{"id":95964,"date":"2020-10-06T01:42:49","date_gmt":"2020-10-05T23:42:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/2-usergate-getting-started-trebovaniya-ustanovka"},"modified":"2020-10-06T01:42:49","modified_gmt":"2020-10-05T23:42:49","slug":"2-usergate-getting-started-trebovaniya-ustanovka","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/2-usergate-getting-started-trebovaniya-ustanovka","title":{"rendered":"2. UserGate Za\u010d\u00edn\u00e1me. Po\u017eadavky, instalace","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"2. UserGate Za\u010d\u00edn\u00e1me. Po\u017eadavky, instalace\" src=\"\/wp-content\/uploads\/2020\/10\/0dec3bafb496cf5c88562b7d59252a30.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Dobr\u00fd den, toto je druh\u00fd \u010dl\u00e1nek o \u0159e\u0161en\u00ed NGFW od spole\u010dnosti&nbsp;<noindex><a rel=\"nofollow\" href=\"http:\/\/tssolution.ru\/katalog\/usergate?utm_source=habr\">UserGate<\/a><\/noindex>. C\u00edlem tohoto \u010dl\u00e1nku je uk\u00e1zat, jak nainstalovat firewall&nbsp;UserGate&nbsp;na virtu\u00e1ln\u00ed syst\u00e9m (pou\u017eiji virtualiza\u010dn\u00ed software&nbsp;VMware&nbsp;Workstation) a prov\u00e9st jeho po\u010d\u00e1te\u010dn\u00ed nastaven\u00ed (umo\u017enit p\u0159\u00edstup z m\u00edstn\u00ed s\u00edt\u011b p\u0159es br\u00e1nu&nbsp;UserGate&nbsp;na internet).&nbsp;&nbsp;&nbsp;<\/p>\n<h2>1. \u00davod<\/h2>\n<p>Nejprve pop\u00ed\u0161u r\u016fzn\u00e9 zp\u016fsoby implementace t\u00e9to br\u00e1ny do s\u00edt\u011b. Chci poznamenat, \u017ee v z\u00e1vislosti na vybran\u00e9 mo\u017enosti p\u0159ipojen\u00ed m\u016f\u017ee b\u00fdt ur\u010dit\u00e1 funk\u010dnost br\u00e1ny nedostupn\u00e1. \u0158e\u0161en\u00ed&nbsp;UserGate&nbsp;podporuje n\u00e1sleduj\u00edc\u00ed re\u017eimy p\u0159ipojen\u00ed:&nbsp;<\/p>\n<ul>\n<li>\n<p>L3-L7 firewall<\/p>\n<\/li>\n<li>\n<p>L2 pr\u016fhledn\u00fd most<\/p>\n<\/li>\n<li>\n<p>L3 pr\u016fhledn\u00fd most<\/p>\n<\/li>\n<li>\n<p>Virtu\u00e1ln\u011b v p\u0159eru\u0161en\u00ed, s pou\u017eit\u00edm protokolu WCCP<\/p>\n<\/li>\n<li>\n<p>Virtu\u00e1ln\u011b v p\u0159eru\u0161en\u00ed, s pou\u017eit\u00edm Policy Based Routing<\/p>\n<\/li>\n<li>\n<p>Router on a Stick<\/p>\n<\/li>\n<li>\n<p> V\u00fdslovn\u011b zadan\u00fd WEB-proxy<\/p>\n<\/li>\n<li>\n<p>UserGate jako br\u00e1na pro v\u00fdchoz\u00ed um\u00edst\u011bn\u00ed<\/p>\n<\/li>\n<li>\n<p>Monitorov\u00e1n\u00ed Mirror-portu<\/p>\n<\/li>\n<\/ul>\n<p>UserGate podporuje 2 typy cluster\u016f:<\/p>\n<ol>\n<li>\n<p>Konfigura\u010dn\u00ed cluster. Uzly sdru\u017een\u00e9 v konfigura\u010dn\u00edm clusteru podporuj\u00ed jednotn\u00e1 nastaven\u00ed v r\u00e1mci clustru.<\/p>\n<\/li>\n<li>\n<p>Cluster vysok\u00e9 dostupnosti. A\u017e 4 uzly konfigura\u010dn\u00edho clusteru mohou b\u00fdt spojeny do clusteru vysok\u00e9 dostupnosti, kter\u00fd podporuje provoz v re\u017eimu Aktivn\u00ed-Aktivn\u00ed nebo Aktivn\u00ed-Pasivn\u00ed. Je mo\u017en\u00e9 vytvo\u0159it n\u011bkolik cluster\u016f vysok\u00e9 dostupnosti.