{"id":41051,"date":"2020-02-05T21:28:58","date_gmt":"2020-02-05T18:28:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/consul-iptables-3"},"modified":"2020-02-05T21:28:58","modified_gmt":"2020-02-05T18:28:58","slug":"consul-iptables-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/consul-iptables-3","title":{"rendered":"Consul + iptables = :3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>N\u00eb vitin 2010, kompania <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/wargaming\/\">Wargaming<\/a><\/noindex> kishte 50 server\u00eb dhe nj\u00eb model t\u00eb thjesht\u00eb rrjetor: backend, frontend dhe firewall. Numri i server\u00ebve u rrit, modeli u komplikuar: staging, VLAN t\u00eb izoluara me ACL, pastaj VPN me VRF, VLAN me ACL n\u00eb L2, VRF me ACL n\u00eb L3. \u00cbsht\u00eb e v\u00ebshtir\u00eb p\u00ebr t\u00eb imagjinuar? Do t\u00eb b\u00ebhet m\u00eb arg\u00ebtuese.<\/p>\n<p>Kur server\u00ebt arrit\u00ebn n\u00eb 16,000, ishte e pamundur t\u00eb funksiononim pa lot me nj\u00eb num\u00ebr kaq t\u00eb madh segmentesh t\u00eb llojllojshme. Prandaj, u shpik nj\u00eb zgjidhje tjet\u00ebr. Merret staku Netfilter, shtohet Consul si burim t\u00eb dh\u00ebnash, dhe rezultati \u00ebsht\u00eb nj\u00eb firewall i shpejt\u00eb dhe t\u00eb shp\u00ebrndar\u00eb. Ai z\u00ebvend\u00ebsoi ACL-t\u00eb n\u00eb routerat dhe u p\u00ebrdor si firewall i jasht\u00ebm dhe i brendsh\u00ebm. P\u00ebr menaxhim dinamik, \u00ebsht\u00eb zhvilluar nj\u00eb sistem BEFW, i cili u aplikua kudo: nga menaxhimi i aksesit t\u00eb p\u00ebrdoruesve n\u00eb rrjetin produktiv deri te izolimi i segmenteve t\u00eb rrjetit nj\u00ebri nga tjetri.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/246e74278f413749a676599b5ce986a5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSi funksionon gjith\u00e7ka dhe pse duhet t'i kushtoni v\u00ebmendje k\u00ebtij sistemi, do na tregoj\u00eb <strong>Ivan Agarikov<\/strong> (<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/annmuor\/\" class=\"user_link\">annmuor<\/a><\/noindex>) \u2014 kreu i grupit t\u00eb siguris\u00eb infrastrukturore n\u00eb divizionin e Mantenanc\u00ebs n\u00eb Qendr\u00ebn e Zhvillimit n\u00eb Minsk t\u00eb kompanis\u00eb. Ivan \u00ebsht\u00eb nj\u00eb fan i SELinux, do Perl, shkruan kod. Si kreu i grupit t\u00eb SIG, punon rregullisht me log-et, backup-et dhe R&amp;D, p\u00ebr t\u00eb mbrojtur Wargaming nga hakerat dhe p\u00ebr t\u00eb siguruar funksionimin e t\u00eb gjith\u00eb server\u00ebve t\u00eb lojrave n\u00eb kompani.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n<center><div class=\"youtube-placeholder\" data-id=\"4zP67uYnsR4\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/4zP67uYnsR4\/hqdefault.jpg\" alt=\"Luaj videon\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<h2>Kronologjia historike<\/h2>\n<p>\nPara se t\u00eb tregoj se si e b\u00ebm\u00eb k\u00ebt\u00eb, do t\u00eb flas se si arrit\u00ebm k\u00ebtu dhe pse ishte e nevojshme. P\u00ebr k\u00ebt\u00eb, le t\u00eb kthehemi n\u00eb 9 vjet m\u00eb par\u00eb: viti 2010, kur sapo ishin shfaqur World of Tanks. Kompania Wargaming kishte rreth 50 server\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/64e1c2839363dbdf59ba5f11bb13530e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<em>Grafiku i rritjes s\u00eb server\u00ebve t\u00eb kompanis\u00eb.<\/em><\/p>\n<p>Ne kemi pasur nj\u00eb model rrjeti. N\u00eb at\u00eb koh\u00eb ishte optimal.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/c0509324e2a83882a9792ba75612ceea.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<em>Modeli rrjetor n\u00eb 2010.<\/em><\/p>\n<p>N\u00eb frontend jetojn\u00eb djemt\u00eb e k\u00ebqij q\u00eb duan t\u00eb na thyejn\u00eb, por aty ka nj\u00eb firewall. N\u00eb backend nuk ka firewall, por aty jan\u00eb 50 server\u00eb, ne i njohim t\u00eb gjith\u00eb. \u00c7do gj\u00eb funksionon mir\u00eb.<\/p>\n<p>N\u00eb 4 vjet, parku i server\u00ebve u rrit 100 her\u00eb, deri n\u00eb 5000. U shfaq\u00ebn rrjetet e para t\u00eb izoluara \u2014 staging: ato nuk mund t\u00eb shkojn\u00eb n\u00eb prodhim, dhe aty shpesh kishte gj\u00ebra q\u00eb mund t\u00eb ishin t\u00eb rrezikshme.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/08e1d7670ce1a1346e49d87c67c4be1b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<em>Modeli rrjetor n\u00eb 2014.<\/em><\/p>\n<p>Me inercin\u00eb vazhduam t\u00eb p\u00ebrdorim t\u00eb nj\u00ebjtat pajisje, dhe e gjith\u00eb puna u zhvillua n\u00eb VLAN t\u00eb izoluara: p\u00ebr VLAN shkruhen ACL, t\u00eb cilat lejojn\u00eb ose ndalojn\u00eb nj\u00eb lidhje t\u00eb caktuar.<\/p>\n<p>N\u00eb vitin 2016, numri i server\u00ebve arriti n\u00eb 8000. Wargaming bleu studiot e tjera dhe u shfaq\u00ebn rrjetet e reja partnere. Disa duken tonat, por nuk jan\u00eb plot\u00ebsisht: p\u00ebr partner\u00ebt, VLAN shpesh nuk punon, k\u00ebshtu q\u00eb ne p\u00ebrdorim VPN me VRF, izolimet komplikohet. Nj\u00eb p\u00ebrzierje e izolimeve ACL \u00ebsht\u00eb rritur.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/a6580c9551730447e16d7881eb102275.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<em>Modeli rrjetor n\u00eb 2016.<\/em><\/p>\n<p>N\u00eb fillim t\u00eb vitit 2018, parku i makinerive u rrit n\u00eb 16,000. Kishim 6 segmente, dhe t\u00eb tjer\u00ebt nuk i kemi llogaritur, duke p\u00ebrfshir\u00eb ato t\u00eb mbyllura, ku ruhej informacioni financiar. Rrjetet kontejner (Kubernetes), DevOps, rrjetet e reja n\u00eb re, t\u00eb lidhura p\u00ebrmes VPN, p\u00ebr shembull, nga IVS. Kishte shum\u00eb rregulla - ishte e dhimbshme.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/ec44e6a60da98daa4bbf2bca2e3b2e1a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<em>Modeli rrjetor dhe m\u00ebnyrat e izolimit n\u00eb 2018.<\/em><\/p>\n<p>P\u00ebr izolimin, ne p\u00ebrdor\u00ebm: VLAN me ACL n\u00eb L2, VRF me ACL n\u00eb L3, VPN dhe shum\u00eb m\u00eb tep\u00ebr. Shum\u00eb t\u00eb shumta.<\/p>\n<h2>Problemet<\/h2>\n<p>\nT\u00eb gjith\u00eb jetojn\u00eb me ACL dhe VLAN. \u00c7far\u00eb \u00ebsht\u00eb e gabuar? K\u00ebtij pyetje do t'i p\u00ebrgjigjet Garold, i cili fsheh dhimbjen.