Firewalld, qalab maarayn dab-damis oo heersare ah

Inta badan Qaybinta Linux waxay leedahay adeegyo dab-damis u gaar ah horay loo dhisay, markaa isticmaaluhu inta badan maaha inuu soo farageliyo qaybtan. Laakiin mararka qaarkood nooc ka mid ah qaabeynta gaarka ah ayaa lagama maarmaan u ah ama wax kasta oo kale oo isticmaaluhu rabo.

Waana sababta maanta aan ka hadalno firewalld, taas oo waa firewall la maamuli karo oo firfircoon, asal ahaan waxay kuu ogolaaneysaa inaad maamusho Firewall-ka adigoo taageeraya aagagga shabakada si aad u qeexdo heerka kalsoonida shabakadaha ama is-dhexgalka aad isticmaasho si aad ugu xirto. Waxay taageero u leedahay IPv4, IPv6 iyo isku xidhka ethernet.

Ku saabsan Firewalld

Firewalld waa loo hirgeliyay sida duubab ka sarreeya filtarrada baakadaha nftables iyo iptables. Firewalld wuxuu u shaqeeyaa sidii hab-socod kaas oo u oggolaanaya in xeerarka shaandhada baakidhka si firfircoon loogu beddelo D-Bus iyada oo aan dib loo rarin xeerarka shaandhada baakidhka iyo iyada oo aan la jarin isku-xidhka la aasaasay.

Si loo maareeyo firewall-ka, utility firewall-cmd ayaa loo isticmaalaa, kaas oo, marka la abuurayo xeerar, aan ku salaysnayn cinwaanada IP-ga, shabakadaha shabakadaha iyo lambarrada dekedaha, laakiin magacyada adeegyada, tusaale ahaan, si loo furo gelitaanka SSH, si loo xiro. SSH, iyo kuwo kale.

Isku xirka garaafyada ee firewall-config (GTK) iyo tufaaxa dabka-appt (Qt) sidoo kale waxaa loo isticmaali karaa in lagu beddelo goobaha dab-damiska. Taageerada maamulka ee loo maro D-BUS API firewalld ayaa laga heli karaa mashaariicda sida NetworkManager, libvirt, podman, docker, iyo fail2ban.

Sidoo kale, firewalld wuxuu si gooni ah u ilaaliyaa socodsiinta iyo qaabaynta joogtada ah. Sidaa darteed, firewalld sidoo kale waxay bixisaa interface ah codsiyada si loogu daro xeerarka hab ku habboon.

Qaabkii hore (system-config-firewall/lokkit) wuxuu ahaa mid taagan oo isbedel kastaa wuxuu u baahday reboot adag. Tani waxay ka dhigan tahay in la soo dejiyo cutubyada kernel-ka (tusaale: netfilter) oo dib loo soo dejiyo qaab kasta. Intaa waxaa dheer, dib u bilaabashadan waxay ka dhigan tahay luminta xogta heerka xidhiidhada la aasaasay.

Taas bedelkeeda, firewalld uma baahna adeeg dib u bilow si loo isticmaalo qaabayn cusub. Sidaa darteed, muhiim ma aha in dib loo soo dejiyo cutubyada kernel-ka. Ciladda kaliya ee jirta ayaa ah in waxaas oo dhan ay si sax ah u shaqeeyaan, qaabeynta waa in lagu sameeyaa iyada oo loo marayo firewalld iyo aaladaha qaabeynta (firewall-cmd ama firewall-config). Firewalld waxa uu awood u leeyahay in uu ku daro xeerar istimaalaya isla syntax sida {ip,ip6,eb} amarada miiska (xeerarka tooska ah).

Firewalld 1.3

Hadda, Firewalld waxay ku jirtaa nooca 1.3, kaas oo dhawaan la sii daayay waxayna iftiimisay isbeddellada soo socda:

• Adeeg ku habboon arjiga wadaagga faylka Warpinator ee ay soo saartay Linux Mint qaybinta waa la hirgeliyay.
• Waxaa lagu daray agaasimaha bareos-filedaemon, bareos-filedaemon, iyo adeegyada kaydinta bareos-ka si ay u taageeraan nidaamka kaydinta Bareos.
• Xeer indho-shareerka ayaa loo hirgeliyay dhabarka dambe ee nftables, kaas oo kuu ogolaanaya inaad ku xidho isku-xidhka shabakadaha aag ka shaqeeya taraafikada soo socda. Wixii iptables backend ah, sifadan lama taageero.
• Adeegga lagu daray ee shabakadaha P2P ee dulsaaran ee Nebula.
• Waxaa lagu daray adeeg loogu talagalay nidaamka dhoofinta metrik ee Ceph database Prometheus.
• Lagu daray adeeg taageera OMG DDS (Adeegga Qaybinta Xogta Kooxda Maareynta Shayga)
• Adeeg ayaa lagu daray si loo habeeyo codsiyada macmiilka si loo go'aamiyo magacyada martida loo yahay iyadoo la adeegsanayo nidaamka LLMNR (Link-Local Multicast Name Resolution).
• Adeeg lagu daray borotokoolka ps2link ee loo isticmaalo in lagula xidhiidho consoles-yada ciyaarta PlayStation 2.
• Adeeg ayaa lagu daray si uu u taageero hawlgalka server-ka ee nidaamka isku xidhka faylka Syncthing.

Haddii aad xiisaynayso inaad wax badan ka ogaato nooca cusub, waxaad kala tashan kartaa faahfaahinta gudaha xiriirka soo socda.

Hel Firewalld

Ugu dambayn kuwa xiisaynaya inaad awood u yeelato inaad rakibto Firewall-kan, waa inaad ogaataa in mashruucu horeyba loogu isticmaalay qaybin badan oo Linux ah, oo ay ku jiraan RHEL 7+, Fedora 18+, iyo SUSE/openSUSE 15+. Koodhka firewalld wuxuu ku qoran yahay Python waxaana lagu sii daayay shatiga GPLv2.

Waxaad heli kartaa koodhka isha ee dhismahaaga ka soo xiriir khadkan hoose.