DNAT a cikin kwandon VPN: turawa, ba INPUT ba

Buƙatar tana zuwa da adireshin IP na ramin kuma tana barin wannan kwandon da adireshin wata hidima makwabta. Tsakanin waɗannan lokuta biyu, DNAT ya sake rubuta inda aka nufa, kuma fakitin ya daina zama shigarwa ga kwandon VPN. Yanzu ya zama zirga-zirgar da aka tura, wadda wata doka ce ke hukunta shi. Wannan canji ya bayyana dalilin da ya sa dokar katangar wuta da ta yi kama da daidai ga adireshin ramin ba ta da wani tasiri a kan haɗin da aka fassara.

Bi fakitin bayan fassara

Ɗauki rukunin abokan ciniki 10.90.0.0/24 da adireshin rami 10.90.0.1. Kwanduna biyu suna kan gada ɗaya: 192.0.2.2 yana gudanar da VPN kuma 192.0.2.3 yana gudanar da manhajar. Abokin ciniki ya haɗa zuwa 10.90.0.1:8080, kuma dokar DNAT a cikin sararin suna na kwandon VPN ta sake rubuta hakan zuwa ainihin adireshi da tashar manhajar. Sai wata hanya ta aika fakitin ta kan gada. Waɗannan adiresoshin misali ne, ba girke-girken turawa ba.

Tashar da manhajar ke saurara a kai da gaske na iya bambanta da duk wata tasha da aka buga a kan mai masaukin. Karanta mai saurara a cikin kwandon maimakon ɗauka cewa lambobin biyu sun yi daidai.

Izini na cikin hanyar turawa

Kwandon VPN yana buƙatar turawa IP da shawarar turawa da aka takaita ga rukunin abokan ciniki, adireshin manhajar da tashar da aka yi niyya. Amsoshin da aka kafa suna buƙatar izininsu. Doka da ta dace da ainihin adireshin ramin ba za ta dace ba bayan DNAT, domin inda aka nufa ya riga ya canza. Izinin INPUT shine ƙugiya mara kyau ga zirga-zirgar da ba a nufa ga wannan mai masaukin ba kuma.

Riƙe iyaka a ƙunci: yanki ɗaya na tushe, manufa ɗaya, hidima ɗaya. Dokar turawa mai sassauci ta fi sauƙin rubutawa kuma ta fi wahalar karewa daga baya.

docker exec vpn-container ip route get 192.0.2.3
docker exec vpn-container iptables -t nat -S
docker exec vpn-container iptables -S FORWARD

Sarkokin Docker ba sarkokin kwandonka ba ne

Dokoki a cikin sararin suna na kwandon ba dokokin mai masaukin Docker ba ne. Lokacin da zirga-zirgar ke wucewa daga mu'amalar ramin zuwa gada, katangar wuta ta gada a kan mai masaukin na iya yin wata shawara. Tare da iptables backend na Docker, sarkokin turawa da aka rubuta da wuraren daidaitawa bayan DNAT su ne wurin da wannan shawarar ke bayyana.

Bayanin katangar wuta na Docker ya bayyana waɗannan sarkoki da daidaitawa bayan DNAT. Kada ka gyara karɓar da ta ɓace ta hanyar kashe gudanarwar katangar wuta ta Docker ko sanya kowace sarka sassauci, domin hakan yana cire iyakar da kake ƙoƙarin amfani da ita.

Maida hanyar dawowa zaɓi na gangan

Idan an kiyaye adireshin tushe, manhajar tana ganin 10.90.0.x kuma dole ne ta tura amsoshi baya ta kwandon VPN. In ba haka ba, ƙofar Docker ta al'ada za ta tura su zuwa mai masaukin, wanda ba ya mallakar ramin. Madadin shine fassarar tushe mai ƙunci a kwandon VPN, wanda ke sauƙaƙa amsa amma yana ɓoye abokin ciniki daga manhajar. Zaɓi da gangan kuma rubuta wanda ka zaɓa.

Gwada sabon haɗi da aka yarda daga abokin ciniki na yau da kullum, sannan tabbatar tashoshin da ba su da alaƙa sun kasance a rufe. Lokacin da fakitin ya ɓace, duba sararin suna na VPN, sararin suna na manhajar da log na manhajar kanta. Ping zuwa ƙofar gada ba gwajin karɓa ba ne ga hidimar.

Riƙe dokokin a cikin tsarin farawa da aka goyi bayan na kwandon, domin gyare-gyaren kai tsaye suna ɓacewa idan an sake ƙirƙira shi. Bugawar tashar mai masauki wata hanya ce ta fallasa kuma ba a buƙata kawai saboda ana iya isa hidimar ta ramin.