{"id":95964,"date":"2020-10-06T01:42:49","date_gmt":"2020-10-05T23:42:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/2-usergate-getting-started-trebovaniya-ustanovka"},"modified":"2020-10-06T01:42:49","modified_gmt":"2020-10-05T23:42:49","slug":"2-usergate-getting-started-trebovaniya-ustanovka","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/2-usergate-getting-started-trebovaniya-ustanovka","title":{"rendered":"2. UserGate Za\u010diatok. Po\u017eiadavky, in\u0161tal\u00e1cia","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"2. UserGate Za\u010diatok. Po\u017eiadavky, in\u0161tal\u00e1cia\" src=\"\/wp-content\/uploads\/2020\/10\/0dec3bafb496cf5c88562b7d59252a30.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Dobr\u00fd de\u0148, toto je druh\u00fd \u010dl\u00e1nok o NGFW rie\u0161en\u00ed od spolo\u010dnosti&nbsp;<noindex><a rel=\"nofollow\" href=\"http:\/\/tssolution.ru\/katalog\/usergate?utm_source=habr\">UserGate<\/a><\/noindex>. \u00dalohou tohto \u010dl\u00e1nku je uk\u00e1za\u0165, ako nain\u0161talova\u0165 firewall UserGate na virtu\u00e1lny syst\u00e9m (budem pou\u017e\u00edva\u0165 virtualiza\u010dn\u00fd softv\u00e9r VMware Workstation) a vykona\u0165 jeho po\u010diato\u010dn\u00e9 nastavenie (umo\u017eni\u0165 pr\u00edstup z lok\u00e1lnej siete cez br\u00e1nu UserGate na internet).&nbsp;&nbsp;&nbsp;<\/p>\n<h2>1. \u00davod<\/h2>\n<p>Na za\u010diatok op\u00ed\u0161em r\u00f4zne sp\u00f4soby integr\u00e1cie tejto br\u00e1ny do siete. Chcem podotkn\u00fa\u0165, \u017ee v z\u00e1vislosti od zvolen\u00e9ho pripojenia m\u00f4\u017ee by\u0165 ur\u010dit\u00e1 funk\u010dnos\u0165 br\u00e1ny nedostupn\u00e1. Rie\u0161enie UserGate podporuje nasleduj\u00face re\u017eimy pripojenia:&nbsp;<\/p>\n<ul>\n<li>\n<p>L3-L7 firewall<\/p>\n<\/li>\n<li>\n<p>L2 prieh\u013eadn\u00fd most<\/p>\n<\/li>\n<li>\n<p>L3 prieh\u013eadn\u00fd most<\/p>\n<\/li>\n<li>\n<p>Virtu\u00e1lne v preru\u0161en\u00ed, pomocou protokolu WCCP<\/p>\n<\/li>\n<li>\n<p>Virtu\u00e1lne v preru\u0161en\u00ed, pomocou Policy Based Routing<\/p>\n<\/li>\n<li>\n<p>Router on a Stick<\/p>\n<\/li>\n<li>\n<p> Explicitne zadan\u00fd WEB-proxy<\/p>\n<\/li>\n<li>\n<p>UserGate ako predvolen\u00e1 br\u00e1na<\/p>\n<\/li>\n<li>\n<p>Sledovanie Mirror-portu<\/p>\n<\/li>\n<\/ul>\n<p>UserGate podporuje 2 typy klastrov:<\/p>\n<ol>\n<li>\n<p>Klastr konfigur\u00e1cie. Uzly, ktor\u00e9 s\u00fa zdru\u017een\u00e9 do klastra konfigur\u00e1cie, podporuj\u00fa jednotn\u00e9 nastavenia v r\u00e1mci klastra.<\/p>\n<\/li>\n<li>\n<p>Klastr odolnosti vo\u010di poruch\u00e1m. A\u017e 4 uzly klastra konfigur\u00e1cie m\u00f4\u017eu by\u0165 zdru\u017een\u00e9 do klastra odolnosti vo\u010di poruch\u00e1m, ktor\u00fd podporuje prev\u00e1dzku v re\u017eime Akt\u00edvne-Akt\u00edvne alebo Akt\u00edvne-Pas\u00edvne. Je mo\u017en\u00e9 vytvori\u0165 nieko\u013eko klastrov odolnosti vo\u010di poruch\u00e1m.