Kugadzirisa Firewall paLinux

Firewall paLinux inoita basa rakakosha kuchengetedza komputa system. Inoita sechipinganidzo, kutonga uye kusefa network traffic kuchengetedza sisitimu kubva kune isina mvumo yekuwana, kurwiswa, uye kumwe kutyisidzira. Pasina Firewall yakanyatso gadziridzwa, sevha inogona kuve panjodzi yemhando dzakasiyana dzecyberattacks, zvichitungamira kune zvakakomba mhedzisiro yekuchengetedza data uye kuvanzika.

Muchinyorwa chino, tichatarisa maturusi maviri makuru ekugadzirisa Linux Firewall: firewalld uye iptables. Tichaita ongororo yekuenzanisa maficha avo, mashandiro avo, uye zvakanakira. Pamusoro pezvo, tichapa mirairo yakadzama yekugadzirisa nekushandisa chimwe nechimwe chezvishandiso izvi, pamwe nekukurukura nzira dzakanakisa dzekuchengetedza system yako neFirewall papuratifomu yeLinux. Mabasa ese acharatidzwa pavirtual server ine root access.

Kugadzirisa firewalld paLinux

Firewalld (Firewall Daemon) ipurogiramu yekutarisira firewall mumasisitimu ekushanda eLinux. Inopa mushandisi wekugadzirisa mitemo yefirewall, kubvumira kana kuvharira kubatana kwemapurogiramu enetwork. Inoiswa kare muzvikamu zvakawanda zvemasevha. Kana Firewalld isati yaiswa kare, inogona kuiswa yakazvimiririra kubva munzvimbo dzepamutemo dzedistribution.

Kune Red Hat masisitimu (akadai seRHEL, CentOS, Fedora) kuisirwa kunoitwa nemurairo:

yum install firewalld

ZveDebian/Ubuntu:

apt-get install firewalld

Mushure mekuiswa, inogona kutangwa uye kuvhurwa nekukasira nekuraira:

systemctl start firewalld

Tevere, iwe unofanirwa kuwedzera iyo sevhisi kuti utange:

systemctl enable firewalld

Panguva ino, tinokurudzira kudzima ufw, sezvo kushandiswa panguva imwe chete kwechigadzirwa ichi ne firewalld kana iptables hazvikurudzirwi. Tarisa chimiro:

systemctl status ufw

Kuti uimise, isa murairo:

systemctl stop ufw

Kudzima zvachose:

ufw disable

Mushure mezviito izvi, unogona kuenderera mberi nekugadzirisa firewalld.

Kutanga, zvinodikanwa kutsanangura nzvimbo dzekuvimba. Firewalld inoshandisa iyo pfungwa yenzvimbo kuona huwandu hwekuvimba kune network interfaces. Imwe neimwe interface inopihwa imwe nzvimbo, uye firewall mitemo inoshandiswa zvichienderana nenzvimbo. Rondedzero yenzvimbo dzese dziripo inovhurwa nemurairo:

firewall-cmd --get-zones

Kazhinji, 4 nzvimbo huru dzinoshandiswa:

1. ruzhinji rwevanhu: Nzvimbo iyi ndeyemanetiweki aunoona seasina kuchengetedzeka;
2. Private: Inoshanda kunetiweki epamba kana mamwe akavimbika network yekubatanidza;
3. Internal: Inoshandiswa kune network yemukati, senge iyo iri mukati mesangano kana yemakambani network;
4. DMZ: Nzvimbo iyi ndipo panowanzoiswa maseva anofanirwa kuwanikwa kubva painternet.

Zvisinei, uyu unongova muenzaniso mumwe chete. Iwe unogona kuwedzera yako zone uchishandisa murairo:

firewall-cmd --permanent --new-zone=nameyourzone

Mushure mekuwedzera, kurodha zvakare kunodiwa:

firewall-cmd --reload

Kudzima nzvimbo, nzira yakafanana inoshandiswa

firewall-cmd --permanent --delete-zone=nameyourzone

Mushure mekutsanangura nzvimbo, zvinodikanwa kubvumidza traffic kune inodiwa masevhisi uye madoko. Kubvumira imwe sevhisi, shandisa murairo:

firewall-cmd --zone=public --add-service=name

Apo zita ndiro zita rebasa. Semuenzaniso, kubvumira traffic yeApache:

firewall-cmd --zone=public --add-service=http

Kutsanangura zviteshi zvinotenderwa, shandisa murairo:

firewall-cmd --zone=public --add-port=number/protocol

Semuenzaniso, yakajairwa makumi maviri nemaviri chiteshi cheSSH chaizotaridzika seizvi:

