{"id":31057,"date":"2019-10-31T21:39:12","date_gmt":"2019-10-31T18:39:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya\/"},"modified":"2019-10-31T21:39:12","modified_gmt":"2019-10-31T18:39:12","slug":"kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","title":{"rendered":"Si ta merrni infrastruktur\u00ebn rrjetore n\u00ebn kontrollin tuaj. Kapteri i tret\u00eb. Siguria e rrjetit. Pjesa e dyt\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Ky kjo artikull \u00ebsht\u00eb e kat\u00ebrta n\u00eb serin\u00eb e artikujve \"Si ta marrim n\u00ebn kontroll infrastruktur\u00ebn rrjetore\". P\u00ebrmbajtja e t\u00eb gjith\u00eb artikujve t\u00eb seris\u00eb dhe lidhjet mund t\u00eb gjenden <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447008\/\">k\u00ebtu<\/a><\/noindex><\/i>.<\/p>\n<p>N\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">pjes\u00ebs s\u00eb par\u00eb<\/a><\/noindex> n\u00eb k\u00ebt\u00eb kapitull, ne shqyrtuam disa aspekte t\u00eb siguris\u00eb rrjetore t\u00eb segmentit \"Data Center\". Kjo pjes\u00eb do t\u00eb p\u00ebrqendrohet n\u00eb segmentin \"Internet Access\". <\/p>\n<p><img decoding=\"async\" alt=\"Si ta merrni infrastruktur\u00ebn rrjetore n\u00ebn kontrollin tuaj. Kapteri i tret\u00eb. Siguria e rrjetit. Pjesa e dyt\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/10b33f9b02e3a7562d9e7cf023cbc197.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h1>Qasja n\u00eb Internet<\/h1>\n<p>\nTema e siguris\u00eb padyshim \u00ebsht\u00eb nj\u00eb nga temat m\u00eb t\u00eb komplikuara t\u00eb bot\u00ebs s\u00eb rrjeteve t\u00eb transmetimit t\u00eb t\u00eb dh\u00ebnave. Si n\u00eb rastet e m\u00ebparshme, pa pretenduar p\u00ebr thell\u00ebsi dhe plot\u00ebsi, do t\u00eb shqyrtoj k\u00ebtu disa pyetje mjaft t\u00eb thjeshta, por q\u00eb n\u00eb mendimin tim jan\u00eb t\u00eb r\u00ebnd\u00ebsishme, p\u00ebrgjigjet e t\u00eb cilave shpresoj t\u00eb ndihmojn\u00eb n\u00eb p\u00ebrmir\u00ebsimin e nivelit t\u00eb mbrojtjes s\u00eb rrjetit tuaj.<\/p>\n<p>Kur auditoj k\u00ebt\u00eb segment, vini re aspektet e m\u00ebposhtme:<\/p>\n<ul>\n<li>dizajn<\/li>\n<li>konfigurimet BGP <\/li>\n<li>mbrojtja DOS\/DDOS<\/li>\n<li>filtrimi i trafikut n\u00eb firewall<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Dizajni<\/h3>\n<p>\nSi nj\u00eb shembull t\u00eb dizajnit t\u00eb k\u00ebtij segmenti p\u00ebr rrjetin e nj\u00eb nd\u00ebrmarrjeje, do t'ju rekomandoja <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/dam\/en\/us\/solutions\/collateral\/enterprise\/design-zone-security\/safe-architecture-guide-pin-secure-internet-edge.pdf\">nj\u00eb udh\u00ebzues<\/a><\/noindex> nga Cisco brenda <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/solutions\/enterprise\/design-zone-security\/landing_safe.html#~tab-architecture\">modelit SAFE<\/a><\/noindex>.<\/p>\n<p>Sigurisht, ndoshta zgjidhjet e tjera t\u00eb ofruesve do t'ju duken m\u00eb t\u00ebrheq\u00ebse (shihni <noindex><a rel=\"nofollow\" href=\"https:\/\/researchcenter.paloaltonetworks.com\/2018\/10\/palo-alto-networks-seven-time-gartner-magic-quadrant-leader\/\">kadarin e Gartner-it p\u00ebr 2018<\/a><\/noindex>), por, pa ju k\u00ebrkuar t\u00eb ndiqni detajet e k\u00ebtij dizajni, mendoj se \u00ebsht\u00eb e dobishme t\u00eb kuptoni parimet dhe idet\u00eb q\u00eb q\u00ebndrojn\u00eb pas tij.<\/p>\n<blockquote><p><b>V\u00ebrejtje<\/b><\/p>\n<p>N\u00eb SAFE, segmenti \"Remote Access\" \u00ebsht\u00eb nj\u00eb pjes\u00eb e \"Internet Access\". Por n\u00eb k\u00ebt\u00eb seri artikujsh do ta shqyrtojm\u00eb at\u00eb ve\u00e7mas.<\/p><\/blockquote>\n<p>Grupi standard i pajisjeve n\u00eb k\u00ebt\u00eb segment p\u00ebr rrjetin e nd\u00ebrmarrjes \u00ebsht\u00eb <\/p>\n<ul>\n<li>routerat kufitar\u00eb (border routers)<\/li>\n<li>firewall-et<\/li>\n<\/ul>\n<p><\/p>\n<blockquote><p><b>Kujtes\u00eb 1<\/b><\/p>\n<p>N\u00eb k\u00ebt\u00eb seri artikujsh, kur flas p\u00ebr firewall-et, kam parasysh <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Next-generation_firewall\">NGFW<\/a><\/noindex>.