubo ezinhle zokusebenza: igijima ngamalungelo afanelekile, londoloza amafayela ngaphandle /tmp futhi uzivumelanise nendawo ezungezile (izixhumanisi zokusebenzelana ezifanele nama-subnets) ukuze ugweme izimanga.

I-DMZ ngokuningiliziwe: isibonelo esiphelele nesingokoqobo

Cabanga ukuthi i-firewall ye-Linux ixhunywe ku-router kwimodi "yomsebenzisi oyedwa" (ngaphandle kwe-NAT), enezixhumi ezintathu: i-eth0 (LAN 192.168.1.1/24), i-eth1 (DMZ 192.168.2.1/24) kanye ne-eth2 (WAN ene-IP nge-DHCP) . I-DMZ isingatha iseva yewebhu ye-Apache (192.168.2.2) kanye neseva ye-FTP (192.168.2.3).

Izinhloso zenqubomgomo: ukushicilela i-HTTP/HTTPS kanye ne-FTP kusuka ku-DMZ kuya ku-inthanethi , ukuvumela ukuphathwa kwe-SSH kusuka ku-LAN kuya ku-firewall, kanye nokuvumela i-LAN ukuthi iphequlule (HTTP/HTTPS), idlulise amafayela nge-FTP, futhi ixazulule i-DNS. Konke okunye ukufinyelela kuyanqatshwa.

Ukukhuluma ngokubanzi: ku isihlungi/PHAMBILI ivumela i-LAN→i-WAN yokuhamba ngempendulo, kanye I-WAN→DMZ kumachweba ashicilelwe kuphela con ESTABLISHED,RELATED ukuze uthole izimpendulo. Ku nat/PREROUTING, isebenzisa i-DNAT ukushicilela amasevisi; phakathi nat/POSTROUTING, I-SNAT/MASQUERADE yokuphuma kwe-LAN/DMZ.

Izibonelo zokuvuleka: I-DNAT 80/443 kuya ku-192.168.2.2 no-21/20 (kuye ngokuthi imodi) kuya ku-192.168.2.3 ngokuhambisanayo FORWARD Ukuvumela lawo machweba. Vikela amashaneli okulawula kanye nedatha ye-FTP (esebenzayo/enziwayo) noma ubeke umkhawulo webanga lokwenziwa futhi ubonise lokhu ku-firewall.

Okwe-LAN: ivumela ukuphuma ku-80, 443, 21 kanye no-53 kanye nokubuya kwayo, kusetshenziswa i-NAT ephumayo POSTROUTING. Ku-firewall, gunyaza I-SSH engenayo kuphela esuka ku-subnet engu-192.168.1.0/24 futhi ivimbela ukufinyelela okungafuneki kusuka ku-WAN.

Ungakhohlwa ukuhlanzeka: YISA kububanzi obungavumelekile ku-WAN (yangasese, i-loopback, eyakho yomphakathi) bese ubhala kuphela lokho okuthakaselayo. Ngezinqubomgomo ezizenzakalelayo ezinqunyelwe kanye nokuvuleka okuncane, ukuvezwa kwakho kuncishiswa kube okungenani.

Izenzo ezinhle kanye namaqhinga okusebenza

Hlala usebenza ngohlelo: bhala phansi lokho okuvumelayo nokuthi kungani , qinisekisa ukugeleza okulindelekile ngomdwebo olula, bese usebenzisa imithetho ngokulandelana okufanele ukuze ugweme ukugqagqana.

Sebenzisa inhlanganisela yamamojula anekhanda: state/contrack ukuze uthole izimpendulo, tcp con --syn ezintubeni, futhi multiport eqenjiniNgale ndlela wenza kube lula futhi unciphise ubungozi bokungahambisani.

Ezindaweni ezinoshintsho oluvamile, cabanga ukuhlukanisa imithetho ngomsebenzi: amaketanga ngokwezifiso (nge -N) izingcingo ezivela ku-INPUT/OUTPUT/PHAMBILI, ukuze ukugcina noma ukuhlehlisa izingcezu kuhlanzeke.

Ukushintshela kuma-nftables kuyaqhubeka ekusatshalalisweni okuningi, kodwa uma ipulatifomu/umkhiqizo wakho usebenzisa ama-iptables, ukuqonda kahle lezi zingxenye kuzokunikeza ukulawula okuphelele . Futhi uma ufuduka, uzoqonda kalula imephu yengqondo efanayo kuma-nftables.

Ngalokho okumbozile, manje usunesisekelo esiqinile sokusebenzisa nokugcina ama-iptable ekukhiqizeni: uyaqonda ukwakheka (amathebula, amaketanga, kanye nokugeleza), unekhono emiyalweni ebalulekile, ungasebenzisa i-NAT futhi ushicilele nge-DNAT/SNAT, futhi uyazi ukuthi ungayisetha kanjani i-DMZ evikelekile . Kusukela lapha, kuyindaba yokuyivumelanisa nezidingo zakho ezithile, ukuyihlola njalo, nokugcina imithetho yakho icacile njengemodeli yakho yenethiwekhi.