<\/p>\n<\/li>\n<\/ol>\n<h2>2. Instalace<\/h2>\n<p>Jak bylo uvedeno v p\u0159edchoz\u00edm \u010dl\u00e1nku, UserGate se dod\u00e1v\u00e1 jako hardwarov\u011b-softwarov\u00fd komplex nebo se nasazuje ve virtu\u00e1ln\u00edm prost\u0159ed\u00ed. Z u\u017eivatelsk\u00e9ho rozhran\u00ed na str\u00e1nk\u00e1ch <noindex><a rel=\"nofollow\" href=\"https:\/\/www.usergate.com\/\">UserGate <\/a><\/noindex>stahujeme obraz ve form\u00e1tu OVF (Open Virtualization Format), tento form\u00e1t je vhodn\u00fd pro dodavatele VMWare a Oracle Virtualbox. Pro Microsoft Hyper-v a KVM jsou dod\u00e1v\u00e1ny obrazy disk\u016f virtu\u00e1ln\u00edch stroj\u016f.<\/p>\n<p>Podle informac\u00ed z webu UserGate se pro spr\u00e1vnou funkci virtu\u00e1ln\u00edho stroje doporu\u010duje pou\u017e\u00edt minim\u00e1ln\u011b 8 GB RAM a dvouj\u00e1drov\u00fd virtu\u00e1ln\u00ed procesor. Hypervisor mus\u00ed podporovat 64bitov\u00e9 opera\u010dn\u00ed syst\u00e9my.<\/p>\n<p>Instalace za\u010d\u00edn\u00e1 importem obrazu do vybran\u00e9ho hypervisoru (VirtualBox a VMWare). V p\u0159\u00edpad\u011b Microsoft Hyper-v a KVM je pot\u0159eba vytvo\u0159it virtu\u00e1ln\u00ed stroj a jako disk nastavit sta\u017een\u00fd obraz, po \u010dem\u017e je nutn\u00e9 vypnout integra\u010dn\u00ed slu\u017eby v nastaven\u00ed vytvo\u0159en\u00e9ho virtu\u00e1ln\u00edho stroje.<\/p>\n<p>Ve v\u00fdchoz\u00edm nastaven\u00ed se po importu do VMWare vytvo\u0159\u00ed virtu\u00e1ln\u00ed stroj s n\u00e1sleduj\u00edc\u00edmi nastaven\u00edmi:<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010d\u00edn\u00e1me. Po\u017eadavky, instalace\" src=\"\/wp-content\/uploads\/2020\/10\/98764da6ccaed86f86c9924fdfe67516.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Jak bylo zm\u00edn\u011bno v\u00fd\u0161e, minim\u00e1ln\u00ed velikost opera\u010dn\u00ed pam\u011bti by m\u011bla b\u00fdt 8 GB, a nav\u00edc je t\u0159eba p\u0159idat 1 GB za ka\u017ed\u00fdch 100 u\u017eivatel\u016f. V\u00fdchoz\u00ed velikost pevn\u00e9ho disku je 100 GB, ale obvykle to nesta\u010d\u00ed pro ulo\u017een\u00ed v\u0161ech protokol\u016f a nastaven\u00ed. Doporu\u010den\u00e1 velikost je 300 GB nebo v\u00edce. Proto v nastaven\u00edch virtu\u00e1ln\u00edho stroje zm\u011bn\u00edme velikost disku na po\u017eadovanou. P\u016fvodn\u011b je virtu\u00e1ln\u00ed UserGate UTM dod\u00e1v\u00e1n se \u010dty\u0159mi rozhran\u00edmi, kter\u00e9 jsou p\u0159i\u0159azeny do z\u00f3n:<\/p>\n<p>Management \u2014 prvn\u00ed rozhran\u00ed virtu\u00e1ln\u00edho stroje, z\u00f3na pro p\u0159ipojen\u00ed d\u016fv\u011bryhodn\u00fdch s\u00edt\u00ed, ze kter\u00fdch je povoleno \u0159\u00edzen\u00ed UserGate.<\/p>\n<p>Trusted \u2014 druh\u00e9 rozhran\u00ed virtu\u00e1ln\u00edho stroje, z\u00f3na pro p\u0159ipojen\u00ed d\u016fv\u011bryhodn\u00fdch s\u00edt\u00ed, nap\u0159\u00edklad LAN s\u00edt\u00ed.<\/p>\n<p>Untrusted \u2014 t\u0159et\u00ed rozhran\u00ed virtu\u00e1ln\u00edho stroje, z\u00f3na pro rozhran\u00ed p\u0159ipojen\u00e1 k ned\u016fv\u011bryhodn\u00fdm s\u00edt\u00edm, nap\u0159\u00edklad k internetu.<\/p>\n<p>DMZ \u2014 \u010dtvrt\u00e9 rozhran\u00ed virtu\u00e1ln\u00edho stroje, z\u00f3na pro rozhran\u00ed p\u0159ipojen\u00e1 k s\u00edti DMZ.