{"id":41051,"date":"2020-02-05T21:28:58","date_gmt":"2020-02-05T18:28:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/consul-iptables-3"},"modified":"2020-02-05T21:28:58","modified_gmt":"2020-02-05T18:28:58","slug":"consul-iptables-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/consul-iptables-3","title":{"rendered":"Consul + iptables = :3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>N\u00eb vitin 2010, kompania <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/wargaming\/\">Wargaming<\/a><\/noindex> kishte 50 server\u00eb dhe nj\u00eb model t\u00eb thjesht\u00eb rrjeti: backend, frontend dhe firewall. Numri i server\u00ebve po rritej, modeli po komplikohej: staging, VLAN t\u00eb izoluar me ACL, m\u00eb pas VPN me VRF, VLAN me ACL n\u00eb L2, VRF me ACL n\u00eb L3. Po ju lakohet koka? Do t\u00eb b\u00ebhet m\u00eb arg\u00ebtuese.<\/p>\n<p>Kur numri i server\u00ebve arriti n\u00eb 16,000, punimi pa lot me nj\u00eb num\u00ebr kaq t\u00eb madh segmentesh heterogjene u b\u00eb i pamundur. Prandaj, u mendua nj\u00eb zgjidhje tjet\u00ebr. U mor nj\u00eb grup Netfilter, iu shtua Consul si burim t\u00eb dh\u00ebnash, dhe k\u00ebshtu u krijua nj\u00eb firewall i shpejt\u00eb dhe t\u00eb shp\u00ebrndar\u00eb. Kjo z\u00ebvend\u00ebsoi ACL-n\u00eb n\u00eb routera dhe u p\u00ebrdor si firewall i jasht\u00ebm dhe t\u00eb brendsh\u00ebm. P\u00ebr menaxhimin dinamik t\u00eb mjetit, u zhvillua nj\u00eb sistem BEFW, i cili u p\u00ebrdor kudo: nga menaxhimi i qasjes s\u00eb p\u00ebrdoruesve n\u00eb rrjetin produktiv deri te izolimi i segmenteve t\u00eb rrjetit nga nj\u00ebri-tjetri.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/246e74278f413749a676599b5ce986a5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSi funksionon gjith\u00e7ka dhe pse ia vlen t\u00eb shikoni k\u00ebt\u00eb sistem, do t\u00eb tregoj\u00eb <strong>Ivan Agarov<\/strong> (<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/annmuor\/\" class=\"user_link\">annmuor<\/a><\/noindex>) \u2014 udh\u00ebheq\u00ebsi i grupit t\u00eb siguris\u00eb s\u00eb infrastruktur\u00ebs n\u00eb nj\u00ebsin\u00eb e Maintenance n\u00eb Qendren e Zhvillimit t\u00eb Minskut t\u00eb kompanis\u00eb. Ivan \u00ebsht\u00eb nj\u00eb adhurues i SELinux, i p\u00eblqen Perl, shkruan kod. Si udh\u00ebheq\u00ebs i grupit t\u00eb siguris\u00eb, ai punon rregullisht me log-et, back-up-et dhe R&amp;D p\u00ebr t\u00eb mbrojtur Wargaming nga hackerat dhe p\u00ebr t\u00eb siguruar funksionimin e t\u00eb gjith\u00eb server\u00ebve t\u00eb loj\u00ebrave n\u00eb kompanin\u00eb.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n<center><div class=\"youtube-placeholder\" data-id=\"4zP67uYnsR4\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/4zP67uYnsR4\/hqdefault.jpg\" alt=\"Luaj videon\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<h2>Historiku<\/h2>\n<p>\nPara se t\u00eb flas se si e b\u00ebm\u00eb k\u00ebt\u00eb, do t\u00eb tregoj se si erdh\u00ebm n\u00eb k\u00ebt\u00eb pik\u00eb dhe pse ishte e nevojshme. P\u00ebr k\u00ebt\u00eb, do t\u00eb rikthehemi n\u00eb 9 vjet m\u00eb par\u00eb: viti 2010, sapo ishin paraqitur World of Tanks. Kompania Wargaming kishte rreth 50 server\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/64e1c2839363dbdf59ba5f11bb13530e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<em>Grafiku i rritjes s\u00eb server\u00ebve t\u00eb kompanis\u00eb.<\/em><\/p>\n<p>Ne kishim nj\u00eb model rrjeti. P\u00ebr at\u00eb koh\u00eb, ishte optimal.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/c0509324e2a83882a9792ba75612ceea.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<em>Modeli i rrjetit n\u00eb 2010.<\/em><\/p>\n<p>N\u00eb frontend jetojn\u00eb djemt\u00eb e k\u00ebqinjt\u00eb q\u00eb duan t\u00eb na thyejn\u00eb, por aty ka nj\u00eb firewall. N\u00eb backend nuk ka firewall, por aty jan\u00eb 50 server\u00eb, t\u00eb gjith\u00eb i njohim. T\u00eb gjitha funksionon mir\u00eb.<\/p>\n<p>N\u00eb 4 vitet e fundit, parku i server\u00ebve u rrit me 100 her\u00eb, duke arritur n\u00eb 5000. U shfaq\u00ebn rrjetet e para t\u00eb izoluara \u2014 staging: ato nuk mund t\u00eb shkojn\u00eb n\u00eb prodhim, dhe aty shpesh l\u00ebviznin gj\u00ebra q\u00eb mund t\u00eb ishin t\u00eb rrezikshme.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/08e1d7670ce1a1346e49d87c67c4be1b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<em>Modeli i rrjetit n\u00eb 2014.<\/em><\/p>\n<p>P\u00ebr inercin\u00eb, p\u00ebrdor\u00ebm t\u00eb nj\u00ebjtin hardware, dhe gjith\u00eb puna u zhvillua n\u00eb VLAN t\u00eb izoluara: p\u00ebr VLAN shkruheshin ACL q\u00eb lejojn\u00eb ose ndalojn\u00eb nj\u00eb lidhje t\u00eb caktuar.<\/p>\n<p>N\u00eb vitin 2016, numri i server\u00ebve arriti n\u00eb 8000. Wargaming p\u00ebrthithi estudio t\u00eb tjera, u shfaq\u00ebn rrjete partnere t\u00eb shtes\u00ebs. Duket sikur jan\u00eb tonat, por nuk jan\u00eb plot\u00ebsisht: p\u00ebr partner\u00ebt, VLAN shpesh nuk funksionon, dhe \u00ebsht\u00eb e nevojshme t\u00eb p\u00ebrdoret VPN me VRF, izolimet b\u00ebhen m\u00eb t\u00eb komplikuara. Nj\u00eb p\u00ebrzierje izolimesh ACL u rrit.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/a6580c9551730447e16d7881eb102275.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<em>Modeli rrjetor n\u00eb vitin 2016.<\/em><\/p>\n<p>N\u00eb fillim t\u00eb vitit 2018, parku i makinave u rrit n\u00eb 16,000. Ishin 6 segmente dhe t\u00eb tjerat nuk i llogarit\u00ebm, p\u00ebrfshir\u00eb ato t\u00eb mbyllura, ku ruheshin t\u00eb dh\u00ebnat financiare. U shfaq\u00ebn rrjetet me en\u00eb (Kubernetes), DevOps, rrjetet cloud, t\u00eb lidhura p\u00ebrmes VPN, p\u00ebr shembull, nga IVS. Rregullat ishin shum\u00eb t\u00eb shumta \u2014 ishte e dhimbshme.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/ec44e6a60da98daa4bbf2bca2e3b2e1a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<em>Modeli rrjetor dhe metodat e izolimit n\u00eb vitin 2018.<\/em><\/p>\n<p>P\u00ebr izolim p\u00ebrdor\u00ebm: VLAN me ACL n\u00eb L2, VRF me ACL n\u00eb L3, VPN dhe shum\u00eb gj\u00ebra t\u00eb tjera. Shum\u00eb.