{"id":97713,"date":"2020-10-21T02:42:44","date_gmt":"2020-10-21T00:42:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/3-usergate-getting-started-politiki-seti"},"modified":"2020-10-21T02:42:44","modified_gmt":"2020-10-21T00:42:44","slug":"3-usergate-getting-started-politiki-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/3-usergate-getting-started-politiki-seti","title":{"rendered":"3. UserGate \u00davod. Politiky s\u00edt\u011b","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"3. UserGate \u00davod. Politiky s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/10\/6135a0c5287f8256222ce4d295f2b2ec.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>V\u00edtejte \u010dten\u00e1\u0159i u t\u0159et\u00edho \u010dl\u00e1nku cyklu \u010dl\u00e1nk\u016f UserGate Getting Started, kter\u00fd se zab\u00fdv\u00e1 \u0159e\u0161en\u00edm NGFW od spole\u010dnosti&nbsp;<noindex><a rel=\"nofollow\" href=\"http:\/\/tssolution.ru\/katalog\/usergate?utm_source=habr\">UserGate<\/a><\/noindex>. V minul\u00e9m \u010dl\u00e1nku byl pops\u00e1n proces instalace firewallu a byla provedena jeho po\u010d\u00e1te\u010dn\u00ed konfigurace. Nyn\u00ed se pod\u00edv\u00e1me podrobn\u011bji na vytv\u00e1\u0159en\u00ed pravidel v sekc\u00edch jako \u201eFirewall\u201c, \u201eNAT a sm\u011brov\u00e1n\u00ed\u201c a \u201ePropustnost\u201c.<\/p>\n<p>Ideologie fungov\u00e1n\u00ed pravidel UserGate je takov\u00e1, \u017ee pravidla se vykon\u00e1vaj\u00ed shora dol\u016f, a\u017e do prvn\u00edho spou\u0161t\u011bn\u00e9ho. Z v\u00fd\u0161e uveden\u00e9ho vypl\u00fdv\u00e1, \u017ee specifick\u00e1 pravidla mus\u00ed b\u00fdt nad obecn\u00fdm. Je v\u0161ak t\u0159eba poznamenat, \u017ee proto\u017ee pravidla jsou kontrolov\u00e1na v po\u0159ad\u00ed, z hlediska v\u00fdkonu je lep\u0161\u00ed vytv\u00e1\u0159et obecn\u00e1 pravidla. Podm\u00ednky p\u0159i vytv\u00e1\u0159en\u00ed jak\u00e9hokoli pravidla se uplat\u0148uj\u00ed podle logiky \u201eA\u201c. Pokud je nutn\u00e9 pou\u017e\u00edt logiku \u201eNEBO\u201c, dos\u00e1hne se toho vytvo\u0159en\u00edm n\u011bkolika pravidel. Tak\u017ee to, co je pops\u00e1no v tomto \u010dl\u00e1nku, plat\u00ed i pro jin\u00e9 politiky UserGate.<\/p>\n<h3>Firewall<\/h3>\n<p>Po instalaci UserGate v sekci \u201eFirewall\u201c ji\u017e existuje jednoduch\u00e1 politika. Prvn\u00ed dv\u011b pravidla zakazuj\u00ed provoz pro botnety. N\u00e1sleduj\u00ed p\u0159\u00edklady pravidel p\u0159\u00edstupu z r\u016fzn\u00fdch z\u00f3n. Posledn\u00ed pravidlo se v\u017edy naz\u00fdv\u00e1 \u201eBlokovat v\u0161e\u201c a je ozna\u010deno symbolem z\u00e1mku (ten znamen\u00e1, \u017ee pravidlo nelze odstranit, zm\u011bnit, p\u0159esunout, deaktivovat; pro n\u011bj lze pouze aktivovat mo\u017enost z\u00e1znamu). D\u00edky tomuto pravidlu bude ve\u0161ker\u00fd v\u00fdslovn\u011b nepovolen\u00fd provoz blokov\u00e1n posledn\u00edm pravidlem. Pokud je pot\u0159eba povolit ve\u0161ker\u00fd provoz p\u0159es UserGate (i kdy\u017e se to d\u016frazn\u011b nedoporu\u010duje), v\u017edy lze vytvo\u0159it p\u0159edposledn\u00ed pravidlo \u201ePovolit v\u0161e\u201c.<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate \u00davod. Politiky s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/10\/6259ea9b51da9481e186b9027ddcbcf8.