{"id":97713,"date":"2020-10-21T02:42:44","date_gmt":"2020-10-21T00:42:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/3-usergate-getting-started-politiki-seti"},"modified":"2020-10-21T02:42:44","modified_gmt":"2020-10-21T00:42:44","slug":"3-usergate-getting-started-politiki-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/3-usergate-getting-started-politiki-seti","title":{"rendered":"3. UserGate Za\u010d\u00edname. Politiky siete","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"3. UserGate Za\u010d\u00edname. Politiky siete\" src=\"\/wp-content\/uploads\/2020\/10\/6135a0c5287f8256222ce4d295f2b2ec.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>V\u00edtam \u010ditate\u013eov v tre\u0165om \u010dl\u00e1nku cyklu \u010dl\u00e1nkov UserGate Za\u010d\u00edname, kde sa hovor\u00ed o rie\u0161en\u00ed NGFW od spolo\u010dnosti&nbsp;<noindex><a rel=\"nofollow\" href=\"http:\/\/tssolution.ru\/katalog\/usergate?utm_source=habr\">UserGate<\/a><\/noindex>. V predch\u00e1dzaj\u00facom \u010dl\u00e1nku bol pop\u00edsan\u00fd proces in\u0161tal\u00e1cie firewallu a jeho po\u010diato\u010dn\u00e1 konfigur\u00e1cia. Teraz sa podrobnej\u0161ie pozrieme na vytv\u00e1ranie pravidiel v oblastiach, ako s\u00fa \u201eFirewall\u201c, \u201eNAT a smerovanie\u201c a \u201ePriepustnos\u0165\u201c.<\/p>\n<p>Ideol\u00f3gia pr\u00e1ce pravidiel UserGate je tak\u00e1, \u017ee pravidl\u00e1 sa vykon\u00e1vaj\u00fa zhora nadol, k\u00fdm sa nen\u00e1jde prv\u00e9, ktor\u00e9 sa uplatn\u00ed. Na z\u00e1klade vy\u0161\u0161ie uveden\u00e9ho je potrebn\u00e9 si uvedomi\u0165, \u017ee konkr\u00e9tnej\u0161ie pravidl\u00e1 by mali by\u0165 vy\u0161\u0161ie ako v\u0161eobecn\u00e9 pravidl\u00e1. Av\u0161ak je potrebn\u00e9 poznamena\u0165, \u017ee preto\u017ee sa pravidl\u00e1 kontroluj\u00fa postupne, je z poh\u013eadu v\u00fdkonu lep\u0161ie vytv\u00e1ra\u0165 v\u0161eobecn\u00e9 pravidl\u00e1. Podmienky pri vytv\u00e1ran\u00ed ak\u00e9hoko\u013evek pravidla sa uplat\u0148uj\u00fa pod\u013ea logiky \u201eA\u201c. Ak potrebujete pou\u017ei\u0165 logiku \u201eALTERNAT\u00cdVNE\u201c, dosiahne sa to vytvoren\u00edm viacer\u00fdch pravidiel. To, \u010do je op\u00edsan\u00e9 v tomto \u010dl\u00e1nku, je pou\u017eite\u013en\u00e9 aj na in\u00e9 politiky UserGate.<\/p>\n<h3>Firewall<\/h3>\n<p>Po nain\u0161talovan\u00ed UserGate je v sekcii \u201eFirewall\u201c u\u017e nastaven\u00e1 jednoduch\u00e1 politika. Prv\u00e9 dve pravidl\u00e1 zakazuj\u00fa prenos pre botnety. N\u00e1sledne nasleduj\u00fa pr\u00edklady pr\u00edstupov\u00fdch pravidiel z r\u00f4znych z\u00f3n. Posledn\u00e9 pravidlo sa v\u017edy naz\u00fdva \u201eBlokova\u0165 v\u0161etko\u201c a je ozna\u010den\u00e9 symbolom z\u00e1mku (ozna\u010duje, \u017ee pravidlo nemo\u017eno odstr\u00e1ni\u0165, zmeni\u0165, presun\u00fa\u0165 alebo vypn\u00fa\u0165, pre\u0148 m\u00f4\u017eete len zapn\u00fa\u0165 mo\u017enos\u0165 denn\u00edka). Tak\u017ee kv\u00f4li tomuto pravidlu bude cel\u00fd jasne neautorizovan\u00fd prenos zablokovan\u00fd posledn\u00fdm pravidlom. Ak potrebujete povoli\u0165 v\u0161etok prenos cez UserGate (aj ke\u010f sa to d\u00f4razne neodpor\u00fa\u010da), v\u017edy m\u00f4\u017eete vytvori\u0165 predposledn\u00e9 pravidlo \u201ePovoli\u0165 v\u0161etko\u201c.<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate Za\u010d\u00edname. Politiky siete\" src=\"\/wp-content\/uploads\/2020\/10\/6259ea9b51da9481e186b9027ddcbcf8.