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/4df5105af3bce515d80e8e5f3e14c027.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIshte shum\u00eb problematik, por masivisht - pes\u00eb.<\/p>\n<ul>\n<li><strong>Rritja geometrike e \u00e7mimit p\u00ebr rregullat e reja<\/strong>. \u00c7do rregull i ri merrej m\u00eb gjat\u00eb se ai i m\u00ebparshmi, sepse duhej fillimisht t\u00eb shikohej n\u00ebse tashm\u00eb ekziston nj\u00eb rregull i till\u00eb.<\/li>\n<li><strong>Nuk ka firewall brenda segmenteve<\/strong>. Segmentet ishin ndar\u00eb ndaras, brenda nuk kishte burime t\u00eb mjaftueshme.<\/li>\n<li><strong>Rregullat zbatoheshin ngadal\u00eb. <\/strong>Nj\u00eb operator mund t\u00eb shkruaj\u00eb nj\u00eb rregull lokal me dor\u00eb brenda nj\u00eb ore. Nj\u00eb global zgjaste disa dit\u00eb.<\/li>\n<li><strong>V\u00ebshtir\u00ebsi me audienc\u00ebn e rregullave<\/strong>. M\u00eb sakt\u00eb, ai ishte i pamundur. Rregullat e para u shkruan ende n\u00eb vitin 2010, dhe shumica e autor\u00ebve t\u00eb tyre nuk punonin m\u00eb n\u00eb kompani.<\/li>\n<li><strong>Niveli i ul\u00ebt i kontrollit mbi infrastruktur\u00ebn<\/strong>. Kjo \u00ebsht\u00eb problemi kryesor - ne nuk e dinim mir\u00eb se \u00e7far\u00eb po ndodhte realisht.<\/li>\n<\/ul>\n<p>\nK\u00ebshtu dukej inxhinieri rrjetor n\u00eb vitin 2018, kur d\u00ebgjoi: \"Na nevojitet edhe pak ACL\".<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/8366d3092558ebb15a4ba6d8e5702032.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<h2>Zgjidhjet<\/h2>\n<p>\nN\u00eb fillim t\u00eb vitit 2018, u vendos t\u00eb b\u00ebhej di\u00e7ka p\u00ebr k\u00ebt\u00eb.<\/p>\n<p><strong>\u00c7mimi i integrimeve po rritet vazhdimisht. <\/strong>Pika e nisjes ishte se qendrat e m\u00ebdha t\u00eb t\u00eb dh\u00ebnave pushuan s\u00eb mb\u00ebshteturi VLAN dhe ACL t\u00eb izoluara, sepse p\u00ebrfundoi memoria n\u00eb pajisje.<\/p>\n<p>Zgjidhja: heqja e faktor\u00ebve njer\u00ebzor\u00eb dhe sa m\u00eb shum\u00eb automatizimin e ofrimit t\u00eb qasjes.<\/p>\n<p><strong>Rregullat e reja aplikohen ngadal\u00eb. <\/strong>Zgjidhja: p\u00ebrshpejtimi i aplikimit t\u00eb rregullave, duke e b\u00ebr\u00eb at\u00eb t\u00eb shp\u00ebrndar\u00eb dhe paralel. P\u00ebr k\u00ebt\u00eb nevojitet nj\u00eb sistem i shp\u00ebrndar\u00eb, n\u00eb m\u00ebnyr\u00eb q\u00eb rregullat t\u00eb d\u00ebrgoheshin vet\u00eb, pa rsync ose SFTP n\u00eb nj\u00eb mij\u00eb sisteme.<\/p>\n<p><strong>Mungesa e firewall-it brenda segmenteve. <\/strong>Firewall brenda segmenteve filloi t\u00eb na arrij\u00eb kur n\u00eb nj\u00eb rrjet t\u00eb vet\u00ebm shfaqeshin sh\u00ebrbime t\u00eb ndryshme. Zgjidhja: t\u00eb p\u00ebrdorim firewall n\u00eb nivel hosti \u2014 host-based firewalls. Praktikisht kudo kemi Linux, dhe kudo ka iptables, kjo nuk \u00ebsht\u00eb problem.<\/p>\n<p><strong>V\u00ebshtir\u00ebsi me auditet e rregullave.<\/strong> Zgjidhja: t\u00eb ruajm\u00eb t\u00eb gjitha rregullat n\u00eb nj\u00eb vend t\u00eb vet\u00ebm p\u00ebr shqyrtim dhe menaxhim, k\u00ebshtu q\u00eb mund t\u00eb auditojm\u00eb gjith\u00e7ka.<\/p>\n<p><strong>Nivel i ul\u00ebt kontrolli mbi infrastruktur\u00ebn. <\/strong>Zgjidhja: t\u00eb kryejm\u00eb nj\u00eb inventarizim t\u00eb t\u00eb gjitha sh\u00ebrbimeve dhe qasjeve midis tyre.<\/p>\n<p>Ky \u00ebsht\u00eb nj\u00eb proces m\u00eb administrativ sesa teknik. Ndonj\u00ebher\u00eb kemi 200-300 l\u00ebshime t\u00eb reja n\u00eb jav\u00eb, ve\u00e7an\u00ebrisht gjat\u00eb fushatave dhe festave. Kjo \u00ebsht\u00eb vet\u00ebm p\u00ebr nj\u00eb ekip t\u00eb DevOps tan\u00eb. Me k\u00ebt\u00eb num\u00ebr t\u00eb l\u00ebshimeve, \u00ebsht\u00eb e pamundur t\u00eb identifikosh se cilat porte, IP, integrime jan\u00eb t\u00eb nevojshme. Prandaj na duhej menaxher\u00eb sh\u00ebrbimesh t\u00eb trajnuar posa\u00e7\u00ebrisht, t\u00eb cil\u00ebt intervistuan ekipet: '\u00c7far\u00eb ka dhe pse e keni ngritur k\u00ebt\u00eb?'<\/p>\n<p>Pas gjith\u00eb asaj q\u00eb lan\u00e7uam, inxhinieri rrjetit n\u00eb vitin 2019 dukej tashm\u00eb k\u00ebshtu.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/ccca25d7f7bb7f70638725addc6d99ed.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Consul<\/h2>\n<p>\nVendos\u00ebm q\u00eb gjith\u00e7ka q\u00eb gjet\u00ebm me ndihm\u00ebn e menaxher\u00ebve t\u00eb sh\u00ebrbimeve do ta vendosnim n\u00eb Consul dhe nga aty do t\u00eb shkruajm\u00eb rregullat e iptables.<\/p>\n<p>Si e vendos\u00ebm ta b\u00ebjm\u00eb k\u00ebt\u00eb?<\/p>\n<ul>\n<li>T\u00eb mbledhim t\u00eb gjitha sh\u00ebrbimet, rrjetet dhe p\u00ebrdoruesit.<\/li>\n<li>T\u00eb krijojm\u00eb rregulla iptables mbi baz\u00ebn e tyre.<\/li>\n<li>T\u00eb automatizojm\u00eb kontrollin.<\/li>\n<li>\u2026.<\/li>\n<li>PROFIT.<\/li>\n<\/ul>\n<p>\nConsul nuk \u00ebsht\u00eb nj\u00eb API i distancuar, ai mund t\u00eb funksionoj\u00eb n\u00eb \u00e7do nod dhe t\u00eb shkruaj\u00eb n\u00eb iptables. Mbete vet\u00ebm t\u00eb krijosh mjete automatike kontrolli, t\u00eb cilat do t\u00eb pastrojn\u00eb t\u00eb tep\u00ebrtat, dhe nj\u00eb pjes\u00eb e madhe e problemeve do t\u00eb zgjidhen! T\u00eb tjerat do t'i p\u00ebrshtatim gjat\u00eb procesit.<\/p>\n<h3>P\u00ebrse Consul?<\/h3>\n<p>\n<strong>E ka treguar veten mir\u00eb. <\/strong>N\u00eb vitet 2014-15 e kemi p\u00ebrdorur si backend p\u00ebr Vault, ku ruajm\u00eb fjal\u00ebkalimet.<\/p>\n<p><strong>Nuk humbet t\u00eb dh\u00ebna.<\/strong>. Gjat\u00eb p\u00ebrdorimit, Consul nuk ka humbur t\u00eb dh\u00ebna asnj\u00ebher\u00eb gjat\u00eb nj\u00eb aksidenti. Kjo \u00ebsht\u00eb nj\u00eb avantazh i madh p\u00ebr sistemin e menaxhimit t\u00eb firewall-it.<\/p>\n<p><strong>Lidhjet P2P p\u00ebrshpejtojn\u00eb shp\u00ebrndarjen e ndryshimeve.<\/strong>. Me P2P, t\u00eb gjitha ndryshimet mb\u00ebrrijn\u00eb shpejt, nuk nevojitet t\u00eb pres\u00ebsh me or\u00eb.<\/p>\n<p><strong>REST API i p\u00ebrshtatsh\u00ebm.<\/strong> Kemi shqyrtuar gjithashtu Apache ZooKeeper, por ai nuk ka REST API, do t\u00eb duhet t\u00eb p\u00ebrdorim zgjidhje t\u00eb zakonshme.<\/p>\n<p><strong>Funksionon si nj\u00eb magazin\u00eb \u00e7el\u00ebsh (KV), ashtu si nj\u00eb katalog (Service Discovery).