<\/p>\n<h2>Problemet<\/h2>\n<p>\nT\u00eb gjith\u00eb jetojn\u00eb me ACL dhe VLAN. \u00c7far\u00eb nuk shkon? P\u00ebr k\u00ebt\u00eb pyetje do t\u00eb p\u00ebrgjigjet Garold, i cilin fsheh dhimbjen.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/4df5105af3bce515d80e8e5f3e14c027.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIshte shum\u00eb probleme, por t\u00eb masive \u2014 pes\u00eb.<\/p>\n<ul>\n<li><strong>Rritje geometrike e \u00e7mimit p\u00ebr rregulla t\u00eb reja<\/strong>. \u00c7do rregull i ri shtohej m\u00eb gjat\u00eb se ai i m\u00ebparshmi, sepse duhej par\u00eb s\u00eb pari n\u00ebse nuk kishte nj\u00eb rregull t\u00eb till\u00eb m\u00eb par\u00eb.<\/li>\n<li><strong>Nuk ka firewall brenda segmenteve<\/strong>. Segmentet u ndan\u00eb ndonj\u00ebher\u00eb nga nj\u00ebra-tjetra, brenda tashm\u00eb nuk kishte mjaft burime.<\/li>\n<li><strong>Rregullat u aplikuan me ngadal\u00eb. <\/strong>Me duar, nj\u00eb rregull lokal operatoret mund ta shkruanin p\u00ebr nj\u00eb or\u00eb. Nj\u00eb rregull global merrte disa dit\u00eb.<\/li>\n<li><strong>V\u00ebshtir\u00ebsi me auditimin e rregullave<\/strong>. Sakt\u00ebsisht, ai ishte i pamundur. Rregullat e para u shkruan q\u00eb n\u00eb vitin 2010, dhe pjesa m\u00eb e madhe e autor\u00ebve t\u00eb tyre nuk punonte m\u00eb n\u00eb kompani.<\/li>\n<li><strong>Niveli i ul\u00ebt i kontrollit mbi infrastruktur\u00ebn<\/strong>. Kjo \u00ebsht\u00eb problemi kryesor \u2014 ne nuk e dinim mir\u00eb se \u00e7far\u00eb ndodhte me ne.<\/li>\n<\/ul>\n<p>\nK\u00ebshtu dukej inxhinieri rrjetor n\u00eb vitin 2018, kur d\u00ebgjonte: \"Duhet edhe pak ACL\".<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/8366d3092558ebb15a4ba6d8e5702032.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<h2>Zgjidhjet<\/h2>\n<p>\nN\u00eb fillim t\u00eb vitit 2018 u vendos q\u00eb t\u00eb merreshin masa p\u00ebr k\u00ebt\u00eb.<\/p>\n<p><strong>\u00c7mimi i integrimeve rritet n\u00eb m\u00ebnyr\u00eb t\u00eb vazhdueshme. <\/strong>Pika fillestare ishte q\u00eb qendrat e m\u00ebdha t\u00eb t\u00eb dh\u00ebnave nuk mb\u00ebshtetnin m\u00eb VLAN t\u00eb izoluar dhe ACL, sepse kishte mbaruar memorja n\u00eb pajisje.<\/p>\n<p>Zgjidhja: hoq\u00ebm faktor\u00ebt njer\u00ebzor\u00eb dhe automatizuam maksimalisht ofrimin e aksesit.<\/p>\n<p><strong>Rregullat e reja aplikohen ngadal\u00eb. <\/strong>Zgjidhja: t\u00eb p\u00ebrshpejtohet aplikimi i rregullave, ta b\u00ebjm\u00eb at\u00eb t\u00eb shp\u00ebrndar\u00eb dhe paralel. P\u00ebr k\u00ebt\u00eb nevojitet nj\u00eb sistem i shp\u00ebrndar\u00eb, q\u00eb rregullat t\u00eb d\u00ebrgoheshin vet\u00eb, pa rsync ose SFTP n\u00eb mij\u00ebra sisteme.<\/p>\n<p><strong>Mungesa e firewall-it brenda segmenteve. <\/strong>Firewalli brenda segmenteve filloi t\u00eb na arrinte kur sh\u00ebrbime t\u00eb ndryshme shfaqeshin brenda nj\u00eb rrjeti. Zgjidhja: p\u00ebrdorimi i firewalls n\u00eb nivelin e hostit \u2014 firewalls t\u00eb bazuara n\u00eb host. Praktikisht n\u00eb \u00e7do vend kemi Linux, dhe kudo ka iptables, k\u00ebshtu q\u00eb kjo nuk \u00ebsht\u00eb nj\u00eb problem.<\/p>\n<p><strong>V\u00ebshtir\u00ebsi me auditetin e rregullave.<\/strong> Zgjidhja: t\u00eb ruajm\u00eb t\u00eb gjitha rregullat n\u00eb nj\u00eb vend t\u00eb vet\u00ebm p\u00ebr pasqyr\u00eb dhe menaxhim, k\u00ebshtu q\u00eb mund t\u00eb auditojm\u00eb gjith\u00e7ka.<\/p>\n<p><strong>Nivel i ul\u00ebt kontrolli mbi infrastruktur\u00ebn. <\/strong>Zgjidhja: t\u00eb b\u00ebjm\u00eb nj\u00eb inventarizim t\u00eb gjith\u00eb sh\u00ebrbimeve dhe aksesit midis tyre.<\/p>\n<p>Ky \u00ebsht\u00eb m\u00eb shum\u00eb nj\u00eb proces administrativ sesa teknik. Ndonj\u00ebher\u00eb kemi 200-300 l\u00ebshime t\u00eb reja n\u00eb jav\u00eb, ve\u00e7an\u00ebrisht gjat\u00eb fushatave dhe festave. Dhe kjo \u00ebsht\u00eb vet\u00ebm p\u00ebr nj\u00eb ekip t\u00eb DevOps. Me nj\u00eb num\u00ebr t\u00eb till\u00eb l\u00ebshimesh, \u00ebsht\u00eb e pamundur t\u00eb kuptohet cilat porte, IP, integrime nevojiten. Prandaj, na nevojiteshin menaxher\u00eb t\u00eb sh\u00ebrbimeve t\u00eb trajnuar posa\u00e7\u00ebrisht, t\u00eb cil\u00ebt pyetnin ekipet: \"\u00c7far\u00eb ka n\u00eb t\u00eb v\u00ebrtet\u00eb dhe p\u00ebrse e keni ngritur k\u00ebt\u00eb?\"<\/p>\n<p>Pas gjith\u00eb atij q\u00eb ne lan\u00e7uam, inxhinieri i rrjetit n\u00eb vitin 2019 dukej k\u00ebshtu.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/ccca25d7f7bb7f70638725addc6d99ed.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Consul<\/h2>\n<p>\nVendos\u00ebm q\u00eb gjith\u00e7ka q\u00eb gjet\u00ebm me ndihm\u00ebn e menaxher\u00ebve t\u00eb sh\u00ebrbimeve, ta vendosim n\u00eb Consul dhe nga aty do t\u00eb shkruajm\u00eb rregullat e iptables.<\/p>\n<p>Si vendos\u00ebm ta b\u00ebjm\u00eb k\u00ebt\u00eb?<\/p>\n<ul>\n<li>Do t\u00eb mbledhim t\u00eb gjitha sh\u00ebrbimet, rrjetet dhe p\u00ebrdoruesit.<\/li>\n<li>Do t\u00eb b\u00ebjm\u00eb rregulla iptables mbi k\u00ebt\u00eb baz\u00eb.<\/li>\n<li>Do ta automatizojm\u00eb kontrollin.<\/li>\n<li>\u2026.<\/li>\n<li>PROFIT.<\/li>\n<\/ul>\n<p>\nConsul nuk \u00ebsht\u00eb nj\u00eb API i larg\u00ebt, ai mund t\u00eb punoj\u00eb n\u00eb \u00e7do nyje dhe t\u00eb shkruaj\u00eb n\u00eb iptables. Mbetej vet\u00ebm t\u00eb imagjinonim mjete automatike kontrolli, q\u00eb do t\u00eb pastronin t\u00eb tep\u00ebrt\u00ebn, dhe pjesa m\u00eb e madhe e problemeve do t\u00eb zgjidhej! Pjesa tjet\u00ebr do ta p\u00ebrmir\u00ebsonim gjat\u00eb procesit.<\/p>\n<h3>Pse Consul?<\/h3>\n<p>\n<strong>E ka treguar veten mir\u00eb. <\/strong>N\u00eb vitet 2014-15 ne e p\u00ebrdor\u00ebm si backend p\u00ebr Vault, ku ruajm\u00eb fjal\u00ebkalimet.<\/p>\n<p><strong>Nuk humb t\u00eb dh\u00ebna.<\/strong>. Gjat\u00eb p\u00ebrdorimit t\u00eb Consul, nuk ka humbur asnj\u00eb t\u00eb dh\u00ebn\u00eb gjat\u00eb ndonj\u00eb avarie. Kjo \u00ebsht\u00eb nj\u00eb avantazh i madh p\u00ebr sistemin e menaxhimit t\u00eb firewallit.<\/p>\n<p><strong>Lidhjet P2P p\u00ebrshpejtojn\u00eb p\u00ebrhapjen e ndryshimeve.