firewall-cmd --zone=public --add-port=22/tcp

Panguva ino, mitemo mikuru inenge yatogadzirwa. Tevere, sarudza kuti traffic ichagadziriswa sei zvichienderana nekwakabva, kwainoenda, chiteshi, nezvimwe zvinodiwa. Kuwedzera mutemo (uchishandisa nzvimbo yeruzhinji semuenzaniso):

firewall-cmd --zone=public rule

Semuenzaniso, kubvumira traffic inouya kubva kune chero sosi kuenda kuchiteshi 80 (HTTP):

firewall-cmd --zone=public --add-port=80/tcp --permanent

Kubvisa mutemo:

firewall-cmd --permanent --remove-rule=rule_specification

Apo mutemo ndiwo rudzi rwemutemo (semuenzaniso, port, service, rich-rule, nezvimwewo), uye mutemo_specification ndiwo muganho wemutemo wacho pachawo.

Mushure mekuita shanduko kuFirewalld kumisikidzwa, zvinodikanwa kuti uzvichengetedze uye uzvishandise. Kuti uchengetedze shanduko, shandisa murairo:

firewall-cmd --runtime-to-permanent

Kushandisa shanduko:

firewall-cmd --reload

Kana wapedza kuseta, unogona kuonesa maparameter akasarudzwa nekuvhura runyoro rwemitemo yese:

firewall-cmd --list-all

Kana paine matambudziko amuka, tarisa iyo Firewalld matanda nemurairo:

journalctl -u firewalld

Cherechedza: Tangotarisa chete nzira yakajairika yekugadzirisa kubatana. Chishandiso ichi chine mashandiro akakura. Kuti uwane ruzivo rwakakwana pane zvese zviripo, unogona kushandisa magwaro epamutemo kana open help:

firewall-cmd --help

Kugadzirisa iptables paLinux

Kusiyana neFirewalld, iptables ndeyekare asi ichiri kushandiswa zvakanyanya muLinux yekugadzirisa firewall. Inopa nzira yakananga uye inochinjika kumitemo yekusefa yepakiti paLinux kernel level. Nekudaro, iptables inoda ruzivo rwepamusoro uye ruzivo kana ichienzaniswa neFirewalld, zvichiita kuti isawanike kune vanotanga. Tarisa iyo pre-yakaiswa vhezheni yechishandiso nemurairo:

iptables -V

Kana chishandiso chisina kuiswa, chinoda kuiswa. Iwo murairo wekugadza paUbuntu, Debian:

apt install iptables

YeRed Hat masisitimu (semuenzaniso, CentOS, Fedora):

yum install iptables

Murairo we activation mushure mekuiswa:

systemctl start iptables

Kuti uwedzere kune yekutanga, ita:

systemctl enable iptables

Usati watanga iyo iptables kumisikidzwa, zvakakosha kuti unzwisise kuti inoshanda sei. Izvi zvinobatsirwa ne syntax yepurogiramu. Zvinotaridzika sezvizvi:

iptables -t table action chain additional_parameters

Ngationgororei zvakadzama muchinhu chimwe nechimwe.

Iptables ine matafura mana makuru: filter, nat, mangle, uye raw . Imwe neimwe yakagadzirirwa kugadzirisa mamwe marudzi emapaketi uye ine cheni dzayo dzemitemo:

1. firita: Iyi ndiyo tafura inonyanya kushandiswa, ine packet kusefa mitemo. Inoshandiswa pakuita zvisarudzo pamusoro pekubvumira kana kuramba mapaketi.
2. nat: Tafura iyi inoshandiswa kugadzirisa kero yetiweki uye zviteshi mumapaketi. Inowanzo shandiswa kumisikidza masquerading (NAT).
3. mangle: Mutafura iyi, unogona kugadzirisa misoro yepakiti. Inoshandiswa kune yakasarudzika packet mashandiro, sekumaka.
4. mbishi: Tafura iyi inoshandiswa kugadzirisa mitemo inoshanda vasati vapfuura nekubatanidza nzira yekutevera. Inowanzo shandiswa kumisikidza mitemo isingafanirwe kugadziridzwa neiyo tracking system, sekudonhedza mapaketi kubva kune mamwe kero.

Tafura imwe neimwe ine seti yemaketani. Maketani ndiwo nhevedzano yemitemo inotariswa sequentially. Kune matatu akatemerwa cheni:

1. INPUT (inouya). Mitemo iri mucheni iyi inosarudza zvekuita nemapaketi anouya.
2. OUTPUT (inobuda). Cheni iyi inoshanda kumapaketi ese anotumirwa nekombuta yako kune mamwe maturusi kana makomputa ari panetwork.
3. KUFAMBIRA (kuendesa mberi). Mitemo iri mucheni iyi inotsanangura zvekuita nemapaketi anotumirwa.