<\/p>\n<\/li>\n<\/ol>\n<h2>2. In\u0161tal\u00e1cia<\/h2>\n<p>Ako bolo uveden\u00e9 v predch\u00e1dzaj\u00facom \u010dl\u00e1nku, UserGate sa dod\u00e1va vo forme softv\u00e9rovo-hardv\u00e9rovej s\u00fapravy alebo sa nasadzuje vo virtu\u00e1lnom prostred\u00ed. Z osobn\u00e9ho \u00fa\u010dtu na webovej str\u00e1nke <noindex><a rel=\"nofollow\" href=\"https:\/\/www.usergate.com\/\">UserGate <\/a><\/noindex>stiahneme obraz vo form\u00e1te OVF (Open Virtualization Format), tento form\u00e1t je vhodn\u00fd pre dod\u00e1vate\u013eov VMWare a Oracle Virtualbox. Pre Microsoft Hyper-v a KVM s\u00fa dod\u00e1van\u00e9 obrazy diskov virtu\u00e1lneho stroja.<\/p>\n<p>Pod\u013ea \u00fadajov na str\u00e1nke UserGate sa na korektn\u00fa funkciu virtu\u00e1lneho stroja odpor\u00fa\u010da pou\u017ei\u0165 minim\u00e1lne 8 Gb opera\u010dnej pam\u00e4te a 2-jadrov\u00fd virtu\u00e1lny procesor. Hyperv\u00edzor mus\u00ed podporova\u0165 prev\u00e1dzku 64-bitov\u00fdch opera\u010dn\u00fdch syst\u00e9mov.<\/p>\n<p>In\u0161tal\u00e1cia sa za\u010d\u00edna importovan\u00edm obrazu do vybran\u00e9ho hyperv\u00edzora (VirtualBox a VMWare). V pr\u00edpade Microsoft Hyper-v a KVM je potrebn\u00e9 vytvori\u0165 virtu\u00e1lny stroj a zada\u0165 stiahnut\u00fd obraz ako disk, po \u010dom je potrebn\u00e9 vypn\u00fa\u0165 integra\u010dn\u00e9 slu\u017eby v nastaveniach vytvoren\u00e9ho virtu\u00e1lneho stroja.<\/p>\n<p>Predvolene, po importe do VMWare sa vytvor\u00ed virtu\u00e1lny stroj s nasleduj\u00facimi nastaveniami:<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010diatok. Po\u017eiadavky, in\u0161tal\u00e1cia\" src=\"\/wp-content\/uploads\/2020\/10\/98764da6ccaed86f86c9924fdfe67516.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Ako bolo uveden\u00e9 vy\u0161\u0161ie, opera\u010dn\u00e1 pam\u00e4\u0165 by mala by\u0165 minim\u00e1lne 8 Gb a navy\u0161e je potrebn\u00e9 prida\u0165 1 Gb na ka\u017ed\u00fdch 100 u\u017e\u00edvate\u013eov. Predvolen\u00e1 ve\u013ekos\u0165 pevn\u00e9ho disku je 100 Gb, av\u0161ak to zvy\u010dajne nesta\u010d\u00ed na ulo\u017eenie v\u0161etk\u00fdch protokolov a nastaven\u00ed. Odpor\u00fa\u010dan\u00e1 ve\u013ekos\u0165 je 300 Gb alebo viac. Preto v nastaveniach virtu\u00e1lneho stroja zmen\u00edme ve\u013ekos\u0165 disku na po\u017eadovan\u00fa. P\u00f4vodne virtu\u00e1lny UserGate UTM je dod\u00e1van\u00fd so \u0161tyrmi rozhran\u00edm, ktor\u00fdm s\u00fa priraden\u00e9 z\u00f3ny:<\/p>\n<p>Management \u2014 prv\u00e9 rozhranie virtu\u00e1lneho stroja, z\u00f3na na pripojenie d\u00f4veryhodn\u00fdch siet\u00ed, z ktor\u00fdch je povolen\u00e9 spravova\u0165 UserGate.<\/p>\n<p>Trusted \u2014 druh\u00e9 rozhranie virtu\u00e1lneho stroja, z\u00f3na na pripojenie d\u00f4veryhodn\u00fdch siet\u00ed, napr\u00edklad LAN siet\u00ed.<\/p>\n<p>Untrusted \u2014 tretie rozhranie virtu\u00e1lneho stroja, z\u00f3na pre rozhrania pripojen\u00e9 k ned\u00f4veryhodn\u00fdm sie\u0165am, napr\u00edklad k internetu.<\/p>\n<p>DMZ \u2014 \u0161tvrt\u00e9 rozhranie virtu\u00e1lneho stroja, z\u00f3na pre rozhrania pripojen\u00e9 k DMZ sieti.