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Pri \u00faprave alebo vytv\u00e1ran\u00ed pravidla pre firewall prv\u00e1 <em>z\u00e1lo\u017eka \u201eV\u0161eobecn\u00e9\u201c<\/em>, na nej je potrebn\u00e9 vykona\u0165 nasleduj\u00face kroky:&nbsp;<\/p>\n<ul>\n<li>\n<p>Za\u0161krt\u00e1vac\u00edm pol\u00ed\u010dkom \u201eZapn\u00fa\u0165\u201c zapnete alebo vypnete pravidlo.<\/p>\n<\/li>\n<li>\n<p>zada\u0165 n\u00e1zov pravidla.<\/p>\n<\/li>\n<li>\n<p>ur\u010di\u0165 popis pravidla.<\/p>\n<\/li>\n<li>\n<p>vybra\u0165 z dvoch akci\u00ed:<\/p>\n<ul>\n<li>\n<p>Zak\u00e1za\u0165 \u2014 blokuje prenos (pri nastaven\u00ed tejto podmienky m\u00e1te mo\u017enos\u0165 posiela\u0165 ICMP host unreachable, sta\u010d\u00ed len za\u0161krtn\u00fa\u0165 pr\u00edslu\u0161n\u00e9 za\u0161krt\u00e1vacie pol\u00ed\u010dko).<\/p>\n<\/li>\n<li>\n<p>Povoli\u0165 \u2014 povo\u013euje prenos.<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>Polo\u017eka sc\u00e9n\u00e1\u0159e \u2013 umo\u017e\u0148uje vybrat sc\u00e9n\u00e1\u0159, kter\u00fd je dodate\u010dnou podm\u00ednkou pro vyvol\u00e1n\u00ed pravidla. Takto spole\u010dnost UserGate realizuje koncept SOAR (Security Orchestration, Automation and Response).<\/p>\n<\/li>\n<li>\n<p>Z\u00e1znam \u2013 z\u00e1znam informac\u00ed o provozu do protokolu p\u0159i vyvol\u00e1n\u00ed pravidla. Mo\u017en\u00e9 varianty:<\/p>\n<ul>\n<li>\n<p>Zaznamen\u00e1vat za\u010d\u00e1tek relace. V tomto p\u0159\u00edpad\u011b se do z\u00e1znamu provozu zapisuje pouze informace o za\u010d\u00e1tku relace (prvn\u00ed paket). To je doporu\u010den\u00e1 varianta z\u00e1znamu.<\/p>\n<\/li>\n<li>\n<p>Zaznamen\u00e1vat ka\u017ed\u00fd paket. V tomto p\u0159\u00edpad\u011b se zapisuj\u00ed informace o ka\u017ed\u00e9m p\u0159en\u00e1\u0161en\u00e9m s\u00ed\u0165ov\u00e9m paketu. Pro tuto variantu se doporu\u010duje zahrnout limit z\u00e1znamu, aby se p\u0159ede\u0161lo vysok\u00e9mu zat\u00ed\u017een\u00ed za\u0159\u00edzen\u00ed.<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>Pou\u017e\u00edt pravidlo na:<\/p>\n<ul>\n<li>\n<p>V\u0161echny pakety<\/p>\n<\/li>\n<li>\n<p>na fragmentovan\u00e9 pakety<\/p>\n<\/li>\n<li>\n<p>na nefragmentovan\u00e9 pakety<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>P\u0159i vytv\u00e1\u0159en\u00ed nov\u00e9ho pravidla lze vybrat m\u00edsto v politice.<\/p>\n<\/li>\n<\/ul>\n<p>Dal\u0161\u00ed <em>z\u00e1lo\u017eku \u201eZdroj\u201c<\/em>. Zde uv\u00e1d\u00edme zdroj provozu, m\u016f\u017ee to b\u00fdt z\u00f3na, ze kter\u00e9 provoz p\u0159ich\u00e1z\u00ed, nebo m\u016f\u017eeme uv\u00e9st seznam nebo konkr\u00e9tn\u00ed IP adresu (Geoip). Prakticky ve v\u0161ech pravidlech, kter\u00e1 lze nastavit ve za\u0159\u00edzen\u00ed, lze objekt vytvo\u0159it z pravidla, nap\u0159\u00edklad bez p\u0159echodu do sekce \u201eZ\u00f3ny\u201c lze tla\u010d\u00edtkem \u201eVytvo\u0159it a p\u0159idat nov\u00fd objekt\u201c vytvo\u0159it po\u017eadovanou z\u00f3nu. Tak\u00e9 se \u010dasto setk\u00e1v\u00e1me s checkboxem \u201eInvertovat\u201c, kter\u00fd m\u011bn\u00ed v podm\u00ednce pravidla akci na opak, co\u017e odpov\u00edd\u00e1 logick\u00e9 akci negace. <em>Z\u00e1lo\u017eka &#171;\u00da\u010del&#187;<\/em> je podobn\u00e1 z\u00e1lo\u017ece zdroj, jen nam\u00edsto zdroje provozu nastavujeme