Tabbatar da Firewall a cikin Pentos 7

Ana amfani da Firewall a cikin aikin aiki don hana zirga-zirga marasa izini tsakanin cibiyoyin sadarwar kwamfuta. Jagora ko ta atomatik yana haifar da ka'idodi na musamman don wutar muryar, waɗanda ke da alhakin samun damar sarrafawa. A cikin OS, ci gaba a kan Linux kwernel, Centos 7 akwai wani ginanniyar wuta, kuma wutar wuta tana sarrafawa. Tsohuwar gidan wasan kwaikwayo tana da hannu, kuma muna son yin magana game da shi yau.

Tsara wuta a cikin Pentos 7

Kamar yadda aka ambata a sama, an sanya takamaiman Strean Firewall a cikin PentOS 7 an sanya amfani da amfani da wuta. Abin da ya sa za'a duba saitin wuta akan misalin wannan kayan aikin. Kuna iya saita ƙa'idojin tace tare da wannan ipables iri ɗaya, amma ana yin shi dan dan daban. Muna ba da shawarar sanin kanku tare da tsarin da aka ambata na amfani ta danna maɓallin da ke zuwa, kuma zamu fara rakodin wasan wuta.

Idan kun kasance na ɗan lokaci ko na dindindin, muna ba ku shawara ku yi amfani da umarnin da aka gabatar a cikin wannan labarin.

Kara karantawa: Kashe Firewall a cikin Pentos 7

Duba tsoffin dokoki da bangarorin masu araha

Har ma yau da kullun wuta yana da ƙa'idodin ƙa'idodi da wuraren amfani da su. Kafin fara gyaran siyasa, muna ba ku shawara don sanin kanku tare da tsarin yanzu. Ana yin wannan ta amfani da umarni mai sauƙi:

1. Tsohon yankin zai tantance ikon kashe wutar lantarki - tsegumi-yankin-Zone-.



2. Bayan kunnawa, za ku ga sabon igiyar ciki inda za'a nuna sigogi da ake so. Misali, an dauki yankin "Jama'a" a cikin hotunan allo da ke ƙasa.



3. Koyaya, bangarorin da yawa na iya zama aiki nan da nan, banda, ana ɗaure su da keɓaɓɓiyar dubawa. Gano wannan bayanin ta hanyar Firewall-CMD - wuraren aiki.



4. Firewall-cmd --list-duk umurnin zai nuna dokokin da aka saita don yankin tsoho. Kula da hotunan allo da ke ƙasa. Kun ga cewa an sanya yankin mai aiki "jama'a" "a matsayin sarautar" Tsohuwar "- Tsohuwar aikin, enp0s3 ke dubawa da ayyuka biyu da aka kara.



5. Idan kana da bukatar koyon duk wuraren da kake samonan wasan wuta, shigar da wutar lantarki-cmd --etgetget.



6. An ba da sigogi na takamaiman yankin ta hanyar Firewall-cmd --zonzonzonzone = sunan - wannan sunan ne na yankin.

Bayan tantance sigogi da ake buƙata, zaku iya motsawa zuwa canjin su kuma Bugu da kari. Bari muyi nazari game da yawancin sanannun saiti dalla-dalla.

Kafa yankuna na dubawa

Kamar yadda kuka sani daga bayanan da ke sama, an ayyana yankinku na ainihi ga kowane ke dubawa. Zai kasance a ciki har sai saitunan canza mai amfani ko kuma shirye-shirye. Yana yiwuwa a canza wurin dubawa zuwa yankin a kowane zaman, kuma ana aiwatar da ta ta hanyar kunna sudo wuta-cmd --zonsud = Cibiyar Gida - Fuskar gida = Ethy. Sakamakon "Nasara" ya nuna cewa canja wurin ya yi nasara. Ka tuna cewa ana sake saita saitunan nan da nan bayan sake kunna wuta.