<\/p><\/blockquote>\n<blockquote><p><b>Kujtes\u00eb 2<\/b><\/p>\n<p>Po anashkaloj shqyrtimin e llojeve t\u00eb ndryshme t\u00eb zgjidhjeve L2\/L1 ose L2 over L3 t\u00eb nevojshme p\u00ebr t\u00eb siguruar lidhshm\u00ebrin\u00eb L1\/L2 dhe p\u00ebrqendrohem vet\u00ebm n\u00eb \u00e7\u00ebshtjet e nivelit L3 e lart. Pjes\u00ebrisht \u00e7\u00ebshtjet L1\/L2 jan\u00eb trajtuar n\u00eb kapitullin \"<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/434750\/\">Pastrimi dhe dokumentimi<\/a><\/noindex>&#171;.<\/p><\/blockquote>\n<p> N\u00ebse nuk keni gjetur nj\u00eb firewall n\u00eb k\u00ebt\u00eb segment, at\u00ebher\u00eb mos u nxito n\u00eb p\u00ebrfundime.<\/p>\n<p>T\u00eb shohim, si\u00e7 b\u00ebm\u00eb n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">pjes\u00ebn e m\u00ebparshme<\/a><\/noindex>, t\u00eb fillojm\u00eb me pyetjen, a \u00ebsht\u00eb e nevojshme p\u00ebrdorimi i nj\u00eb firewall-i n\u00eb k\u00ebt\u00eb segment n\u00eb rastin tuaj?<\/p>\n<p>Mund t\u00eb them se, duket, ky \u00ebsht\u00eb vendi m\u00eb i arsyesh\u00ebm p\u00ebr p\u00ebrdorimin e firewall-eve dhe p\u00ebr aplikimin e algoritmeve komplekse t\u00eb filtrimit t\u00ebtrafikut. N\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">pjesa 1<\/a><\/noindex> ne p\u00ebrmend\u00ebm 4 faktor\u00eb q\u00eb mund t\u00eb pengojn\u00eb p\u00ebrdorimin e firewall-eve n\u00eb segmentin e qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave. Por k\u00ebtu ata nuk jan\u00eb aq thelb\u00ebsor\u00eb.<\/p>\n<blockquote><p>Shembulli 1. <b>Vonesa<\/b><\/p>\n<p>N\u00eb at\u00eb q\u00eb ka t\u00eb b\u00ebj\u00eb me internetin, s'ka ndonj\u00eb sens p\u00ebr t\u00eb folur p\u00ebr vonesa edhe rreth 1 milisekond\u00eb. Prandaj, vonesa n\u00eb k\u00ebt\u00eb segment nuk mund t\u00eb jet\u00eb nj\u00eb faktor q\u00eb kufizon p\u00ebrdorimin e firewall-it.<\/p><\/blockquote>\n<blockquote><p>Shembulli 2. <b>Performanca<\/b><\/p>\n<p>N\u00eb disa raste, ky faktor ende mund t\u00eb jet\u00eb i r\u00ebnd\u00ebsish\u00ebm. Prandaj, ndoshta nj\u00eb pjes\u00eb e trafikut (p.sh., trafiku i balancuesve t\u00eb ngarkes\u00ebs) do t\u00eb duhet ta kaloni n\u00ebp\u00ebr anashkalimin e firewall-it.<\/p><\/blockquote>\n<blockquote><p>Shembulli 3. <b>Besueshm\u00ebria<\/b><\/p>\n<p>Ky faktor ende duhet marr\u00eb n\u00eb konsiderat\u00eb, por megjithat\u00eb, duke marr\u00eb parasysh pasigurin\u00eb e vet internetit, r\u00ebnd\u00ebsia e tij p\u00ebr k\u00ebt\u00eb segment nuk \u00ebsht\u00eb aq e madhe sa p\u00ebr qendr\u00ebn e t\u00eb dh\u00ebnave. <\/p>\n<p>K\u00ebshtu, supozoni q\u00eb sh\u00ebrbimi juaj ekziston p\u00ebrmes http\/https (me sesione t\u00eb shkurtra). N\u00eb k\u00ebt\u00eb rast, mund t\u00eb p\u00ebrdorni dy kutit\u00eb t\u00eb pavarura (pa HA) dhe n\u00eb rast problemi me nj\u00ebr\u00ebn prej tyre p\u00ebrcillni gjith\u00eb trafikun n\u00eb t\u00eb dyt\u00ebn p\u00ebrmes rrug\u00ebs. <\/p>\n<p>Ose mund t\u00eb p\u00ebrdorni firewall-et n\u00eb modin transparent dhe, kur dalin jasht\u00eb funksionit p\u00ebr nj\u00eb periudh\u00eb p\u00ebr t\u00eb zgjidhur problemin, t\u00eb lejoni trafikun t\u00eb kaloj\u00eb p\u00ebrmes anashkalimit firewall-eve.<\/p><\/blockquote>\n<p> Prandaj, ndoshta vet\u00ebm <b>\u00e7mimi<\/b> mund t\u00eb jet\u00eb ai faktor q\u00eb do t\u2019ju detyroj\u00eb t\u00eb heqni dor\u00eb nga p\u00ebrdorimi i firewall-eve n\u00eb k\u00ebt\u00eb segment.<\/p>\n<blockquote><p><b>E r\u00ebnd\u00ebsishme!<\/b><\/p>\n<p>Shfaqet tundimi p\u00ebr t\u00eb bashkuar k\u00ebt\u00eb firewall me at\u00eb t\u00eb qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave (p\u00ebrdor nj\u00eb firewall p\u00ebr k\u00ebto segmente). Nj\u00eb zgjidhje, n\u00eb parim, e mundshme, por \u00ebsht\u00eb me r\u00ebnd\u00ebsi t\u00eb kuptohet se, pasi firewall-i \"Internet Access\" n\u00eb fakt gj\u00ebndet n\u00eb vij\u00ebn e par\u00eb t\u00eb mbrojtjes suaj dhe \"merr\" mbi vete, t\u00eb pakt\u00ebn, nj\u00eb pjes\u00eb t\u00eb trafikut t\u00eb d\u00ebmsh\u00ebm, sigurisht, duhet t\u00eb merret parasysh rreziku n\u00eb rritje se ky firewall mund t\u00eb dal\u00eb jasht\u00eb sh\u00ebrbimit. DM\u00eb th\u00ebn\u00eb, duke p\u00ebrdorur t\u00eb nj\u00ebjtat pajisje n\u00eb k\u00ebto dy segmente, do t\u00eb ulnim duksh\u00ebm disponueshm\u00ebrin\u00eb e segmentit tuaj t\u00eb qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave.<\/p><\/blockquote>\n<p> Si zakonisht, duhet t\u00eb kuptoni se n\u00eb var\u00ebsi t\u00eb sh\u00ebrbimit q\u00eb kompania ofron, dizajni i k\u00ebtij segmenti mund t\u00eb ndryshoj\u00eb ndjesh\u00ebm. Mundohuni t\u00eb zgjidhni qasje t\u00eb ndryshme n\u00eb var\u00ebsi t\u00eb k\u00ebrkesave. <\/p>\n<blockquote><p><b>Shembuj<\/b><\/p>\n<p>N\u00ebse jeni nj\u00eb ofrues p\u00ebrmbajtjeje, me nj\u00eb rrjet CDN (shihni, p\u00ebr shembull, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/ramax\/posts\/\">serin\u00eb e artikujve<\/a><\/noindex>), at\u00ebher\u00eb ndoshta nuk do t\u00eb d\u00ebshironit t\u00eb krijoni infrastruktura me dhjet\u00ebra, madje qindra pik\u00eb prese p\u00ebrmes p\u00ebrdorimit t\u00eb pajisjeve t\u00eb ve\u00e7anta p\u00ebr ruterimin dhe filtrimin e trafikut. Kjo do t\u00eb ishte e shtrenjt\u00eb dhe ndoshta e tepruar. <\/p>\n<p>P\u00ebr BGP, nuk keni nevoj\u00eb p\u00ebr ruter\u00eb t\u00eb dedikuar, mund t\u00eb p\u00ebrdorni mjete open-source, p\u00ebr shembull, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.quagga.net\">Quagga<\/a><\/noindex>. Prandaj, ndoshta, gjith\u00e7ka q\u00eb ju nevojitet \u00ebsht\u00eb nj\u00eb server ose disa server\u00eb, nj\u00eb switches dhe BGP.<\/p>\n<p>N\u00eb k\u00ebt\u00eb rast, serveri juaj ose disa server\u00eb mund t\u00eb luajn\u00eb rolin e serverit CDN, por gjithashtu edhe t\u00eb ruterit. Sigurisht, ka ende shum\u00eb detaje (p.sh., si t\u00eb sigurohet balancimi), por kjo \u00ebsht\u00eb e realizueshme, dhe ky qasje e kemi zbatuar me sukses p\u00ebr nj\u00eb nga partner\u00ebt tan\u00eb.<\/p>\n<p>Mund t\u00eb keni disa qendra t\u00eb dh\u00ebnash me mbrojtje t\u00eb plot\u00eb (firewalls, sh\u00ebrbime mbrojtjeje nga DDOS, t\u00eb ofruara nga ofruesit tuaj t\u00eb internetit) dhe dhjet\u00ebra ose qindra pika \"t\u00eb thjeshta\" t\u00eb pranishme vet\u00ebm me switches L2 dhe server\u00eb.<\/p>\n<p>E si \u00ebsht\u00eb mbrojtja n\u00eb k\u00ebt\u00eb rast?<\/p>\n<p>Le t\u00eb shqyrtojm\u00eb, p\u00ebr shembull, sulmin e njohur s\u00eb fundmi <noindex>DNS Amplification DDOS.<\/noindex>. Rreziku i tij \u00ebsht\u00eb se gjenerohet nj\u00eb sasi e madhe trafiku, e cila thjesht \"mbush\" 100% t\u00eb t\u00eb gjitha uplink-\u00ebve tuaj. <\/p>\n<p>\u00c7far\u00eb kemi n\u00eb rastin e dizajnit ton\u00eb.<\/p>\n<ul>\n<li>n\u00ebse p\u00ebrdorni AnyCast, at\u00ebher\u00eb trafiku shp\u00ebrndahet midis pikave t\u00eb pranishme. N\u00ebse gjer\u00ebsi e p\u00ebrgjithshme e band\u00ebs \u00ebsht\u00eb terabita, at\u00ebher\u00eb kjo vet\u00eb (pavar\u00ebsisht, n\u00eb fakt, s\u00eb fundmi ka pasur disa sulme me trafik t\u00eb d\u00ebmsh\u00ebm t\u00eb rrethit t\u00eb terabit) ju mbron nga \"mbingarkesa\" e uplink-\u00ebve.<\/li>\n<li>n\u00ebse ndonj\u00eb uplink \u00ebsht\u00eb \"bllokuar\", thjesht e largoni k\u00ebt\u00eb site nga sh\u00ebrbimi (ndaloni njoftimin e prefix-it).<\/li>\n<li>Po ashtu, mund t\u00eb rritni ndarjen e trafikut q\u00eb del nga qendrat tuaja \"t\u00eb plota\" (dhe p\u00ebr rrjedhoj\u00eb, t\u00eb mbrojtura), k\u00ebshtu q\u00eb largoni nj\u00eb sasi t\u00eb konsiderueshme t\u00eb trafikut t\u00eb d\u00ebmsh\u00ebm nga pikat e pranishme t\u00eb pambrojtura.<\/li>\n<\/ul>\n<p>\nDhe nj\u00eb v\u00ebrejtje t\u00eb vog\u00ebl p\u00ebr k\u00ebt\u00eb shembull. N\u00ebse nj\u00eb sasi e mjaftueshme e trafikut d\u00ebrgohet p\u00ebrmes IX-eve, kjo gjithashtu zvog\u00eblon ndjeshm\u00ebrin\u00eb tuaj ndaj sulmeve t\u00eb tilla.<\/p><\/blockquote>\n<h3>Konfigurimi BGP<\/h3>\n<p>\nK\u00ebtu ka dy tema.