c\u00edl provozu. <em>Z\u00e1lo\u017eka &#171;Pou\u017e\u00edvatelia&#187;<\/em> \u2013 na tomto m\u00edst\u011b lze p\u0159idat seznam u\u017eivatel\u016f nebo skupin, pro kter\u00e9 se toto pravidlo pou\u017e\u00edv\u00e1. <em>Z\u00e1lo\u017eka &#171;Slu\u017eba&#187;<\/em> \u2013 vyb\u00edr\u00e1me typ slu\u017eby z ji\u017e p\u0159eddefinovan\u00fdch nebo si m\u016f\u017eeme nastavit vlastn\u00ed. <em>Z\u00e1lo\u017eka &#171;Aplik\u00e1cia&#187;<\/em> \u2013 zde se vyb\u00edraj\u00ed konkr\u00e9tn\u00ed aplikace nebo skupiny aplikac\u00ed. A <em>z\u00e1lo\u017eka &#171;\u010cas&#187;<\/em> uv\u00e1d\u00edme \u010das, kdy je toto pravidlo aktivn\u00ed.&nbsp;<\/p>\n<p>Z minul\u00e9ho lekce m\u00e1me pravidlo pro p\u0159\u00edstup na internet ze z\u00f3ny \u201eTrust\u201c, nyn\u00ed v\u00e1m uk\u00e1\u017eu jako p\u0159\u00edklad, jak vytvo\u0159it blokuj\u00edc\u00ed pravidlo pro ICMP provoz ze z\u00f3ny \u201eTrust\u201c do z\u00f3ny \u201eUntrusted\u201c.<\/p>\n<p>Na za\u010diatok vytvor\u00edme pravidlo kliknut\u00edm na tla\u010didlo \u201ePrida\u0165\u201c. V otvorenom okne na karte v\u0161eobecn\u00e9 vypln\u00edme n\u00e1zov (Z\u00e1kaz ICMP z trusted do untrusted), za\u0161krtneme pol\u00ed\u010dko \u201eZapn\u00fa\u0165\u201c, vyberieme akciu zak\u00e1za\u0165 a najd\u00f4le\u017eitej\u0161ie, spr\u00e1vne vyberieme miesto umiestnenia tohto pravidla. Pod\u013ea mojej politiky by toto pravidlo malo by\u0165 umiestnen\u00e9 nad pravidlom \u201ePovoli\u0165 trusted do untrusted\u201c:<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate Za\u010d\u00edname. Politiky siete\" src=\"\/wp-content\/uploads\/2020\/10\/61b267e2e914dd82473bb242c75af173.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Na karte \u201eZdroj\u201c pre moju \u00falohu existuj\u00fa dve mo\u017enosti:<\/p>\n<ul>\n<li>\n<p>Vybrat\u00edm z\u00f3ny \u201eTrusted\u201c<\/p>\n<\/li>\n<li>\n<p>Vybrat\u00edm v\u0161etk\u00fdch z\u00f3n s v\u00fdnimkou \u201eTrusted\u201c a za\u0161krtnut\u00edm pol\u00ed\u010dka \u201eInvertova\u0165\u201c<\/p>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"3. UserGate Za\u010d\u00edname. Politiky siete\" src=\"\/wp-content\/uploads\/2020\/10\/b84ba5bd64a27d904607e23e0529bfa8.png\" style=\"display:block;margin: 0 auto;\" \/><img decoding=\"async\" alt=\"3. UserGate Za\u010d\u00edname. Politiky siete\" src=\"\/wp-content\/uploads\/2020\/10\/d938df2d1b567a9712e6a486e53d1a67.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Karta \u201eUmiestnenie\u201c sa nastavuje podobne ako karta \u201eZdroj\u201e.<\/p>\n<p>\u010ealej prech\u00e1dzame na z\u00e1lo\u017eku \u201cSlu\u017eba\u201d, preto\u017ee v UserGate je prednastaven\u00e1 slu\u017eba pre ICMP prenos, tak stla\u010den\u00edm tla\u010didla &#171;Prida\u0165&#187; vyber\u00e1me zo zoznamu slu\u017ebu s n\u00e1zvom \u201cAny ICMP\u201d:<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate Za\u010d\u00edname. Politiky siete\" src=\"\/wp-content\/uploads\/2020\/10\/c5ab4720c8f4c178f3e1d16d64d1a2ac.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Mo\u017eno to tak zam\u00fd\u0161\u013eali tvorcovia UserGate, ale ja som bol schopn\u00fd vytv\u00e1ra\u0165 nieko\u013eko \u00faplne identick\u00fdch pravidiel. Hoci sa bude vykon\u00e1va\u0165 iba prv\u00e9 pravidlo zo zoznamu, mo\u017enos\u0165 vytvori\u0165 r\u00f4zne funk\u010dn\u00e9 pravidl\u00e1 s rovnak\u00fdm n\u00e1zvom m\u00f4\u017ee sp\u00f4sobi\u0165 zm\u00e4tok pri spolupr\u00e1ci viacer\u00fdch administr\u00e1torov zariadenia.