<\/strong>. Mund t\u00eb ruajm\u00eb menj\u00ebher\u00eb sh\u00ebrbime, kataloga dhe qendrat e t\u00eb dh\u00ebnave. Kjo \u00ebsht\u00eb e p\u00ebrshtatshme jo vet\u00ebm p\u00ebr ne, por edhe p\u00ebr ekipet fqinje, sepse duke nd\u00ebrtuar nj\u00eb sh\u00ebrbim global, mendojm\u00eb n\u00eb m\u00ebnyr\u00eb t\u00eb zgjeruar.<\/p>\n<p><strong>\u00cbsht\u00eb shkruar n\u00eb Go, q\u00eb b\u00ebn pjes\u00eb n\u00eb stakun e Wargaming. <\/strong>Ne kemi dashuri p\u00ebr k\u00ebt\u00eb gjuh\u00eb, kemi shum\u00eb zhvillues Go.<\/p>\n<p><strong>Nj\u00eb sistem i fuqish\u00ebm ACL. <\/strong>Me ndihm\u00ebn e ACL n\u00eb Consul mund t\u00eb menaxhojm\u00eb se kush dhe \u00e7far\u00eb mund t\u00eb shkruaj. Garantojm\u00eb q\u00eb rregullat e firewall-it nuk do t\u00eb nd\u00ebrthuren me asgj\u00eb dhe nuk do t\u00eb kemi probleme me k\u00ebt\u00eb.<\/p>\n<p>Por Consul ka edhe disavantazhe.<\/p>\n<ul>\n<li><strong>Nuk shkall\u00ebzohet brenda nj\u00eb qendre t\u00eb t\u00eb dh\u00ebnave n\u00ebse nuk keni versionin biznes. <\/strong>Ai shkall\u00ebzohet vet\u00ebm p\u00ebrmes federat\u00ebs.<\/li>\n<li><strong>Shum\u00eb var\u00ebsie nga cil\u00ebsia e rrjetit dhe ngarkesa e server\u00ebve. <\/strong>Consul nuk do t\u00eb funksionoj\u00eb si\u00e7 duhet si server n\u00eb nj\u00eb server t\u00eb ngarkuar n\u00ebse rrjeti ka ndonj\u00eb vones\u00eb, p\u00ebr shembull, shpejt\u00ebsia e paqar\u00eb. Kjo \u00ebsht\u00eb e lidhur me lidhjet P2P dhe modelet e shp\u00ebrndarjes s\u00eb azhurnimeve.<\/li>\n<li><strong>V\u00ebshtir\u00ebsi me monitorimin e disponueshm\u00ebris\u00eb.<\/strong>. N\u00eb statusin e Consul mund t\u00eb thot\u00eb se gjith\u00e7ka \u00ebsht\u00eb n\u00eb rregull, kur ai ka vdekur prej koh\u00ebsh.<\/li>\n<\/ul>\n<p>\nShumic\u00ebn e k\u00ebtyre problemeve i zgjidh\u00ebm gjat\u00eb p\u00ebrdorimit t\u00eb Consul, prandaj e zgjodh\u00ebm. N\u00eb kompani ka plane p\u00ebr nj\u00eb backend alternativ, por kemi m\u00ebsuar t\u00eb luftojm\u00eb me problemet dhe p\u00ebr momentin jetojm\u00eb me Consul.<\/p>\n<h3>Si funksionon Consul<\/h3>\n<p>\nN\u00eb nj\u00eb qend\u00ebr t\u00eb dh\u00ebnash hipotetike do t\u00eb vendosim server\u00eb \u2014 nga tre n\u00eb pes\u00eb. Nj\u00eb ose dy server\u00eb nuk do t\u00eb mjaftonin: ata nuk do t\u00eb ishin n\u00eb gjendje t\u00eb organizonin quorum dhe t\u00eb zgjidhnin se kush \u00ebsht\u00eb i drejt\u00eb dhe kush \u00ebsht\u00eb gabim, kur t\u00eb dh\u00ebnat nuk p\u00ebrputhen. M\u00eb shum\u00eb se pes\u00eb nuk ka kuptim, performanca do t\u00eb bjer\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/96153c4e9075b067b34a63ceba5b80f0.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKlient\u00ebt i lidhin me server\u00ebt n\u00eb rend t\u00eb rast\u00ebsish\u00ebm: po ashtu agjent\u00ebt, vet\u00ebm me flamurin <code>server = false<\/code>.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/0854d1286c18bb5e7c1130c6734154a9.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPas k\u00ebsaj, klient\u00ebt marrin nj\u00eb list\u00eb lidhjesh P2P dhe nd\u00ebrtosin lidhje mes tyre.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/2457cb7707c27cc23f6e13415119b91d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb nivel global ne i lidhim disa qendra t\u00eb t\u00eb dh\u00ebnave. Ato gjithashtu lidhen P2P dhe komunikojn\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/3b4ae922eb8d2a6a9a79425e769505d7.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKur d\u00ebshirojm\u00eb t\u00eb marrim t\u00eb dh\u00ebna nga nj\u00eb tjet\u00ebr qend\u00ebr t\u00eb dh\u00ebnash, k\u00ebrkesa shkon nga serveri n\u00eb server. Ky skem\u00eb quhet <strong>protokolli Serf<\/strong>. Protokolli Serf, ashtu si edhe Consul, \u00ebsht\u00eb nj\u00eb zhvillim i HashiCorp.<\/p>\n<h3>Disa fakte t\u00eb r\u00ebnd\u00ebsishme p\u00ebr Consul<\/h3>\n<p>\nConsul ka dokumentacion q\u00eb p\u00ebrshkruan funksionimin e tij. Un\u00eb do t\u00eb jap vet\u00ebm disa fakte selektive q\u00eb duhet t\u00eb dini.<\/p>\n<p><strong>Serverat e Consul zgjedhin nj\u00eb mjesht\u00ebr nga ata q\u00eb votojn\u00eb<\/strong>. Consul zgjedh nj\u00eb mjesht\u00ebr nga lista e server\u00ebve p\u00ebr secil\u00ebn qend\u00ebr t\u00eb dh\u00ebnash, dhe t\u00eb gjitha k\u00ebrkesat shkojn\u00eb vet\u00ebm tek ai, pavar\u00ebsisht nga numri i server\u00ebve. Ndalimi i mjeshtrit nuk rezulton n\u00eb rip\u00ebrcaktim. N\u00ebse nuk \u00ebsht\u00eb zgjedhur asnj\u00eb mjesht\u00ebr \u2014 k\u00ebrkesat nuk p\u00ebrpunohen nga askush.<\/p>\n<blockquote><p>A donit shkall\u00ebzim horizontal? M\u00eb falni, jo.<\/p><\/blockquote>\n<p> K\u00ebrkesa p\u00ebr n\u00eb nj\u00eb qend\u00ebr t\u00eb t\u00eb dh\u00ebnave tjet\u00ebr shkon nga masteri te masteri, pavar\u00ebsisht se n\u00eb cilin server ka ardhur. Masteri i zgjedhur merr 100% ngarkes\u00ebs, p\u00ebrve\u00e7 ngarkes\u00ebs p\u00ebr p\u00ebrpara t\u00eb k\u00ebrkesave. Nj\u00eb kopje aktuale e t\u00eb dh\u00ebnave \u00ebsht\u00eb n\u00eb t\u00eb gjith\u00eb server\u00ebt e qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave, por vet\u00ebm nj\u00eb nga ata p\u00ebrgjigjet.<\/p>\n<blockquote><p>M\u00ebnyra e vetme p\u00ebr t\u00eb shkall\u00ebzuar \u00ebsht\u00eb t\u00eb aktivizoni modalitetin stale n\u00eb klient.<\/p><\/blockquote>\n<p>N\u00eb modalitetin stale mund t\u00eb p\u00ebrgjigjeni pa nj\u00eb kuorum. Kjo \u00ebsht\u00eb nj\u00eb gjendje n\u00eb t\u00eb cil\u00ebn heqim dor\u00eb nga konsistenca e t\u00eb dh\u00ebnave, por lexojm\u00eb pak m\u00eb shpejt se zakonisht, dhe p\u00ebrgjigjet \u00e7do server. Natyrisht, shkruani vet\u00ebm p\u00ebrmes masterit.<\/p>\n<p><strong>Consul nuk kopjon t\u00eb dh\u00ebna nd\u00ebrmjet qendrave t\u00eb t\u00eb dh\u00ebnave.<\/strong>. Kur ndodh grumbullimi i federat\u00ebs, \u00e7do server do t\u00eb ket\u00eb vet\u00ebm t\u00eb dh\u00ebnat e veta. P\u00ebr t\u00eb tjerat, ai gjithmon\u00eb do t\u00eb drejtohet te dikush tjet\u00ebr.<\/p>\n<p><strong>Atomikshm\u00ebria e operacioneve nuk garanton jasht\u00eb transaksionit.<\/strong>. Kini kujdes, sepse mund t\u00eb ndryshoni di\u00e7ka jo vet\u00ebm ju. N\u00ebse d\u00ebshironi ndryshe, kryeni nj\u00eb transaksion me bllokim.<\/p>\n<p><strong>Operacione bllokuese nuk garanton bllokim.