{"id":18610,"date":"2021-01-25T09:04:22","date_gmt":"2021-01-25T02:04:22","guid":{"rendered":"https:\/\/speed.family\/?p=18610"},"modified":"2021-01-25T09:04:22","modified_gmt":"2021-01-25T02:04:22","slug":"firewall-hay-tuong-lua","status":"publish","type":"post","link":"https:\/\/kiencang.net\/firewall-hay-tuong-lua\/","title":{"rendered":"Firewall hay T\u01b0\u1eddng l\u1eeda l\u00e0 g\u00ec?"},"content":{"rendered":"\n<p>T\u01b0\u1eddng l\u1eeda (firewall) l\u00e0 m\u1ed9t h\u1ec7 th\u1ed1ng b\u1ea3o m\u1eadt c\u00f3 nhi\u1ec7m v\u1ee5 gi\u00e1m s\u00e1t v\u00e0 ki\u1ec3m so\u00e1t l\u01b0u l\u01b0\u1ee3ng m\u1ea1ng d\u1ef1a tr\u00ean m\u1ed9t t\u1eadp h\u1ee3p c\u00e1c quy t\u1eafc b\u1ea3o m\u1eadt (security rules).&nbsp;T\u01b0\u1eddng l\u1eeda th\u01b0\u1eddng n\u1eb1m gi\u1eefa m\u1ea1ng tin c\u1eady v\u00e0 m\u1ea1ng kh\u00f4ng tin c\u1eady (untrusted network);&nbsp;\u0111\u00f4i khi m\u1ea1ng kh\u00f4ng \u0111\u00e1ng tin c\u1eady l\u1ea1i l\u00e0 Internet!&nbsp;V\u00ed d\u1ee5, c\u00e1c m\u1ea1ng v\u0103n ph\u00f2ng th\u01b0\u1eddng s\u1eed d\u1ee5ng t\u01b0\u1eddng l\u1eeda \u0111\u1ec3 b\u1ea3o v\u1ec7 m\u1ea1ng c\u1ee7a h\u1ecd kh\u1ecfi c\u00e1c m\u1ed1i \u0111e d\u1ecda tr\u1ef1c tuy\u1ebfn (online threats):<\/p>\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"530\" src=\"https:\/\/kiencang.net\/wp-content\/uploads\/2021\/01\/tuong-lua-1024x530.png\" alt=\"\" class=\"wp-image-18613\" srcset=\"https:\/\/kiencang.net\/wp-content\/uploads\/2021\/01\/tuong-lua-1024x530.png 1024w, https:\/\/kiencang.net\/wp-content\/uploads\/2021\/01\/tuong-lua-300x155.png 300w, https:\/\/kiencang.net\/wp-content\/uploads\/2021\/01\/tuong-lua-768x398.png 768w, https:\/\/kiencang.net\/wp-content\/uploads\/2021\/01\/tuong-lua.png 1165w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n<p>T\u01b0\u1eddng l\u1eeda quy\u1ebft \u0111\u1ecbnh c\u00f3 cho ph\u00e9p l\u01b0u l\u01b0\u1ee3ng v\u00e0o v\u00e0 ra hay kh\u00f4ng.&nbsp;Ch\u00fang c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c t\u00edch h\u1ee3p v\u00e0o ph\u1ea7n c\u1ee9ng, ph\u1ea7n m\u1ec1m ho\u1eb7c k\u1ebft h\u1ee3p c\u1ea3 hai lo\u1ea1i.&nbsp;Thu\u1eadt ng\u1eef &#8216;t\u01b0\u1eddng l\u1eeda&#8217; th\u1ef1c s\u1ef1 \u0111\u01b0\u1ee3c m\u01b0\u1ee3n t\u1eeb m\u1ed9t th\u1ef1c t\u1ebf x\u00e2y d\u1ef1ng l\u00e0 x\u00e2y c\u00e1c b\u1ee9c t\u01b0\u1eddng \u1edf gi\u1eefa ho\u1eb7c xuy\u00ean qua gi\u1eefa c\u00e1c t\u00f2a nh\u00e0 \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 ch\u1ee9a l\u1eeda.&nbsp;T\u01b0\u01a1ng t\u1ef1, t\u01b0\u1eddng l\u1eeda m\u1ea1ng ho\u1ea1t \u0111\u1ed9ng \u0111\u1ec3 \u0111\u1ed1i ph\u00f3 (bao v\u00e2y) c\u00e1c m\u1ed1i \u0111e d\u1ecda tr\u1ef1c tuy\u1ebfn.<\/p>\n\n\n<h2 class=\"wp-block-heading\">T\u1ea1i sao s\u1eed d\u1ee5ng t\u01b0\u1eddng l\u1eeda?<\/h2>\n\n\n<p>M\u1ee5c \u0111\u00edch s\u1eed d\u1ee5ng ch\u00ednh c\u1ee7a t\u01b0\u1eddng l\u1eeda l\u00e0 b\u1ea3o m\u1eadt.&nbsp;T\u01b0\u1eddng l\u1eeda c\u00f3 th\u1ec3 ch\u1eb7n l\u01b0u l\u01b0\u1ee3ng \u0111\u1ed9c h\u1ea1i tr\u01b0\u1edbc khi n\u00f3 \u0111\u1ebfn \u0111\u01b0\u1ee3c m\u1ea1ng, c\u0169ng nh\u01b0 ng\u0103n th\u00f4ng tin nh\u1ea1y c\u1ea3m (sensitive information) r\u1eddi kh\u1ecfi m\u1ea1ng.