<\/p>\n<p>N\u00e1sledne spust\u00edme virtu\u00e1lny stroj, aj ke\u010f v pr\u00edru\u010dke je nap\u00edsan\u00e9, \u017ee by sme mali vybra\u0165 Support Tools a vykona\u0165 Factory reset UTM, ale ako vid\u00edme, je tu len jedna mo\u017enos\u0165 (UTM First Boot). Po\u010das tohto kroku UTM nastav\u00ed sie\u0165ov\u00e9 adapt\u00e9ry a zv\u00fd\u0161i ve\u013ekos\u0165 oddielu na pevnom disku na celkov\u00fa ve\u013ekos\u0165 disku:<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010diatok. Po\u017eiadavky, in\u0161tal\u00e1cia\" src=\"\/wp-content\/uploads\/2020\/10\/f702cb25e9b6fb0da4a8e27ade1b2c01.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Na pripojenie k webov\u00e9mu rozhraniu UserGate je potrebn\u00e9 prihl\u00e1si\u0165 sa cez Management z\u00f3nu, za \u010do zodpoved\u00e1 rozhranie eth0, ktor\u00e9 je nastaven\u00e9 na z\u00edskavanie IP adresy automaticky (DHCP). Ak nie je mo\u017en\u00e9 priradi\u0165 adresu pre Management rozhranie automaticky pomocou DHCP, m\u00f4\u017ee sa explicitne zada\u0165 pomocou CLI (Command Line Interface). Na to treba vst\u00fapi\u0165 do CLI s menom a heslom pou\u017e\u00edvate\u013ea s pr\u00e1vami Full administrator (predvolene Admin s ve\u013ek\u00fdm p\u00edsmenom). Ak zariadenie UserGate nepre\u0161lo po\u010diato\u010dnou inicializ\u00e1ciou, na pr\u00edstup k CLI je potrebn\u00e9 pou\u017ei\u0165 meno u\u017e\u00edvate\u013ea Admin a heslo \u2013 utm. A zada\u0165 pr\u00edkaz typu iface config \u2013name eth0 \u2013ipv4 192.168.1.254\/24 \u2013enable true \u2013mode static. N\u00e1sledne prejdeme do webovej konzoly UserGate na uvedenej adrese, ktorej vzh\u013ead by mal by\u0165 pribli\u017ene tak\u00fdto:<noindex><a rel=\"nofollow\" href=\"https:\/\/usergate_ip_address:8001\/\"> <\/a><\/noindex><u>https:\/\/UserGateIPaddress:8001<\/u>:<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010diatok. Po\u017eiadavky, in\u0161tal\u00e1cia\" src=\"\/wp-content\/uploads\/2020\/10\/398f741bb9e16c33465c10d072ab31c0.png\" style=\"display:block;margin: 0 auto;\" \/><img decoding=\"async\" alt=\"2. UserGate Za\u010diatok. Po\u017eiadavky, in\u0161tal\u00e1cia\" src=\"\/wp-content\/uploads\/2020\/10\/0751e1047997f5afde57044beea10f74.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>V webovom rozhran\u00ed pokra\u010dujeme v in\u0161tal\u00e1cii, mus\u00edme si vybra\u0165 jazyk rozhrania (aktu\u00e1lne ru\u0161tinu alebo angli\u010dtinu), \u010dasov\u00e9 p\u00e1smo, potom si pre\u010d\u00edtame a s\u00fahlas\u00edme s licen\u010dnou zmluvou. Zad\u00e1me pou\u017e\u00edvate\u013esk\u00e9 meno a heslo na prihl\u00e1senie do webov\u00e9ho rozhrania spr\u00e1vy. <\/p>\n<h2>3. Nastavenie<\/h2>\n<p>Po in\u0161tal\u00e1cii takto vyzer\u00e1 okno webov\u00e9ho rozhrania spr\u00e1vy platformy:<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010diatok. Po\u017eiadavky, in\u0161tal\u00e1cia\" src=\"\/wp-content\/uploads\/2020\/10\/16a0d900c66eb23e07a9b5d56915ace8.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Potom je potrebn\u00e9 nastavi\u0165 sie\u0165ov\u00e9 rozhrania. Na to v sekcii \u201eRozhrania\u201c je potrebn\u00e9 ich zapn\u00fa\u0165, nastavi\u0165 spr\u00e1vne IP adresy a priradi\u0165 zodpovedaj\u00face z\u00f3ny.