<\/strong>. Me P2P, t\u00eb gjitha ndryshimet vijn\u00eb shpejt, nuk nevojitet t\u00eb pres\u00ebsh me or\u00eb t\u00eb t\u00ebra.<\/p>\n<p><strong>API REST i p\u00ebrshtatsh\u00ebm.<\/strong> Ne shqyrtuam gjithashtu Apache ZooKeeper, por nuk ka API REST, do t\u00eb duhej t\u00eb vendosnim disa zgjidhje t\u00eb p\u00ebrkohshme.<\/p>\n<p><strong>Punon si nj\u00eb depo e \u00e7el\u00ebsave (KV), po ashtu edhe si nj\u00eb katalog (Zbulojn\u00eb Sh\u00ebrbimet).<\/strong>. Mund t\u00eb ruash menj\u00ebher\u00eb sh\u00ebrbimet, katalog\u00ebt, qendrat e t\u00eb dh\u00ebnave. Kjo \u00ebsht\u00eb e p\u00ebrshtatshme jo vet\u00ebm p\u00ebr ne, por edhe p\u00ebr ekipet fqinj, pasi duke nd\u00ebrtuar nj\u00eb sh\u00ebrbim global, ne mendojm\u00eb me shkall\u00eb.<\/p>\n<p><strong>Shkruar n\u00eb Go, i cili \u00ebsht\u00eb pjes\u00eb e stek Wargaming. <\/strong>Ne e dashuri p\u00ebr k\u00ebt\u00eb gjuh\u00eb, kemi shum\u00eb zhvillues Go.<\/p>\n<p><strong>Nj\u00eb sistem t\u00eb fuqish\u00ebm ACL. <\/strong>Me ndihm\u00ebn e ACL n\u00eb Consul, mund t\u00eb menaxhojm\u00eb se kush dhe \u00e7far\u00eb mund t\u00eb shkruaj\u00eb. Ne garantojm\u00eb q\u00eb rregullat e firewall-it nuk do t\u00eb p\u00ebrputhen m\u00eb me asgj\u00eb tjet\u00ebr dhe se nuk do t\u00eb kemi probleme me k\u00ebt\u00eb.<\/p>\n<p>Por Consul ka edhe disavantazhe.<\/p>\n<ul>\n<li><strong>Nuk shtrihen brenda qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave, n\u00ebse nuk keni versionin biznes. <\/strong>Ai shtrihen vet\u00ebm n\u00ebp\u00ebrmjet federat\u00ebs.<\/li>\n<li><strong>Shum\u00eb var\u00ebs nga cil\u00ebsia e rrjetit dhe ngarkes\u00ebs s\u00eb server\u00ebve. <\/strong>Consul nuk do t\u00eb funksionoj\u00eb si nj\u00eb server n\u00eb nj\u00eb server t\u00eb ngarkuar, n\u00ebse ka vonesa n\u00eb rrjet, p\u00ebr shembull, shpejt\u00ebsi t\u00eb paparashikueshme. Kjo \u00ebsht\u00eb e lidhur me lidhjet P2P dhe modelet e shp\u00ebrndarjes s\u00eb p\u00ebrdit\u00ebsimeve.<\/li>\n<li><strong>Sfidat e monitorimit t\u00eb disponueshm\u00ebris\u00eb<\/strong>. Statusi i Consul mund t\u00eb tregoj\u00eb se gjith\u00e7ka \u00ebsht\u00eb mir\u00eb, nd\u00ebrsa ai ka vdekur prej kohe.<\/li>\n<\/ul>\n<p>\nShumic\u00ebn e k\u00ebtyre problemeve i kemi zgjidhur gjat\u00eb p\u00ebrdorimit t\u00eb Consul, prandaj e zgjodh\u00ebm at\u00eb. Kompania ka planifikuar nj\u00eb backend alternativ, por ne m\u00ebsuam t\u00eb trajtojm\u00eb problemet dhe p\u00ebr momentin jetojm\u00eb me Consul.<\/p>\n<h3>Si funksionon Consul<\/h3>\n<p>\nN\u00eb nj\u00eb qend\u00ebr t\u00eb dh\u00ebnash t\u00eb supozuar do t\u00eb vendosim server\u00eb - nga tre deri n\u00eb pes\u00eb. Nj\u00eb ose dy server\u00eb nuk do t\u00eb mjaftojn\u00eb: ata nuk do t\u00eb jen\u00eb n\u00eb gjendje t\u00eb organizojn\u00eb kuorum dhe t\u00eb vendosin se kush ka t\u00eb drejt\u00eb dhe kush gabon kur t\u00eb dh\u00ebnat nuk p\u00ebrputhen. M\u00eb shum\u00eb se pes\u00eb s'ka kuptim, performanca do t\u00eb jet\u00eb e ul\u00ebt.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/96153c4e9075b067b34a63ceba5b80f0.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKlient\u00ebt lidhen me serverat n\u00eb \u00e7do rend: t\u00eb nj\u00ebjtat agjent\u00eb, vet\u00ebm me flamurin <code>server = false<\/code>.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/0854d1286c18bb5e7c1130c6734154a9.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPas k\u00ebsaj, klient\u00ebt marrin nj\u00eb list\u00eb lidhjesh P2P dhe ndajn\u00eb lidhje mes tyre.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/2457cb7707c27cc23f6e13415119b91d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb nivel global, ne lidhim disa qendra t\u00eb t\u00eb dh\u00ebnave mes tyre. Ato gjithashtu lidhen P2P dhe komunikojn\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/3b4ae922eb8d2a6a9a79425e769505d7.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKur duam t\u00eb marrim t\u00eb dh\u00ebna nga nj\u00eb tjet\u00ebr qend\u00ebr t\u00eb dh\u00ebnash, k\u00ebrkesa shkon nga serveri n\u00eb server. Kjo skem\u00eb quhet <strong>protokolli Serf<\/strong>. Protokolli Serf, si dhe Consul, \u00ebsht\u00eb nj\u00eb zhvillim i HashiCorp.<\/p>\n<h3>Disa fakti t\u00eb r\u00ebnd\u00ebsishme p\u00ebr Consul<\/h3>\n<p>\nConsul ka dokumentacion q\u00eb shpjegon funksionimin e tij. Do t\u00eb sjell vet\u00ebm disa fakte p\u00ebr t\u00eb cilat vlen t\u00eb dini.<\/p>\n<p><strong>Serverat e Consul zgjedhin nj\u00eb master nga mes atyre q\u00eb votojn\u00eb<\/strong>. Consul zgjedh masterin nga lista e server\u00ebve p\u00ebr \u00e7do qend\u00ebr t\u00eb dh\u00ebnash, dhe t\u00eb gjitha k\u00ebrkesat shkojn\u00eb vet\u00ebm te ai, pavar\u00ebsisht numrit t\u00eb server\u00ebve. Ng\u00ebr\u00e7i i masterit nuk \u00e7on n\u00eb rizgjedhje. N\u00ebse masteri nuk \u00ebsht\u00eb zgjedhur - k\u00ebrkesat nuk sh\u00ebrbehen nga askush.<\/p>\n<blockquote><p>D\u00ebshironit t\u00eb b\u00ebni p\u00ebrmasim horizontal? M\u00eb vjen keq, jo.<\/p><\/blockquote>\n<p> K\u00ebrkesa n\u00eb nj\u00eb qend\u00ebr t\u00eb dh\u00ebnash tjet\u00ebr shkon nga masteri deri te masteri, pavar\u00ebsisht se n\u00eb cilin server ka arritur. Masteri i zgjedhur merr 100% ngarkes\u00ebs, p\u00ebrve\u00e7 ngarkes\u00ebs p\u00ebr p\u00ebrparimin e k\u00ebrkesave. Nj\u00eb kopje e sakt\u00eb e t\u00eb dh\u00ebnave ekziston n\u00eb t\u00eb gjith\u00eb server\u00ebt e qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave, por p\u00ebrgjigjet vet\u00ebm nj\u00eb.<\/p>\n<blockquote><p>M\u00ebnyra e vetme p\u00ebr t\u00eb shkall\u00ebzuar \u00ebsht\u00eb t\u00eb aktivizoni modalitetin stale n\u00eb klient.<\/p><\/blockquote>\n<p>N\u00eb modalitetin stale mund t\u00eb p\u00ebrgjigjeni pa kvorum. Ky \u00ebsht\u00eb nj\u00eb modalitet n\u00eb t\u00eb cilin heqim dor\u00eb nga q\u00ebndrueshm\u00ebria e t\u00eb dh\u00ebnave, por lexojm\u00eb pak m\u00eb shpejt se zakonisht, dhe \u00e7do server p\u00ebrgjigjet. Natyrisht, regjistrimi b\u00ebhet vet\u00ebm p\u00ebrmes masterit.<\/p>\n<p><strong>Consul nuk kopjon t\u00eb dh\u00ebna midis qendrave t\u00eb t\u00eb dh\u00ebnave.