<\/p>\n\n\n<p>T\u01b0\u1eddng l\u1eeda c\u0169ng c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 l\u1ecdc n\u1ed9i dung (content filtering).&nbsp;V\u00ed d\u1ee5: m\u1ed9t tr\u01b0\u1eddng h\u1ecdc c\u00f3 th\u1ec3 \u0111\u1ecbnh c\u1ea5u h\u00ecnh t\u01b0\u1eddng l\u1eeda \u0111\u1ec3 ng\u0103n ng\u01b0\u1eddi d\u00f9ng tr\u00ean m\u1ea1ng c\u1ee7a h\u1ecd truy c\u1eadp th\u00f4ng tin ng\u01b0\u1eddi l\u1edbn.&nbsp;T\u01b0\u01a1ng t\u1ef1, \u1edf m\u1ed9t s\u1ed1 qu\u1ed1c gia, ch\u00ednh ph\u1ee7 thi\u1ebft k\u1ebf m\u1ed9t b\u1ee9c t\u01b0\u1eddng l\u1eeda c\u00f3 th\u1ec3 ng\u0103n nh\u1eefng ng\u01b0\u1eddi b\u00ean trong qu\u1ed1c gia \u0111\u00f3 truy c\u1eadp v\u00e0o nh\u1eefng ph\u1ea7n nh\u1ea5t \u0111\u1ecbnh tr\u00ean Internet.<\/p>\n\n\n<p>B\u00e0i vi\u1ebft n\u00e0y s\u1ebd t\u1eadp trung v\u00e0o c\u00e1c t\u01b0\u1eddng l\u1eeda \u0111\u01b0\u1ee3c c\u1ea5u h\u00ecnh \u0111\u1ec3 b\u1ea3o m\u1eadt, trong \u0111\u00f3 s\u1ebd b\u00e0n v\u1ec1 m\u1ed9t s\u1ed1 lo\u1ea1i ph\u1ed5 bi\u1ebfn.<\/p>\n\n\n<h2 class=\"wp-block-heading\">C\u00e1c lo\u1ea1i t\u01b0\u1eddng l\u1eeda kh\u00e1c nhau l\u00e0 g\u00ec?<\/h2>\n\n\n<h3 class=\"wp-block-heading\">T\u01b0\u1eddng l\u1eeda d\u1ef1a tr\u00ean proxy<\/h3>\n\n\n<p>\u0110\u00e2y l\u00e0 nh\u1eefng proxy* n\u1eb1m gi\u1eefa&nbsp;m\u00e1y kh\u00e1ch v\u00e0 m\u00e1y ch\u1ee7.&nbsp;M\u00e1y kh\u00e1ch k\u1ebft n\u1ed1i v\u1edbi t\u01b0\u1eddng l\u1eeda v\u00e0 t\u01b0\u1eddng l\u1eeda s\u1ebd ki\u1ec3m tra c\u00e1c&nbsp;g\u00f3i tin&nbsp;g\u1eedi \u0111i, sau \u0111\u00f3 n\u00f3 s\u1ebd t\u1ea1o k\u1ebft n\u1ed1i \u0111\u1ebfn ng\u01b0\u1eddi nh\u1eadn d\u1ef1 ki\u1ebfn \u200b\u200b(m\u00e1y ch\u1ee7 web).&nbsp;T\u01b0\u01a1ng t\u1ef1, khi m\u00e1y ch\u1ee7 web c\u1ed1 g\u1eafng g\u1eedi ph\u1ea3n h\u1ed3i \u0111\u1ebfn m\u00e1y kh\u00e1ch, t\u01b0\u1eddng l\u1eeda s\u1ebd ch\u1eb7n y\u00eau c\u1ea7u \u0111\u00f3, ki\u1ec3m tra c\u00e1c g\u00f3i v\u00e0 sau \u0111\u00f3 g\u1eedi ph\u1ea3n h\u1ed3i \u0111\u00f3 trong m\u1ed9t k\u1ebft n\u1ed1i ri\u00eang gi\u1eefa t\u01b0\u1eddng l\u1eeda v\u00e0 m\u00e1y kh\u00e1ch.&nbsp;T\u01b0\u1eddng l\u1eeda d\u1ef1a tr\u00ean proxy ng\u0103n ch\u1eb7n hi\u1ec7u qu\u1ea3 k\u1ebft n\u1ed1i tr\u1ef1c ti\u1ebfp gi\u1eefa m\u00e1y kh\u00e1ch v\u00e0 m\u00e1y ch\u1ee7.<\/p>\n\n\n<p>T\u01b0\u1eddng l\u1eeda d\u1ef1a tr\u00ean proxy gi\u1ed1ng nh\u01b0 m\u1ed9t ng\u01b0\u1eddi b\u1ea3o v\u1ec7 t\u1ea1i m\u1ed9t qu\u00e1n bar.&nbsp;Ng\u01b0\u1eddi b\u1ea3o v\u1ec7 n\u00e0y s\u1ebd ch\u1eb7n kh\u00e1ch tr\u01b0\u1edbc khi h\u1ecd b\u01b0\u1edbc v\u00e0o qu\u00e1n bar \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o r\u1eb1ng h\u1ecd kh\u00f4ng d\u01b0\u1edbi tu\u1ed5i v\u1ecb th\u00e0nh ni\u00ean, mang v\u0169 kh\u00ed ho\u1eb7c b\u1ea5t c\u1ee9 c\u00e1i g\u00ec l\u00e0 m\u1ed1i \u0111e d\u1ecda \u0111\u1ed1i v\u1edbi qu\u00e1n bar v\u00e0 kh\u00e1ch quen c\u1ee7a qu\u00e1n.