<\/p>\n<p>Sekcia \u201eRozhrania\u201c zobrazuje v\u0161etky fyzick\u00e9 a virtu\u00e1lne rozhrania dostupn\u00e9 v syst\u00e9me, umo\u017e\u0148uje meni\u0165 ich nastavenia a prid\u00e1va\u0165 VLAN rozhrania. Taktie\u017e zobrazuje v\u0161etky rozhrania ka\u017ed\u00e9ho uzla klastru. Nastavenia rozhran\u00ed s\u00fa \u0161pecifick\u00e9 pre ka\u017ed\u00fd uzol, teda nie glob\u00e1lne.<\/p>\n<p>V parametroch rozhrania:<\/p>\n<ul>\n<li>\n<p>Aktivova\u0165 alebo deakt\u00edvova\u0165 rozhranie&nbsp; <\/p>\n<\/li>\n<li>\n<p>Ur\u010di\u0165 typ rozhrania \u2014 Layer 3 alebo Mirror<\/p>\n<\/li>\n<li>\n<p>Priradi\u0165 z\u00f3nu k rozhraniu<\/p>\n<\/li>\n<li>\n<p>Priradi\u0165 profil Netflow na odosielanie \u0161tatistick\u00fdch \u00fadajov do Netflow zbern\u00e9ho zariadenia<\/p>\n<\/li>\n<li>\n<p>Zmeni\u0165 fyzick\u00e9 parametre rozhrania \u2014 MAC adresa a ve\u013ekos\u0165 MTU <\/p>\n<\/li>\n<li>\n<p>Vybra\u0165 typ priradenia IP adresy \u2014 bez adresy, statick\u00e1 IP adresa alebo adresa z\u00edskan\u00e1 cez DHCP <\/p>\n<\/li>\n<li>\n<p>Nastavi\u0165 pr\u00e1cu DHCP rel\u00e9 na vybranom rozhran\u00ed.<\/p>\n<\/li>\n<\/ul>\n<p>Tla\u010didlo \u201ePrida\u0165\u201c umo\u017e\u0148uje prida\u0165 nasleduj\u00face typy logick\u00fdch rozhran\u00ed:<\/p>\n<ul>\n<li>\n<p>VLAN<\/p>\n<\/li>\n<li>\n<p>Bond<\/p>\n<\/li>\n<li>\n<p>Most<\/p>\n<\/li>\n<li>\n<p>PPPoE<\/p>\n<\/li>\n<li>\n<p>VPN<\/p>\n<\/li>\n<li>\n<p>Tunel<\/p>\n<\/p>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010diatok. Po\u017eiadavky, in\u0161tal\u00e1cia\" src=\"\/wp-content\/uploads\/2020\/10\/7f389a91d4d8c584140a1d7b1dbe3a11.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Okrem predt\u00fdm uveden\u00fdch z\u00f3n, s ktor\u00fdmi sa dod\u00e1va obraz Usergate, existuj\u00fa e\u0161te tri typy preddefinovan\u00fdch:<\/p>\n<p>Cluster \u2014 z\u00f3na pre rozhrania pou\u017e\u00edvan\u00e9 pre pr\u00e1cu klastru<\/p>\n<p>VPN for Site-to-Site \u2014 z\u00f3na, do ktorej sa umiest\u0148uj\u00fa v\u0161etci klienti typu Office-Office, pripojen\u00ed k UserGate cez VPN<\/p>\n<p>VPN for remote access \u2014 z\u00f3na, do ktorej sa umiest\u0148uj\u00fa v\u0161etci mobiln\u00ed pou\u017e\u00edvatelia, pripojen\u00ed k UserGate cez VPN<\/p>\n<p>Administr\u00e1tori UserGate m\u00f4\u017eu meni\u0165 nastavenia z\u00f3n vytvoren\u00fdch predvolene a tie\u017e vytv\u00e1ra\u0165 \u010fal\u0161ie z\u00f3ny, av\u0161ak ako je uveden\u00e9 v pr\u00edru\u010dke k verzii 5, je mo\u017en\u00e9 vytvori\u0165 najviac 15 z\u00f3n. Na ich zmenu alebo vytvorenie je potrebn\u00e9 prejs\u0165 do sekcie z\u00f3ny. Pre ka\u017ed\u00fa z\u00f3nu je mo\u017en\u00e9 nastavi\u0165 prah zahodenia paketov, podporuje sa SYN, UDP, ICMP. Taktie\u017e sa nastavuje kontrola pr\u00edstupu k slu\u017eb\u00e1m Usergate a zap\u00edna sa ochrana pred spoofingom.<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010diatok. Po\u017eiadavky, in\u0161tal\u00e1cia\" src=\"\/wp-content\/uploads\/2020\/10\/86a0d5f6898c5e1a4f10d2827b4c855d.