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>P\u0159i editaci nebo vytv\u00e1\u0159en\u00ed pravidla pro firewall je prvn\u00ed <em>karta \u201eObecn\u00e9\u201c<\/em>, na n\u00ed\u017e je t\u0159eba prov\u00e9st n\u00e1sleduj\u00edc\u00ed kroky:&nbsp;<\/p>\n<ul>\n<li>\n<p>Za\u0161krt\u00e1vac\u00edm pol\u00ed\u010dkem \u201eZapnuto\u201c povolit nebo zak\u00e1zat pravidlo.<\/p>\n<\/li>\n<li>\n<p>vlo\u017eit n\u00e1zev pravidla.<\/p>\n<\/li>\n<li>\n<p>zadajte popis pravidla.<\/p>\n<\/li>\n<li>\n<p>vyberte jedno ze dvou akc\u00ed:<\/p>\n<ul>\n<li>\n<p>Zak\u00e1zat \u2014 blokuje provoz (p\u0159i stanoven\u00ed t\u00e9to podm\u00ednky je mo\u017en\u00e9 odeslat ICMP host unreachable, sta\u010d\u00ed za\u0161krtnout odpov\u00eddaj\u00edc\u00ed za\u0161krt\u00e1vac\u00ed pol\u00ed\u010dko).<\/p>\n<\/li>\n<li>\n<p>Povolit \u2014 povoluje provoz.<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>Sc\u00e9n\u00e1\u0159 pravidel \u2014 umo\u017e\u0148uje vybrat sc\u00e9n\u00e1\u0159, kter\u00fd je dal\u0161\u00edm podm\u00ednkou pro aktivaci pravidla. Tak spole\u010dnost UserGate realizuje koncept SOAR (Security Orchestration, Automation and Response).<\/p>\n<\/li>\n<li>\n<p>Protokolov\u00e1n\u00ed \u2014 zapisov\u00e1n\u00ed informac\u00ed o provozu do protokolu p\u0159i aktivaci pravidla. Mo\u017en\u00e9 varianty:<\/p>\n<ul>\n<li>\n<p>Protokolovat za\u010d\u00e1tek relace. V tomto p\u0159\u00edpad\u011b se do protokolu provozu zap\u00ed\u0161e pouze informace o za\u010d\u00e1tku relace (prvn\u00ed paket). Toto je doporu\u010den\u00e1 varianta protokolov\u00e1n\u00ed.<\/p>\n<\/li>\n<li>\n<p>Protokolovat ka\u017ed\u00fd paket. V tomto p\u0159\u00edpad\u011b se zap\u00ed\u0161e informace o ka\u017ed\u00e9m p\u0159en\u00e1\u0161en\u00e9m s\u00ed\u0165ov\u00e9m paketu. Pro tento re\u017eim se doporu\u010duje zapnout limit protokolov\u00e1n\u00ed, aby se p\u0159ede\u0161lo vysok\u00e9mu zat\u00ed\u017een\u00ed za\u0159\u00edzen\u00ed.<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>Pou\u017e\u00edt pravidlo na:<\/p>\n<ul>\n<li>\n<p>V\u0161echny pakety<\/p>\n<\/li>\n<li>\n<p>na fragmentovan\u00e9 pakety<\/p>\n<\/li>\n<li>\n<p>na nefragmentovan\u00e9 pakety<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>P\u0159i vytv\u00e1\u0159en\u00ed nov\u00e9ho pravidla lze vybrat m\u00edsto v politice.<\/p>\n<\/li>\n<\/ul>\n<p>Dal\u0161\u00ed <em>z\u00e1lo\u017eka \u201eZdroj\u201c<\/em>. Zde uv\u00e1d\u00edme zdroj provozu, m\u016f\u017ee to b\u00fdt z\u00f3na, ze kter\u00e9 provoz poch\u00e1z\u00ed, nebo m\u016f\u017eeme uv\u00e9st seznam nebo konkr\u00e9tn\u00ed ip adresu (Geoip). Prakticky ve v\u0161ech pravidlech, kter\u00e1 lze nastavit v za\u0159\u00edzen\u00ed, lze vytvo\u0159it objekt z pravidla. Nap\u0159\u00edklad nen\u00ed nutn\u00e9 p\u0159ech\u00e1zet do sekce \u201eZ\u00f3ny\u201c, pomoc\u00ed tla\u010d\u00edtka \u201eVytvo\u0159it a p\u0159idat nov\u00fd objekt\u201c lze vytvo\u0159it po\u017eadovanou z\u00f3nu. Tak\u00e9 se \u010dasto vyskytuje za\u0161krt\u00e1vac\u00ed pol\u00ed\u010dko \u201eInvertovat\u201c, kter\u00e9 m\u011bn\u00ed v podm\u00ednce pravidla akci na opa\u010dnou, co\u017e je analogick\u00e9 logick\u00e9 akci negace. <em>Z\u00e1lo\u017eka &#171;\u00da\u010del&#187;<\/em> je podobn\u00e1 z\u00e1lo\u017ece zdroje, pouze m\u00edsto zdroje provozu zad\u00e1v\u00e1me c\u00edl provozu. <em>Z\u00e1lo\u017eka &#171;U\u017eivatel\u00e9&#187;<\/em> \u2014 v