<\/strong>. N\u00eb mbledhjen e federat\u00ebs, \u00e7do server do t\u00eb ket\u00eb vet\u00ebm t\u00eb dh\u00ebnat e tij. P\u00ebr t\u00eb tjerat, ai gjithmon\u00eb k\u00ebrkon ndihm\u00ebn e dikujt tjet\u00ebr.<\/p>\n<p><strong>Aksioni i atomizuar nuk garanton jasht\u00eb transaksionit<\/strong>. Mbani mend se di\u00e7ka mund t\u00eb ndryshohet jo vet\u00ebm nga ju. N\u00ebse d\u00ebshironi ndryshe, b\u00ebni nj\u00eb transaksion me bllokim.<\/p>\n<p><strong>Operacionet e bllokimit nuk garantojn\u00eb bllokimin<\/strong>. K\u00ebrkesa shkon nga masteri n\u00eb master, e jo direkt, k\u00ebshtu q\u00eb nuk ka garanci q\u00eb bllokimi do t\u00eb funksionoj\u00eb kur ju b\u00ebni bllokimin, p\u00ebr shembull, n\u00eb nj\u00eb qend\u00ebr t\u00eb dh\u00ebnash tjet\u00ebr.<\/p>\n<p><strong>ACL gjithashtu nuk garanton qasje (n\u00eb shum\u00eb raste)<\/strong>. ACL mund t\u00eb mos funksionoj\u00eb, sepse ruhet n\u00eb nj\u00eb qend\u00ebr t\u00eb dh\u00ebnash t\u00eb federat\u00ebs \u2014 n\u00eb qendr\u00ebn e t\u00eb dh\u00ebnave ACL (DC Kryesor). N\u00ebse DC juaj nuk p\u00ebrgjigjet, ACL do t\u00eb ndaloj\u00eb.<\/p>\n<p><strong>Nj\u00eb master i ngritur do t\u00eb \u00e7oj\u00eb n\u00eb ngritjen e t\u00ebr\u00eb federat\u00ebs<\/strong>. P\u00ebr shembull, n\u00eb nj\u00eb federat\u00eb me 10 qendra t\u00eb t\u00eb dh\u00ebnash, dhe n\u00eb nj\u00ebra prej tyre ka nj\u00eb rrjet t\u00eb keq, dhe nj\u00eb master bie. T\u00eb gjith\u00eb ata q\u00eb komunikojn\u00eb me t\u00eb do t\u00eb ngjiten n\u00eb nj\u00eb rreth: po shkon nj\u00eb k\u00ebrkes\u00eb, nuk ka p\u00ebrgjigje p\u00ebr t\u00eb, rrjedha ngec. Nuk do t\u00eb keni mund\u00ebsi t\u00eb dini kur do t\u00eb ndodh\u00eb kjo, thjesht pas nj\u00eb ore ose dy do t\u00eb bjer\u00eb e gjith\u00eb federata. Nuk do t\u00eb keni mund\u00ebsi t\u00eb b\u00ebni asgj\u00eb p\u00ebr k\u00ebt\u00eb.<\/p>\n<p>Statusi, kvorumi dhe zgjedhjet p\u00ebrpunohen n\u00eb nj\u00eb rrjedh t\u00eb ve\u00e7ant\u00eb. Nuk do t\u00eb ket\u00eb rizgjedhje, statusi nuk do t\u00eb tregoj\u00eb asgj\u00eb. Ju mendoni se keni nj\u00eb Consul aktiv, k\u00ebrkoni, dhe nuk ndodh asgj\u00eb \u2014 nuk ka p\u00ebrgjigje. Por statusi tregon se gjith\u00e7ka \u00ebsht\u00eb n\u00eb rregull.<\/p>\n<p>Ne kemi hasur n\u00eb k\u00ebt\u00eb problem, na \u00ebsht\u00eb dashur t\u00eb riparojm\u00eb pjes\u00eb specifike t\u00eb qendrave t\u00eb t\u00eb dh\u00ebnave p\u00ebr ta shmangur at\u00eb.<\/p>\n<p><strong>N\u00eb versionin e biznesit t\u00eb Consul Enterprise nuk ka disa nga disavantazhet e m\u00ebsip\u00ebrme.<\/strong>. Ai \u00ebsht\u00eb shum\u00eb funksione t\u00eb dobishme: zgjedhja e votuesve, shp\u00ebrndarja, shkall\u00ebzimi. Ka vet\u00ebm nj\u00eb \"por\" - sistemi i licencimit p\u00ebr sistemin e shp\u00ebrndar\u00eb \u00ebsht\u00eb shum\u00eb i shtrenjt\u00eb.<\/p>\n<p>K\u00ebshill\u00eb: <code>rm -rf \/var\/lib\/consul<\/code> - ila\u00e7 p\u00ebr t\u00eb gjitha s\u00ebmundjet e agjentit. N\u00ebse di\u00e7ka nuk funksionon, thjesht fshini t\u00eb dh\u00ebnat tuaja dhe ngarkoni t\u00eb dh\u00ebnat nga kopja. Me shum\u00eb gjasa, Consul do t\u00eb funksionoj\u00eb.<\/p>\n<h2>BEFW<\/h2>\n<p>\nTani do t\u00eb flasim p\u00ebr at\u00eb q\u00eb kemi shtuar n\u00eb Consul.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/wgnet\/befw\">BEFW<\/a><\/noindex> - \u00ebsht\u00eb nj\u00eb akronim nga <strong>B<\/strong>ack<strong>E<\/strong>nd<strong>F<\/strong>ire<strong>W<\/strong>all. Duhej t\u00eb kishte nj\u00eb em\u00ebr p\u00ebr produktin kur krijoja depo, n\u00eb t\u00eb cilin t\u00eb vendosja testet e para. Ky em\u00ebr mbeti.<\/p>\n<h3>Shabllonet e rregullave<\/h3>\n<p>\nRregullat jan\u00eb shkruar n\u00eb sintaks\u00ebn e iptables.<\/p>\n<ul>\n<li>-N BEFW<\/li>\n<li>-P INPUT DROP<\/li>\n<li>-A INPUT -m state&mdash;state RELATED,ESTABLISHED -j ACCEPT<\/li>\n<li>-A INPUT -i lo -j ACCEPT<\/li>\n<li>-A INPUT -j BEFW<\/li>\n<\/ul>\n<p>\nT\u00eb gjitha shkojn\u00eb n\u00eb zinxhirin BEFW, p\u00ebrve\u00e7 <code>T\u00cb KRIJUARA<\/code>, <code>RELATED<\/code> dhe localhost. Shablloni mund t\u00eb jet\u00eb \u00e7far\u00ebdo, \u00ebsht\u00eb thjesht nj\u00eb shembull.<\/p>\n<p>\u00c7far\u00eb dobi ka BEFW?<\/p>\n<h3>Sh\u00ebrbimet<\/h3>\n<p>\nKemi nj\u00eb sh\u00ebrbim, gjithmon\u00eb ka nj\u00eb port, nodo, n\u00eb t\u00eb cilin funksionon. Nga nodoja jon\u00eb mund t\u00eb pyesim lokalish agjentin dhe t\u00eb kuptojm\u00eb se kemi nj\u00eb sh\u00ebrbim. Gjithashtu mund t\u00eb vendosim etiketat.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/6d8c74db37e2e1eed971cfa6947cc5c8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCdo sh\u00ebrbim q\u00eb \u00ebsht\u00eb aktiv dhe regjistruar n\u00eb Consul, kthehet n\u00eb nj\u00eb rregull t\u00eb iptables. Kemi SSH - hapim portin 22. Skripti i Bash-it \u00ebsht\u00eb i thjesht\u00eb: curl dhe iptables, nuk ka nevoj\u00eb p\u00ebr gj\u00eb tjet\u00ebr.<\/p>\n<h3>Klient\u00ebt<\/h3>\n<p>\nSi t\u00eb hapim qasje jo p\u00ebr t\u00eb gjith\u00eb, por p\u00ebrzgjedh\u00ebs? Me emrin e sh\u00ebrbimit, vendosni listat e IP-ve n\u00eb depozitat KV.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/11a5af5aad9e848565458f168a1eee64.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr shembull, duam q\u00eb t\u00eb gjith\u00eb nga rrjeti i dhjet\u00eb t\u00eb mund t\u00eb aksesojn\u00eb sh\u00ebrbimin SSH_TCP_22. Shtojm\u00eb nj\u00eb fush\u00eb t\u00eb vog\u00ebl TTL? dhe tani kemi lejet e p\u00ebrkohshme, p\u00ebr shembull, p\u00ebr nj\u00eb dit\u00eb.<\/p>\n<h3>Qasjet<\/h3>\n<p>\nLidhim sh\u00ebrbimet dhe klient\u00ebt: kemi nj\u00eb sh\u00ebrbim, p\u00ebr \u00e7do nj\u00ebsi ka depozit\u00eb KV t\u00eb gatshme. Tani ne ofrojm\u00eb qasje jo p\u00ebr t\u00eb gjith\u00eb, por p\u00ebrzgjedh\u00ebs.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/d1119fbb226595184cac8d9ce7a924e3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Grupet<\/h3>\n<p>\nN\u00ebse \u00e7do her\u00eb do t\u00eb shkruajm\u00eb mij\u00ebra IP p\u00ebr qasje, do t\u00eb lodhemi. Do t\u00eb krijojm\u00eb grupe - nj\u00eb n\u00ebngrup t\u00eb ve\u00e7ant\u00eb n\u00eb KV. Do ta quajm\u00eb Alias (ose grupe) dhe do t\u00eb ruajm\u00eb atje grupet sipas t\u00eb nj\u00ebjtit parim.