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Po nastaven\u00ed rozhran\u00ed je potrebn\u00e9 v sekcii \u201eBr\u00e1ny\u201c nastavi\u0165 predvolen\u00fa trasu. T.j. pre pripojenie UserGate k internetu je potrebn\u00e9 uvies\u0165 IP adresu jedn\u00e9ho alebo viacer\u00fdch br\u00e1n. Ak sa na pripojenie k internetu pou\u017e\u00edva viacero poskytovate\u013eov, je potrebn\u00e9 uvies\u0165 nieko\u013eko br\u00e1n. Nastavenie br\u00e1ny je jedine\u010dn\u00e9 pre ka\u017ed\u00e9ho z uzlov klastera. Ak s\u00fa zadan\u00e9 dve alebo viacer\u00e9 br\u00e1ny, existuj\u00fa dva mo\u017en\u00e9 re\u017eimy fungovania:<\/p>\n<ol>\n<li>\n<p>Vyva\u017eov\u00e1n\u00ed provozu mezi br\u00e1nami.<\/p>\n<\/li>\n<li>\n<p>Hlavn\u00ed br\u00e1na s p\u0159epnut\u00edm na z\u00e1lo\u017en\u00ed.<\/p>\n<\/li>\n<\/ol>\n<p>Stav br\u00e1ny (dostupn\u00e1 \u2013 zelen\u00e1, nedostupn\u00e1 \u2013 \u010derven\u00e1) se ur\u010duje n\u00e1sleduj\u00edc\u00edm zp\u016fsobem:<\/p>\n<ol>\n<li>\n<p>Kontrola s\u00edt\u011b je vypnuta \u2013 br\u00e1na se pova\u017euje za dostupnou, pokud si UserGate m\u016f\u017ee vy\u017e\u00e1dat jej\u00ed MAC adresu pomoc\u00ed ARP dotazu. Kontrola p\u0159\u00edstupu na internet p\u0159es tuto br\u00e1nu se neprov\u00e1d\u00ed. Pokud nelze ur\u010dit MAC adresu br\u00e1ny, br\u00e1na se pova\u017euje za nedostupnou.<\/p>\n<\/li>\n<li>\n<p>Kontrola siete je zapnut\u00e1 \u2014 br\u00e1na sa pova\u017euje za dostupn\u00fa, ak:<\/p>\n<\/li>\n<\/ol>\n<ul>\n<li>\n<p>UserGate m\u016f\u017ee vy\u017e\u00e1dat jej\u00ed MAC adresu pomoc\u00ed ARP dotazu.<\/p>\n<\/li>\n<li>\n<p>Kontrola p\u0159\u00edstupu na internet p\u0159es tuto br\u00e1nu byla \u00fasp\u011b\u0161n\u00e1.<\/p>\n<\/li>\n<\/ul>\n<p>V opa\u010dn\u00e9m p\u0159\u00edpad\u011b se br\u00e1na pova\u017euje za nedostupnou.<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010diatok. Po\u017eiadavky, in\u0161tal\u00e1cia\" src=\"\/wp-content\/uploads\/2020\/10\/f3bbb603ab50d1d665df761fa55efac9.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>V sekcii \u201eDNS\u201c je potrebn\u00e9 prida\u0165 DNS servery, ktor\u00e9 bude pou\u017e\u00edva\u0165 UserGate. Toto nastavenie je uveden\u00e9 v oblasti Syst\u00e9mov\u00e9 DNS servery. Ni\u017e\u0161ie s\u00fa uveden\u00e9 nastavenia na spr\u00e1vu DNS po\u017eiadaviek od pou\u017e\u00edvate\u013eov. UserGate umo\u017e\u0148uje pou\u017e\u00edva\u0165 DNS proxy. Slu\u017eba DNS proxy umo\u017e\u0148uje zachyt\u00e1va\u0165 DNS po\u017eiadavky od pou\u017e\u00edvate\u013eov a meni\u0165 ich pod\u013ea potrieb administr\u00e1tora. Pomocou pravidiel DNS proxy je mo\u017en\u00e9 uvies\u0165 DNS servery, na ktor\u00e9 sa presmerov\u00e1vaj\u00fa po\u017eiadavky na ur\u010dit\u00e9 dom\u00e9ny. Okrem toho, s pomocou DNS proxy je mo\u017en\u00e9 nastavi\u0165 statick\u00e9 z\u00e1znamy typu host (A z\u00e1znam).<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010diatok. Po\u017eiadavky, in\u0161tal\u00e1cia\" src=\"\/wp-content\/uploads\/2020\/10\/f98bb05fd143b873fdd5fee8cd38a6d0.