Dante SOCKS a kan loopback don sabis ɗin HTTPS ta WireGuard kawai

Wannan jagorar tana ba wa aikace-aikacen da ya san proxy damar shiga hanyar WireGuard da take, ba tare da buga tashar proxy a kan uwar garken VPN ko a intanet ba. Daemon ɗin SOCKS yana ba da fuskar aikace-aikacen, WireGuard yana ba da hanyar IP da aka riga aka amince da ita, kuma babu ɗayansu da ke tabbatar da mai amfani a madadinka. Kowane mataki a ƙasa yana samar da wani abu da za ka iya dubawa, kowanne kuma yana da hanyar dawowa: dakatar da instance ɗin, cire dokar, ko cire saitin proxy na aikace-aikacen. Babu abin da ke nan da ke canza hanyar da aka saba ta host ɗin.

Misalin yana ɗauka cewa an shigar da Dante 1.4.x a matsayin instance na musamman da ake sarrafawa a kan ingantaccen aikin Linux, tare da asusun sabis da tsarin log ɗin fakitin an bar su a wurinsu. Aikin yana da 10.77.0.2 a kan fuskar WireGuard ɗinsa, yana isa 10.60.0.20:443 ta wannan tunnel ɗin, kuma ainihin sunan sabis ɗin shine app.corp.example.

Mataki 1: ɗaure mai saurare a loopback kawai

Saka sassan cibiyar sadarwa, hanya da dokoki a cikin tsarin aiki na instance ɗin, ka maye gurbin adiresoshin misalin. Duk saitin uwar garke suna zuwa gaban tubalan dokoki:

internal: 127.0.0.1 port = 1080
external: 10.77.0.2
external.protocol: ipv4
clientmethod: none
socksmethod: none

client pass {
    from: 127.0.0.1/32 to: 127.0.0.1/32
}

socks pass {
    from: 127.0.0.1/32 to: 10.60.0.20/32 port = 443
    command: connect
    protocol: tcp
}

Wannan guntu ne, ba maye gurbin saitin mai amfani da log ɗin fakitin ba. Zaɓi tashar gida da ba a yi amfani da ita ba, ka tabbatar wannan instance na musamman ba shi da wasu masu saurare, manyan dokokin wucewa ko shigarwar sarkar sama da za su canza yarjejeniyar. Idan tsarin da ya gabata ya bar socks pass ba tare da takurawar manufa ba, cire shi kafin ka gwada komai.

Dawowar wannan mataki ita ce dakatar da instance ɗin; fayil ɗin tsari na iya zama a faifai yayin da kake mayar da shi.

Mataki 2: rubuta dokoki biyu, ba ɗaya ba

Dante mabuɗin tsari yana ba wa nau'ikan doka biyu ayyuka daban-daban. Dokar abokin ciniki tana karɓar haɗi zuwa mai sauraren loopback, manufarta kuma ita ce adireshin mai sauraren kansa. Dokar SOCKS tana ba da izinin haɗin gaba da aka nema zuwa uwar garke da tashar da aka amince. Ana toshe buƙatun da ba su dace ba ta tsohuwa, wanda shine dalilin da ya sa dokar da ta ɓace tana kama da hanyar da ta lalace.

Lura da abin da wannan tsarin ba ya yi da gangan: baya neman kalmar sirri ta SOCKS. Wannan ya dace da amintaccen host na gida, kuma ba tabbatar da mai amfani bane. Kowane wani tsari a wannan na'ura na iya amfani da loopback shima. Ka riƙe tabbatarwar aikace-aikacen nesa a wurinsa, kuma kada ka sake amfani da wannan siffa marar tabbaci ga marasa aminci na gida ko mai saurare da ke fuskantar LAN.

Mataki 3: tabbatar da hanyar daga tushen da ya dace

external yana zaɓar adireshin tushen fita; baya girka hanyar WireGuard. Bincike na karatu kawai don tushen misali da manufa:

ip -4 route get 10.60.0.20 from 10.77.0.2

Gudanar da wannan a cikin ainihin sararin sunan cibiyar sadarwar Dante, ba cikin kowane harsashi da ka buɗe ba. Hanyar, zaɓin abokin WireGuard, izinin gefen nesa da hanyar dawowa duk dole su dace da wannan adireshin tushen. Nasarar bincike dole ne kuma bai isa ba, domin baya faɗin komai game da ko ƙarshen nesa yana karɓar buƙatar.

Ka yi tsayin daka da jarabar ƙara hanyar da aka saba domin binciken ya yi nasara. Tashar proxy tana nan a wannan aikin kawai; canza hanyar da aka saba ta host don ƙirƙirar ta yana juya dukan ƙirar baya.

Mataki 4: gwada da asalin da aka nufa

Bayan mai shi ya tabbatar da tsarin da aka girka kuma ya fara instance ɗin ta hanyar mai sarrafa sabis ɗinsa, buƙata misali ita ce:

curl --proxy socks5h://127.0.0.1:1080 --noproxy '' https://app.corp.example/

Da socks5h, Dante yana yin warwarewar manufa, amma Dante yana gudana a wannan aikin, don haka saitin ba ya aika DNS zuwa ƙarshen tunnel ɗin da kansa. Mai warwarewar da aka amince da shi da Dante ke amfani da shi dole ya dawo da adireshin da aka yarda don wannan sunan. Jerin da babu proxy yana hana keɓancewar gado ta wuce SOCKS a hankali.

Ka kiyaye tabbatarwar sunan host da takardar shaidar HTTPS a cikin gwajin, sannan ka duba ainihin mai saurare ka tabbatar da rabobin yarjejeniyar biyu: buƙatar da aka yarda tana yin nasara kuma wata manufa da aka cire tana gazawa. Har ila yau ka tabbatar umarnin turawa marasa tallafi sun kasance an hana su, domin wannan guntu yana ba da izinin umarnin SOCKS CONNECT a kan TCP kuma babu wani abu mai kama da tunnel na gama-gari na UDP ko na dukan na'urar.

Mataki 5: yanke shawara abin da zai faru idan tunnel ɗin ya faɗi

Gwada asarar tunnel da sake kunna instance ɗin kafin ka kira wannan samarwa. Mai sa ido da ke fara Dante bayan WireGuard baya ƙirƙirar tuƙi na fail-closed, kuma baya ƙirƙirar DNS na fail-closed; dole ne a tilasta duka biyu ta hanyar mai cibiyar sadarwa. Ka lura abin da aikace-aikacen ke yi lokacin da tunnel ɗin ya faɗi: kuskure mai tsabta sakamako ne mai kyau, faɗuwa a hankali zuwa mai warwarewa na jama'a ba haka bane.

Ka daidaita sabuntawa idan adireshin tunnel ɗin da aka ɗaure ya canza, domin external an lika shi da shi. Lokacin da ba a buƙatar wannan tsarin kuma, ka yi ritaya da wannan instance da saitin proxy na aikace-aikacen tare, ka bar hanyar WireGuard ga wanda ya mallake ta.