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/67c6ab76cc25a3973739bdd44b69cef9.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLidhim: tani mund t\u00eb hapim SSH jo ve\u00e7an\u00ebrisht n\u00eb P2P, por n\u00eb nj\u00eb grup t\u00eb t\u00ebr\u00eb ose disa grupe. Po ashtu ka TTL - mund t\u00eb shtojm\u00eb n\u00eb grup dhe t\u00eb largojm\u00eb nga grupi p\u00ebrkoh\u00ebsisht.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/a00b7db5087a96730c2725090f33e2b0.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Integrimi<\/h3>\n<p>\nProblemi yn\u00eb &mdash;&nbsp;faktori njer\u00ebzor dhe automatizimi. P\u00ebr momentin e kemi zgjidhur k\u00ebshtu.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/ce7a0c16543d0624453e6bdada3b8f03.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNe punojm\u00eb me Puppet dhe i transferojm\u00eb gjith\u00e7ka q\u00eb ka t\u00eb b\u00ebj\u00eb me sistemin (kodin e aplikacioneve). N\u00eb puppetdb (nj\u00eb PostgreSQL i zakonsh\u00ebm) ruhet lista e sh\u00ebrbimeve q\u00eb jan\u00eb aktivizuar atje, mund t'i gjejm\u00eb ato sipas llojit t\u00eb burimeve. Atje gjithashtu mund t\u00eb gjejm\u00eb se kush e th\u00ebrret cil\u00ebn. Po ashtu, kemi nj\u00eb sistem pull request dhe merge request p\u00ebr k\u00ebt\u00eb.<\/p>\n<p>Kemi shkruar befw-sync \u2014 nj\u00eb zgjidhje shum\u00eb t\u00eb thjesht\u00eb q\u00eb ndihmon n\u00eb transferimin e t\u00eb dh\u00ebnave. Fillimisht cookies sync i drejtohen puppetdb. Atje \u00ebsht\u00eb e konfiguruar HTTP API: k\u00ebrkojm\u00eb cilat sh\u00ebrbime kemi, \u00e7far\u00eb duhet b\u00ebr\u00eb. M\u00eb pas b\u00ebjn\u00eb nj\u00eb k\u00ebrkes\u00eb n\u00eb Consul.<\/p>\n<p>A ka integrim? Po: kemi shkruar rregulla, lejuam pranimin e Pull Request. A duhen ndonj\u00eb port ose t\u00eb shtojm\u00eb nj\u00eb host n\u00eb ndonj\u00eb grup? Pull Request, shqyrtim \u2014 pa ndonj\u00eb \u201cGjej 200 ACL t\u00eb tjera dhe provoj di\u00e7ka me k\u00ebt\u00eb.\u201d<\/p>\n<h3>Optimizimi<\/h3>\n<p>\nPing localhost me nj\u00eb zinxhir rregullash t\u00eb zbraz\u00ebt z\u00eb 0,075 ms.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/39263844f79c4795af05dc3ecb734394.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDo t\u00eb shtojm\u00eb n\u00eb k\u00ebt\u00eb zinxhir 10,000 adresat e iptables. Si rezultat, ping do t\u00eb rritet 5 her\u00eb: iptables \u00ebsht\u00eb plot\u00ebsisht lineare, trajtimi i \u00e7do adrese merr nj\u00ebfar\u00eb kohe.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/e6c314155c3a34fdf61e40479ecb26c3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr firewall-in, n\u00eb t\u00eb cilin migrojm\u00eb mij\u00ebra ACL, kemi shum\u00eb rregulla, dhe kjo sjell vones\u00eb. Kjo \u00ebsht\u00eb keq p\u00ebr protokollet e loj\u00ebrave.<\/p>\n<p>Por n\u00ebse ne vendosim <strong>10,000 adresat n\u00eb ipset<\/strong> ping do t\u00eb shkurtohet edhe m\u00eb shum\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/2dd844d9324d057ba9ab098e501a1e51.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKuptimi \u00ebsht\u00eb se \"O\" (kompleksiteti i algoritmit) p\u00ebr ipset \u00ebsht\u00eb gjithmon\u00eb 1, sa her\u00eb q\u00eb rregullat jan\u00eb atje. E v\u00ebrtet\u00eb, ka nj\u00eb kufizim \u2014 rregullat nuk mund t\u00eb jen\u00eb m\u00eb shum\u00eb se 65,535. Deri tani po e mbajm\u00eb k\u00ebshtu: mund t'i kombinojm\u00eb, t\u00eb zgjerojm\u00eb, t\u00eb b\u00ebjm\u00eb dy ipset n\u00eb nj\u00eb.<\/p>\n<h3>Ruajtja<\/h3>\n<p>\nNj\u00eb vazhdim logjik i procesit t\u00eb iteracioneve \u00ebsht\u00eb ruajtja e informacionit mbi klient\u00ebt p\u00ebr sh\u00ebrbimin n\u00eb ipset.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/126069799d95594be8611237e935189d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTani kemi t\u00eb nj\u00ebjtin SSH, dhe nuk shkruajm\u00eb menj\u00ebher\u00eb 100 IP, por caktojm\u00eb emrin e ipset me t\u00eb cilin duhet t\u00eb komunikojm\u00eb, dhe rregullin tjet\u00ebr <code>DROP<\/code>. Mund ta ndryshojm\u00eb n\u00eb nj\u00eb rregull \"Kush nuk \u00ebsht\u00eb k\u00ebtu, at\u00ebher\u00eb DROP\", por k\u00ebshtu \u00ebsht\u00eb m\u00eb e dukshme.<\/p>\n<p>Tani kemi rregulla dhe sete. Detyra kryesore \u00ebsht\u00eb t\u00eb b\u00ebjm\u00eb nj\u00eb set para se t\u00eb shkruajm\u00eb nj\u00eb rregull, sepse p\u00ebrndryshe iptables nuk do ta regjistroj\u00eb rregullin.<\/p>\n<h3>Schema e p\u00ebrgjithshme<\/h3>\n<p>\nN\u00eb form\u00ebn e nj\u00eb skeme, gjith\u00e7ka q\u00eb kam treguar duket k\u00ebshtu.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/4046e921cb5f466f8af5a6af1fcd151c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPo commit-ojm\u00eb n\u00eb Puppet, gjith\u00e7ka d\u00ebrgohet n\u00eb host, sh\u00ebrbimet jan\u00eb k\u00ebtu, ipset atje, dhe kush nuk \u00ebsht\u00eb regjistruar atje, nuk lejohet.<\/p>\n<h3>Lejo &amp; amp; moho<\/h3>\n<p>\nP\u00ebr t\u00eb shp\u00ebrndar\u00eb shpejt bot\u00ebn ose p\u00ebr t\u00eb \u00e7aktivizuar dik\u00eb shpejt, n\u00eb fillim t\u00eb t\u00eb gjitha zinxhir\u00ebve krijuam dy ipset: <code>rules_allow<\/code> dhe <code>rules_deny<\/code>. Si funksionon kjo?<\/p>\n<p>P\u00ebr shembull, dikush krijon ngarkes\u00eb n\u00eb Web-in ton\u00eb me bota. M\u00eb par\u00eb duheshin gjetur log-et e IP-s\u00eb s\u00eb tij, t'i drejtoheshin inxhinier\u00ebve rrjet\u00eb q\u00eb t\u00eb gjenin burimin e trafikut dhe ta bllokonin at\u00eb. Tani kjo duket ndryshe.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/6e7f906919536cab2c283ba6ceb0472d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nD\u00ebrgojm\u00eb n\u00eb Consul, presim 2.5 s, dhe \u00ebsht\u00eb gati. Duke qen\u00eb se Consul ndan shpejt p\u00ebrmes P2P, funksionon kudo, n\u00eb \u00e7do pjes\u00eb t\u00eb bot\u00ebs.