<\/p>\n<p>D\u00e1le spust\u00edme virtu\u00e1ln\u00ed stroje, i kdy\u017e se v p\u0159\u00edru\u010dce uv\u00e1d\u00ed, \u017ee je t\u0159eba zvolit Support Tools a prov\u00e9st Factory reset UTM, jak vid\u00edme, je zde pouze jedna volba (UTM First Boot). B\u011bhem t\u00e9to f\u00e1ze UTM nastavuje s\u00ed\u0165ov\u00e9 adapt\u00e9ry a zvy\u0161uje velikost odd\u00edlu na pevn\u00e9m disku na plnou velikost disku:<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010d\u00edn\u00e1me. Po\u017eadavky, instalace\" src=\"\/wp-content\/uploads\/2020\/10\/f702cb25e9b6fb0da4a8e27ade1b2c01.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Pro p\u0159ipojen\u00ed k webov\u00e9mu rozhran\u00ed UserGate je nutn\u00e9 vstoupit p\u0159es z\u00f3nu Management, za to odpov\u00edd\u00e1 rozhran\u00ed eth0, kter\u00e9 je nastaveno na automatick\u00e9 z\u00edsk\u00e1n\u00ed IP adresy (DHCP). Pokud nen\u00ed mo\u017en\u00e9 p\u0159id\u011blit adresu pro Management rozhran\u00ed automaticky pomoc\u00ed DHCP, lze ji explicitn\u011b zadat prost\u0159ednictv\u00edm CLI (Command Line Interface). K tomu je t\u0159eba se p\u0159ihl\u00e1sit do CLI s u\u017eivatelsk\u00fdm jm\u00e9nem a heslem u\u017eivatele s pr\u00e1vy Full administrator (v\u00fdchoz\u00ed Admin s velk\u00fdm A). Pokud za\u0159\u00edzen\u00ed UserGate nepro\u0161lo po\u010d\u00e1te\u010dn\u00edm zprovozn\u011bn\u00edm, je pro p\u0159\u00edstup k CLI nutn\u00e9 pou\u017e\u00edt jako u\u017eivatelsk\u00e9 jm\u00e9no Admin a jako heslo \u2013 utm. A zadat p\u0159\u00edkaz typu iface config \u2013name eth0 \u2013ipv4 192.168.1.254\/24 \u2013enable true \u2013mode static. Pot\u00e9 p\u0159ech\u00e1z\u00edme na webovou konzolu UserGate na uvedenou adresu, kter\u00e1 by m\u011bla vypadat p\u0159ibli\u017en\u011b takto:<noindex><a rel=\"nofollow\" href=\"https:\/\/usergate_ip_address:8001\/\"> <\/a><\/noindex><u>https:\/\/UserGateIPaddress:8001<\/u>:<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010d\u00edn\u00e1me. Po\u017eadavky, instalace\" src=\"\/wp-content\/uploads\/2020\/10\/398f741bb9e16c33465c10d072ab31c0.png\" style=\"display:block;margin: 0 auto;\" \/><img decoding=\"async\" alt=\"2. UserGate Za\u010d\u00edn\u00e1me. Po\u017eadavky, instalace\" src=\"\/wp-content\/uploads\/2020\/10\/0751e1047997f5afde57044beea10f74.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>V webov\u00e9m rozhran\u00ed pokra\u010dujeme v instalaci, mus\u00edme si vybrat jazyk rozhran\u00ed (moment\u00e1ln\u011b je to ru\u0161tina nebo angli\u010dtina), \u010dasov\u00e9 p\u00e1smo, pot\u00e9 si p\u0159e\u010d\u00edst a souhlasit s licen\u010dn\u00ed smlouvou. Nastavujeme u\u017eivatelsk\u00e9 jm\u00e9no a heslo pro p\u0159ihl\u00e1\u0161en\u00ed do webov\u00e9ho rozhran\u00ed spr\u00e1vy. <\/p>\n<h2>3. Nastaven\u00ed<\/h2>\n<p>Po instalaci takto vypad\u00e1 okno webov\u00e9ho rozhran\u00ed spr\u00e1vy platformy:<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010d\u00edn\u00e1me. Po\u017eadavky, instalace\" src=\"\/wp-content\/uploads\/2020\/10\/16a0d900c66eb23e07a9b5d56915ace8.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>D\u00e1le je nutn\u00e9 nastavit s\u00ed\u0165ov\u00e1 rozhran\u00ed. K tomu je t\u0159eba v \u010d\u00e1sti &#171;Rozhran\u00ed&#187; je aktivovat, nastavit spr\u00e1vn\u00e9 IP adresy a p\u0159i\u0159adit odpov\u00eddaj\u00edc\u00ed z\u00f3ny.