&nbsp;B\u1ea3o v\u1ec7 c\u0169ng ng\u0103n nh\u1eefng ng\u01b0\u1eddi kh\u00e1ch quen khi h\u1ecd \u0111i ra ngo\u00e0i \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o r\u1eb1ng h\u1ecd v\u1ec1 nh\u00e0 theo c\u00e1ch an to\u00e0n v\u00e0 kh\u00f4ng \u0111\u1ecbnh u\u1ed1ng r\u01b0\u1ee3u v\u00e0 l\u00e1i xe.<\/p>\n\n\n<p>Nh\u01b0\u1ee3c \u0111i\u1ec3m c\u1ee7a vi\u1ec7c c\u00f3 m\u1ed9t ng\u01b0\u1eddi b\u1ea3o v\u1ec7 \u0111\u1ee9ng tr\u01b0\u1edbc qu\u1ea7y bar l\u00e0 khi nhi\u1ec1u ng\u01b0\u1eddi \u0111ang c\u1ed1 g\u1eafng v\u00e0o ho\u1eb7c r\u1eddi kh\u1ecfi qu\u1ea7y bar c\u00f9ng m\u1ed9t l\u00fac, s\u1ebd c\u00f3 m\u1ed9t h\u00e0ng d\u00e0i v\u00e0 m\u1ed9t s\u1ed1 ng\u01b0\u1eddi s\u1ebd g\u1eb7p ph\u1ea3i s\u1ef1 ch\u1eadm tr\u1ec5.&nbsp;T\u01b0\u01a1ng t\u1ef1, m\u1ed9t nh\u01b0\u1ee3c \u0111i\u1ec3m l\u1edbn c\u1ee7a t\u01b0\u1eddng l\u1eeda d\u1ef1a tr\u00ean proxy l\u00e0 n\u00f3 c\u00f3 th\u1ec3 g\u00e2y ra&nbsp;\u0111\u1ed9 tr\u1ec5, \u0111\u1eb7c bi\u1ec7t l\u00e0 trong th\u1eddi gian c\u00f3 l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp l\u1edbn.<\/p>\n\n\n<p>* Proxy l\u00e0 m\u1ed9t m\u00e1y t\u00ednh ho\u1ea1t \u0111\u1ed9ng nh\u01b0 m\u1ed9t c\u1ed5ng k\u1ebft n\u1ed1i gi\u1eefa&nbsp;m\u1ea1ng c\u1ee5c b\u1ed9&nbsp;v\u00e0 m\u1ea1ng l\u1edbn h\u01a1n, ch\u1eb3ng h\u1ea1n nh\u01b0 Internet.<\/p>\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n<h3 class=\"wp-block-heading\">T\u01b0\u1eddng l\u1eeda tr\u1ea1ng th\u00e1i<\/h3>\n\n\n<p>Trong khoa h\u1ecdc m\u00e1y t\u00ednh, \u1ee9ng d\u1ee5ng &#8216;tr\u1ea1ng th\u00e1i&#8217; l\u00e0 \u1ee9ng d\u1ee5ng l\u01b0u d\u1eef li\u1ec7u t\u1eeb c\u00e1c s\u1ef1 ki\u1ec7n v\u00e0 t\u01b0\u01a1ng t\u00e1c tr\u01b0\u1edbc \u0111\u00f3.&nbsp;T\u01b0\u1eddng l\u1eeda tr\u1ea1ng th\u00e1i l\u01b0u th\u00f4ng tin v\u1ec1 c\u00e1c k\u1ebft n\u1ed1i m\u1edf v\u00e0 s\u1eed d\u1ee5ng th\u00f4ng tin n\u00e0y \u0111\u1ec3 ph\u00e2n t\u00edch l\u01b0u l\u01b0\u1ee3ng \u0111\u1ebfn v\u00e0 \u0111i, thay v\u00ec ki\u1ec3m tra t\u1eebng g\u00f3i.&nbsp;B\u1edfi v\u00ec n\u00f3 kh\u00f4ng ki\u1ec3m tra t\u1eebng g\u00f3i, t\u01b0\u1eddng l\u1eeda tr\u1ea1ng th\u00e1i (stateful firewall) nhanh h\u01a1n t\u01b0\u1eddng l\u1eeda d\u1ef1a tr\u00ean proxy (proxy-based firewalls).<\/p>\n\n\n<p>T\u01b0\u1eddng l\u1eeda tr\u1ea1ng th\u00e1i d\u1ef1a tr\u00ean r\u1ea5t nhi\u1ec1u ng\u1eef c\u1ea3nh khi \u0111\u01b0a ra quy\u1ebft \u0111\u1ecbnh.&nbsp;V\u00ed d\u1ee5: n\u1ebfu t\u01b0\u1eddng l\u1eeda ghi l\u1ea1i c\u00e1c g\u00f3i g\u1eedi \u0111i tr\u00ean m\u1ed9t k\u1ebft n\u1ed1i y\u00eau c\u1ea7u m\u1ed9t lo\u1ea1i ph\u1ea3n h\u1ed3i nh\u1ea5t \u0111\u1ecbnh, n\u00f3 s\u1ebd ch\u1ec9 cho ph\u00e9p c\u00e1c g\u00f3i \u0111\u1ebfn tr\u00ean k\u1ebft n\u1ed1i \u0111\u00f3 n\u1ebfu ch\u00fang cung c\u1ea5p lo\u1ea1i ph\u1ea3n h\u1ed3i \u0111\u01b0\u1ee3c y\u00eau c\u1ea7u.<\/p>\n\n\n<p>T\u01b0\u1eddng l\u1eeda tr\u1ea1ng th\u00e1i c\u0169ng c\u00f3 th\u1ec3 b\u1ea3o v\u1ec7&nbsp;c\u00e1c c\u1ed5ng (ports)* b\u1eb1ng c\u00e1ch \u0111\u00f3ng t\u1ea5t c\u1ea3 ch\u00fang tr\u1eeb khi c\u00e1c g\u00f3i \u0111\u1ebfn y\u00eau c\u1ea7u quy\u1ec1n truy c\u1eadp v\u00e0o m\u1ed9t c\u1ed5ng c\u1ee5 th\u1ec3.