<\/strong>. K\u00ebrkesa shkon nga masteri te masteri, e jo direkt, k\u00ebshtu q\u00eb nuk ka garanci q\u00eb bllokimi do t\u00eb funksionoj\u00eb kur b\u00ebni bllokimin, p\u00ebr shembull, n\u00eb nj\u00eb qend\u00ebr t\u00eb dh\u00ebnash tjet\u00ebr.<\/p>\n<p><strong>ACL gjithashtu nuk garanton akses (n\u00eb shum\u00eb raste).<\/strong>. ACL mund t\u00eb mos funksionoj\u00eb, sepse ruhet n\u00eb nj\u00eb qend\u00ebr t\u00eb t\u00eb dh\u00ebnave t\u00eb federat\u00ebs \u2014 n\u00eb qendr\u00ebn e t\u00eb dh\u00ebnave ACL (Primary DC). N\u00ebse DC nuk ju p\u00ebrgjigjet, ACL nuk do t\u00eb funksionoj\u00eb.<\/p>\n<p><strong>Nj\u00eb master i ngrir\u00eb do t\u00eb shkaktoj\u00eb ngrirjen e gjith\u00eb federat\u00ebs.<\/strong>. P\u00ebr shembull, n\u00eb nj\u00eb federat\u00eb me 10 qendra t\u00eb t\u00eb dh\u00ebnave, dhe n\u00eb nj\u00ebra prej tyre ka nj\u00eb rrjet t\u00eb keq, dhe nj\u00eb master bie. T\u00eb gjith\u00eb ata q\u00eb komunikojn\u00eb me t\u00eb do t\u00eb ngrijn\u00eb n\u00eb m\u00ebnyr\u00eb t\u00eb p\u00ebrhershme: po ndodh nj\u00eb k\u00ebrkes\u00eb, nuk ka p\u00ebrgjigje, dhe thread-i ngec. Nuk do t\u00eb keni mund\u00ebsi t\u00eb dini kur do t\u00eb ndodhi, vet\u00ebm pas nj\u00eb ore ose dy do t\u00eb bjer\u00eb e gjith\u00eb federata. Nuk do t\u00eb b\u00ebni dot asgj\u00eb p\u00ebr k\u00ebt\u00eb.<\/p>\n<p>Statusi, kuorumi dhe zgjedhjet trajtohen nga nj\u00eb rrjedh\u00eb e ve\u00e7ant\u00eb. Rizgjedhje nuk do t\u00eb ndodhin, statusi nuk do t\u00eb tregoj\u00eb asgj\u00eb. Mendoni se keni nj\u00eb Consul aktiv, k\u00ebrkoni, dhe nuk ndodh asgj\u00eb \u2014 nuk ka p\u00ebrgjigje. N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, statusi tregon se gjith\u00e7ka \u00ebsht\u00eb n\u00eb rregull.<\/p>\n<p>Ne kemi hasur n\u00eb k\u00ebt\u00eb problem, na \u00ebsht\u00eb dashur t\u00eb rind\u00ebrtojm\u00eb pjes\u00eb specifike t\u00eb qendrave t\u00eb t\u00eb dh\u00ebnave p\u00ebr ta shmangur at\u00eb.<\/p>\n<p><strong>N\u00eb versionin e biznesit t\u00eb Consul Enterprise nuk ka disa nga mang\u00ebsit\u00eb m\u00eb lart.<\/strong>. Ka shum\u00eb funksione t\u00eb dobishme: zgjedhja e votuesve, shp\u00ebrndarja, shkall\u00ebzimi. Ka vet\u00ebm nj\u00eb \u00abpor\u00bb \u2014 sistemi i licenc\u00ebs p\u00ebr sistemin e shp\u00ebrndar\u00eb \u00ebsht\u00eb shum\u00eb i shtrenjt\u00eb.<\/p>\n<p>Hack i dobish\u00ebm: <code>rm -rf \/var\/lib\/consul<\/code> \u2014 ila\u00e7i p\u00ebr t\u00eb gjitha s\u00ebmundjet e agjentit. N\u00ebse ndonj\u00eb gj\u00eb nuk funksionon, thjesht hiqni t\u00eb dh\u00ebnat tuaja dhe ngarkoni t\u00eb dh\u00ebnat nga nj\u00eb kopje. Me shum\u00eb gjasa, Consul do t\u00eb punoj\u00eb.<\/p>\n<h2>BEFW<\/h2>\n<p>\nTani le t\u00eb flasim p\u00ebr at\u00eb q\u00eb kemi shtuar n\u00eb Consul.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/wgnet\/befw\">BEFW<\/a><\/noindex> \u2014 \u00ebsht\u00eb nj\u00eb akronim p\u00ebr <strong>B<\/strong>ack<strong>E<\/strong>nd<strong>F<\/strong>ire<strong>W<\/strong>all. Duhej t\u00eb gjenim nj\u00eb em\u00ebr p\u00ebr produktin kur krijova depozit\u00ebn p\u00ebr t\u00eb vendosur komitet e para testuese. Ky em\u00ebrtim mbeti.<\/p>\n<h3>Shabllonet e rregullave<\/h3>\n<p>\nRregullat shkruhen n\u00eb sintaks\u00ebn e iptables.<\/p>\n<ul>\n<li>-N BEFW<\/li>\n<li>-P INPUT DROP<\/li>\n<li>-A INPUT -m state\u2014state RELATED,ESTABLISHED -j ACCEPT<\/li>\n<li>-A INPUT -i lo -j ACCEPT<\/li>\n<li>-A INPUT -j BEFW<\/li>\n<\/ul>\n<p>\nT\u00eb gjitha shkojn\u00eb n\u00eb zinxhirin BEFW, p\u00ebrve\u00e7 <code>ESTABLISHED<\/code>, <code>RELATED<\/code> dhe localhost. Shablloni mund t\u00eb jet\u00eb i \u00e7far\u00ebdo lloji, \u00ebsht\u00eb thjesht nj\u00eb shembull.<\/p>\n<p>\u00c7far\u00eb \u00ebsht\u00eb e dobishme BEFW?<\/p>\n<h3>Sh\u00ebrbimet<\/h3>\n<p>\nKemi nj\u00eb sh\u00ebrbim, gjithmon\u00eb ka nj\u00eb port, nod\u00ebn mbi t\u00eb cilin funksionon ai. Nga nodi yn\u00eb mund t\u00eb k\u00ebrkojm\u00eb lokalisht agjentin dhe t\u00eb m\u00ebsojm\u00eb se kemi ndonj\u00eb sh\u00ebrbim. Gjithashtu mund t\u00eb vendosim etiketa.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/6d8c74db37e2e1eed971cfa6947cc5c8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00c7do sh\u00ebrbim q\u00eb \u00ebsht\u00eb aktiv dhe regjistruar n\u00eb Consul shnd\u00ebrrohet n\u00eb rregull t\u00eb iptables. Kemi SSH \u2014 hapim portin 22. Skripti Bash \u00ebsht\u00eb i thjesht\u00eb: curl dhe iptables, nuk nevojiten gj\u00ebra m\u00eb shum\u00eb.<\/p>\n<h3>Klient\u00ebt<\/h3>\n<p>\nSi t\u00eb hapim qasje jo p\u00ebr t\u00eb gjith\u00eb, por p\u00ebr disa? Duke p\u00ebrdorur emrin e sh\u00ebrbimit p\u00ebr t\u00eb grumbulluar lista IP n\u00eb magazin\u00ebn KV.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/11a5af5aad9e848565458f168a1eee64.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr shembull, duam q\u00eb t\u00eb gjith\u00eb nga rrjeti i dhjet\u00eb t\u00eb mund t\u00eb ken\u00eb qasje n\u00eb sh\u00ebrbimin SSH_TCP_22. Shtojm\u00eb nj\u00eb fush\u00eb t\u00eb vog\u00ebl TTL? dhe tani kemi leht\u00ebsira t\u00eb p\u00ebrkohshme, p\u00ebr shembull, p\u00ebr nj\u00eb dit\u00eb.<\/p>\n<h3>Qasjet<\/h3>\n<p>\nLidhim sh\u00ebrbimet dhe klient\u00ebt: kemi nj\u00eb sh\u00ebrbim, p\u00ebr secilin \u00ebsht\u00eb gati nj\u00eb magazin\u00eb KV. Tani jepim qasje jo p\u00ebr t\u00eb gjith\u00eb, por p\u00ebr disa.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/d1119fbb226595184cac8d9ce7a924e3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Grupet<\/h3>\n<p>\nN\u00ebse do t\u00eb shkruajm\u00eb mij\u00ebra IP p\u00ebr qasje \u00e7do her\u00eb, do t\u00eb lodhemi. Do t\u00eb shpikim grupe \u2014 nj\u00eb subset t\u00eb ve\u00e7ant\u00eb n\u00eb KV. Do ta quajm\u00eb Alias (ose grupe) dhe do t\u00eb ruajm\u00eb aty grupe sipas t\u00eb nj\u00ebjtit parim.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/67c6ab76cc25a3973739bdd44b69cef9.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLidhim: tani mund t\u00eb hapim SSH jo konkretisht n\u00eb P2P, por n\u00eb nj\u00eb grup t\u00eb t\u00ebr\u00eb ose disa grupe. Po ashtu ka TTL \u2014 mund t\u00eb shtojm\u00eb dhe t\u00eb largojm\u00eb p\u00ebrkoh\u00ebsisht n\u00eb grup.