Tare da irin wannan canjin a cikin sigogi, ya kamata a ɗauka a tuna cewa aikin za a iya sake saiti. Wasu daga cikinsu ba sa tallafawa aiki a wasu bangon, bari mu ce, "Ko da yake SSH ko da yake amfani da" gida ", amma a cikin mai amfani ko sabis na musamman za su yi aiki. Tabbatar cewa masaniyar da aka samu nasarar ɗaure shi ga sabon reshe, ta hanyar shigar da wuta-cmd - pmd-mai aiki.

Idan kana son sake saita saitunan da aka yi a baya, kawai gudanar da sake fara kunna wutar: Supemt Sett Sikakken Fireldald.service.

Wani lokaci ba koyaushe ba ne ya dace da canza yankin dubawa a cikin zaman ɗaya kawai. A wannan yanayin, zaku buƙaci shirya fayil ɗin sanyi don an sanya duk saitunan akan dindindin. Don yin wannan, muna ba ku shawara ku yi amfani da editan rubutun Nano, wanda aka sanya daga aikin ajiyar Supon Sum Shigar Nano. Na gaba ya kasance irin waɗannan ayyukan:

1. Bude fayil ɗin sanyi ta hanyar edita ta hanyar shigar da sudo Nano / etc / sysconfig / rubutun-etcfg-eth0, inda etcfg-eth0, inda Eth0 shine sunan mai da ake buƙata.



2. Tabbatar da amincin asusunku don yin ƙarin ayyuka.



3. Layout da "yankin" sigogi da canza darajar ta ga abin da ake so, alal misali, jama'a ko gida.



4. Riƙe mabuɗin Ctrl + O don adana canje-canje.



5. Karka canza sunan fayil ɗin, amma kawai danna Shigar.



6. Fita da Editan rubutun ta hanyar Ctrl + X.

Yanzu yanki na dubawa zai zama wanda kuka ayyana shi, har sai Emeing na gaba na fayil ɗin sanyi. Don sigogi da aka sabunta, gudu sudo tsarin sake kunna cibiyar sadarwar.service da Supercclle Syime Streetwalld.service.

Saita yankin tsoho

Sama, mun riga ya nuna wata tawagar cewa ba ka damar koyi da default zone. Yana kuma iya a canza ta kafa da siga to your zabi. Don yin wannan, a cikin na'ura wasan bidiyo, shi ne isa yin rajistar sudo Firewall-cmd --set-default-zone = sunan, inda Name ne sunan da ake bukata zone.

Nasarar da umurnin za a evidenced da rubutu "nasara" a raba line. Bayan haka, duk halin yanzu musaya za a haife ga ajali zone, idan wasu ne ba a kayyade ba a cikin sanyi fayiloli.

Samar da dokoki domin shirye-shirye da kuma utilities

A farkon sosai na labarin, za mu yi magana game da mataki na kowane sashi. Ma'ana sabis, utilities da kuma shirye-shirye a wannan rassan zai ba da damar a yi amfani mutum sigogi ga kowane daga cikinsu domin kowane mai amfani buƙatun. Don fara da, mu shawara da ka familiarize kanka tare da cikakken jerin ayyuka samuwa a wannan lokacin: Firewall-cmd --GET-Services.

A sakamakon za a nuna kai tsaye a cikin na'ura wasan bidiyo. Kowane uwar garke da aka raba ta a sarari, da kuma zaka iya samun kayan aiki da kake sha'awar. Idan bukata sabis da ya bace, ya kamata a bugu da žari shigar. A shigarwa dokoki, karanta a cikin aikin hukuma software takardun.

A bisa umurnin nuna kawai sunayen da sabis. Cikakken bayani ga kowane daga cikinsu da aka samu ta hanyar da mutum fayil a kan hanya / usr / lib / FireWalld / Services. Irin takardun da wani XML format, da hanya, misali, zuwa SSH kama da wannan: /usr/lib/firewalld/services/ssh.xml, da kuma daftarin aiki yana da wadannan abubuwan:

SSH.