&nbsp;\u0110i\u1ec1u n\u00e0y c\u00f3 th\u1ec3 gi\u1ea3m thi\u1ec3u m\u1ed9t ki\u1ec3u t\u1ea5n c\u00f4ng \u0111\u01b0\u1ee3c g\u1ecdi l\u00e0 qu\u00e9t c\u1ed5ng.<\/p>\n\n\n<p>M\u1ed9t l\u1ed7 h\u1ed5ng \u0111\u00e3 bi\u1ebft li\u00ean quan \u0111\u1ebfn t\u01b0\u1eddng l\u1eeda tr\u1ea1ng th\u00e1i l\u00e0 ch\u00fang c\u00f3 th\u1ec3 b\u1ecb thao t\u00fang b\u1eb1ng c\u00e1ch l\u1eeba m\u00e1y kh\u00e1ch y\u00eau c\u1ea7u m\u1ed9t lo\u1ea1i th\u00f4ng tin nh\u1ea5t \u0111\u1ecbnh.&nbsp;Khi m\u00e1y kh\u00e1ch y\u00eau c\u1ea7u ph\u1ea3n h\u1ed3i \u0111\u00f3, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 g\u1eedi c\u00e1c g\u00f3i d\u1eef li\u1ec7u \u0111\u1ed9c h\u1ea1i ph\u00f9 h\u1ee3p v\u1edbi ti\u00eau ch\u00ed \u0111\u00f3 th\u00f4ng qua t\u01b0\u1eddng l\u1eeda.&nbsp;V\u00ed d\u1ee5: c\u00e1c trang web kh\u00f4ng an to\u00e0n c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng m\u00e3 JavaScript \u0111\u1ec3 t\u1ea1o c\u00e1c lo\u1ea1i y\u00eau c\u1ea7u gi\u1ea3 m\u1ea1o (forged requests) n\u00e0y t\u1eeb tr\u00ecnh duy\u1ec7t web.<\/p>\n\n\n<p>* C\u1ed5ng m\u1ea1ng l\u00e0 n\u01a1i g\u1eedi th\u00f4ng tin;&nbsp;n\u00f3 kh\u00f4ng ph\u1ea3i l\u00e0 m\u1ed9t \u0111\u1ecba \u0111i\u1ec3m v\u1eadt l\u00fd m\u00e0 l\u00e0 m\u1ed9t \u0111i\u1ec3m cu\u1ed1i giao ti\u1ebfp.&nbsp;Khi c\u00f3 c\u01a1 h\u1ed9i, ch\u00fang ta s\u1ebd t\u00ecm hi\u1ec3u th\u00eam v\u1ec1 c\u00e1c c\u1ed5ng m\u1ea1ng sau.<\/p>\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n<h3 class=\"wp-block-heading\">T\u01b0\u1eddng l\u1eeda th\u1ebf h\u1ec7 ti\u1ebfp theo (NGFW \/ Next-Generation Firewalls)<\/h3>\n\n\n<p>\u0110\u00e2y l\u00e0 nh\u1eefng t\u01b0\u1eddng l\u1eeda c\u00f3 c\u00e1c kh\u1ea3 n\u0103ng c\u1ee7a t\u01b0\u1eddng l\u1eeda truy\u1ec1n th\u1ed1ng nh\u01b0ng c\u0169ng s\u1eed d\u1ee5ng m\u1ed9t lo\u1ea1t c\u00e1c t\u00ednh n\u0103ng b\u1ed5 sung \u0111\u1ec3 gi\u1ea3i quy\u1ebft c\u00e1c m\u1ed1i \u0111e d\u1ecda tr\u00ean c\u00e1c l\u1edbp kh\u00e1c c\u1ee7a&nbsp;M\u00f4 h\u00ecnh OSI.&nbsp;M\u1ed9t s\u1ed1 t\u00ednh n\u0103ng d\u00e0nh ri\u00eang cho NGFW bao g\u1ed3m:<\/p>\n\n\n<ul><li><strong>Ki\u1ec3m tra g\u00f3i tin s\u00e2u (DPI)<\/strong>&nbsp;&#8211; NGFW th\u1ef1c hi\u1ec7n ki\u1ec3m tra g\u00f3i tin s\u00e2u h\u01a1n nhi\u1ec1u so v\u1edbi t\u01b0\u1eddng l\u1eeda truy\u1ec1n th\u1ed1ng.&nbsp;Vi\u1ec7c ki\u1ec3m tra s\u00e2u n\u00e0y c\u00f3 th\u1ec3 xem x\u00e9t c\u00e1c y\u1ebfu t\u1ed1 nh\u01b0 tr\u1ecdng t\u1ea3i g\u00f3i v\u00e0 \u1ee9ng d\u1ee5ng n\u00e0o \u0111ang \u0111\u01b0\u1ee3c c\u00e1c g\u00f3i truy c\u1eadp.&nbsp;\u0110i\u1ec1u n\u00e0y cho ph\u00e9p t\u01b0\u1eddng l\u1eeda th\u1ef1c hi\u1ec7n c\u00e1c quy t\u1eafc l\u1ecdc chi ti\u1ebft h\u01a1n.<\/li><li><strong>Nh\u1eadn bi\u1ebft \u1ee9ng d\u1ee5ng<\/strong>&nbsp;&#8211; B\u1eadt t\u00ednh n\u0103ng n\u00e0y gi\u00fap t\u01b0\u1eddng l\u1eeda bi\u1ebft \u1ee9ng d\u1ee5ng n\u00e0o \u0111ang ch\u1ea1y v\u00e0 c\u1ed5ng n\u00e0o \u1ee9ng d\u1ee5ng \u0111\u00f3 \u0111ang s\u1eed d\u1ee5ng.&nbsp;\u0110i\u1ec1u n\u00e0y c\u00f3 th\u1ec3 b\u1ea3o v\u1ec7 ch\u1ed1ng l\u1ea1i m\u1ed9t s\u1ed1 lo\u1ea1i&nbsp;ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i&nbsp;nh\u1eb1m m\u1ee5c \u0111\u00edch ch\u1ea5m d\u1ee9t m\u1ed9t qu\u00e1 tr\u00ecnh \u0111ang ch\u1ea1y v\u00e0 sau \u0111\u00f3 chi\u1ebfm l\u1ea5y c\u1ed5ng c\u1ee7a n\u00f3.