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/a00b7db5087a96730c2725090f33e2b0.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Integrimi<\/h3>\n<p>\nProblemi yn\u00eb \u2014 faktor\u00eb njer\u00ebzor\u00eb dhe automatizimi. Deri tani e kemi zgjidhur k\u00ebshtu.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/ce7a0c16543d0624453e6bdada3b8f03.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNe punojm\u00eb me Puppet dhe transferojm\u00eb gjith\u00e7ka q\u00eb lidhet me sistemin (kodin e aplikacioneve). N\u00eb puppetdb (PostgreSQL standard) ruhet lista e sh\u00ebrbimeve q\u00eb jan\u00eb aktive, t\u00eb cilat mund t\u00eb gjenden sipas llojit t\u00eb burimit. Po ashtu, mund t\u00eb gjejm\u00eb se kush i drejtohet k\u00ebndej. Gjithashtu, kemi nj\u00eb sistem t\u00eb k\u00ebrkesave p\u00ebr t\u00ebrheqje dhe p\u00ebr bashkim p\u00ebr k\u00ebt\u00eb.<\/p>\n<p>Kemi shkruar befw-sync \u2014 nj\u00eb zgjidhje t\u00eb thjesht\u00eb q\u00eb ndihmon n\u00eb transferimin e t\u00eb dh\u00ebnave. S\u00eb pari, cookie-t e sync drejtohen n\u00eb puppetdb. Atje \u00ebsht\u00eb e konfiguruar HTTP API: k\u00ebrkojm\u00eb cilat sh\u00ebrbime kemi, \u00e7far\u00eb duhet b\u00ebr\u00eb. Pastaj b\u00ebjn\u00eb nj\u00eb k\u00ebrkes\u00eb n\u00eb Consul.<\/p>\n<p>A ka integrim? Po: kemi shkruar rregulla, lejuar pranim t\u00eb K\u00ebrkesave p\u00ebr T\u00ebrheqje. A nevojitet ndonj\u00eb port ose t\u00eb shtojm\u00eb nj\u00eb host n\u00eb ndonj\u00eb grup? K\u00ebrkes\u00eb p\u00ebr T\u00ebrheqje, rishikim \u2014 asgj\u00eb m\u00eb shum\u00eb se \"Gjeje 200 ACL t\u00eb tjera dhe provoni t\u00eb b\u00ebni di\u00e7ka me k\u00ebt\u00eb\".<\/p>\n<h3>Optimizimi<\/h3>\n<p>\nPing localhost me nj\u00eb zinxhir rregullash t\u00eb zbraz\u00ebt zgjat 0.075 ms.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/39263844f79c4795af05dc3ecb734394.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDo t\u00eb shtojm\u00eb n\u00eb k\u00ebt\u00eb zinxhir 10,000 adresat e iptables. Si rezultat, ping-u do t\u00eb rritet 5 her\u00eb: iptables \u00ebsht\u00eb plot\u00ebsisht linear, procesi p\u00ebr secil\u00ebn adres\u00eb merr nj\u00eb koh\u00eb t\u00eb caktuar.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/e6c314155c3a34fdf61e40479ecb26c3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr firewall-in, n\u00eb t\u00eb cilin migrojm\u00eb mij\u00ebra ACL, kemi shum\u00eb rregulla, dhe kjo krijon vonesa. Kjo \u00ebsht\u00eb e keqe p\u00ebr protokollet e loj\u00ebrave.<\/p>\n<p>Por n\u00ebse e vendosim <strong>10,000 adresat n\u00eb ipset<\/strong> ping-u madje do t\u00eb pak\u00ebsohet.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/2dd844d9324d057ba9ab098e501a1e51.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKoncesi \u00ebsht\u00eb se \"O\" (kompleksiteti i algorithmit) p\u00ebr ipset \u00ebsht\u00eb gjithmon\u00eb i barabart\u00eb me 1, sa her\u00eb rregulla q\u00eb t\u00eb ket\u00eb. E v\u00ebrteta \u00ebsht\u00eb se ka nj\u00eb kufizim \u2014 numri i rregullave nuk mund t\u00eb kaloj\u00eb 65535. Deri tani po jetojm\u00eb me k\u00ebt\u00eb: mund t'i kombinojm\u00eb, zgjerim, t\u00eb b\u00ebjm\u00eb dy ipset n\u00eb nj\u00eb.<\/p>\n<h3>Ruajtja<\/h3>\n<p>\nNj\u00eb vazhdim logjik i procesit t\u00eb iteracioneve \u00ebsht\u00eb ruajtja e informacionit mbi klient\u00ebt p\u00ebr sh\u00ebrbimin n\u00eb ipset.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/126069799d95594be8611237e935189d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTani kemi t\u00eb nj\u00ebjtin SSH, dhe nuk shkruajm\u00eb menj\u00ebher\u00eb 100 IP, por caktojm\u00eb nj\u00eb em\u00ebr ipseti, me t\u00eb cilin duhet t\u00eb komunikojm\u00eb, dhe rregullin e ardhsh\u00ebm <code>DROP<\/code>. Mund ta riformatojm\u00eb n\u00eb nj\u00eb rregull \"Kush nuk \u00ebsht\u00eb k\u00ebtu, at\u00ebher\u00eb DROP\", por k\u00ebshtu \u00ebsht\u00eb m\u00eb e qart\u00eb.<\/p>\n<p>Tani kemi rregulla dhe sete. Detyra kryesore \u00ebsht\u00eb t\u00eb krijojm\u00eb nj\u00eb set para se t\u00eb shkruajm\u00eb nj\u00eb rregull, sepse ndryshe iptables nuk do t\u00eb regjistroj\u00eb rregullin.<\/p>\n<h3>Skema e p\u00ebrgjithshme<\/h3>\n<p>\nN\u00eb form\u00ebn e skem\u00ebs, \u00e7do gj\u00eb q\u00eb kam treguar duket k\u00ebshtu.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/4046e921cb5f466f8af5a6af1fcd151c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nB\u00ebjm\u00eb commit n\u00eb Puppet, gjith\u00e7ka d\u00ebrgohet n\u00eb host, sh\u00ebrbimet jan\u00eb k\u00ebtu, ipset atje, nd\u00ebrsa ata q\u00eb nuk jan\u00eb regjistruar atje, nuk lejohet t\u00eb hyjn\u00eb.<\/p>\n<h3>Lejo &amp; ndalo<\/h3>\n<p>\nP\u00ebr t\u00eb shp\u00ebtuar bot\u00ebn shpejt ose p\u00ebr t\u00eb \u00e7aktivizuar dik\u00eb shpejt, n\u00eb fillim t\u00eb \u00e7do zinxhiri kemi b\u00ebr\u00eb dy ipset: <code>rules_allow<\/code> dhe <code>rules_deny<\/code>. Si funksionon kjo?<\/p>\n<p>P\u00ebr shembull, dikush krijon ngarkes\u00eb n\u00eb Web-in ton\u00eb me bota. M\u00eb par\u00eb duhej t\u00eb gjenim IP-n\u00eb e tij n\u00eb log-e, p\u00ebr ta \u00e7uar tek inxhinier\u00ebt rrjet\u00eb dhe ata t\u00eb gjenin burimin e trafikut dhe ta bllokonin. Tani kjo duket ndryshe.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/6e7f906919536cab2c283ba6ceb0472d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nD\u00ebrgojm\u00eb n\u00eb Consul, presim 2.5 sekonda, dhe \u00ebsht\u00eb gati. Duke qen\u00eb se Consul shp\u00ebrndan shpejt p\u00ebrmes P2P, ai punon kudo, n\u00eb \u00e7do pjes\u00eb t\u00eb bot\u00ebs.<\/p>\n<p>Nj\u00eb her\u00eb e ndaluam plot\u00ebsisht WOT-in, duke e th\u00ebn\u00eb gabim me firewall-in. <code>rules_allow<\/code> \u2014 \u00ebsht\u00eb sigurimi yn\u00eb nga k\u00ebto raste. N\u00ebse gabojm\u00eb ndonj\u00ebher\u00eb me firewall-in, ndonj\u00eb gj\u00eb ndalon, mund t\u00eb d\u00ebrgojm\u00eb nj\u00eb 'conditional' p\u00ebr ta rregulluar shpejt. Pastaj ne gjithmon\u00eb mund t\u2019i rregullojm\u00eb gj\u00ebrat me duar. <code>0.0\/0<\/code>T\u00eb tjera sete<\/p>\n<h3>Mund t\u00eb shtoni \u00e7do set tjet\u00ebr n\u00eb hap\u00ebsir\u00eb<\/h3>\n<p>\n$IPSETS$ <code>Pse? Ndonj\u00ebher\u00eb dikush ka nevoj\u00eb p\u00ebr ipset, p\u00ebr shembull, p\u00ebr t\u00eb imituar ndalimin e nj\u00eb pjese t\u00eb klasterit. \u00c7do njeri mund t\u00eb sjell\u00eb \u00e7do set, t\u2019i jap\u00eb emrin dhe ata do t\u00eb merren nga Consul. N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, setet mund t\u00eb marrin pjes\u00eb n\u00eb rregullat e iptables, ose t\u00eb jen\u00eb si nj\u00eb komand\u00eb NOOP: konsistenca do t\u00eb mb\u00ebshtetet nga demoni.