tomto m\u00edst\u011b lze p\u0159idat seznam u\u017eivatel\u016f nebo skupin, pro kter\u00e9 se toto pravidlo aplikuje. <em>Z\u00e1lo\u017eka &#171;Slu\u017eba&#187;<\/em> \u2014 vyb\u00edr\u00e1me typ slu\u017eby z ji\u017e p\u0159eddefinovan\u00fdch nebo m\u016f\u017eeme zadat vlastn\u00ed. <em>Z\u00e1lo\u017eka &#171;Aplikace&#187;<\/em> \u2014 zde vyb\u00edr\u00e1me konkr\u00e9tn\u00ed aplikace nebo skupiny aplikac\u00ed. A <em>z\u00e1lo\u017eka &#171;\u010cas&#187;<\/em> uv\u00e1d\u00ed \u010das, kdy je toto pravidlo aktivn\u00ed.&nbsp;<\/p>\n<p>Z minul\u00e9ho lekce m\u00e1me pravidlo pro p\u0159\u00edstup na internet ze z\u00f3ny \u201eTrust\u201c, nyn\u00ed uk\u00e1\u017eu na p\u0159\u00edkladu, jak vytvo\u0159it zakazuj\u00edc\u00ed pravidlo pro ICMP provoz ze z\u00f3ny \u201eTrust\u201c do z\u00f3ny \u201eUntrusted\u201c.<\/p>\n<p>Nejprve vytvo\u0159\u00edme pravidlo kliknut\u00edm na tla\u010d\u00edtko \u201eP\u0159idat\u201c. V otev\u0159en\u00e9m okn\u011b na z\u00e1lo\u017ece Obecn\u00e9 vypln\u00edme n\u00e1zev (Z\u00e1kaz ICMP z trusted do untrusted), za\u0161krtneme checkbox \u201ePovolit\u201c, zvol\u00edme akci zak\u00e1zat a co je nejd\u016fle\u017eit\u011bj\u0161\u00ed, spr\u00e1vn\u011b vybereme um\u00edst\u011bn\u00ed tohoto pravidla. Podle m\u00e9 politiky by toto pravidlo m\u011blo b\u00fdt um\u00edst\u011bno nad pravidlem \u201ePovolit trusted do untrusted\u201c:<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate \u00davod. Politiky s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/10\/61b267e2e914dd82473bb242c75af173.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Na z\u00e1lo\u017ece \u201eZdroj\u201c pro m\u016fj \u00fakol existuj\u00ed dv\u011b mo\u017enosti:<\/p>\n<ul>\n<li>\n<p>Zvolen\u00edm z\u00f3ny \u201eTrusted\u201c<\/p>\n<\/li>\n<li>\n<p>Zvolen\u00ed v\u0161ech z\u00f3n krom\u011b \u201eTrusted\u201c a za\u0161krtnut\u00ed checkboxu \u201eInvertovat\u201c<\/p>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"3. UserGate \u00davod. Politiky s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/10\/b84ba5bd64a27d904607e23e0529bfa8.png\" style=\"display:block;margin: 0 auto;\" \/><img decoding=\"async\" alt=\"3. UserGate \u00davod. Politiky s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/10\/d938df2d1b567a9712e6a486e53d1a67.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Z\u00e1lo\u017eka \u201e\u00da\u010del\u201c se nastavuje obdobn\u011b jako z\u00e1lo\u017eka \u201eZdroj\u201c.<\/p>\n<p>D\u00e1le p\u0159ech\u00e1z\u00edme na z\u00e1lo\u017eku \u201cSlu\u017eba\u201d, proto\u017ee v UserGate je p\u0159eddefinovan\u00e1 slu\u017eba pro ICMP provoz, tedy po stisknut\u00ed tla\u010d\u00edtka &#171;P\u0159idat&#187; vyb\u00edr\u00e1me ze seznamu slu\u017ebu s n\u00e1zvem \u201cAny ICMP\u201d:<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate \u00davod. Politiky s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/10\/c5ab4720c8f4c178f3e1d16d64d1a2ac.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Mo\u017en\u00e1 to tv\u016frci UserGate zam\u00fd\u0161leli, ale j\u00e1 jsem mohl vytvo\u0159it n\u011bkolik zcela stejn\u00fdch pravidel. I kdy\u017e se bude prov\u00e1d\u011bt pouze prvn\u00ed pravidlo v seznamu, mo\u017enost vytvo\u0159it r\u016fzn\u00e1 funk\u010dn\u00ed pravidla se stejn\u00fdm n\u00e1zvem m\u016f\u017ee zp\u016fsobit zmatek p\u0159i pr\u00e1ci v\u00edce spr\u00e1vc\u016f za\u0159\u00edzen\u00ed.