<\/p>\n<ul>\n<li>Lidhshm\u00ebri<\/li>\n<li>Konfigurimi BGP<\/li>\n<\/ul>\n<p>\nKemi folur pak p\u00ebr lidhshm\u00ebrin\u00eb n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">pjesa 1<\/a><\/noindex>. Q\u00ebllimi \u00ebsht\u00eb q\u00eb trafiku p\u00ebr klient\u00ebt tuaj t\u00eb kaloj\u00eb n\u00eb rrug\u00ebn optimale. Megjithat\u00eb, optimaliteti nuk \u00ebsht\u00eb gjithmon\u00eb vet\u00ebm p\u00ebr vones\u00ebn, por zakonisht vonesa e ul\u00ebt \u00ebsht\u00eb treguesi kryesor i optimalitetit. P\u00ebr disa kompani, kjo \u00ebsht\u00eb m\u00eb e r\u00ebnd\u00ebsishme, p\u00ebr t\u00eb tjerat - m\u00eb pak. Varet nga sh\u00ebrbimi q\u00eb ofroni.<\/p>\n<blockquote><p><b>Shembulli 1<\/b><\/p>\n<p>N\u00ebse jeni nj\u00eb burs\u00eb dhe p\u00ebr klient\u00ebt tuaj jan\u00eb t\u00eb r\u00ebnd\u00ebsishme intervalet e koh\u00ebs m\u00eb pak se milisekondat, at\u00ebher\u00eb, \u00ebsht\u00eb e qart\u00eb, nuk ka asnj\u00eb bised\u00eb p\u00ebr internetin.<\/p><\/blockquote>\n<blockquote><p><b>Shembulli 2<\/b><\/p>\n<p>N\u00ebse jeni nj\u00eb kompani lojrash dhe p\u00ebr ju jan\u00eb t\u00eb r\u00ebnd\u00ebsishme dhjet\u00ebra milisekonda, at\u00ebher\u00eb, sigurisht, lidhshm\u00ebria \u00ebsht\u00eb shum\u00eb e r\u00ebnd\u00ebsishme p\u00ebr ju.<\/p><\/blockquote>\n<blockquote><p><b>Shembulli 3<\/b><\/p>\n<p>Po ashtu, duhet t\u00eb kuptoni se, p\u00ebr shkak t\u00eb ve\u00e7orive t\u00eb protokollit TCP, shpejt\u00ebsia e transferimit t\u00eb t\u00eb dh\u00ebnave brenda nj\u00eb seance TCP gjithashtu varet nga RTT (Round Trip Time). Rjetet CDN nd\u00ebrtohen gjithashtu p\u00ebr t\u00eb zgjidhur k\u00ebt\u00eb problem, duke sjell\u00eb server\u00ebt e shp\u00ebrndarjes s\u00eb p\u00ebrmbajtjes m\u00eb af\u00ebr konsumatorit t\u00eb k\u00ebsaj p\u00ebrmbajtjeje.<\/p><\/blockquote>\n<p> Studimi i lidhshm\u00ebris\u00eb \u00ebsht\u00eb nj\u00eb tem\u00eb e ve\u00e7ant\u00eb interesante, e meriton nj\u00eb artikull t\u00eb ve\u00e7ant\u00eb ose nj\u00eb seri artikujsh dhe k\u00ebrkon nj\u00eb kuptim t\u00eb mir\u00eb se si \"\u00ebsht\u00eb nd\u00ebrtuar\" interneti.<\/p>\n<p>Burime t\u00eb dobishme:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/ripe.net\">ripe.net<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/bgp.he.net\">bgp.he.net<\/a><\/noindex><\/p>\n<blockquote><p><b>Shembuj<\/b><\/p>\n<p>Do t\u00eb jap vet\u00ebm nj\u00eb shembull t\u00eb vog\u00ebl.<\/p>\n<p>Supozoni se qendra juaj e t\u00eb dh\u00ebnave \u00ebsht\u00eb n\u00eb Mosk\u00eb, dhe keni nj\u00eb uplink t\u00eb vet\u00ebm - Rostelecom (AS12389). N\u00eb k\u00ebt\u00eb rast (single homed) BGP nuk ju nevojitet, dhe si adresat publike, ka shum\u00eb t\u00eb ngjar\u00eb t\u00eb p\u00ebrdorni grupe adresash nga Rostelecom. <\/p>\n<p>Supozoni se ofroni nj\u00eb sh\u00ebrbim t\u00eb caktuar, dhe keni nj\u00eb num\u00ebr t\u00eb mjaftuesh\u00ebm klient\u00ebsh nga Ukraina, dhe ata ankohen p\u00ebr vonesa t\u00eb m\u00ebdha. N\u00eb hetimin keni zbuluar se adresat IP t\u00eb disa prej tyre ndodhen n\u00eb rrjetin 37.52.0.0\/21. <\/p>\n<p>Duke kryer traceroute, keni par\u00eb se trafiku kalon p\u00ebrmes AS1299 (Telia), dhe duke kryer ping, keni marr\u00eb nj\u00eb RTT mesatar 70 - 80 milisekonda. K\u00ebt\u00eb mund ta shihni gjithashtu n\u00eb <noindex><a rel=\"nofollow\" href=\"http:\/\/lg.ip.rt.ru\">dritaren e shikimit t\u00eb Rostelecom.<\/a><\/noindex>.<\/p>\n<p>Me mjetin whois (n\u00eb faqen ripe.net ose mjetin lokal) leht\u00ebsisht mund t\u00eb p\u00ebrcaktoni se blloku 37.52.0.0\/21 i p\u00ebrket AS6849 (Ukrtelecom).<\/p>\n<p>M\u00eb pas, duke hyr\u00eb n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/bgp.he.net\">bgp.he.net<\/a><\/noindex> shihni se AS6849 nuk ka marr\u00ebdh\u00ebnie me AS12389 (ata nuk jan\u00eb as klient\u00eb, as uplink p\u00ebr nj\u00ebri-tjetrin, as nuk kan\u00eb peering). Por n\u00ebse shikoni n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/bgp.he.net\/AS6849#_peers\">list\u00ebn e peering-\u00ebve<\/a><\/noindex> p\u00ebr AS6849, at\u00ebher\u00eb do t\u00eb shihni, p\u00ebr shembull, AS29226 (Mastertel) dhe AS31133 (Megafon). <\/p>\n<p>Duke gjetur dritaren e shikimit t\u00eb k\u00ebtyre ofruesve, mund t\u00eb krahasoni rrug\u00ebn dhe RTT. P\u00ebr shembull, p\u00ebr Mastertel RTT do t\u00eb jet\u00eb rreth 30 milisekonda. <\/p>\n<p>K\u00ebshtu q\u00eb, n\u00ebse diferenca mes 80 dhe 30 milisekondave \u00ebsht\u00eb e r\u00ebnd\u00ebsishme p\u00ebr sh\u00ebrbimin tuaj, at\u00ebher\u00eb ndoshta duhet t\u00eb mendoni p\u00ebr lidhshm\u00ebrin\u00eb, t\u00eb merrni nj\u00eb num\u00ebr AS n\u00eb RIPE, grupin tuaj t\u00eb adresave dhe t\u00eb lidhni uplink t\u00eb tjer\u00eb dhe\/ose t\u00eb krijoni pika t\u00eb pranishme n\u00eb IX.