<\/code>.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/4e1e337b35da81cd7324b2adc106b085.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00eb par\u00eb ishte k\u00ebshtu: p\u00ebrdoruesi lidhej n\u00eb rrjet dhe merrte parametrat p\u00ebrmes domenit. Para shfaqjes s\u00eb firewall-eve t\u00eb reja, Cisco nuk dinte t\u00eb kuptonte ku ishte p\u00ebrdoruesi dhe ku ishte IP. Prandaj, hyrja jepeshin vet\u00ebm p\u00ebrmes hostname-it t\u00eb makin\u00ebs. <code>\u00c7far\u00eb b\u00ebm\u00eb ne? U nd\u00ebrhym\u00eb n\u00eb momentin e marrjes s\u00eb adres\u00ebs. Zakonisht kjo \u00ebsht\u00eb dot1x, Wi-Fi ose VPN \u2014 gjith\u00e7ka shkon p\u00ebrmes RADIUS. P\u00ebr \u00e7do p\u00ebrdorues krijojm\u00eb nj\u00eb grup me emrin e p\u00ebrdoruesit dhe vendosim n\u00eb t\u00eb IP-n\u00eb me TTL, e cila \u00ebsht\u00eb e barabart\u00eb me dhcp.lease e tij \u2014 sa her\u00eb t\u00eb skadoj\u00eb, rregulli do t\u00eb zhduket.<\/code>Tani mund t\u00eb hapim aksesin n\u00eb sh\u00ebrbime, ashtu si n\u00eb grupe t\u00eb tjera, sipas username. Ne u shp\u00ebtuam nga dhimbja me hostname, kur ato ndryshojn\u00eb, dhe ia hoq\u00ebm ngarkes\u00ebn inxhinier\u00ebve rrjet\u00eb, sepse nuk u duhet m\u00eb Cisco. Tani inxhinier\u00ebt vet\u00eb shkruajn\u00eb akseset n\u00eb server\u00ebt e tyre.<\/p>\n<h3>P\u00ebrdoruesit<\/h3>\n<p>\nP\u00ebr paralel, filluam t\u00eb shqyrtojm\u00eb izolimin. Menaxher\u00ebt e sh\u00ebrbimeve b\u00ebn\u00eb nj\u00eb inventar, dhe ne analizuam t\u00eb gjitha rrjetet tona. Do t\u2019i rendisim ato n\u00eb grupe t\u00eb ngjashme, dhe n\u00eb server\u00ebt e nevojsh\u00ebm grupeve i shtuam, p\u00ebr shembull, n\u00eb deny. Tani izolimi i nj\u00ebllojt\u00eb i stadyng-it kalon n\u00eb rules_deny n\u00eb prodhimin, por jo n\u00eb vet\u00eb prodhimin.<\/p>\n<p>Skema punon shpejt dhe thjesht\u00eb: hiqim t\u00eb gjitha ACL nga server\u00ebt, shkarkojm\u00eb pajisjet, ulim numrin e VLAN-ve t\u00eb izoluar.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/04550475c6af49d094c18b1d5b89123a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKontrolli i integritetit<\/p>\n<h3>Izolimi<\/h3>\n<p>\nN\u00eb m\u00ebnyr\u00eb paralele filluam t\u00eb heqim izolimin. Menaxher\u00ebt e sh\u00ebrbimit b\u00ebn\u00eb nj\u00eb inventar, dhe ne analizuam t\u00eb gjitha rrjetet tona. Do t'i grupojm\u00eb n\u00eb grupe t\u00eb ngjashme, dhe grupet e nevojshme n\u00eb server\u00ebt e nevojsh\u00ebm do t'i shtojm\u00eb, p\u00ebr shembull, n\u00eb deny. Tani, e nj\u00ebjta izolim e staging \u00ebsht\u00eb n\u00eb rules_deny t\u00eb prodhimit, por jo n\u00eb vet\u00eb prodhimin.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/60fe7407013aa64b853791f8def627cc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSchema punon shpejt dhe thjesht\u00eb: heqim t\u00eb gjitha ACL nga server\u00ebt, shkarkojm\u00eb pajisjet, zvog\u00eblojm\u00eb numrin e VLAN-ve t\u00eb izoluara.<\/p>\n<h3>Kontrolli i integritetit<\/h3>\n<p>\nDeri m\u00eb par\u00eb kishim nj\u00eb trigger t\u00eb ve\u00e7ant\u00eb q\u00eb informonte kur dikush ndryshonte manualisht rregullin e firewall-it. Un\u00eb shkrova nj\u00eb linters t\u00eb madh p\u00ebr kontrollin e rregullave t\u00eb firewall-it, ishte e komplikuar. Tani integritetin e kontrollet BEFW. Ai ndjek me zell q\u00eb rregullat q\u00eb krijon t\u00eb mos ndryshohen. N\u00ebse dikush ndryshon rregullat e firewall-it, ai do t'i kthej\u00eb t\u00eb gjitha p\u00ebrs\u00ebri. 'K\u00ebtu ngrita shpejt nj\u00eb proxy p\u00ebr t\u00eb punuar nga sht\u00ebpia' \u2014 k\u00ebto mund\u00ebsi nuk ekzistojn\u00eb m\u00eb.<\/p>\n<p>BEFW kontrollon ipset nga sh\u00ebrbimet dhe lista n\u00eb befw.conf, rregullat e sh\u00ebrbimeve n\u00eb zinxhirin BEFW. Por nuk ndjek zinxhir\u00eb dhe rregulla t\u00eb tjera dhe ipset t\u00eb tjera.<\/p>\n<h3>Mbrojtja nga d\u00ebshtimet<\/h3>\n<p>\nBEFW gjithmon\u00eb ruan gjendjen e fundit t\u00eb suksesshme drejtp\u00ebrdrejt n\u00eb struktur\u00ebn binare state.bin. N\u00ebse di\u00e7ka shkon keq, ai gjithmon\u00eb kthehet pas n\u00eb k\u00ebt\u00eb state.bin.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/724f3537c06a7135fa6397f9ddd5630f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKjo \u00ebsht\u00eb nj\u00eb sigurim nga punimi i paq\u00ebndruesh\u00ebm i Consul, kur ai nuk d\u00ebrgoi t\u00eb dh\u00ebnat ose dikush b\u00ebri nj\u00eb gabim dhe p\u00ebrdori rregulla q\u00eb nuk mund t\u00eb aplikohen. Q\u00eb t\u00eb mos mbetemi pa firewall, BEFW do t\u00eb kthehet n\u00eb gjendjen e fundit n\u00ebse n\u00eb ndonj\u00eb pik\u00eb ndodh nj\u00eb gabim.<\/p>\n<p>N\u00eb situata kritike kjo \u00ebsht\u00eb nj\u00eb garanci q\u00eb do t\u00eb mbetemi me nj\u00eb firewall n\u00eb pun\u00eb. Ne hapim t\u00eb gjitha rrjetet gri n\u00eb shpres\u00eb se admini do t\u00eb vij\u00eb dhe do ta rregulloj\u00eb. Disa her\u00eb do ta nxjerr k\u00ebt\u00eb n\u00eb konfigurime, por tani kemi thjesht tre rrjete gri: 10\/8, 172\/12 dhe 192.168\/16. Brenda Consul ton\u00eb kjo \u00ebsht\u00eb nj\u00eb ve\u00e7ori e r\u00ebnd\u00ebsishme q\u00eb ndihmon n\u00eb zhvillimin m\u00eb tej.<\/p>\n<p><em>Demo: gjat\u00eb prezantimit, Ivan demonstron modin demo t\u00eb pun\u00ebs s\u00eb BEFW. \u00cbsht\u00eb m\u00eb e leht\u00eb t\u00eb shikosh demonstrat\u00ebn n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/4zP67uYnsR4?t=1663\">video<\/a><\/noindex>. Kodi burimor i demostrat\u00ebs \u00ebsht\u00eb i disponuesh\u00ebm <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/wgnet\/befw\/tree\/master\/demo\">n\u00eb GitHub<\/a><\/noindex>.<\/em><\/p>\n<h2>ProHoster Sofiyadak\u0131 dig\u0259r server provayderl\u0259rind\u0259n n\u0259 il\u0259 f\u0259rql\u0259nir?