<\/p>\n<p>Nj\u00eb her\u00eb e ndalova plot\u00ebsisht WOT-in, duke u ngat\u00ebrruar me fire\u00eball-in. <code>rules_allow<\/code> Kjo \u00ebsht\u00eb sigurimi yn\u00eb p\u00ebr raste t\u00eb tilla. N\u00ebse gabojm\u00eb diku me fire\u00eball-in, di\u00e7ka do t\u00eb bllokohet diku, gjithmon\u00eb mund t\u00eb d\u00ebrgojm\u00eb nj\u00eb <code>0.0\/0<\/code>, p\u00ebr ta ngritur gjith\u00e7ka shpejt. M\u00eb pas do t'i rregullojm\u00eb gjith\u00e7ka me duar.<\/p>\n<h3>Grupet e tjera<\/h3>\n<p>\nMund t\u00eb shtoni \u00e7do grup tjet\u00ebr n\u00eb hap\u00ebsir\u00eb <code>$IPSETS$<\/code>.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/4e1e337b35da81cd7324b2adc106b085.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPse? Ndonj\u00ebher\u00eb dikush ka nevoj\u00eb p\u00ebr ipset, p\u00ebr shembull, p\u00ebr t\u00eb imituar fikjen e ndonj\u00eb pjese t\u00eb klasit. \u00c7dokush mund t\u00eb sjell\u00eb \u00e7do grup, t'i jap\u00eb emra dhe ata do t\u00eb merren nga Consul. K\u00ebto grupe mund si t\u00eb marrin pjes\u00eb n\u00eb rregullat iptables, ashtu edhe t\u00eb jen\u00eb si nj\u00eb komand\u00eb <code>NOOP<\/code>: konsistenca do t\u00eb mb\u00ebshtetet nga demoni.<\/p>\n<h3>P\u00ebrdoruesit<\/h3>\n<p>\nM\u00eb par\u00eb, p\u00ebrdoruesi lidhej me rrjetin dhe merrte parametrat p\u00ebrmes domain-it. Para se t\u00eb shfaqeshin fire\u00eball-et e brezit t\u00eb ri, Cisco nuk dinte t\u00eb kuptonte se ku ishte p\u00ebrdoruesi dhe ku ishte IP. Prandaj, qasjeja jepeshin vet\u00ebm p\u00ebrmes hostname-it t\u00eb makin\u00ebs.<\/p>\n<p>\u00c7far\u00eb b\u00ebm\u00eb ne? U p\u00ebrfshim n\u00eb momentin e marrjes s\u00eb adres\u00ebs. Zakonisht kjo \u00ebsht\u00eb dot1x, Wi-Fi ose VPN \u2014 gjith\u00e7ka kalon p\u00ebrmes RADIUS. P\u00ebr \u00e7do p\u00ebrdorues krijojm\u00eb nj\u00eb grup sipas emrit t\u00eb p\u00ebrdoruesit dhe vendosim n\u00eb t\u00eb IP me TTL, q\u00eb \u00ebsht\u00eb i barabart\u00eb me dhcp.lease e tij \u2014 sapo t\u00eb p\u00ebrfundoj\u00eb, rregulli do t\u00eb zhduket.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/04550475c6af49d094c18b1d5b89123a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTani mund t\u00eb hapim aksesin n\u00eb sh\u00ebrbime, ashtu si n\u00eb grupet e tjera, sipas emrit t\u00eb p\u00ebrdoruesit. E shp\u00ebtuam veten nga dhimbja me hostname-in, kur ato ndodhin t\u00eb ndryshojn\u00eb, dhe e heq\u00ebm ngarkes\u00ebn nga inxhinier\u00ebt rrjet\u00eb, sepse ata nuk kan\u00eb m\u00eb nevoj\u00eb p\u00ebr Cisco. Tani inxhinier\u00ebt vet\u00eb p\u00ebrcaktojn\u00eb qasjet n\u00eb serverat e tyre.<\/p>\n<h3>Izolimi<\/h3>\n<p>\nParalelisht, filluam t\u00eb shqyrtonim izolimin. Menaxher\u00ebt e sh\u00ebrbimeve b\u00ebn\u00eb nj\u00eb inventar dhe ne analizuam t\u00eb gjitha rrjetet tona. Do t'i ndajm\u00eb ato n\u00eb grupe t\u00eb tilla, dhe n\u00eb server\u00ebt p\u00ebrkat\u00ebs grupet i shtuam, p\u00ebr shembull, n\u00eb deny. Tani e nj\u00ebjta izolim e stagingut p\u00ebrfundon n\u00eb rules_deny t\u00eb prodhimit, por jo n\u00eb prodhimin vet\u00eb.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/60fe7407013aa64b853791f8def627cc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSkema funksionon shpejt dhe thjesht\u00eb: heqim t\u00eb gjitha ACL-t\u00eb nga server\u00ebt, ngarkojm\u00eb pajisjet, ulim numrin e VLAN-eve t\u00eb izoluara.<\/p>\n<h3>Kontrolli i integritetit<\/h3>\n<p>\nM\u00eb par\u00eb, na kishte nj\u00eb trigger t\u00eb ve\u00e7ant\u00eb q\u00eb informonte kur dikush ndryshonte rregullin e firewall-it manualisht. Un\u00eb shkrova nj\u00eb lintr t\u00eb madh p\u00ebr kontrollin e rregullave t\u00eb firewall-it, ishte e v\u00ebshtir\u00eb. Tani, integritetin e kontrollon BEFW. Ai e ndjek me rigorozitet q\u00eb rregullat q\u00eb ai krijon t\u00eb mos ndryshojn\u00eb. N\u00ebse dikush ndryshon rregullat e firewall-it, ai do t'i kthej\u00eb s\u00ebrish n\u00eb gjendjen e m\u00ebparshme. \"E ngrita shpejt nj\u00eb proxy p\u00ebr t\u00eb punuar nga sht\u00ebpia\" \u2014 k\u00ebto mund\u00ebsi nuk ekzistojn\u00eb m\u00eb.<\/p>\n<p>BEFW kontrollon ipset nga sh\u00ebrbimet dhe lista n\u00eb befw.conf, rregullat e sh\u00ebrbimeve n\u00eb zinxhirin BEFW. Por nuk ndjek zinxhir\u00eb t\u00eb tjer\u00eb dhe rregulla dhe ipset t\u00eb tjera.<\/p>\n<h3>Mbrojtje nga defektet<\/h3>\n<p>\nBEFW gjithmon\u00eb ruan gjendjen e fundit t\u00eb suksesshme drejtp\u00ebrdrejt n\u00eb struktur\u00ebn binar state.bin. N\u00ebse ndodhi ndonj\u00eb problem, ai gjithmon\u00eb kthehet prapa n\u00eb k\u00ebt\u00eb state.bin.<\/p>\n<p><img decoding=\"async\" alt=\"Consul + iptables = :3\" src=\"\/wp-content\/uploads\/2020\/02\/724f3537c06a7135fa6397f9ddd5630f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKjo \u00ebsht\u00eb nj\u00eb sigurim nga puna jo e q\u00ebndrueshme e Consul, kur ai nuk d\u00ebrgon t\u00eb dh\u00ebna ose dikush gabon dhe p\u00ebrdor rregulla q\u00eb nuk mund t\u00eb aplikohen. Q\u00eb t\u00eb mos mbetemi pa firewall, BEFW do t\u00eb kthehet n\u00eb gjendjen e fundit, n\u00ebse ndonj\u00ebher\u00eb ndodh nj\u00eb gabim.<\/p>\n<p>N\u00eb situata kritike, kjo \u00ebsht\u00eb garancia q\u00eb ne do t\u00eb q\u00ebndrojm\u00eb me nj\u00eb firewall funksional. Ne hapim t\u00eb gjitha rrjetet e gris\u00eb n\u00eb shpres\u00eb se administratori do t\u00eb vij\u00eb dhe do ta rregulloj\u00eb. Ndonj\u00ebher\u00eb do ta nxjerr k\u00ebt\u00eb n\u00eb konfigurime, por tani kemi thjesht tre rrjete gri: 10\/8, 172\/12 dhe 192.168\/16. N\u00eb kuad\u00ebr t\u00eb Consul ton\u00eb, kjo \u00ebsht\u00eb nj\u00eb ve\u00e7ori e r\u00ebnd\u00ebsishme q\u00eb ndihmon n\u00eb avancimin m\u00eb tej.<\/p>\n<p><em>Demo: gjat\u00eb prezantimit, Ivan tregon modalitetin demo t\u00eb funksionimit t\u00eb BEFW. \u00cbsht\u00eb m\u00eb e leht\u00eb t\u00eb shikohet demoja n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/4zP67uYnsR4?t=1663\">video<\/a><\/noindex>. Kodi burimor i demos \u00ebsht\u00eb i disponuesh\u00ebm <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/wgnet\/befw\/tree\/master\/demo\">n\u00eb GitHub<\/a><\/noindex>.