<\/p><\/blockquote>\n<p>\nDuke p\u00ebrdorur BGP, ju jo vet\u00ebm q\u00eb p\u00ebrmir\u00ebsoni lidhshm\u00ebrin\u00eb, por gjithashtu rezervoni lidhjen tuaj me internetin.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.ssi.gouv.fr\/uploads\/2016\/03\/bgp-configuration-best-practices.pdf\">Ky dokument<\/a><\/noindex> p\u00ebrmban rekomandime p\u00ebr konfigurimin e BGP. Edhe pse k\u00ebto rekomandime jan\u00eb formuluar mbi baz\u00ebn e \"praktikave m\u00eb t\u00eb mira\" t\u00eb ofruesve, ato jan\u00eb padyshim t\u00eb dobishme dhe n\u00eb fakt duhet t\u00eb jen\u00eb nj\u00eb pjes\u00eb e hardening-ut q\u00eb kemi diskutuar n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">pjes\u00ebs s\u00eb par\u00eb<\/a><\/noindex>.<\/p>\n<h3>mbrojtja DOS\/DDOS<\/h3>\n<p>\nTani sulmet DOS\/DDOS jan\u00eb b\u00ebr\u00eb nj\u00eb realitet i p\u00ebrditsh\u00ebm p\u00ebr shum\u00eb kompani. N\u00eb t\u00eb v\u00ebrtet\u00eb, n\u00eb nj\u00eb form\u00eb apo n\u00eb nj\u00eb tjet\u00ebr, ju sulmoheni mjaft shpesh. Ajo q\u00eb nuk e v\u00ebreni aktualisht tregon se ende nuk \u00ebsht\u00eb organizuar nj\u00eb sulm i drejtuar ndaj jush, dhe se ato mjete mbrojt\u00ebse q\u00eb ju p\u00ebrdorni, madje duke mos e dyshuar k\u00ebt\u00eb (mbrojtje t\u00eb ndryshme t\u00eb integruara n\u00eb sistemet operative), jan\u00eb t\u00eb mjaftueshme p\u00ebr t\u00eb minimizuar degradimin e sh\u00ebrbimit q\u00eb ofroni p\u00ebr ju dhe klient\u00ebt tuaj.<\/p>\n<p>Ekzistojn\u00eb burime n\u00eb internet q\u00eb, mbi baz\u00ebn e log\u00ebve nga pajisjet, vizatojn\u00eb harta t\u00eb bukura t\u00eb sulmeve n\u00eb koh\u00eb reale.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.csoonline.com\/article\/3217944\/security\/8-top-cyber-attack-maps-and-how-to-use-them.html\">K\u00ebtu<\/a><\/noindex> mund t\u00eb gjeni lidhje p\u00ebr to.<\/p>\n<p>M\u00eb e preferuara ime <noindex><a rel=\"nofollow\" href=\"https:\/\/threatmap.checkpoint.com\/ThreatPortal\/livemap.html\">harta<\/a><\/noindex> nga CheckPoint.<\/p>\n<p>Mbrojtja nga DDOS\/DOS zakonisht \u00ebsht\u00eb e p\u00ebrb\u00ebr\u00eb nga disa nivele. P\u00ebr t\u00eb kuptuar pse, duhet t\u00eb kuptoni se \u00e7far\u00eb lloj sulmesh DOS\/DDOS ekzistojn\u00eb (shihni p\u00ebr shembuj, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.csoonline.com\/article\/3222095\/network-security\/ddos-explained-how-denial-of-service-attacks-are-evolving.html\">k\u00ebtu <\/a><\/noindex> ose <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.thousandeyes.com\/three-types-ddos-attacks\/\">k\u00ebtu<\/a><\/noindex>)<\/p>\n<p>Pra, kemi tre lloje sulmesh:<\/p>\n<ul>\n<li>sulme volumetrike<\/li>\n<li>sulme protokollesh<\/li>\n<li>sulme aplikimesh<\/li>\n<\/ul>\n<p>\nN\u00ebse p\u00ebr dy llojet e fundit t\u00eb sulmeve keni mund\u00ebsi t\u00eb mbroheni vet\u00eb duke p\u00ebrdorur, p\u00ebr shembull, firewall-e, nga sulmet e orientuara n\u00eb \"mbushjen\" e uplink-eve tuaj nuk do t\u00eb mbroheni dot vet\u00eb (sigurisht, n\u00ebse kapaciteti juaj i p\u00ebrgjithsh\u00ebm i kanaleve t\u00eb internetit nuk arrin terabit\u00eb, dhe preferohet, dhjet\u00ebra terabit\u00eb).<\/p>\n<p>Prandaj, linja e par\u00eb e mbrojtjes \u00ebsht\u00eb mbrojtja ndaj sulmeve \"volumetrike\" dhe k\u00ebt\u00eb mbrojtje duhet t'jua ofroj\u00eb ofruesi juaj ose ofruesit. N\u00ebse nuk e keni kuptuar k\u00ebt\u00eb, at\u00ebher\u00eb thjesht keni qen\u00eb me fat deri tani.<\/p>\n<blockquote><p><b>Shembuj<\/b><\/p>\n<p>Supozoni se keni disa uplink-e, por vet\u00ebm nj\u00eb nga ofruesit mund t'ju ofroj\u00eb k\u00ebt\u00eb mbrojtje. Por n\u00ebse e gjith\u00eb trafiku kalon p\u00ebrmes nj\u00eb ofruesi, at\u00ebher\u00eb si do t\u00eb ruhet lidhshm\u00ebria q\u00eb kemi diskutuar shkurtimisht m\u00eb par\u00eb?