Pakupedzisira, cheni yega yega ine chimwe chiito (chinangwa). Mukuita, 5 zviito zvikuru zvinoshandiswa:

1. ACCEPT: Bvumira pakiti kuti ipfuure nepafirewall.
2. DONHEDZA: Ramba pakiti uye uirase pasina mhinduro.
3. RUDZA: Ramba pakiti uye tumira anotumira meseji yeICMP yekukanganisa.
4. log: Isa pakiti murogi yehurongwa uye ita chimwe chiito (semuenzaniso, ACCEPT kana DROP).
5. Dzokera: Rega kutarisa mitemo mumaketani azvino uye dzokera kuketani yekufona (kana iripo).

Kuti utange kuseta, vhura runyorwa rwemitemo iripo nemurairo:

iptables -L

Segwara rekugadzirisa maIptables, ngatitarisei mienzaniso inoshanda yemirairo inonyanya kushandiswa. Kuti zvive nyore, tichagovanisa mienzaniso kuita mapoka matatu, zvichienderana neketani chaiyo.

ZVINHU ZVINOPIHWA NECHENI :

1. Bvumira traffic inouya kuburikidza neTCP protocol pachiteshi 80:

iptables -A INPUT -p tcp --dport 80 -j ACCEPT

2. Bvumira traffic inouya kuburikidza neUDP protocol pachiteshi 22:

iptables -A INPUT -p udp --dport 22 -j ACCEPT

3. Vhara traffic inouya kubva kune chaiyo IP kero:

iptables -A INPUT -s 192.168.1.100 -j DROP

KUBUDA KWECHITESHI :

1. Bvumira traffic inobuda kuburikidza neTCP protocol pachiteshi 443:

iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT

2. Bvumira traffic inobuda kuburikidza neUDP protocol pachiteshi 80:

iptables -A OUTPUT -p udp --dport 80 -j ACCEPT

3. Vhara traffic inobuda kune imwe chiteshi (semuenzaniso, 21):

iptables -A OUTPUT -p tcp --dport 21 -j DROP

Cheni paMberi :

1. Vhara traffic inotumirwa kubva kune yakatarwa siyana ye IP kero:

iptables -A FORWARD -s 172.16.0.0/24 -j DROP

2. Vhara kutumirwa kwemapaketi kubva kune chaiyo network interface:

iptables -A FORWARD -i eth1 -j DROP

3. Deredza nhamba yekubatanidza panguva imwe chete kune imwe chiteshi (mumuenzaniso uyu, gumi paminiti pachiteshi 10):

iptables -A INPUT -p tcp --dport 80 -m limit --limit 10/minute -j ACCEPT

Sezvauri kuona, mune yega yega yega yega, imwe nharo yekuwedzera (murairo) inoshandiswa. Kuti uwane runyorwa ruzere rwezvinobvira kupokana uye rutsigiro rwakakwana rwekushanda kwechishandiso, pinda:

iptables -h

Kuti uone kuti marongero akarurama, isa zvakare murairo kuti uone rondedzero yemitemo:

iptables -L

Kudzima mutemo chaiwo, shandisa murairo:

iptables -D chain rule_number

Semuenzaniso, kana iwe uchida kudzima mutemo nhamba 1 kubva kuINPUT cheni, murairo uchaita seizvi:

iptables -D INPUT 1

Kudzima mitemo yese nemurairo mumwechete:

iptables -F

Chinokosha : mitemo ye iptables haichengetwi otomatiki mushure mekutangazve system kana sevhisi. Kuti uchengetedze mitemo, inofanirwa kuwedzerwa kufaira rekugadzirisa uye kudzoreredzwa mushure mekutangazve. Zvinhu zvinoshandiswa zve iptables-save uye iptables-restore zvinogona kubatsira neizvi. Kuti uchengetedze mitemo, isa murairo:

iptables-save > /etc/iptables/rules.v4

Izvi zvinochengetedza ikozvino iptables mitemo mumitemo.v4 faira. Kuti udzorere mushure mekutangazve, isa:

iptables-restore < /etc/iptables/rules.v4

Uyu murairo unodzorera mitemo kubva pamitemo.v4 faira.

mhedziso

Kugadzirisa Firewall paLinux uchishandisa firewalld kana iptables chinhu chakakosha chekuchengetedza server kuchengetedza. Maturusi ese ari maviri anopa nzira dzakavimbika dzekutarisira network traffic uye kuchengetedza sisitimu kubva kune isina mvumo yekuwana uye cyberattacks. Sarudzo pakati pe firewalld uye iptables zvinoenderana nezvinodiwa chaizvo uye zvido zvemushandisi, tichifunga nezvekuita kwavo kwakasiyana uye simba.