<\/p>\n<h3>NAT a smerovanie<\/h3>\n<p>Pri vytv\u00e1ran\u00ed pravidiel NAT vid\u00edme nieko\u013eko podobn\u00fdch kariet, ako pre firewall. Na karte \u201eV\u0161eobecn\u00e9\u201c sa objavilo pole \u201eTyp\u201c, ktor\u00e9 umo\u017e\u0148uje vybra\u0165, za \u010do bude toto pravidlo zodpovedn\u00e9:<\/p>\n<ul>\n<li>\n<p>NAT &#8212; Prevod sie\u0165ov\u00fdch adries.<\/p>\n<\/li>\n<li>\n<p>DNAT &#8212; Preposiela prenos na ur\u010den\u00fa IP adresu.<\/p>\n<\/li>\n<li>\n<p>Port forwarding &#8212; Preposiela prenos na ur\u010den\u00fa IP adresu, ale umo\u017e\u0148uje zmeni\u0165 \u010d\u00edslo portu zverejnenej slu\u017eby.<\/p>\n<\/li>\n<li>\n<p>Policy-based routing &#8212; Umo\u017e\u0148uje smerova\u0165 IP pakety na z\u00e1klade roz\u0161\u00edren\u00fdch inform\u00e1ci\u00ed, ako s\u00fa slu\u017eby, MAC adresy alebo servery (IP adresy).<\/p>\n<\/li>\n<li>\n<p>Network mapping &#8212; Umo\u017e\u0148uje nahradi\u0165 IP adresy zdroja alebo cie\u013ea jednej siete inou sie\u0165ou.<\/p>\n<\/li>\n<\/ul>\n<p>Po v\u00fdbere pr\u00edslu\u0161n\u00e9ho typu bud\u00fa dostupn\u00e9 jeho nastavenia.<\/p>\n<p>V poli SNAT IP (vonkaj\u0161ia adresa) jasne uv\u00e1dzame IP adresu, na ktor\u00fa bude nahraden\u00e1 adresa zdroja. Toto pole je potrebn\u00e9 pri viacer\u00fdch IP adres\u00e1ch priraden\u00fdch k rozhraniam cie\u013eovej z\u00f3ny. Ak toto pole nech\u00e1te pr\u00e1zdne, syst\u00e9m pou\u017eije n\u00e1hodn\u00fa adresu zo zoznamu dostupn\u00fdch IP adries priraden\u00fdch rozhraniam cie\u013eovej z\u00f3ny. UserGate odpor\u00fa\u010da uvies\u0165 SNAT IP na zv\u00fd\u0161enie v\u00fdkonu prev\u00e1dzky firewallu.<\/p>\n<p>Pre uk\u00e1\u017eku zverejn\u00edm SSH slu\u017ebu servera Windows nach\u00e1dzaj\u00faceho sa v z\u00f3ne \u201eDMZ\u201c pomocou pravidla \u201eport forwarding\u201c. Na to stla\u010dte tla\u010didlo \u201ePrida\u0165\u201c a vypl\u0148te kartu \u201eV\u0161eobecn\u00e9\u201c, uv\u00e1dzajte n\u00e1zov pravidla \u201eSSH to Windows\u201c a typ \u201ePort forwarding\u201c:<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate Za\u010d\u00edname. Politiky siete\" src=\"\/wp-content\/uploads\/2020\/10\/b08987af4e8e8c30a48a82811d060e5a.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Na z\u00e1lo\u017eke \u201cZdroj\u201d vyberieme z\u00f3nu \u201cNeoveren\u00e1\u201d a prech\u00e1dzame na z\u00e1lo\u017eku \u201cPort forwarding\u201d. Tu mus\u00edme uvies\u0165 protokol \u201cTCP\u201d (k dispoz\u00edcii s\u00fa \u0161tyri mo\u017enosti &#8212; TCP, UDP, SMTP, SMTPS). P\u00f4vodn\u00fd cie\u013eov\u00fd port 9922 &#8212; \u010d\u00edslo portu, na ktor\u00fd pou\u017e\u00edvatelia posielaj\u00fa po\u017eiadavky (nie je dovolen\u00e9 pou\u017e\u00edva\u0165 porty: 2200, 8001, 4369, 9000-9100). Nov\u00fd cie\u013eov\u00fd port (22) &#8212; \u010d\u00edslo portu, na ktor\u00fd bud\u00fa preposielan\u00e9 po\u017eiadavky pou\u017e\u00edvate\u013eov na skryt\u00fd zverejnen\u00fd server.<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate Za\u010d\u00edname. Politiky siete\" src=\"\/wp-content\/uploads\/2020\/10\/d65a52e88c6f03f0540aa1ddb58fadcd.