<\/p>\n<p>N\u00eb koh\u00ebn e sulmit, do t'ju duhet t\u00eb sakrifikoni disi lidhshm\u00ebrin\u00eb. Por<\/p>\n<ul>\n<li>kjo \u00ebsht\u00eb vet\u00ebm p\u00ebrsa koh\u00eb q\u00eb po ndodh sulmi. N\u00eb rast sulmi, mund t\u00eb rregulloni manualisht ose automatikisht BGP-n\u00eb, n\u00eb m\u00ebnyr\u00eb q\u00eb trafiku t\u00eb kaloj\u00eb vet\u00ebm p\u00ebrmes ofruesit q\u00eb ju ofron \"zhurmat\". Pas p\u00ebrfundimit t\u00eb sulmit, mund t\u00eb ktheheni n\u00eb gjendjen e m\u00ebparshme t\u00eb rrug\u00ebzimit.<\/li>\n<li>nuk \u00ebsht\u00eb e nevojshme t\u00eb transferoni t\u00eb gjith\u00eb trafikun. N\u00ebse, p\u00ebr shembull, vini re se p\u00ebrmes disa uplink-eve ose peering-ut nuk po ndodhin sulme (ose trafiku \u00ebsht\u00eb i pap\u00ebrfillsh\u00ebm), mund t\u00eb vazhdoni t\u00eb njoftoni prefikse me atribute konkurruese ndaj k\u00ebtyre fqinjve BGP.<\/li>\n<\/ul>\n<\/blockquote>\n<p>\nMbrojtjen nga \"sulmet e protokollit\" dhe \"sulmet aplikimesh\" mund ta delegoni gjithashtu partner\u00ebve tuaj.<br \/>\nK\u00ebtu \u00ebsht\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/geekflare.com\/ddos-protection-service\/\">k\u00ebtu<\/a><\/noindex> mund t\u00eb lexoni nj\u00eb studim t\u00eb mir\u00eb (<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/company\/hosting-cafe\/blog\/324848\/\">p\u00ebrkthim<\/a><\/noindex>). Megjithat\u00eb, artikulli \u00ebsht\u00eb dy vjet i vjet\u00ebr, por do t'ju jap\u00eb nj\u00eb ide mbi qasjet, si mund t\u00eb mbroheni nga sulmet DDOS.<\/p>\n<p>N\u00eb parim, mund ta shp\u00ebrndani mbrojtjen tuaj gjithashtu n\u00eb atribuimin e mbrojtjes s\u00eb jashtme. Ky zgjidhje ka p\u00ebrfitime, por ka dhe nj\u00eb disavantazh t\u00eb qart\u00eb. Fakti \u00ebsht\u00eb se mund t\u00eb p\u00ebrfshij\u00eb (s\u00ebrish, n\u00eb var\u00ebsi t\u00eb asaj q\u00eb b\u00ebn kompania juaj) mbijetes\u00ebn e biznesit. Dhe besimi ndaj k\u00ebtyre gj\u00ebrave tek organizata t\u00eb jashtme...<\/p>\n<p>Prandaj, le t\u00eb shqyrtojm\u00eb se si t\u00eb organizojm\u00eb linj\u00ebn e dyt\u00eb dhe t\u00eb tret\u00eb t\u00eb mbrojtjes (si nj\u00eb shtes\u00eb ndaj mbrojtjes nga ofruesi).<\/p>\n<p>Prandaj, linja e dyt\u00eb e mbrojtjes \u00ebsht\u00eb filtrimi dhe kufizuesit e trafikut (policers) n\u00eb hyrje n\u00eb rrjetin tuaj. <\/p>\n<blockquote><p><b>Shembulli 1<\/b><\/p>\n<p>Supozoni se jeni \"mbuluar me zhura\" nga DDOS nga nj\u00eb nga ofruesit. Supozoni se ky ofrues p\u00ebrdor Arbor p\u00ebr filtrimin e trafikut dhe filtrat n\u00eb kufirin e rrjetit t\u00eb tij. <\/p>\n<p>Gjer\u00ebsia e band\u00ebs q\u00eb Arbor mund t\u00eb \"procesoj\u00eb\" \u00ebsht\u00eb e kufizuar, dhe sigurisht ofruesi nuk mund ta kaloj\u00eb vazhdimisht trafikun e t\u00eb gjith\u00eb partner\u00ebve t\u00eb tij q\u00eb kan\u00eb porositur k\u00ebt\u00eb sh\u00ebrbim p\u00ebrmes pajisjeve filtrimi. Prandaj, n\u00eb kushte normale, trafiku nuk filtrohet.<\/p>\n<p>Supozoni se po ndodh nj\u00eb sulm SYN flood. Edhe n\u00ebse keni porositur nj\u00eb sh\u00ebrbim, n\u00eb t\u00eb cilin n\u00eb rast sulmi trafiku automatikisht kalon n\u00eb filtrimin, kjo nuk ndodh menj\u00ebher\u00eb. Gjat\u00eb nj\u00eb minute ose m\u00eb shum\u00eb ju mbeteni n\u00ebn sulm. Dhe kjo mund t\u00eb \u00e7oj\u00eb n\u00eb d\u00ebshtimin e pajisjeve tuaja ose degradimin e sh\u00ebrbimit. N\u00eb k\u00ebt\u00eb rast, kufizimi i trafikut n\u00eb rrug\u00ebzimin kufitar, edhe pse do t\u00eb b\u00ebj\u00eb q\u00eb disa seancat TCP gjat\u00eb k\u00ebtij koha t\u00eb mos krijohen, do t\u00eb shp\u00ebtoj\u00eb infrastruktur\u00ebn tuaj nga probleme m\u00eb t\u00eb m\u00ebdha.<\/p><\/blockquote>\n<blockquote><p><b>Shembulli 2<\/b><\/p>\n<p>Nj\u00eb num\u00ebr anormal i madh i paketave SYN nuk mund t\u00eb jet\u00eb vet\u00ebm rezultat i nj\u00eb sulmi SYN flood. Le t\u00eb supozom\u00eb se ofroni nj\u00eb sh\u00ebrbim, ku keni nj\u00ebkoh\u00ebsisht deri n\u00eb 100 mij\u00eb lidhje TCP (n\u00eb nj\u00eb qend\u00ebr t\u00eb dh\u00ebnash).