<\/p>\n<h3>NAT a sm\u011brov\u00e1n\u00ed<\/h3>\n<p>P\u0159i vytv\u00e1\u0159en\u00ed pravidel NAT vid\u00edme n\u011bkolik podobn\u00fdch z\u00e1lo\u017eek, jako pro firewall. Na z\u00e1lo\u017ece \u201eObecn\u00e9\u201c se objevilo pole \u201eTyp\u201c, kter\u00e9 umo\u017e\u0148uje vybrat, za co bude toto pravidlo odpov\u011bdn\u00e9:<\/p>\n<ul>\n<li>\n<p>NAT &#8212; P\u0159evod s\u00ed\u0165ov\u00fdch adres.<\/p>\n<\/li>\n<li>\n<p>DNAT &#8212; P\u0159esm\u011brov\u00e1v\u00e1 provoz na ur\u010denou IP adresu.<\/p>\n<\/li>\n<li>\n<p>Port forwarding &#8212; P\u0159esm\u011brov\u00e1v\u00e1 provoz na ur\u010denou IP adresu, ale umo\u017e\u0148uje m\u011bnit \u010d\u00edslo portu publikovan\u00e9 slu\u017eby.<\/p>\n<\/li>\n<li>\n<p>Sm\u011brnicov\u00e9 sm\u011brov\u00e1n\u00ed &#8212; Umo\u017e\u0148uje sm\u011brovat IP pakety na z\u00e1klad\u011b roz\u0161\u00ed\u0159en\u00fdch informac\u00ed, jako jsou slu\u017eby, MAC adresy nebo servery (IP adresy).<\/p>\n<\/li>\n<li>\n<p>Mapov\u00e1n\u00ed s\u00edt\u011b &#8212; Umo\u017e\u0148uje nahradit zdrojov\u00e9 nebo c\u00edlov\u00e9 IP adresy jedn\u00e9 s\u00edt\u011b jinou s\u00edt\u00ed.<\/p>\n<\/li>\n<\/ul>\n<p>Po v\u00fdb\u011bru p\u0159\u00edslu\u0161n\u00e9ho typu budou dostupn\u00e1 nastaven\u00ed k n\u011bmu.<\/p>\n<p>V poli SNAT IP (extern\u00ed adresa) jasn\u011b uv\u00e1d\u00edme IP adresu, na kterou bude nahrazeno adresa zdroje. Toto pole je pot\u0159eba, kdy\u017e jsou p\u0159i\u0159azeny v\u00edce IP adres k rozhran\u00edm c\u00edlov\u00e9 z\u00f3ny. Pokud toto pole nech\u00e1me pr\u00e1zdn\u00e9, syst\u00e9m pou\u017eije n\u00e1hodnou adresu z dostupn\u00e9ho seznamu IP adres p\u0159i\u0159azen\u00fdch k rozhran\u00edm c\u00edlov\u00e9 z\u00f3ny. UserGate doporu\u010duje uv\u00e9st SNAT IP pro zv\u00fd\u0161en\u00ed v\u00fdkonu pr\u00e1ce firewallu.<\/p>\n<p>Pro p\u0159\u00edklad zve\u0159ejn\u00edm SSH slu\u017ebu serveru Windows, nach\u00e1zej\u00edc\u00edho se v z\u00f3n\u011b \"DMZ\", pomoc\u00ed pravidla \"port forwarding\". Pro to klikneme na tla\u010d\u00edtko \"P\u0159idat\" a vypln\u00edme z\u00e1lo\u017eku \"Obecn\u00e9\", uvedeme n\u00e1zev pravidla \"SSH to Windows\" a typ \"Port forwarding\":<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate \u00davod. Politiky s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/10\/b08987af4e8e8c30a48a82811d060e5a.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Na z\u00e1lo\u017ece \u201cZdroj\u201d vybereme z\u00f3nu \u201cUntrusted\u201d a p\u0159ejdeme na z\u00e1lo\u017eku \u201cPort forwarding\u201d. Zde mus\u00edme uv\u00e9st protokol \u201cTCP\u201d (k dispozici jsou \u010dty\u0159i varianty &#8212; TCP, UDP, SMTP, SMTPS). Origin\u00e1ln\u00ed port ur\u010den\u00ed 9922 &#8212; \u010d\u00edslo portu, na kter\u00fd u\u017eivatel\u00e9 odes\u00edlaj\u00ed po\u017eadavky (nelze pou\u017e\u00edvat porty: 2200, 8001, 4369, 9000-9100). Nov\u00fd port ur\u010den\u00ed (22) &#8212; \u010d\u00edslo portu, na kter\u00fd budou p\u0159esm\u011brov\u00e1ny po\u017eadavky u\u017eivatel\u016f na vnit\u0159n\u00ed publikovan\u00fd server.<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate \u00davod. Politiky s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/10\/d65a52e88c6f03f0540aa1ddb58fadcd.