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Na karte \u201eDNAT\u201c nastav\u00edme IP adresu po\u010d\u00edta\u010da v lok\u00e1lnej sieti, ktor\u00fd bude publikovan\u00fd na internete (192.168.3.2). A volite\u013ene m\u00f4\u017eeme zapn\u00fa\u0165 SNAT, potom UserGate zmen\u00ed adresu zdroja v paketoch z vonkaj\u0161ej siete na svoju IP adresu.<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate Za\u010d\u00edname. Politiky siete\" src=\"\/wp-content\/uploads\/2020\/10\/827801091a57c3460d70dba01fde055f.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Po v\u0161etk\u00fdch nastaveniach vznikne pravidlo, ktor\u00e9 umo\u017e\u0148uje pr\u00edstup zo z\u00f3ny \u201eNevytrusten\u00e1\u201c k serveru s IP adresou 192.168.3.2 cez protokol SSH, pri\u010dom sa pri pripojen\u00ed pou\u017e\u00edva vonkaj\u0161ia adresa UserGate.<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate Za\u010d\u00edname. Politiky siete\" src=\"\/wp-content\/uploads\/2020\/10\/6eea26e4fcb8c427d0ac0231f63cdfc3.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<h3>Priemern\u00e1 priepustnos\u0165<\/h3>\n<p>V tejto sekcii sa definuj\u00fa pravidl\u00e1 na riadenie priepustnosti. M\u00f4\u017eu sa pou\u017ei\u0165 na obmedzenie kan\u00e1la ur\u010dit\u00fdch pou\u017e\u00edvate\u013eov, hostite\u013eov, slu\u017eieb, aplik\u00e1ci\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate Za\u010d\u00edname. Politiky siete\" src=\"\/wp-content\/uploads\/2020\/10\/d6eb55e1eb77c3640bf08e2120ffbf13.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Pri vytv\u00e1ran\u00ed pravidiel ur\u010dujeme na z\u00e1lo\u017ek\u00e1ch podmienky, t\u00fdkaj\u00face sa prev\u00e1dzky, na ktor\u00fa sa vz\u0165ahuj\u00fa obmedzenia. \u0160\u00edrku p\u00e1sma si m\u00f4\u017eete vybra\u0165 z pon\u00fakan\u00fdch mo\u017enost\u00ed alebo zada\u0165 vlastn\u00fa. Pri vytv\u00e1ran\u00ed \u0161\u00edrky p\u00e1sma m\u00f4\u017eete zada\u0165 zna\u010dku prioriz\u00e1cie prev\u00e1dzky DSCP. Pr\u00edklad, kedy s\u00fa zna\u010dky DSCP aplikovan\u00e9: ak v pravidle uvediete scen\u00e1r, v ktorom sa dan\u00e9 pravidlo uplat\u0148uje, m\u00f4\u017ee toto pravidlo automaticky zmeni\u0165 tieto zna\u010dky. \u010eal\u0161\u00ed pr\u00edklad fungovania scen\u00e1ra: pravidlo sa uplatn\u00ed pre pou\u017e\u00edvate\u013ea len vtedy, ke\u010f je detekovan\u00fd torrent alebo objem prev\u00e1dzky prekro\u010d\u00ed nastaven\u00fd limit. Ostatn\u00e9 z\u00e1lo\u017eky vypl\u0148ujeme rovnako ako v in\u00fdch politik\u00e1ch, na z\u00e1klade typu prev\u00e1dzky, na ktor\u00fd m\u00e1 by\u0165 pravidlo aplikovan\u00e9.<\/p>\n<p><img decoding=\"async\" alt=\"3. UserGate Za\u010d\u00edname. Politiky siete\" src=\"\/wp-content\/uploads\/2020\/10\/99c8edd1bd8c6059acf21e548a7467c4.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<h3>Z\u00e1ver<\/h3>\n<p>V tomto \u010dl\u00e1nku som sa zaoberal vytv\u00e1ran\u00edm pravidiel v sekci\u00e1ch \"Firewall\", \"NAT a smerovanie\" a \"\u0160\u00edrka p\u00e1sma\". Na za\u010diatku \u010dl\u00e1nku som op\u00edsal pravidl\u00e1 pre vytv\u00e1ranie polit\u00edk UserGate a tie\u017e princ\u00edp fungovania podmienok pri vytv\u00e1ran\u00ed pravidla.&nbsp;<\/p>\n<p>Sledujte aktualiz\u00e1cie na na\u0161ich kan\u00e1loch (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>,&nbsp;<noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/tssolution2020\/\">Facebook<\/a><\/noindex>,&nbsp;<noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>,&nbsp;<noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">Blog TS Solution<\/a><\/noindex>)!