<\/li><li><strong>Nh\u1eadn bi\u1ebft danh t\u00ednh<\/strong>&nbsp;&#8211; \u0110i\u1ec1u n\u00e0y cho ph\u00e9p t\u01b0\u1eddng l\u1eeda th\u1ef1c thi c\u00e1c quy t\u1eafc d\u1ef1a tr\u00ean danh t\u00ednh, ch\u1eb3ng h\u1ea1n nh\u01b0 m\u00e1y t\u00ednh n\u00e0o \u0111ang \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng, ng\u01b0\u1eddi d\u00f9ng n\u00e0o \u0111\u00e3 \u0111\u0103ng nh\u1eadp, v.v.<\/li><li><strong>H\u1ed9p c\u00e1t<\/strong>&nbsp;&#8211; T\u01b0\u1eddng l\u1eeda c\u00f3 th\u1ec3 c\u00f4 l\u1eadp c\u00e1c \u0111o\u1ea1n m\u00e3 \u0111\u01b0\u1ee3c li\u00ean k\u1ebft v\u1edbi c\u00e1c g\u00f3i tin \u0111\u1ebfn v\u00e0 th\u1ef1c thi ch\u00fang trong m\u00f4i tr\u01b0\u1eddng &#8216;h\u1ed9p c\u00e1t \/ sandbox&#8217; \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o ch\u00fang kh\u00f4ng c\u00f3 ho\u1ea1t \u0111\u1ed9ng nguy h\u1ea1i.&nbsp;Sau \u0111\u00f3, k\u1ebft qu\u1ea3 c\u1ee7a th\u1eed nghi\u1ec7m h\u1ed9p c\u00e1t n\u00e0y c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng l\u00e0m ti\u00eau ch\u00ed khi quy\u1ebft \u0111\u1ecbnh c\u00f3 cho ph\u00e9p c\u00e1c g\u00f3i tin v\u00e0o m\u1ea1ng hay kh\u00f4ng.<\/li><\/ul>\n\n\n<h2 class=\"wp-block-heading\">T\u01b0\u1eddng l\u1eeda \u1ee9ng d\u1ee5ng web (WAF \/ Web Application Firewalls)<\/h2>\n\n\n<p>Trong khi firewall truy\u1ec1n th\u1ed1ng gi\u00fap b\u1ea3o v\u1ec7 m\u1ea1ng ri\u00eang t\u01b0 kh\u1ecfi c\u00e1c \u1ee9ng d\u1ee5ng web \u0111\u1ed9c h\u1ea1i,&nbsp;WAF&nbsp;gi\u00fap b\u1ea3o v\u1ec7 c\u00e1c \u1ee9ng d\u1ee5ng web kh\u1ecfi ng\u01b0\u1eddi d\u00f9ng \u0111\u1ed9c h\u1ea1i.&nbsp;WAF gi\u00fap b\u1ea3o v\u1ec7 c\u00e1c \u1ee9ng d\u1ee5ng web b\u1eb1ng c\u00e1ch l\u1ecdc v\u00e0 gi\u00e1m s\u00e1t&nbsp;l\u01b0u l\u01b0\u1ee3ng&nbsp;HTTP&nbsp;gi\u1eefa \u1ee9ng d\u1ee5ng web v\u00e0 Internet.&nbsp;N\u00f3 th\u01b0\u1eddng b\u1ea3o v\u1ec7 c\u00e1c \u1ee9ng d\u1ee5ng web t\u1eeb c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng ki\u1ec3u nh\u01b0&nbsp;cross-site gi\u1ea3 m\u1ea1o,&nbsp;cross-site-scripting (XSS), t\u1eadp tin bao g\u1ed3m, v\u00e0&nbsp;SQL injection, v\u00e0 c\u1ea3 nh\u1eefng ki\u1ec3u t\u1ea5n c\u00f4ng kh\u00e1c n\u1eefa.<\/p>\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"498\" src=\"https:\/\/kiencang.net\/wp-content\/uploads\/2021\/01\/WAF-1024x498.png\" alt=\"\" class=\"wp-image-18617\" srcset=\"https:\/\/kiencang.net\/wp-content\/uploads\/2021\/01\/WAF-1024x498.png 1024w, https:\/\/kiencang.net\/wp-content\/uploads\/2021\/01\/WAF-300x146.png 300w, https:\/\/kiencang.net\/wp-content\/uploads\/2021\/01\/WAF-768x374.png 768w, https:\/\/kiencang.net\/wp-content\/uploads\/2021\/01\/WAF.png 1274w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n<p>B\u1eb1ng c\u00e1ch tri\u1ec3n khai WAF tr\u01b0\u1edbc m\u1ed9t \u1ee9ng d\u1ee5ng web, m\u1ed9t l\u00e1 ch\u1eafn \u0111\u01b0\u1ee3c \u0111\u1eb7t gi\u1eefa \u1ee9ng d\u1ee5ng web v\u00e0 Internet.