<\/p>\n<p>Supozoni se q\u00eb, si rezultat i nj\u00eb problemi t\u00eb p\u00ebrkohsh\u00ebm me nj\u00eb nga ofruesit tuaj kryesor\u00eb, ju \u00ebsht\u00eb \u201cndaluar\u201d gjysma e seancave. N\u00ebse aplikacioni juaj \u00ebsht\u00eb i nd\u00ebrtuar n\u00eb nj\u00eb m\u00ebnyr\u00eb q\u00eb, \"pa menduar shum\u00eb\", menj\u00ebher\u00eb (ose n\u00eb nj\u00eb interval kohor t\u00eb nj\u00ebjt\u00eb p\u00ebr t\u00eb gjitha seancat) p\u00ebrpiqet t\u00eb ristabilizoj\u00eb lidhjen, at\u00ebher\u00eb do t\u00eb merrni p\u00ebrgjith\u00ebsisht t\u00eb pakt\u00ebn 50 mij\u00eb paketa SYN n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb. <\/p>\n<p>N\u00ebse mbi k\u00ebto seanca, p\u00ebr shembull, duhet t\u00eb funksionoj\u00eb nj\u00eb ssl\/tls handshake, q\u00eb parashikon shk\u00ebmbimin e certifikatave, at\u00ebher\u00eb nga pik\u00ebpamja e shfryt\u00ebzimit t\u00eb burimeve p\u00ebr balancuesin tuaj t\u00eb ngarkes\u00ebs, kjo do t\u00eb ishte nj\u00eb \"DDOS\" shum\u00eb m\u00eb e fort\u00eb se nj\u00eb fluks i zakonsh\u00ebm SYN. Duke u dukur, balancuesit duhet t\u00eb trajtojn\u00eb k\u00ebto ngjarje, por... p\u00ebr fat t\u00eb keq, ne jemi p\u00ebrballur drejtp\u00ebrdrejt me nj\u00eb problem t\u00eb till\u00eb.<\/p>\n<p>Dhe, sigurisht, policeri n\u00eb ruterin kufitar do t\u00eb shp\u00ebtoj\u00eb pajisjet tuaja n\u00eb k\u00ebt\u00eb rast.<\/p><\/blockquote>\n<p>Niveli i tret\u00eb i mbrojtjes nga DDOS\/DOS \u00ebsht\u00eb konfigurimi i firewall-it tuaj.<\/p>\n<p>K\u00ebtu mund t\u00eb ndaloni si sulmet e nivelit t\u00eb dyt\u00eb ashtu edhe ato t\u00eb tret\u00eb. N\u00eb p\u00ebrgjith\u00ebsi, \u00e7do gj\u00eb q\u00eb arrin tek firewall-i mund t\u00eb filtroni k\u00ebtu. <\/p>\n<blockquote><p><b>K\u00ebshill\u00eb<\/b><\/p>\n<p>P\u00ebrpiquni t'i jepni firewall-it sa m\u00eb pak pun\u00eb, duke filtruar sa m\u00eb shum\u00eb n\u00eb dy linjat e para t\u00eb mbrojtjes. Dhe ja pse.<\/p>\n<p>A keni pasur ndonj\u00ebher\u00eb ndodhi t\u00eb till\u00eb, ku rast\u00ebsisht, duke gjeneruar trafik p\u00ebr t\u00eb provuar, p\u00ebr shembull, sa e q\u00ebndrueshme \u00ebsht\u00eb sistemi operativ i server\u00ebve tuaj ndaj sulmeve DDOS, ju \"ndalonit\" firewall-in tuaj, duke e ngarkuar at\u00eb n\u00eb 100 p\u00ebr qind, me nj\u00eb trafik t\u00eb zakonsh\u00ebm? N\u00ebse jo, ndoshta thjesht sepse nuk e keni provuar?<\/p>\n<p>N\u00eb p\u00ebrgjith\u00ebsi, firewall-i, si\u00e7 kam th\u00ebn\u00eb m\u00eb par\u00eb, \u00ebsht\u00eb nj\u00eb thesar kompleks, dhe ai funksionon mir\u00eb me vulnerabilitete t\u00eb njohura dhe zgjidhje t\u00eb provuara, por n\u00ebse d\u00ebrgoni di\u00e7ka t\u00eb pazakont\u00eb, thjesht ndonj\u00eb mbeturin\u00eb ose paketa me tituj t\u00eb pap\u00ebrshtatsh\u00ebm, at\u00ebher\u00eb me ndonj\u00eb probabilitet jo t\u00eb vog\u00ebl (duke u mb\u00ebshtetur n\u00eb p\u00ebrvoj\u00ebn time) mund t\u00eb bllokoni dhe pajisjet m\u00eb t\u00eb avancuara. Prandaj, n\u00eb faz\u00ebn 2, me ndihm\u00ebn e ACL-ve t\u00eb zakonshme (n\u00eb nivelin L3\/L4), lejoni n\u00eb rrjetin tuaj vet\u00ebm at\u00eb trafik q\u00eb duhet t\u00eb hyj\u00eb aty.<\/p><\/blockquote>\n<h3>Filtrimi i trafikut n\u00eb firewall<\/h3>\n<p>\nVazhdojm\u00eb bised\u00ebn p\u00ebr firewall-in. Duhet t\u00eb kuptoni se sulmet DOS\/DDOS jan\u00eb vet\u00ebm nj\u00eb nga llojet e sulmeve kibernetike. <\/p>\n<p>P\u00ebrve\u00e7 mbrojtjes DOS\/DDOS, ne gjithashtu mund t\u00eb kemi di\u00e7ka t\u00eb ngjashme me list\u00ebn e m\u00ebposhtme t\u00eb mund\u00ebsive:<\/p>\n<ul>\n<li>firewall p\u00ebr aplikacione<\/li>\n<li>parandalimi i k\u00ebrc\u00ebnimeve (antivirus, anti-spyware dhe vulnerabilitet)<\/li>\n<li>filtrimi i URL-ve<\/li>\n<li>filtrimi i t\u00eb dh\u00ebnave (filtrimi i p\u00ebrmbajtjes)<\/li>\n<li>bllokimi i skedar\u00ebve (bllokimi i llojeve t\u00eb skedar\u00ebve)<\/li>\n<\/ul>\n<p>\nI takon juve t\u00eb vendosni se cila nga k\u00ebto mund\u00ebsi ju nevojitet.<\/p>\n<p><i>Vazhdon<\/i><br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/436230\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u044d\u0442\u043e\u0439 \u0433\u043b\u0430\u0432\u044b \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u0441\u043f\u0435\u043a\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430 \u00abData Center\u00bb. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 \u00abInternet Access\u00bb \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0443. Internet access \u0422\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u0441\u043e\u043c\u043d\u0435\u043d\u043d\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0442\u0435\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23032,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31057","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u044d\u0442\u043e\u0439 \u0433\u043b\u0430\u0432\u044b \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u0441\u043f\u0435\u043a\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430 \u00abData Center\u00bb. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 \u00abInternet Access\u00bb \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0443. Internet access \u0422\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u0441\u043e\u043c\u043d\u0435\u043d\u043d\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0442\u0435\u043c\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0432\u0442\u043e\u0440\u0430\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u044d\u0442\u043e\u0439 \u0433\u043b\u0430\u0432\u044b \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u0441\u043f\u0435\u043a\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430 \u00abData Center\u00bb. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 \u00abInternet Access\u00bb \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0443. Internet access \u0422\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u0441\u043e\u043c\u043d\u0435\u043d\u043d\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0442\u0435\u043c\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Si t\u00eb merrni n\u00ebn kontroll infrastruktur\u00ebn tuaj rrjetore. Kapitulli i tret\u00eb. Siguria e rrjetit. Pjesa e dyt\u00eb | ProHoster","description":"Ky este artikulli i kat\u00ebrt n\u00eb ciklin e artikujve \"Si t\u00eb merrni n\u00ebn kontroll infrastruktur\u00ebn tuaj rrjetore\". Mund t\u00eb gjeni p\u00ebrmbajtjen e gjith\u00eb ciklit t\u00eb artikujve dhe lidhjet k\u00ebtu. N\u00eb pjes\u00ebn e par\u00eb t\u00eb k\u00ebtij kapitulli, ne shqyrtuam disa aspekte t\u00eb siguris\u00eb rrjetore n\u00eb segmentin \"Data Center\". Kjo pjes\u00eb do t'i kushtohet segmentit \"Internet Access\". \u00c7\u00ebshtja e siguris\u00eb s\u00eb aksesit n\u00eb internet \u00ebsht\u00eb padyshim nj\u00eb nga temat m\u00eb t\u00eb komplikuara.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0432\u0442\u043e\u0440\u0430\u044f | ProHoster","og:description":"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u044d\u0442\u043e\u0439 \u0433\u043b\u0430\u0432\u044b \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u0441\u043f\u0435\u043a\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430 \u00abData Center\u00bb. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 \u00abInternet Access\u00bb \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0443. Internet access \u0422\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u0441\u043e\u043c\u043d\u0435\u043d\u043d\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0442\u0435\u043c","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:39:12+00:00","article:modified_time":"2019-10-31T18:39:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31057","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 04:19:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:24:14","updated":"2026-01-21 04:19:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31057","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=31057"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31057\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/23032"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=31057"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=31057"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=31057"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}