<\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/524188\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e \u0447\u0438\u0442\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0446\u0438\u043a\u043b\u0430 \u0441\u0442\u0430\u0442\u0435\u0439 UserGate Getting Started, \u0433\u0434\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043e NGFW \u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438&nbsp;UserGate. \u0412 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u0431\u044b\u043b \u043e\u043f\u0438\u0441\u0430\u043d \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0434\u0435\u043d\u0430 \u0435\u0433\u043e \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430. \u0421\u0435\u0439\u0447\u0430\u0441 \u0436\u0435 \u043c\u044b \u0431\u043e\u043b\u0435\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b \u0432 \u0440\u0430\u0437\u0434\u0435\u043b\u0430\u0445, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u201c\u041c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u044d\u043a\u0440\u0430\u043d\u201d, \u201cNAT \u0438 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u044f\u201d \u0438 \u201c\u041f\u0440\u043e\u043f\u0443\u0441\u043a\u043d\u0430\u044f \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c\u201d. \u0418\u0434\u0435\u043e\u043b\u043e\u0433\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u0440\u0430\u0432\u0438\u043b [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":97714,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-97713","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/3-usergate-getting-started-politiki-seti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd473. UserGate Getting Started. \u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0441\u0435\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/3-usergate-getting-started-politiki-seti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-21T00:42:44+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-21T00:42:44+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd473. UserGate Za\u010diatky. Sie\u0165ov\u00e9 politiky | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/3-usergate-getting-started-politiki-seti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd473. UserGate Getting Started. \u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0441\u0435\u0442\u0438 | ProHoster","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/3-usergate-getting-started-politiki-seti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-21T00:42:44+00:00","article:modified_time":"2020-10-21T00:42:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"97713","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:14:40","updated":"2022-10-01 16:58:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/97713","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=97713"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/97713\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/97714"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=97713"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=97713"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=97713"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}