&nbsp;Trong khi &#8216;t\u01b0\u1eddng l\u1eeda d\u1ef1a tr\u00ean proxy&#8217; b\u1ea3o v\u1ec7 danh t\u00ednh c\u1ee7a m\u00e1y kh\u00e1ch b\u1eb1ng c\u00e1ch s\u1eed d\u1ee5ng trung gian, WAF l\u00e0 m\u1ed9t lo\u1ea1i&nbsp;<a href=\"https:\/\/kiencang.net\/proxy-nguoc-la-gi\/\" target=\"_blank\" rel=\"noreferrer noopener\">proxy ng\u01b0\u1ee3c<\/a>, t\u1ee9c l\u00e0 d\u00f9ng \u0111\u1ec3 b\u1ea3o v\u1ec7 m\u00e1y ch\u1ee7 kh\u1ecfi b\u1ecb l\u1ed9 b\u1eb1ng c\u00e1ch cho m\u00e1y kh\u00e1ch \u0111i qua WAF tr\u01b0\u1edbc khi \u0111\u1ebfn \u0111\u01b0\u1ee3c m\u00e1y ch\u1ee7.<\/p>\n\n\n<p>WAF ho\u1ea1t \u0111\u1ed9ng th\u00f4ng qua m\u1ed9t t\u1eadp h\u1ee3p c\u00e1c quy t\u1eafc th\u01b0\u1eddng \u0111\u01b0\u1ee3c g\u1ecdi l\u00e0 ch\u00ednh s\u00e1ch (policies).\u00a0C\u00e1c ch\u00ednh s\u00e1ch n\u00e0y nh\u1eb1m m\u1ee5c \u0111\u00edch b\u1ea3o v\u1ec7 kh\u1ecfi c\u00e1c l\u1ed7 h\u1ed5ng trong \u1ee9ng d\u1ee5ng b\u1eb1ng c\u00e1ch l\u1ecdc ra c\u00e1c l\u01b0u l\u01b0\u1ee3ng \u0111\u1ed9c h\u1ea1i.\u00a0Gi\u00e1 tr\u1ecb c\u1ee7a WAF m\u1ed9t ph\u1ea7n \u0111\u1ebfn t\u1eeb t\u1ed1c \u0111\u1ed9 v\u00e0 vi\u1ec7c s\u1eeda \u0111\u1ed5i ch\u00ednh s\u00e1ch c\u00f3 th\u1ec3 th\u1ef1c hi\u1ec7n d\u1ec5 d\u00e0ng, cho ph\u00e9p ph\u1ea3n \u1ee9ng nhanh h\u01a1n v\u1edbi c\u00e1c vect\u01a1 t\u1ea5n c\u00f4ng kh\u00e1c nhau;\u00a0trong m\u1ed9t\u00a0<a href=\"https:\/\/kiencang.net\/ddos-la-gi\/\" target=\"_blank\" rel=\"noreferrer noopener\">cu\u1ed9c t\u1ea5n c\u00f4ng DDoS<\/a>, gi\u1edbi h\u1ea1n t\u1ed1c \u0111\u1ed9 (rate limiting) c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c th\u1ef1c hi\u1ec7n nhanh ch\u00f3ng b\u1eb1ng c\u00e1ch s\u1eeda \u0111\u1ed5i c\u00e1c ch\u00ednh s\u00e1ch WAF.\u00a0C\u00e1c s\u1ea3n ph\u1ea9m WAF th\u01b0\u01a1ng m\u1ea1i nh\u01b0\u00a0<em>T\u01b0\u1eddng l\u1eeda \u1ee9ng d\u1ee5ng web c\u1ee7a Cloudflare<\/em>\u00a0b\u1ea3o v\u1ec7 h\u00e0ng tri\u1ec7u \u1ee9ng d\u1ee5ng web kh\u1ecfi c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng m\u1ed7i ng\u00e0y.<\/p>\n\n\n<p><em>(T\u1ed5ng h\u1ee3p t\u1eeb b\u00e0i vi\u1ebft What is a Firewall? c\u1ee7a Cloudflare)<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>T\u01b0\u1eddng l\u1eeda (firewall) l\u00e0 m\u1ed9t h\u1ec7 th\u1ed1ng b\u1ea3o m\u1eadt c\u00f3 nhi\u1ec7m v\u1ee5 gi\u00e1m s\u00e1t v\u00e0 ki\u1ec3m so\u00e1t l\u01b0u l\u01b0\u1ee3ng m\u1ea1ng d\u1ef1a tr\u00ean m\u1ed9t t\u1eadp h\u1ee3p c\u00e1c quy t\u1eafc b\u1ea3o m\u1eadt (security rules).&nbsp;T\u01b0\u1eddng l\u1eeda th\u01b0\u1eddng n\u1eb1m gi\u1eefa m\u1ea1ng tin c\u1eady v\u00e0 m\u1ea1ng kh\u00f4ng tin c\u1eady (untrusted network);&nbsp;\u0111\u00f4i khi m\u1ea1ng kh\u00f4ng \u0111\u00e1ng tin c\u1eady l\u1ea1i l\u00e0 Internet!