<\/p>\n<p>Sekce &#171;Rozhran\u00ed&#187; zobrazuje v\u0161echna fyzick\u00e1 a virtu\u00e1ln\u00ed rozhran\u00ed dostupn\u00e1 v syst\u00e9mu, umo\u017e\u0148uje m\u011bnit jejich nastaven\u00ed a p\u0159id\u00e1vat VLAN rozhran\u00ed. Tak\u00e9 ukazuje v\u0161echna rozhran\u00ed ka\u017ed\u00e9ho uzlu clusteru. Nastaven\u00ed rozhran\u00ed jsou specifick\u00e1 pro ka\u017ed\u00fd z uzl\u016f, tedy nejsou glob\u00e1ln\u00ed.<\/p>\n<p>V vlastnostech rozhran\u00ed:<\/p>\n<ul>\n<li>\n<p>Zapnout nebo vypnout rozhran\u00ed&nbsp; <\/p>\n<\/li>\n<li>\n<p>U\u017e\u00edt typ rozhran\u00ed \u2014 Layer 3 nebo Mirror<\/p>\n<\/li>\n<li>\n<p>P\u0159i\u0159azen\u00ed z\u00f3ny rozhran\u00ed<\/p>\n<\/li>\n<li>\n<p>P\u0159i\u0159azen\u00ed profilu Netflow pro zas\u00edl\u00e1n\u00ed statistick\u00fdch dat do Netflow sb\u011bra\u010de<\/p>\n<\/li>\n<li>\n<p>Zm\u011bnit fyzick\u00e9 parametry rozhran\u00ed \u2014 MAC adresu a velikost MTU <\/p>\n<\/li>\n<li>\n<p>Vybrat typ p\u0159i\u0159azen\u00ed IP adresy \u2014 bez adresy, statick\u00e1 IP adresa nebo z\u00edskan\u00e1 p\u0159es DHCP <\/p>\n<\/li>\n<li>\n<p>Nastaven\u00ed DHCP rel\u00e9 na vybran\u00e9m rozhran\u00ed.<\/p>\n<\/li>\n<\/ul>\n<p>Tla\u010d\u00edtko &#171;P\u0159idat&#187; umo\u017e\u0148uje p\u0159idat n\u00e1sleduj\u00edc\u00ed typy logick\u00fdch rozhran\u00ed:<\/p>\n<ul>\n<li>\n<p>VLAN<\/p>\n<\/li>\n<li>\n<p>Bond<\/p>\n<\/li>\n<li>\n<p>Most<\/p>\n<\/li>\n<li>\n<p>PPPoE<\/p>\n<\/li>\n<li>\n<p>VPN<\/p>\n<\/li>\n<li>\n<p>Tunel<\/p>\n<\/p>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010d\u00edn\u00e1me. Po\u017eadavky, instalace\" src=\"\/wp-content\/uploads\/2020\/10\/7f389a91d4d8c584140a1d7b1dbe3a11.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Krom\u011b d\u0159\u00edve uveden\u00fdch z\u00f3n, se kter\u00fdmi se obraz Usergate dod\u00e1v\u00e1, existuj\u00ed tak\u00e9 t\u0159i typy p\u0159eddefinovan\u00fdch:<\/p>\n<p>Cluster \u2014 z\u00f3na pro rozhran\u00ed pou\u017e\u00edvan\u00e1 pro provoz clusteru<\/p>\n<p>VPN for Site-to-Site \u2014 z\u00f3na, do kter\u00e9 se umis\u0165uj\u00ed v\u0161ichni klienti typu Office-Office p\u0159ipojovan\u00ed k UserGate p\u0159es VPN<\/p>\n<p>VPN for remote access \u2014 z\u00f3na, do kter\u00e9 se umis\u0165uj\u00ed v\u0161ichni mobiln\u00ed u\u017eivatel\u00e9 p\u0159ipojen\u00ed k UserGate p\u0159es VPN<\/p>\n<p>Spr\u00e1vci UserGate mohou m\u011bnit nastaven\u00ed z\u00f3n, kter\u00e9 byly vytvo\u0159eny podle defaultu, a tak\u00e9 vytv\u00e1\u0159et dal\u0161\u00ed z\u00f3ny, ale jak je uvedeno v p\u0159\u00edru\u010dce k verzi 5, lze vytvo\u0159it maxim\u00e1ln\u011b 15 z\u00f3n. Pro zm\u011bnu nebo vytvo\u0159en\u00ed je t\u0159eba p\u0159ej\u00edt do sekce z\u00f3ny. Pro ka\u017edou z\u00f3nu lze nastavit prahovou hodnotu pro odhazov\u00e1n\u00ed paket\u016f, podporov\u00e1ny jsou SYN, UDP, ICMP. Tak\u00e9 se nastavuje kontrola p\u0159\u00edstupu k slu\u017eb\u00e1m Usergate a zap\u00edn\u00e1 se ochrana proti spoofingu.<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010d\u00edn\u00e1me. Po\u017eadavky, instalace\" src=\"\/wp-content\/uploads\/2020\/10\/86a0d5f6898c5e1a4f10d2827b4c855d.