<\/h2>\n<p>\nDo t\u00eb flas p\u00ebr gabimet me t\u00eb cilat u p\u00ebrball\u00ebm.<\/p>\n<p><strong>ipset add set 0.0.0.0\/0. <\/strong>\u00c7far\u00eb ndodh n\u00ebse shtoni n\u00eb ipset 0.0.0.0\/0? Do t\u00eb shtohen t\u00eb gjitha IP? Do t\u00eb hapet qasje n\u00eb internet? <\/p>\n<p>Jo, do t\u00eb marrim nj\u00eb bug q\u00eb na kostoi dy or\u00eb q\u00ebndrimi. Nga ana tjet\u00ebr, bug-u nuk ka funksionuar q\u00eb nga viti 2016, \u00ebsht\u00eb n\u00eb RedHat Bugzilla me numrin #1297092, dhe ne e gjet\u00ebm at\u00eb rast\u00ebsisht \u2014 nga raporti i zhvilluesit.<\/p>\n<p>Tani n\u00eb BEFW ka nj\u00eb rregull t\u00eb fort\u00eb q\u00eb <code>0.0.0.0\/0<\/code> kthehet n\u00eb dy adresa: <code>0.0.0.0\/1<\/code> dhe <code>128.0.0.0\/1<\/code>.<\/p>\n<p><strong>ipset restore set &lt; file. <\/strong>\u00c7far\u00eb b\u00ebn ipset kur i thoni 'restore' <code>Asgj\u00eb e till\u00eb \u2014 ai b\u00ebn nj\u00eb merge dhe adresat e vjetra nuk zhduken, ju nuk e mbyllni qasjen.<\/code>? \u0412\u044b \u0434\u0443\u043c\u0430\u0435\u0442\u0435, \u043e\u043d \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0442\u0430\u043a\u0436\u0435, \u043a\u0430\u043a iptables? \u0412\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442 \u0434\u0430\u043d\u043d\u044b\u0435?<\/p>\n<p>Ne gjet\u00ebm bug-un kur testonim izolimin. Tani ka nj\u00eb sistem t\u00eb mjaftuesh\u00ebm t\u00eb komplikuar \u2014 n\u00eb vend t\u00eb<\/p>\n<p>kryhet <code>Asgj\u00eb e till\u00eb \u2014 ai b\u00ebn nj\u00eb merge dhe adresat e vjetra nuk zhduken, ju nuk e mbyllni qasjen.<\/code> create temp <code>restore flush temp<\/code>, pastaj <code>restore temp<\/code> dhe <code>. N\u00eb fund swap: p\u00ebr atomaritet, sepse n\u00ebse e kryen fillimisht<\/code>. N\u00eb fund swap: p\u00ebr atomikshm\u00ebrin\u00eb, sepse n\u00ebse fillimisht b\u00ebjm\u00eb <code>flush<\/code> dhe n\u00eb k\u00ebt\u00eb moment do t\u00eb vij\u00eb ndonj\u00eb pako, ajo do t\u00eb hidhet dhe di\u00e7ka do t\u00eb shkoj\u00eb keq. K\u00ebshtu q\u00eb aty ka pak magji t\u00eb zez\u00eb.<\/p>\n<p><strong>consul kv get -datacenter=other. <\/strong>Si\u00e7 e kam th\u00ebn\u00eb, ne mendojm\u00eb se po k\u00ebrkojm\u00eb ndonj\u00eb t\u00eb dh\u00ebn\u00eb, por do t\u00eb marrim ose t\u00eb dh\u00ebna, ose nj\u00eb gabim. Ne mund ta b\u00ebjm\u00eb k\u00ebt\u00eb lokalisht p\u00ebrmes Consul, por edhe n\u00eb k\u00ebt\u00eb rast do t\u00eb ngecim dhe at\u00eb dhe k\u00ebt\u00eb.<\/p>\n<p>Klienti lokal Consul \u00ebsht\u00eb nj\u00eb mb\u00ebshtjell\u00ebs mbi API-n\u00eb HTTP. Por ai ngrihet dhe nuk p\u00ebrgjigjet as p\u00ebr Ctrl+C, as p\u00ebr Ctrl+Z, as p\u00ebr asgj\u00eb, vet\u00ebm p\u00ebr <code>kill -9<\/code> n\u00eb konsol\u00ebn fqinj\u00eb. Ne u ballafaqua me k\u00ebt\u00eb kur nd\u00ebrtuam nj\u00eb grup t\u00eb madh. Por nuk kemi ende nj\u00eb zgjidhje, jemi duke u p\u00ebrgatitur p\u00ebr t\u00eb korrigjuar k\u00ebt\u00eb gabim n\u00eb Consul.<\/p>\n<p><strong>Lideri i Consul-it nuk po p\u00ebrgjigjet. <\/strong>Kemi nj\u00eb master n\u00eb data-qend\u00ebr q\u00eb nuk po p\u00ebrgjigjet, ne mendojm\u00eb: \"Mbase tani do t\u00eb funksionoj\u00eb algoritmi i rinum\u00ebrimit?\" <\/p>\n<p>Jo, nuk do t\u00eb funksionoj\u00eb, dhe monitorimi nuk do t\u00eb tregoj\u00eb asgj\u00eb: Consul do t\u00eb thot\u00eb se indekset e angazhimit jan\u00eb aty, lideri \u00ebsht\u00eb gjetur, gjith\u00e7ka \u00ebsht\u00eb mir\u00eb.<\/p>\n<p>Si po luftojm\u00eb me k\u00ebt\u00eb? <code>service consul restart<\/code> n\u00eb cron \u00e7do or\u00eb. N\u00ebse keni 50 server\u00eb - nuk \u00ebsht\u00eb e frikshme. Kur do t\u00eb jen\u00eb 16,000, do ta kuptoni se si funksionon.<\/p>\n<h2>P\u00ebrfundim<\/h2>\n<p>\nSi rezultat, mor\u00ebm avantazhet e m\u00ebposhtme:<\/p>\n<ul>\n<li>100% mbulim t\u00eb gjitha makinerive Linux.<\/li>\n<li>Shpejt\u00ebsia.<\/li>\n<li>Automatizimin.<\/li>\n<li>\u00c7lirimi i paisjeve dhe inxhinier\u00ebve rrjet\u00eb nga skllav\u00ebria.<\/li>\n<li>Kemi mund\u00ebsi integrimi q\u00eb jan\u00eb praktikisht t\u00eb pakufizuara: qoft\u00eb me Kubernetes, qoft\u00eb me Ansible, qoft\u00eb me Python.<\/li>\n<\/ul>\n<p>\n<strong>Disavantazhet<\/strong>: Consul, me t\u00eb cilin tani duhet t\u00eb jetojm\u00eb, dhe nj\u00eb \u00e7mim shum\u00eb i lart\u00eb gabimi. Si nj\u00eb shembull, nj\u00eb her\u00eb n\u00eb or\u00ebn 6 t\u00eb pasdites (koh\u00eb kryesore n\u00eb Rusi) e ndryshova di\u00e7ka n\u00eb listat e rrjeteve. Ne po nd\u00ebrtoshim izolimin n\u00eb BEFW. Un\u00eb gabova ndoshta, duke treguar mask\u00ebn e gabuar, por gjith\u00e7ka ra brenda dy sekondash. Monitorimi ndez, p\u00ebrfundon ndihma: \"Kemi gjith\u00e7ka t\u00eb bllokuar!\" Shefi i departamentit u b\u00eb thinj kur shpjegoi biznesit pse ndodhi kjo.<\/p>\n<p>\u00c7mimi i gabimit \u00ebsht\u00eb kaq i lart\u00eb, saq\u00eb ne shpik\u00ebm nj\u00eb procedur\u00eb t\u00eb komplikuar parandaluese. N\u00ebse do ta implementoni k\u00ebt\u00eb n\u00eb nj\u00eb prodhim t\u00eb madh, mos jepni master-token mbi Consul t\u00eb gjith\u00ebve pa kriter. Kjo do t\u00eb p\u00ebrfundoj\u00eb keq.<\/p>\n<p><strong>Kostoja. <\/strong>Un\u00eb kam shkruar kodin 400 or\u00eb n\u00eb vetmi. P\u00ebr mb\u00ebshtetje, ekipi im prej 4 personash shpenzon 10 or\u00eb n\u00eb muaj p\u00ebr t\u00eb gjith\u00eb. Krahasuar me \u00e7mimin e \u00e7do firewalle t\u00eb gjenerat\u00ebs s\u00eb re, kjo \u00ebsht\u00eb falas.<\/p>\n<p><strong>Planet. <\/strong>Plani afatgjat\u00eb \u00ebsht\u00eb t\u00eb k\u00ebrkojm\u00eb nj\u00eb transport alternativ p\u00ebrve\u00e7 Consul, ndoshta do t\u00eb jet\u00eb Kafka ose di\u00e7ka e ngjashme. Por n\u00eb vitet e ardhshme do t\u00eb jetojm\u00eb me Consul.<\/p>\n<p>Planifikimet e af\u00ebrta: integrimi me Fail2ban, monitorimi, me nftables, ndoshta edhe me distribucione t\u00eb tjera, metrikat, monitorimi i zgjeruar, optimizimi. Mb\u00ebshtetje p\u00ebr Kubernetes gjithashtu \u00ebsht\u00eb n\u00eb planet, sepse tani kemi disa klaster\u00eb dhe d\u00ebshir\u00eb.