&nbsp;V\u00ed &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[246],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v21.6 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Firewall hay T\u01b0\u1eddng l\u1eeda l\u00e0 g\u00ec? &#8226; Ki\u1ebfn c\u00e0ng<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/kiencang.net\/firewall-hay-tuong-lua\/\" \/>\n<meta property=\"og:locale\" content=\"vi_VN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Firewall hay T\u01b0\u1eddng l\u1eeda l\u00e0 g\u00ec? &#8226; Ki\u1ebfn c\u00e0ng\" \/>\n<meta property=\"og:description\" content=\"T\u01b0\u1eddng l\u1eeda (firewall) l\u00e0 m\u1ed9t h\u1ec7 th\u1ed1ng b\u1ea3o m\u1eadt c\u00f3 nhi\u1ec7m v\u1ee5 gi\u00e1m s\u00e1t v\u00e0 ki\u1ec3m so\u00e1t l\u01b0u l\u01b0\u1ee3ng m\u1ea1ng d\u1ef1a tr\u00ean m\u1ed9t t\u1eadp h\u1ee3p c\u00e1c quy t\u1eafc b\u1ea3o m\u1eadt (security rules).&nbsp;T\u01b0\u1eddng l\u1eeda th\u01b0\u1eddng n\u1eb1m gi\u1eefa m\u1ea1ng tin c\u1eady v\u00e0 m\u1ea1ng kh\u00f4ng tin c\u1eady (untrusted network);&nbsp;\u0111\u00f4i khi m\u1ea1ng kh\u00f4ng \u0111\u00e1ng tin c\u1eady l\u1ea1i l\u00e0 Internet!&nbsp;V\u00ed &hellip;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/kiencang.net\/firewall-hay-tuong-lua\/\" \/>\n<meta property=\"og:site_name\" content=\"Ki\u1ebfn c\u00e0ng\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/anhducnguyen87\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-01-25T02:04:22+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/kiencang.net\/wp-content\/uploads\/2021\/01\/tuong-lua-1024x530.png\" \/>\n<meta name=\"author\" content=\"Nguy\u1ec5n \u0110\u1ee9c Anh\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u0110\u01b0\u1ee3c vi\u1ebft b\u1edfi\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nguy\u1ec5n \u0110\u1ee9c Anh\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u01af\u1edbc t\u00ednh th\u1eddi gian \u0111\u1ecdc\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 ph\u00fat\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Firewall hay T\u01b0\u1eddng l\u1eeda l\u00e0 g\u00ec? &#8226; Ki\u1ebfn c\u00e0ng","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/kiencang.net\/firewall-hay-tuong-lua\/","og_locale":"vi_VN","og_type":"article","og_title":"Firewall hay T\u01b0\u1eddng l\u1eeda l\u00e0 g\u00ec? &#8226; Ki\u1ebfn c\u00e0ng","og_description":"T\u01b0\u1eddng l\u1eeda (firewall) l\u00e0 m\u1ed9t h\u1ec7 th\u1ed1ng b\u1ea3o m\u1eadt c\u00f3 nhi\u1ec7m v\u1ee5 gi\u00e1m s\u00e1t v\u00e0 ki\u1ec3m so\u00e1t l\u01b0u l\u01b0\u1ee3ng m\u1ea1ng d\u1ef1a tr\u00ean m\u1ed9t t\u1eadp h\u1ee3p c\u00e1c quy t\u1eafc b\u1ea3o m\u1eadt (security rules).&nbsp;T\u01b0\u1eddng l\u1eeda th\u01b0\u1eddng n\u1eb1m gi\u1eefa m\u1ea1ng tin c\u1eady v\u00e0 m\u1ea1ng kh\u00f4ng tin c\u1eady (untrusted network);&nbsp;\u0111\u00f4i khi m\u1ea1ng kh\u00f4ng \u0111\u00e1ng tin c\u1eady l\u1ea1i l\u00e0 Internet!&nbsp;V\u00ed &hellip;","og_url":"https:\/\/kiencang.net\/firewall-hay-tuong-lua\/","og_site_name":"Ki\u1ebfn c\u00e0ng","article_author":"https:\/\/www.facebook.com\/anhducnguyen87\/","article_published_time":"2021-01-25T02:04:22+00:00","og_image":[{"url":"https:\/\/kiencang.net\/wp-content\/uploads\/2021\/01\/tuong-lua-1024x530.png"}],"author":"Nguy\u1ec5n \u0110\u1ee9c Anh","twitter_card":"summary_large_image","twitter_misc":{"\u0110\u01b0\u1ee3c vi\u1ebft b\u1edfi":"Nguy\u1ec5n \u0110\u1ee9c Anh","\u01af\u1edbc t\u00ednh th\u1eddi gian \u0111\u1ecdc":"7 