Kafaffen SHELL (SSH) NE A layinhantsaki DON shiga cikin AND aiwatar da umarni ON m inji. Yana bayar da Secure rufaffen Communications. Idan ka shirya kan Samun dama ga Machine Remotenet Via SSH Over A Firewalled Interface, Enable Wannan Option. Kana bukatar OpenSSh-Server Kunshin Installed for Wannan Option zuwa zama da amfani.

Service goyon bayan da aka kunna a cikin wani takamaiman zone da hannu. A cikin Terminal, ya kamata ka saita Sudo Firewall-cmd --Zone = Jama'a --DD-sabis = HTTP umurninSa, inda --Zone = Jama'a ne kunnawa zone, kuma --DD-sabis = HTTP - Sunan sabis. Note cewa irin wannan canji zai yi aiki a cikin daya zaman.

Dindindin Bugu da kari yana da za'ayi via sudo Firewall-cmd --Zone = Jama'a --permanent --DD-sabis = HTTP, da kuma sakamakon "Success" na nuna nasara kammala aiki.

Za ka iya duba da cikakken jerin m sharudda takamaiman zone da nuna wani jerin a raba line na bidiyo: Sudo Firewall-cmd --Zone = Jama'a --permanent --List-Services.

Yanke shawara matsala da rashin samun damar zuwa sabis

Standard Firewall Dokokin aka nuna ta fi rare da kafaffen sabis kamar yadda halatta, amma wasu misali, ko ɓangare-na uku shi tubalan. A wannan yanayin, da mai amfani da hannu yana bukatar canja saituna don magance matsalar da damar. Za ka iya yin wannan a biyu daban-daban hanyoyin.

Portes tashar jiragen ruwa

Kamar yadda ka sani, duk sabis na cibiyar sadarwa amfani da wani takamaiman tashar jiragen ruwa. Ana iya gano ta a Firewall, kuma tubalan za a iya yi. Don kauce wa irin wannan ayyuka daga Firewall, kana bukatar ka bude so tashar jiragen ruwa na Sudo Firewall-cmd --Zone = Jama'a - PORTD-tashar jiragen ruwa = 0000 / TCP, inda --Zone = Jama'a ne a tashar jiragen ruwa yanki, --DD- tashar jiragen ruwa = 0000 / TCP - tashar jiragen ruwa lambar da yarjejeniya. A Firewall-cmd --List-Mashigai zaɓi za su nuna wani jerin bude tashoshin jiragen ruwa.

Idan kana bukatar ka bude tashoshin jiragen ruwa a hada a cikin kewayon, amfani da Sudo Firewall-cmd kirtani --zone = Jama'a --DD-tashar jiragen ruwa = 0000-9999 / UDP, inda --add-tashar jiragen ruwa = 0000-9999 / UDP - tashar jiragen ruwa da kewayon kuma su yarjejeniya.

A bisa dokokin kawai ba ka damar gwada yin amfani da irin wannan sigogi. Idan ya wuce nasarar, ya kamata ka ƙara guda tashoshin jiragen ruwa zuwa m saituna, kuma wannan ne yake aikata ta shigar sudo Firewall-cmd --Zone = Jama'a --permanent --ADD-tashar jiragen ruwa = 0000 / TCP ko Sudo Firewall-cmd - Zone = Jama'a --permanent --Add-tashar jiragen ruwa = 0000-9999 / UDP. Jerin bude m tashoshin jiragen ruwa da aka kyan gani kamar haka: sudo Firewall-cmd --Zone = Jama'a --permanent --List-mashigai.