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>V sekcii \u201eNAT a Sm\u011brov\u00e1n\u00ed\u201c je potrebn\u00e9 vytvori\u0165 potrebn\u00e9 pravidl\u00e1 NAT. Pre pr\u00edstup na internet pou\u017e\u00edvate\u013eov siete Trusted je u\u017e vytvoren\u00e9 pravidlo NAT \u2014 \u201eTrusted-&gt;Untrusted\u201c, sta\u010d\u00ed ho len povoli\u0165. Pravidl\u00e1 sa pou\u017e\u00edvaj\u00fa zhora nadol v tom porad\u00ed, v akom s\u00fa uveden\u00e9 v konzole. V\u017edy sa vykon\u00e1 len prv\u00e9 pravidlo, pre ktor\u00e9 sa zhodli podmienky uveden\u00e9 v pravidle. Na spustenie pravidla je potrebn\u00e9, aby sa zhodli v\u0161etky podmienky, uveden\u00e9 v parametroch pravidla. UserGate odpor\u00fa\u010da vytv\u00e1ra\u0165 v\u0161eobecn\u00e9 pravidl\u00e1 NAT, napr\u00edklad pravidlo NAT z lok\u00e1lnej siete (zvy\u010dajne z\u00f3na Trusted) do internetu (zvy\u010dajne z\u00f3na Untrusted), pri\u010dom obmedzenie pr\u00edstupu pomocou pou\u017e\u00edvate\u013eov, slu\u017eieb a aplik\u00e1ci\u00ed sa realizuje pomocou pravidiel firewallu.<\/p>\n<p>Existuje tie\u017e mo\u017enos\u0165 vytvori\u0165 pravidl\u00e1 DNAT, port forwarding, policy-based routing, network mapping.<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010diatok. Po\u017eiadavky, in\u0161tal\u00e1cia\" src=\"\/wp-content\/uploads\/2020\/10\/efa1a3f8e1b004a3f90c05b957b193f6.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Po tomto je potrebn\u00e9 v sekcii &#171;Firewall&#187; vytvori\u0165 pravidl\u00e1 firewallu. Pre neobmedzen\u00fd pr\u00edstup na internet pou\u017e\u00edvate\u013eov siete Trusted je pravidlo firewallu u\u017e vytvoren\u00e9 \u2014 \u201eInternet pre Trusted\u201c a je potrebn\u00e9 ho povoli\u0165. S pomocou pravidiel firewallu m\u00f4\u017ee administr\u00e1tor povoli\u0165 alebo zak\u00e1za\u0165 ak\u00fdko\u013evek typ tranzitn\u00e9ho sie\u0165ov\u00e9ho prev\u00e1dzky prech\u00e1dzaj\u00faceho cez UserGate. Ako podmienky pravidla m\u00f4\u017eu fungova\u0165 z\u00f3ny a IP adresy zdroja\/ciel, pou\u017e\u00edvate\u013eov a skupiny, slu\u017eby a aplik\u00e1cie. Pravidl\u00e1 sa aplikuj\u00fa rovnako ako v sekcii &#171;NAT a Router&#187;, t.j. zhora nadol. Ak nie s\u00fa vytvoren\u00e9 \u017eiadne pravidl\u00e1, potom je ak\u00fdko\u013evek tranzitn\u00fd prev\u00e1dzka cez UserGate zak\u00e1zan\u00e1.<\/p>\n<p><img decoding=\"async\" alt=\"2. UserGate Za\u010diatok. Po\u017eiadavky, in\u0161tal\u00e1cia\" src=\"\/wp-content\/uploads\/2020\/10\/098871017279694492f381069f172483.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<h2>4. Z\u00e1ver<\/h2>\n<p>T\u00fdmto sa \u010dl\u00e1nok skon\u010dil. Nain\u0161talovali sme firewall UserGate na virtu\u00e1lny stroj a vykonali minim\u00e1lne potrebn\u00e9 nastavenia na zabezpe\u010denie funk\u010dnosti internetu v sieti Trusted. \u010eal\u0161ie nastavenie si prejdeme v \u010fal\u0161\u00edch \u010dl\u00e1nkoch.<\/p>\n<p>Sledujte aktualiz\u00e1cie na na\u0161ich kan\u00e1loch (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>,&nbsp;<noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/tssolution2020\/\">Facebook<\/a><\/noindex>,&nbsp;<noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>,&nbsp;<noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">Blog TS Solution<\/a><\/noindex>)!