ph\u00fat"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/kiencang.net\/firewall-hay-tuong-lua\/","url":"https:\/\/kiencang.net\/firewall-hay-tuong-lua\/","name":"Firewall hay T\u01b0\u1eddng l\u1eeda l\u00e0 g\u00ec? &#8226; Ki\u1ebfn c\u00e0ng","isPartOf":{"@id":"https:\/\/kiencang.net\/#website"},"datePublished":"2021-01-25T02:04:22+00:00","dateModified":"2021-01-25T02:04:22+00:00","author":{"@id":"https:\/\/kiencang.net\/#\/schema\/person\/5e7e1a04d8d1218ad8c421ba43d25c16"},"breadcrumb":{"@id":"https:\/\/kiencang.net\/firewall-hay-tuong-lua\/#breadcrumb"},"inLanguage":"vi","potentialAction":[{"@type":"ReadAction","target":["https:\/\/kiencang.net\/firewall-hay-tuong-lua\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/kiencang.net\/firewall-hay-tuong-lua\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/kiencang.net\/"},{"@type":"ListItem","position":2,"name":"Firewall hay T\u01b0\u1eddng l\u1eeda l\u00e0 g\u00ec?"}]},{"@type":"WebSite","@id":"https:\/\/kiencang.net\/#website","url":"https:\/\/kiencang.net\/","name":"Ki\u1ebfn c\u00e0ng","description":"\u00d4m l\u00fd thuy\u1ebft, h\u00f4n th\u1ef1c h\u00e0nh","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/kiencang.net\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"vi"},{"@type":"Person","@id":"https:\/\/kiencang.net\/#\/schema\/person\/5e7e1a04d8d1218ad8c421ba43d25c16","name":"Nguy\u1ec5n \u0110\u1ee9c Anh","image":{"@type":"ImageObject","inLanguage":"vi","@id":"https:\/\/kiencang.net\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/6d71f9b89393952a8382e30dad26c1ec?s=96&d=monsterid&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6d71f9b89393952a8382e30dad26c1ec?s=96&d=monsterid&r=g","caption":"Nguy\u1ec5n \u0110\u1ee9c Anh"},"description":"Sinh n\u0103m 1987, t\u1ed1t nghi\u1ec7p Cao \u0111\u1eb3ng th\u1ef1c h\u00e0nh FPT qu\u00e3ng 2014, chuy\u00ean ng\u00e0nh Thi\u1ebft k\u1ebf website. T\u00f4i th\u00edch Content, SEO, Ads, T\u0103ng t\u1ed1c website v\u00e0 Th\u01b0\u01a1ng m\u1ea1i \u0111i\u1ec7n t\u1eed. B\u00ean c\u1ea1nh b\u00e0i t\u1ef1 vi\u1ebft, t\u00f4i c\u0169ng d\u1ecbch nhi\u1ec1u n\u1ed9i dung th\u00fa v\u1ecb c\u1ee7a c\u00e1c t\u00e1c gi\u1ea3 kh\u00e1c nhau. FB c\u00e1 nh\u00e2n: facebook.com\/anhducnguyen87. Email li\u00ean h\u1ec7: guiemailchotoi@gmail.com","sameAs":["https:\/\/www.facebook.com\/anhducnguyen87\/"],"url":"https:\/\/kiencang.net\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/kiencang.net\/wp-json\/wp\/v2\/posts\/18610"}],"collection":[{"href":"https:\/\/kiencang.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kiencang.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kiencang.net\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kiencang.net\/wp-json\/wp\/v2\/comments?post=18610"}],"version-history":[{"count":0,"href":"https:\/\/kiencang.net\/wp-json\/wp\/v2\/posts\/18610\/revisions"}],"wp:attachment":[{"href":"https:\/\/kiencang.net\/wp-json\/wp\/v2\/media?parent=18610"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kiencang.net\/wp-json\/wp\/v2\/categories?post=18610"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kiencang.net\/wp-json\/wp\/v2\/tags?post=18610"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}