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Na z\u00e1lo\u017ece \"DNAT\" zad\u00e1me ip adresu po\u010d\u00edta\u010de v lok\u00e1ln\u00ed s\u00edti, kter\u00fd je publikov\u00e1n na internetu (192.168.3.2). A voliteln\u011b m\u016f\u017eeme zapnout SNAT, pak UserGate zm\u011bn\u00ed adresu zdroje v paketech z vn\u011bj\u0161\u00ed s\u00edt\u011b na svou IP adresu.<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate \u00davod. Politiky s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/10\/827801091a57c3460d70dba01fde055f.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Po v\u0161ech nastaven\u00edch vznik\u00e1 pravidlo, kter\u00e9 umo\u017e\u0148uje p\u0159\u00edstup ze z\u00f3ny \"Untrusted\" na server s ip adresou 192.168.3.2 protokolem SSH, p\u0159i\u010dem\u017e p\u0159i p\u0159ipojen\u00ed se pou\u017e\u00edv\u00e1 extern\u00ed adresa UserGate.<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate \u00davod. Politiky s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/10\/6eea26e4fcb8c427d0ac0231f63cdfc3.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<h3>\u0160\u00ed\u0159ka p\u00e1sma<\/h3>\n<p>V t\u00e9to \u010d\u00e1sti se stanovuj\u00ed pravidla pro spr\u00e1vu \u0161\u00ed\u0159ky p\u00e1sma. Mohou b\u00fdt pou\u017eita pro omezen\u00ed kan\u00e1lu ur\u010dit\u00e9mi u\u017eivateli, hostiteli, slu\u017ebami, aplikacemi.<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate \u00davod. Politiky s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/10\/d6eb55e1eb77c3640bf08e2120ffbf13.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>P\u0159i vytv\u00e1\u0159en\u00ed pravidla na z\u00e1lo\u017ek\u00e1ch definujeme podm\u00ednky pro provoz, na kter\u00fd se vztahuj\u00ed omezen\u00ed. \u0160\u00ed\u0159ku p\u00e1sma lze vybrat z nab\u00edzen\u00fdch mo\u017enost\u00ed nebo zadat vlastn\u00ed. P\u0159i vytv\u00e1\u0159en\u00ed \u0161\u00ed\u0159ky p\u00e1sma lze zadat ozna\u010den\u00ed pro prioritu provozu DSCP. P\u0159\u00edkladem aplikace ozna\u010den\u00ed DSCP m\u016f\u017ee b\u00fdt situace, kdy uveden\u00edm sc\u00e9n\u00e1\u0159e do pravidla dojde k automatick\u00e9 zm\u011bn\u011b t\u011bchto ozna\u010den\u00ed. Dal\u0161\u00edm p\u0159\u00edkladem fungov\u00e1n\u00ed sc\u00e9n\u00e1\u0159e m\u016f\u017ee b\u00fdt pravidlo, kter\u00e9 se uplatn\u00ed u u\u017eivatele pouze v p\u0159\u00edpad\u011b, \u017ee je detekov\u00e1n torrent nebo objem provozu p\u0159ekro\u010d\u00ed stanoven\u00fd limit. Ostatn\u00ed z\u00e1lo\u017eky vypl\u0148ujeme stejn\u011b jako v jin\u00fdch politik\u00e1ch, podle typu provozu, na kter\u00fd by se m\u011blo pravidlo vztahovat.<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate \u00davod. Politiky s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/10\/99c8edd1bd8c6059acf21e548a7467c4.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<h3>Z\u00e1v\u011br<\/h3>\n<p>V tomto \u010dl\u00e1nku jsem se zab\u00fdval vytv\u00e1\u0159en\u00edm pravidel v sekc\u00edch \u201eFirewall\u201c, \u201eNAT a sm\u011brov\u00e1n\u00ed\u201c a \u201e\u0160\u00ed\u0159ka p\u00e1sma\u201c. Na za\u010d\u00e1tku \u010dl\u00e1nku jsem popsal pravidla pro vytv\u00e1\u0159en\u00ed politik UserGate a tak\u00e9 princip fungov\u00e1n\u00ed podm\u00ednek p\u0159i vytv\u00e1\u0159en\u00ed pravidla.