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Po nastaven\u00ed rozhran\u00ed je nutn\u00e9 v sekci \u201eBr\u00e1ny\u201c nastavit v\u00fdchoz\u00ed trasu. To znamen\u00e1, \u017ee pro p\u0159ipojen\u00ed UserGate k internetu je t\u0159eba uv\u00e9st IP adresu jedn\u00e9 nebo v\u00edce bran. Pokud se pro p\u0159ipojen\u00ed k internetu pou\u017e\u00edv\u00e1 n\u011bkolik poskytovatel\u016f, je nutn\u00e9 uv\u00e9st n\u011bkolik bran. Nastaven\u00ed br\u00e1ny je jedine\u010dn\u00e9 pro ka\u017ed\u00fd z uzl\u016f clusteru. Pokud je zad\u00e1no dv\u011b nebo v\u00edce bran, jsou mo\u017en\u00e9 2 varianty provozu:<\/p>\n<ol>\n<li>\n<p>Vyrovn\u00e1v\u00e1n\u00ed zat\u00ed\u017een\u00ed mezi br\u00e1nami.<\/p>\n<\/li>\n<li>\n<p>Hlavn\u00ed br\u00e1na s p\u0159epnut\u00edm na z\u00e1lo\u017en\u00ed.<\/p>\n<\/li>\n<\/ol>\n<p>Stav br\u00e1ny (dostupn\u00e1 \u2013 zelen\u00e1, nedostupn\u00e1 \u2013 \u010derven\u00e1) se ur\u010duje n\u00e1sleduj\u00edc\u00edm zp\u016fsobem:<\/p>\n<ol>\n<li>\n<p>Kontrola s\u00edt\u011b je vypnuta \u2013 br\u00e1na se pova\u017euje za dostupnou, pokud UserGate m\u016f\u017ee z\u00edskat jej\u00ed MAC adresu pomoc\u00ed ARP dotazu. Kontrola p\u0159\u00edstupu k internetu p\u0159es tuto br\u00e1nu se neprov\u00e1d\u00ed. Pokud nelze ur\u010dit MAC adresu br\u00e1ny, br\u00e1na se pova\u017euje za nedostupnou.<\/p>\n<\/li>\n<li>\n<p>Kontrola s\u00edt\u011b je zapnuta \u2014 br\u00e1na je pova\u017eov\u00e1na za dostupnou, pokud:<\/p>\n<\/li>\n<\/ol>\n<ul>\n<li>\n<p>UserGate m\u016f\u017ee z\u00edskat jej\u00ed MAC adresu pomoc\u00ed ARP dotazu.<\/p>\n<\/li>\n<li>\n<p>Kontrola p\u0159\u00edstupu k internetu p\u0159es tuto br\u00e1nu byla \u00fasp\u011b\u0161n\u00e1.<\/p>\n<\/li>\n<\/ul>\n<p>V opa\u010dn\u00e9m p\u0159\u00edpad\u011b se br\u00e1na pova\u017euje za nedostupnou.<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010d\u00edn\u00e1me. Po\u017eadavky, instalace\" src=\"\/wp-content\/uploads\/2020\/10\/f3bbb603ab50d1d665df761fa55efac9.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>V sekci \u201eDNS\u201c je t\u0159eba p\u0159idat DNS servery, kter\u00e9 bude pou\u017e\u00edvat UserGate. Toto nastaven\u00ed se uv\u00e1d\u00ed v oblasti Syst\u00e9mov\u00e9 DNS servery. N\u00ed\u017ee naleznete nastaven\u00ed pro spr\u00e1vu DNS dotaz\u016f od u\u017eivatel\u016f. UserGate umo\u017e\u0148uje pou\u017e\u00edvat DNS proxy. Slu\u017eba DNS proxy umo\u017e\u0148uje zachyt\u00e1vat DNS dotazy od u\u017eivatel\u016f a m\u011bnit je podle pot\u0159eb administr\u00e1tora. Pomoc\u00ed pravidel DNS proxy m\u016f\u017eete ur\u010dit DNS servery, na kter\u00e9 jsou p\u0159esm\u011brov\u00e1ny dotazy na ur\u010dit\u00e9 dom\u00e9ny. Krom\u011b toho pomoc\u00ed DNS proxy m\u016f\u017eete definovat statick\u00e9 z\u00e1znamy typu host (A z\u00e1znam).<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010d\u00edn\u00e1me. Po\u017eadavky, instalace\" src=\"\/wp-content\/uploads\/2020\/10\/f98bb05fd143b873fdd5fee8cd38a6d0.