<\/p>\n<p>Gjithashtu n\u00eb planet:<\/p>\n<ul>\n<li>k\u00ebrkimi i anomalis\u00eb n\u00eb trafik;<\/li>\n<li>menaxhimi i hart\u00ebs s\u00eb rrjetit;<\/li>\n<li>mb\u00ebshtetje p\u00ebr Kubernetes;<\/li>\n<li>nd\u00ebrtimi i pakove p\u00ebr t\u00eb gjitha sistemet;<\/li>\n<li>Web-UI.<\/li>\n<\/ul>\n<p>\nP\u00ebrs\u00ebri, ne punojm\u00eb vazhdimisht p\u00ebr t\u00eb zgjeruar konfigurimin, rritur metrikat dhe optimizimin.<\/p>\n<p><i>Bashkohuni me projektin. Projekti doli t\u00eb jet\u00eb shum\u00eb i mir\u00eb, por, fatkeq\u00ebsisht, deri tani \u00ebsht\u00eb nj\u00eb projekt i nj\u00eb personi. Ejani n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/wgnet\/befw\">GitHub <\/a><\/noindex>dhe provoni t\u00eb b\u00ebni di\u00e7ka: b\u00ebni commit, testoni, sugjeroni di\u00e7ka, jepni vler\u00ebsimin tuaj.<\/i><\/p>\n<blockquote><p>Nd\u00ebrkoh\u00eb, po p\u00ebrgatitemi p\u00ebr <noindex><a rel=\"nofollow\" href=\"https:\/\/www.highload.ru\/spb\/2020\">Saint HighLoad++<\/a><\/noindex>, i cili do t\u00eb mbahet m\u00eb 6 dhe 7 prill n\u00eb Sh\u00ebn Petersburg, dhe ftojm\u00eb zhvilluesit e sistemeve me ngarkes\u00eb t\u00eb lart\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/conf.ontico.ru\/lectures\/propose?conference=hl2020-spb\">t\u00eb aplikoni p\u00ebr nj\u00eb referat<\/a><\/noindex>. Fol\u00ebsit me p\u00ebrvoj\u00eb e din\u00eb se \u00e7far\u00eb t\u00eb b\u00ebjn\u00eb, nd\u00ebrsa p\u00ebr fillestar\u00ebt n\u00eb fjalime rekomandojm\u00eb t\u00eb pakt\u00ebn <noindex><a rel=\"nofollow\" href=\"https:\/\/www.highload.ru\/spb\/2020\/speakers\">provoni<\/a><\/noindex>. Pjes\u00ebmarrja n\u00eb konferenc\u00eb si fol\u00ebs ka disa p\u00ebrfitime. Cilat, mund t\u00eb lexoni, p\u00ebr shembull, n\u00eb fund <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/oleg-bunin\/blog\/486142\/\">ky artikull<\/a><\/noindex>.<\/p><\/blockquote>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/oleg-bunin\/blog\/486842\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 2010 \u0433\u043e\u0434\u0443 \u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wargaming \u0431\u044b\u043b\u043e 50 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u043f\u0440\u043e\u0441\u0442\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c: \u0431\u044d\u043a\u0435\u043d\u0434, \u0444\u0440\u043e\u043d\u0442\u0435\u043d\u0434 \u0438 \u0444\u0430\u0439\u0440\u0432\u043e\u043b. \u041a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0440\u043e\u0441\u043b\u043e, \u043c\u043e\u0434\u0435\u043b\u044c \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u043b\u0430\u0441\u044c: \u0441\u0442\u0435\u0439\u0434\u0436\u0438\u043d\u0433\u0438, \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 VLAN \u0441 ACL, \u043f\u043e\u0442\u043e\u043c VPN \u0441 VRF, VLAN c ACL \u043d\u0430 L2, VRF \u0441 ACL \u043d\u0430 L3. \u0417\u0430\u043a\u0440\u0443\u0436\u0438\u043b\u0430\u0441\u044c \u0433\u043e\u043b\u043e\u0432\u0430? \u0414\u0430\u043b\u044c\u0448\u0435 \u0431\u0443\u0434\u0435\u0442 \u0432\u0435\u0441\u0435\u043b\u0435\u0435. \u041a\u043e\u0433\u0434\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0441\u0442\u0430\u043b\u043e 16 000 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0431\u0435\u0437 \u0441\u043b\u0435\u0437 \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":41052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41051","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 2010 \u0433\u043e\u0434\u0443 \u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wargaming \u0431\u044b\u043b\u043e 50 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u043f\u0440\u043e\u0441\u0442\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c: \u0431\u044d\u043a\u0435\u043d\u0434, \u0444\u0440\u043e\u043d\u0442\u0435\u043d\u0434 \u0438 \u0444\u0430\u0439\u0440\u0432\u043e\u043b.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/consul-iptables-3\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Consul + iptables = :3 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 2010 \u0433\u043e\u0434\u0443 \u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wargaming \u0431\u044b\u043b\u043e 50 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u043f\u0440\u043e\u0441\u0442\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c: \u0431\u044d\u043a\u0435\u043d\u0434, \u0444\u0440\u043e\u043d\u0442\u0435\u043d\u0434 \u0438 \u0444\u0430\u0439\u0440\u0432\u043e\u043b.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/consul-iptables-3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-05T18:28:58+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-05T18:28:58+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Consul + iptables = :3 | ProHoster","description":"N\u00eb vitin 2010, kompania Wargaming kishte 50 server\u00eb dhe nj\u00eb model t\u00eb thjesht\u00eb rrjeti: backend, frontend dhe firewall.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/consul-iptables-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Consul + iptables = :3 | ProHoster","og:description":"\u0412 2010 \u0433\u043e\u0434\u0443 \u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wargaming \u0431\u044b\u043b\u043e 50 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u043f\u0440\u043e\u0441\u0442\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c: \u0431\u044d\u043a\u0435\u043d\u0434, \u0444\u0440\u043e\u043d\u0442\u0435\u043d\u0434 \u0438 \u0444\u0430\u0439\u0440\u0432\u043e\u043b.","og:url":"https:\/\/prohoster.info\/sq\/blog\/consul-iptables-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-05T18:28:58+00:00","article:modified_time":"2020-02-05T18:28:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41051","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:24:42","updated":"2022-10-01 10:00:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/41051","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=41051"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/41051\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/41052"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=41051"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=41051"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=41051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}