<\/em><\/p>\n<h2>Pengesa<\/h2>\n<p>\nDo t'ju flas p\u00ebr bug-at me t\u00eb cilat na u desh t\u00eb p\u00ebrballemi.<\/p>\n<p><strong>ipset add set 0.0.0.0\/0. <\/strong>\u00c7far\u00eb do t\u00eb ndodh\u00eb n\u00ebse shtoni n\u00eb ipset 0.0.0.0\/0? A do t\u00eb shtohen t\u00eb gjitha IP-t\u00eb? A do t\u00eb hapet qasja n\u00eb internet? <\/p>\n<p>Jo, do t\u00eb marrim nj\u00eb bug q\u00eb na kushtoi dy or\u00eb ndales\u00eb. P\u00ebr m\u00eb tep\u00ebr, bug-u nuk punon q\u00eb nga viti 2016, ndodhet n\u00eb RedHat Bugzilla me numrin #1297092, dhe ne e gjet\u00ebm at\u00eb rast\u00ebsisht \u2014 nga raporti i zhvilluesit.<\/p>\n<p>Tani n\u00eb BEFW ka nj\u00eb rregull t\u00eb fort\u00eb q\u00eb <code>0.0.0.0\/0<\/code> shnd\u00ebrrohet n\u00eb dy adresa: <code>0.0.0.0\/1<\/code> dhe <code>128.0.0.0\/1<\/code>.<\/p>\n<p><strong>ipset restore set &lt; file. <\/strong>\u00c7far\u00eb b\u00ebn ipset kur i thoni <code>restore<\/code>? \u0412\u044b \u0434\u0443\u043c\u0430\u0435\u0442\u0435, \u043e\u043d \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0442\u0430\u043a\u0436\u0435, \u043a\u0430\u043a iptables? \u0412\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442 \u0434\u0430\u043d\u043d\u044b\u0435?<\/p>\n<p>Nuk ka asgj\u00eb t\u00eb ngjashme \u2014 ai b\u00ebn nj\u00eb bashkim, dhe adresat e vjetra nuk zhduken, qasja nuk e mbyllni.<\/p>\n<p>E gjet\u00ebm bug-un kur testonim izolimin. Tani ka nj\u00eb sistem mjaft t\u00eb komplikuar \u2014 n\u00eb vend t\u00eb <code>restore<\/code> po krijohet <code>create temp<\/code>, pastaj <code>restore flush temp<\/code> dhe <code>restore temp<\/code>. N\u00eb fund swap: p\u00ebr atomik\u00ebn, sepse n\u00ebse fillimisht b\u00ebni <code>flush<\/code> dhe n\u00eb k\u00ebt\u00eb moment do t\u00eb vij\u00eb nj\u00eb paket\u00eb, ajo do t\u00eb refuzohet dhe di\u00e7ka do t\u00eb shkoj\u00eb keq. Prandaj ka pak magji t\u00eb zez\u00eb.<\/p>\n<p><strong>consul kv get -datacenter=other. <\/strong>Si\u00e7 e thash\u00eb edhe m\u00eb par\u00eb, mendojm\u00eb se po k\u00ebrkojm\u00eb disa t\u00eb dh\u00ebna, por do t\u00eb marrim ose t\u00eb dh\u00ebna, ose nj\u00eb gabim. Mund ta b\u00ebjm\u00eb k\u00ebt\u00eb p\u00ebrmes Consul lokal, por dhe n\u00eb k\u00ebt\u00eb rast do t\u00eb ngrij\u00eb, dhe e dyta.<\/p>\n<p>Klienti lokal i Consul \u00ebsht\u00eb nj\u00eb mbulim mbi API-n\u00eb HTTP. Por ai thjesht ngrin dhe nuk p\u00ebrgjigjet as n\u00eb Ctrl+C, as n\u00eb Ctrl+Z, asgj\u00eb, vet\u00ebm n\u00eb <code>kill -9<\/code> n\u00eb konsol\u00ebn fqinj\u00ebsore. Kemi hasur k\u00ebt\u00eb kur nd\u00ebrtuam nj\u00eb grumbull t\u00eb madh. Por p\u00ebr momentin nuk kemi ndonj\u00eb zgjidhje, po e p\u00ebrgatisim p\u00ebr ta rregulluar k\u00ebt\u00eb gabim n\u00eb Consul.<\/p>\n<p><strong>Kryesori i Consul nuk po p\u00ebrgjigjet. <\/strong>Ne nuk kemi p\u00ebrgjigje nga masteri n\u00eb data-qend\u00ebr, mendojm\u00eb: \"Me siguri tani do t\u00eb aktivizohet algoritmi i rip\u00ebrzgjedhjes?\" <\/p>\n<p>Jo, nuk do t\u00eb aktivizohet, dhe monitorimi nuk do t\u00eb tregoj\u00eb asgj\u00eb: Consul do t\u00eb thot\u00eb se indeksi i angazhimit ekziston, lideri \u00ebsht\u00eb gjetur, t\u00eb gjitha jan\u00eb n\u00eb rregull.<\/p>\n<p>Si po e lutemi k\u00ebt\u00eb? <code>service consul restart<\/code> n\u00eb cron \u00e7do or\u00eb. N\u00ebse keni 50 server\u00eb - nuk \u00ebsht\u00eb aq e frikshme. Kur t\u00eb keni 16,000, do ta kuptoni se si funksionon.<\/p>\n<h2>P\u00ebrfundimi<\/h2>\n<p>\nN\u00eb fund, mor\u00ebm k\u00ebto p\u00ebrfitime:<\/p>\n<ul>\n<li>100% mbulimin e t\u00eb gjitha makinave Linux.<\/li>\n<li>Shpejt\u00ebsia.<\/li>\n<li>Automatizimin.<\/li>\n<li>\u00c7liruan harduerin dhe inxhinier\u00ebt e rrjetit nga skllav\u00ebria.<\/li>\n<li>Kemi p\u00ebrmir\u00ebsuar mund\u00ebsit\u00eb p\u00ebr integrim, t\u00eb cilat jan\u00eb praktikisht t\u00eb pakufizuara: me Kubernetes, me Ansible, me Python.<\/li>\n<\/ul>\n<p>\n<strong>Kundrat<\/strong>: Consul, me t\u00eb cilin tani duhet t\u00eb jetojm\u00eb, dhe nj\u00eb \u00e7mim shum\u00eb i lart\u00eb p\u00ebr gabim. Si nj\u00eb shembull, nj\u00eb her\u00eb n\u00eb 6 pasdite (ora kryesore n\u00eb Rusi) po rregulloja di\u00e7ka n\u00eb listat e rrjetit. At\u00ebher\u00eb sapo po nd\u00ebrtoshim izolimin n\u00eb BEFW. Gabova diku, mendon se caktova nj\u00eb mask\u00eb t\u00eb gabuar, por gjith\u00e7ka u shemb n\u00eb dy sekonda. Monitorimi ndizet, dhe vijn\u00eb mb\u00ebshtet\u00ebsit: \"Gjith\u00e7ka \u00ebsht\u00eb bllokuar!\" Shefi i departamentit b\u00ebri lesht kur shpjegonte biznesit pse ndodhi kjo.<\/p>\n<p>\u00c7mimi i gabimit \u00ebsht\u00eb aq i lart\u00eb, saq\u00eb shpik\u00ebm nj\u00eb procedur\u00eb komplekse p\u00ebr parandalimin. N\u00ebse do ta zbatoni k\u00ebt\u00eb n\u00eb nj\u00eb prodhim t\u00eb madh, mos jepni master-tokenin mbi Consul p\u00ebr t\u00eb gjith\u00eb sa her\u00eb. Kjo do t\u00eb p\u00ebrfundoj\u00eb keq.<\/p>\n<p><strong>Kostoja. <\/strong>Kam shkruar kodin p\u00ebr 400 or\u00eb vet\u00ebm. N\u00eb mb\u00ebshtetje, ekipi im prej 4 personash shpenzon 10 or\u00eb n\u00eb muaj p\u00ebr t\u00eb gjith\u00eb. Krahasuar me \u00e7mimin e \u00e7do firewalla t\u00eb brezi t\u00eb ri, kjo \u00ebsht\u00eb falas.<\/p>\n<p><strong>Planet. <\/strong>Plani afatgjat\u00eb \u00ebsht\u00eb t\u00eb gjejm\u00eb nj\u00eb transport alternativ si z\u00ebvend\u00ebsim apo shtes\u00eb p\u00ebr Consul. Ndoshta do t\u00eb jet\u00eb Kafka ose di\u00e7ka e ngjashme. Por n\u00eb vitet n\u00eb vazhdim do t\u00eb jetojm\u00eb me Consul.<\/p>\n<p>Planet m\u00eb t\u00eb af\u00ebrta: integrimi me Fail2ban, me monitorimin, me nftables, ndoshta, me distribucione t\u00eb tjera, metrika, monitorim t\u00eb avancuar, optimizim. N\u00eb planet \u00ebsht\u00eb edhe mb\u00ebshtetje p\u00ebr Kubernetes, sepse tani kemi disa klaster\u00eb dhe d\u00ebshir\u00eb.<\/p>\n<p>Edhe nga planet:<\/p>\n<ul>\n<li>k\u00ebrkimi i anomali n\u00eb trafik;<\/li>\n<li>menaxhimi i hart\u00ebs s\u00eb rrjetit;<\/li>\n<li>mb\u00ebshtetje p\u00ebr Kubernetes;<\/li>\n<li>nd\u00ebrtimi i paketave p\u00ebr t\u00eb gjitha sistemet;<\/li>\n<li>Web-UI.