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>V sekci \u201eNAT a Sm\u011brov\u00e1n\u00ed\u201c je nutn\u00e9 vytvo\u0159it pot\u0159ebn\u00e1 pravidla NAT. Pro p\u0159\u00edstup k internetu u\u017eivatel\u016f s\u00edt\u011b Trusted je pravidlo NAT ji\u017e vytvo\u0159eno \u2014 \u201eTrusted\u2192Untrusted\u201c, zb\u00fdv\u00e1 ho pouze aktivovat. Pravidla se uplat\u0148uj\u00ed shora dol\u016f v tom po\u0159ad\u00ed, v jak\u00e9m jsou uvedena v konzoli. V\u017edy se prov\u00e1d\u00ed pouze prvn\u00ed pravidlo, pro kter\u00e9 se shoduj\u00ed podm\u00ednky uveden\u00e9 v pravidle. Pro aktivaci pravidla je nutn\u00e9, aby v\u0161echny podm\u00ednky uveden\u00e9 v parametrech pravidla byly spln\u011bny. UserGate doporu\u010duje vytv\u00e1\u0159et obecn\u00e1 pravidla NAT, nap\u0159\u00edklad pravidlo NAT z m\u00edstn\u00ed s\u00edt\u011b (obvykle z\u00f3na Trusted) do internetu (obvykle z\u00f3na Untrusted), a rozli\u0161ov\u00e1n\u00ed p\u0159\u00edstupu podle u\u017eivatel\u016f, slu\u017eeb, aplikac\u00ed prov\u00e1d\u011bt pomoc\u00ed pravidel firewallu.<\/p>\n<p>D\u00e1le existuje mo\u017enost vytvo\u0159it pravidla DNAT, port forwarding, Policy-based routing, Network mapping.<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010d\u00edn\u00e1me. Po\u017eadavky, instalace\" src=\"\/wp-content\/uploads\/2020\/10\/efa1a3f8e1b004a3f90c05b957b193f6.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>V sekci \u201eFirewall\u201c je nutn\u00e9 vytvo\u0159it pravidla pro firewall. Pro neomezen\u00fd p\u0159\u00edstup k internetu u\u017eivatel\u016f s\u00edt\u011b Trusted ji\u017e bylo vytvo\u0159eno pravidlo firewallu \u2013 \u201eInternet pro Trusted\u201c a je t\u0159eba jej povolit. Pomoc\u00ed pravidel firewallu m\u016f\u017ee administr\u00e1tor povolit nebo zak\u00e1zat jak\u00fdkoliv typ p\u0159echodov\u00e9ho s\u00ed\u0165ov\u00e9ho provozu proch\u00e1zej\u00edc\u00edho p\u0159es UserGate. Jako podm\u00ednky pravidel mohou slou\u017eit z\u00f3ny a IP adresy zdroje\/ur\u010den\u00ed, u\u017eivatel\u00e9 a skupiny, slu\u017eby a aplikace. Pravidla se uplat\u0148uj\u00ed stejn\u011b jako v sekci \u201eNAT a Sm\u011brov\u00e1n\u00ed\u201c, tedy shora dol\u016f. Pokud nen\u00ed vytvo\u0159eno \u017e\u00e1dn\u00e9 pravidlo, je ve\u0161ker\u00fd p\u0159echodov\u00fd provoz p\u0159es UserGate zak\u00e1z\u00e1n.<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010d\u00edn\u00e1me. Po\u017eadavky, instalace\" src=\"\/wp-content\/uploads\/2020\/10\/098871017279694492f381069f172483.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<h2>4. Z\u00e1v\u011br<\/h2>\n<p>T\u00edmto \u010dl\u00e1nek kon\u010d\u00ed. Nainstalovali jsme firewall UserGate na virtu\u00e1ln\u00ed stroj a provedli minim\u00e1ln\u00ed nezbytn\u00e1 nastaven\u00ed pro zaji\u0161t\u011bn\u00ed internetov\u00e9ho p\u0159ipojen\u00ed v s\u00edti Trusted. Dal\u0161\u00ed nastaven\u00ed budeme prob\u00edrat v r\u00e1mci dal\u0161\u00edch \u010dl\u00e1nk\u016f.<\/p>\n<p>Sledujte aktualizace na na\u0161ich kan\u00e1lech (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>,&nbsp;<noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/tssolution2020\/\">Facebook<\/a><\/noindex>,&nbsp;<noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>,&nbsp;<noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">TS Solution Blog<\/a><\/noindex>)!