Definition na sabis

Kamar yadda ka gani, ƙara da tashoshin jiragen ruwa ba ya haifar da wani matsaloli, amma hanya da wahala a lokacin da aikace-aikace da amfani da manyan adadin. Don waƙa da duk used tashoshin jiragen ruwa ya zama da wahala, a cikin ra'ayi na wanda sabis kafiya zai zama mafi daidai wani zaɓi:

1. Kwafi da sanyi fayil da rubutu sudo Cp /usr/lib/firewalld/services/service.xml /etc/firewalld/services/example.xml, inda service.xml ne sunan da sabis fayil, da kuma example.xml ne sunan ta kofe.



2. Bude wani kwafin zuwa canji via wani rubutu edita, misali, sudo nano /etc/firewalld/services/example.xml.



3. Alal misali, mun halitta kwafin da HTTP sabis. A cikin daftarin aiki, ku m gani daban-daban metadata, misali, a takaice sunan da description. Ana rinjayar da uwar garke zuwa aiki kawai da canji na tashar jiragen ruwa lambar da yarjejeniya. Sama da kirtani "" Ya kamata a kara bude tashar jiragen ruwa. TCP - Used layinhantsaki, A 0000 - tashar jiragen ruwa lambar.



4. Ajiye duk canje-canje (Ctrl + O), kusa da fayil (Ctrl + x), sa'an nan zata sake farawa da Firewall su yi amfani da sigogi ta cikin sudo Firewall-cmd --reload. Bayan haka, sabis zai bayyana a lissafin samammun, wanda za a iya kyan gani, via Firewall-cmd --GET-Services.

Ku ne kawai da za a zabi mafi dace bayani da sabis matsala da damar yin amfani da sabis da kuma aiwatar da umarnin bayar. Kamar yadda ka gani, duk ayyuka ake yi quite sauƙi, kuma a can ya zama babu matsaloli.

Samar da al'ada zones

Za ka riga san cewa a farko wani babban yawan bambancin bangarori da tsare dokoki da aka halitta a Firewalld. Duk da haka, yanayi faru a lokacin da tsarin gudanarwa bukatun don ƙirƙirar wani mai amfani zone, kamar "PublicWeb" domin shigar da sabar yanar gizo ko "PrivatedNS" - domin DNS uwar garke. A wadannan misalai biyu, za mu bincika da Bugu da kari daga cikin rassan:

1. Ƙirƙiri biyu sabon m zones ta hanyar Sudo Firewall-cmd --permanent --New-Zone = PublicWeb da Sudo Firewall-cmd --Permanent --New-Zone = PrivatedNS.



2. Za su zama samuwa bayan rebooting da Sudo Firewall-cmd --reLoad kayan aiki. Don nuna m zones, shigar da Sudo Firewall-cmd --permanent --get-Zones.



3. Sanya musu da zama dole ayyuka, kamar "SSH", "HTTP" da "HTTPS". Wadannan ana yi da Sudo Firewall-cmd --Zone = PublicWeb --ADD-Service = SSH, sudo Firewall-cmd --zone = PublicWeb --Do-Service = PublicWeb --Do Firewall-cmd - PublicWeb - PublicWeb - Add- Service = HTTPS, inda --Zone = PublicWeb ne sunan zone don ƙara. Za ka iya duba aiki na ayyuka ta a lokacin Firewall-cmd --Zone = PublicWeb --List-duka.

Daga wannan labarin, za ka koyi yadda za su haifar da al'ada zones da kuma ƙara da sabis don su. Mun riga ya gaya musu azaman tsoho da assigning musaya sama, za ka iya kawai saka da daidai sunayen. Kada ka manta su zata sake farawa da Firewall bayan yin wani m canji.

Kamar yadda ka gani, FireWalld Firewall ne fairly volumetric kayan aiki da ba ka damar sa mafi m sanyi na Tacewar zaɓi. Ya zauna kawai don tabbatar da cewa mai amfani gabatar da tare da tsarin da kuma kayyade dokokin nan da nan za a fara aikinsu. Make shi tare da Sudo SystemCTL Enable Firewalld umurninSa.