&nbsp;<\/p>\n<p>Sledujte aktualizace na na\u0161ich kan\u00e1lech (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>,&nbsp;<noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/tssolution2020\/\">Facebook<\/a><\/noindex>,&nbsp;<noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>,&nbsp;<noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">TS Solution Blog<\/a><\/noindex>)!<\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/524188\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0446\u0438\u043a\u043b\u0430 \u0441\u0442\u0430\u0442\u0435\u0439 UserGate Getting Started, \u0433\u0434\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e NGFW \u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438&nbsp;UserGate. \u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0431\u044b\u043b \u043e\u043f\u0438\u0441\u0430\u043d \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0430 \u0435\u0433\u043e \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430. \u0421\u0435\u0439\u0447\u0430\u0441 \u0436\u0435 \u043c\u044b \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0430\u0445, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u201c\u041c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u044d\u043a\u0440\u0430\u043d\u201d, \u201cNAT \u0438 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u044f\u201d \u0438 \u201c\u041f\u0440\u043e\u043f\u0443\u0441\u043a\u043d\u0430\u044f \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c\u201d. \u0418\u0434\u0435\u043e\u043b\u043e\u0433\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u0440\u0430\u0432\u0438\u043b [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":97714,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-97713","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/3-usergate-getting-started-politiki-seti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd473. UserGate Getting Started. \u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0441\u0435\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/3-usergate-getting-started-politiki-seti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-21T00:42:44+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-21T00:42:44+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd473. UserGate \u00davod. Politiky s\u00edt\u011b | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/3-usergate-getting-started-politiki-seti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd473. UserGate Getting Started. \u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0441\u0435\u0442\u0438 | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/3-usergate-getting-started-politiki-seti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-21T00:42:44+00:00","article:modified_time":"2020-10-21T00:42:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"97713","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:14:40","updated":"2022-10-01 16:58:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/97713","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=97713"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/97713\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/97714"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=97713"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=97713"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=97713"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}