<\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/521322\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0417\u0434\u0440\u0430\u0432\u0441\u0442\u0432\u0443\u0439\u0442\u0435, \u044d\u0442\u043e \u0432\u0442\u043e\u0440\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u043e NGFW \u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438&nbsp;UserGate. \u0417\u0430\u0434\u0430\u0447\u0430 \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c, \u043a\u0430\u043a \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u044d\u043a\u0440\u0430\u043d&nbsp;UserGate&nbsp;\u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 (\u0431\u0443\u0434\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438&nbsp;VMware&nbsp;Workstation) \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0435\u0433\u043e \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0443\u044e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0443 (\u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0438\u0437 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0447\u0435\u0440\u0435\u0437 \u0448\u043b\u044e\u0437&nbsp;UserGate&nbsp;\u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442).&nbsp;&nbsp;&nbsp; 1. \u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0414\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u044f \u043e\u043f\u0438\u0448\u0443 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u0448\u043b\u044e\u0437\u0430 \u0432 \u0441\u0435\u0442\u044c. \u0425\u043e\u0447\u0443 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":95965,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-95964","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/2-usergate-getting-started-trebovaniya-ustanovka\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd472. UserGate Getting Started. \u0422\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/2-usergate-getting-started-trebovaniya-ustanovka\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-05T23:42:49+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-05T23:42:49+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd472. UserGate Za\u010diatok. Po\u017eiadavky, in\u0161tal\u00e1cia | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/2-usergate-getting-started-trebovaniya-ustanovka","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd472. UserGate Getting Started. \u0422\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f, \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 | ProHoster","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/2-usergate-getting-started-trebovaniya-ustanovka","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-05T23:42:49+00:00","article:modified_time":"2020-10-05T23:42:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95964","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:54:37","updated":"2022-09-28 17:15:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/95964","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=95964"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/95964\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/95965"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=95964"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=95964"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=95964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}