<\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/521322\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0417\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435, \u044d\u0442\u043e \u0432\u0442\u043e\u0440\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u043e NGFW \u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438&nbsp;UserGate. \u0417\u0430\u0434\u0430\u0447\u0430 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c, \u043a\u0430\u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u044d\u043a\u0440\u0430\u043d&nbsp;UserGate&nbsp;\u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 (\u0431\u0443\u0434\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438&nbsp;VMware&nbsp;Workstation) \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0435\u0433\u043e \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0443\u044e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0443 (\u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0438\u0437 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0447\u0435\u0440\u0435\u0437 \u0448\u043b\u044e\u0437&nbsp;UserGate&nbsp;\u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442).&nbsp;&nbsp;&nbsp; 1. \u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0414\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u044f \u043e\u043f\u0438\u0448\u0443 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0448\u043b\u044e\u0437\u0430 \u0432 \u0441\u0435\u0442\u044c. \u0425\u043e\u0447\u0443 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":95965,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-95964","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/2-usergate-getting-started-trebovaniya-ustanovka\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd472. UserGate Getting Started. \u0422\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/2-usergate-getting-started-trebovaniya-ustanovka\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-05T23:42:49+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-05T23:42:49+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd472. UserGate Za\u010d\u00edn\u00e1me. Po\u017eadavky, instalace | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/2-usergate-getting-started-trebovaniya-ustanovka","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd472. UserGate Getting Started. \u0422\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/2-usergate-getting-started-trebovaniya-ustanovka","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-05T23:42:49+00:00","article:modified_time":"2020-10-05T23:42:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95964","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:54:37","updated":"2022-09-28 17:15:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/95964","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=95964"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/95964\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/95965"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=95964"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=95964"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=95964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}