<\/li>\n<\/ul>\n<p>\nP\u00ebrher\u00eb punojm\u00eb p\u00ebr zgjerimin e konfigurimit, rritjen e metrikave dhe optimizimin.<\/p>\n<p><i>Bashkohuni me projektin. Projekti doli i shk\u00eblqyer, por, fatkeq\u00ebsisht, deri tani \u00ebsht\u00eb nj\u00eb projekt i nj\u00eb njeriu. Ejani n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/wgnet\/befw\">GitHub <\/a><\/noindex>dhe provojeni di\u00e7ka: b\u00ebni commit, testoni, propozojeni ndonj\u00eb gj\u00eb, jepni vler\u00ebsimin tuaj.<\/i><\/p>\n<blockquote><p>Nd\u00ebrkoh\u00eb, po p\u00ebrgatitemi p\u00ebr <noindex><a rel=\"nofollow\" href=\"https:\/\/www.highload.ru\/spb\/2020\">Saint HighLoad++<\/a><\/noindex>, e cila do t\u00eb mbahet m\u00eb 6 dhe 7 prill n\u00eb Sh\u00ebn Petersburg, dhe ftojm\u00eb zhvilluesit e sistemeve me ngarkes\u00eb t\u00eb lart\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/conf.ontico.ru\/lectures\/propose?conference=hl2020-spb\">t\u00eb d\u00ebrgojn\u00eb nj\u00eb k\u00ebrkes\u00eb p\u00ebr nj\u00eb prezantim<\/a><\/noindex>. Fol\u00ebsit me p\u00ebrvoj\u00eb e din\u00eb tashm\u00eb se \u00e7far\u00eb duhet t\u00eb b\u00ebjn\u00eb, kurse ne fillestar\u00ebve n\u00eb prezantime rekomandojm\u00eb t\u00eb pakt\u00ebn <noindex><a rel=\"nofollow\" href=\"https:\/\/www.highload.ru\/spb\/2020\/speakers\">provo<\/a><\/noindex>. Pjes\u00ebmarrja n\u00eb konferenc\u00eb si fol\u00ebs ka disa avantazhe. Cilat, mund t\u00eb lexoni, p\u00ebr shembull, n\u00eb fund <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/oleg-bunin\/blog\/486142\/\">k\u00ebt\u00eb artikull<\/a><\/noindex>.<\/p><\/blockquote>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/oleg-bunin\/blog\/486842\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 2010 \u0433\u043e\u0434\u0443 \u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wargaming \u0431\u044b\u043b\u043e 50 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u043f\u0440\u043e\u0441\u0442\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c: \u0431\u044d\u043a\u0435\u043d\u0434, \u0444\u0440\u043e\u043d\u0442\u0435\u043d\u0434 \u0438 \u0444\u0430\u0439\u0440\u0432\u043e\u043b. \u041a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0440\u043e\u0441\u043b\u043e, \u043c\u043e\u0434\u0435\u043b\u044c \u0443\u0441\u043b\u043e\u0436\u043d\u044f\u043b\u0430\u0441\u044c: \u0441\u0442\u0435\u0439\u0434\u0436\u0438\u043d\u0433\u0438, \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 VLAN \u0441 ACL, \u043f\u043e\u0442\u043e\u043c VPN \u0441 VRF, VLAN c ACL \u043d\u0430 L2, VRF \u0441 ACL \u043d\u0430 L3. \u0417\u0430\u043a\u0440\u0443\u0436\u0438\u043b\u0430\u0441\u044c \u0433\u043e\u043b\u043e\u0432\u0430? \u0414\u0430\u043b\u044c\u0448\u0435 \u0431\u0443\u0434\u0435\u0442 \u0432\u0435\u0441\u0435\u043b\u0435\u0435. \u041a\u043e\u0433\u0434\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0441\u0442\u0430\u043b\u043e 16 000 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0431\u0435\u0437 \u0441\u043b\u0435\u0437 \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":41052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41051","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 2010 \u0433\u043e\u0434\u0443 \u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wargaming \u0431\u044b\u043b\u043e 50 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u043f\u0440\u043e\u0441\u0442\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c: \u0431\u044d\u043a\u0435\u043d\u0434, \u0444\u0440\u043e\u043d\u0442\u0435\u043d\u0434 \u0438 \u0444\u0430\u0439\u0440\u0432\u043e\u043b.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/consul-iptables-3\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Consul + iptables = :3 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 2010 \u0433\u043e\u0434\u0443 \u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wargaming \u0431\u044b\u043b\u043e 50 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u043f\u0440\u043e\u0441\u0442\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c: \u0431\u044d\u043a\u0435\u043d\u0434, \u0444\u0440\u043e\u043d\u0442\u0435\u043d\u0434 \u0438 \u0444\u0430\u0439\u0440\u0432\u043e\u043b.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/consul-iptables-3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-05T18:28:58+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-05T18:28:58+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Consul + iptables = :3 | ProHoster","description":"N\u00eb vitin 2010, kompania Wargaming kishte 50 servera dhe nj\u00eb model t\u00eb thjesht\u00eb rrjeti: backend, frontend dhe firewall.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/consul-iptables-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Consul + iptables = :3 | ProHoster","og:description":"\u0412 2010 \u0433\u043e\u0434\u0443 \u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Wargaming \u0431\u044b\u043b\u043e 50 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u043f\u0440\u043e\u0441\u0442\u0430\u044f \u0441\u0435\u0442\u0435\u0432\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c: \u0431\u044d\u043a\u0435\u043d\u0434, \u0444\u0440\u043e\u043d\u0442\u0435\u043d\u0434 \u0438 \u0444\u0430\u0439\u0440\u0432\u043e\u043b.","og:url":"https:\/\/prohoster.info\/sq\/blog\/consul-iptables-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-05T18:28:58+00:00","article:modified_time":"2020-02-05T18:28:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41051","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:24:42","updated":"2022-10-01 10:00:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/41051","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=41051"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/41051\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/41052"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=41051"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=41051"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=41051"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}