Buga tashar Docker da VPN: inda amsa take zuwa

Kwandon da aka buga yana amsawa daga adireshinsa kafin NAT na juyawa. Zane-zane biyu na iya rike wannan amsa a kan hanyar jama'a, da farashi daban-daban.

Mai masaukin yana ci gaba da amsa SSH bayan VPN mai cikakken tunnel ya tashi, yayin da sabis ɗin da aka buga da Docker a kan wannan na'ura ɗaya ya yi shiru. Babu wani abin da ba daidai ba a cikin mai sauraro: kwandon yana aiki, taswirar tashar tana nan, kuma fakitin yana isowa. Kwandon yana cikin lafiya kuma buƙatar tana isa gare shi. Abin da ya bambanta shi ne inda amsa take farawa lokacin da Linux ke zaɓar hanyarsa, kuma wannan bambancin ne ke yanke shawarar wane daga cikin zane-zanen biyu da ke ƙasa kuke buƙata.

Bi tuple ta cikin NAT na manufa

Ɗauki mai masauki a 192.0.2.10 wanda ke buga TCP 2222 zuwa kwando a 172.30.240.5:22. Buƙata daga 198.51.100.25 ana fassara ta kafin ta isa kwandon, kuma kwandon yana amsawa da kansa.

WAN request:      198.51.100.25 -> 192.0.2.10:2222
after DNAT:       198.51.100.25 -> 172.30.240.5:22
container reply:  172.30.240.5:22 -> 198.51.100.25

A lokacin shawarar hanya a mai masaukin, amsar tana ɗauke da adireshin tushen kwandon. Fassarar juyawa tana maido da tuple ɗin da aka buga daga baya, wanda shine dalilin da yasa fakitin yake kama da kuskure a daidai lokacin da ake zaɓar hanya.

Me yasa dokar mai masauki kaɗai ke rasa shi

Doka da ke zaɓar teburin WAN kawai don fakitin da suka fito daga 192.0.2.10 tana rufe daemons na mai masaukin kansa kuma tana rasa wannan amsar da aka tura gaba gaba ɗaya. Adireshin tushen da ke kan amsar shine 172.30.240.5, ba mai masaukin ba.

Gyaran da ya wuce gona da iri shine a tura komai daga kwandon ta WAN, wanda kuma ke keɓance haɗin fita marasa alaƙa na kwandon daga VPN. Wannan wata manufa ce daban da wadda aka nema, kuma yawanci tana ba wani mamaki daga baya.

Daidaitawa bayan DNAT wani hook ne daban

Takardun Docker game da katangar wuta sun lura cewa tacewar mai amfani ta yau da kullum tana ganin manufar bayan DNAT, don haka daidaita tashar da aka buga 2222 a cikin doka ta al'ada ba daidai yake da daidaita tashar kwando 22 ba. Idan tuple na asali yana da mahimmanci, yi amfani da hanyar asalin manufa da aka goyi bayan maimakon yin hasashen wace tasha ake gani.

Wannan rikicewar hook tana haifar da dokoki da suke kama da daidai kuma ba sa taɓa daidaitawa. Duba ƙididdiga a kan dokar kanta kafin ka sake rubuta manufar. Doka da ba ta da bugun komai tana gaya maka ana kimanta ta a wani wuri da fakitin ba ya taɓa isowa.

Zane A: ɗauki shawarar a matsayin yanayin haɗi

Alamar haɗi na iya ɗaukar shawarar shiga ta cikin fassarar, amma dole ne a mayar da ita ga fakitin kafin binciken hanyar da ke da mahimmanci. Matakan su ne:

  1. Ajiye filin alama da fifikon doka waɗanda ba sa karo da Docker, VPN ko wani mai manufa.
  2. Gane sabon haɗin WAN da ake so kawai a wani wuri kafin DNAT inda ake bin haɗi.
  3. Rubuta shawarar a kan alamar haɗi, ba tare da tilasta ainihin buƙatar kanta zuwa teburin WAN ba.
  4. A wajen amsa, mayar da bits ɗin alamarka kawai ga fakitin kafin turawa.
  5. Zaɓi cikakken teburin WAN da wuri sosai don dokar VPN ba za ta iya yin nasara da farko ba.

Wannan teburin yana buƙatar ainihin hanyoyin da aka haɗa da ƙofar. Hakanan yana buƙatar ƙayyadadden hali lokacin da hanyar ta ɓace. Faɗuwa cikin shiru cikin tunnel shine mafi munin sakamako, domin saitin har yanzu yana kama da yana aiki. A maimakon haka ka kasa a rufe kuma ka rubuta shi.

Zane B: ƙare a kan mai masauki

Frontend ɗin da aka tsara da gangan a gefen mai masauki, kamar proxy na TCP ko proxy na juyawa a gaban kwandon, yana riƙe amsar tana fitowa daga adireshin mai masaukin. Sa'an nan dokokin da aka rubuta don mai masaukin suna aiki kamar yadda ake tsammani, kuma kwandon ya kasance a kan cibiyar sadarwarsa ta sirri.

Farashin shine wani sashi mai motsi da nasa saitin, sarrafa adireshin tushe da ikon shiga. Yawanci shine mafi sauƙin iyaka da aka goyi bayan, kuma sau da yawa shine amsar da ta dace lokacin da mutum ɗaya wanda zai iya barin zai kula da manufar turawa.

Tabbatar da canjin, ba niyya ba

Buɗe sabon haɗin da aka ba da izini daga gefen jama'a kuma tabbatar cewa amsar tana barin ingantacciyar hanyar sadarwa. Sannan duba cewa buƙatar da ba ta da alaƙa da kwandon ya fara tana bin VPN har yanzu.

Kada ka wanke teburin haɗin na'urar don gwada doka ɗaya: abubuwan da ke akwai suna riƙe taswirarsu ta baya, kuma wankewar tana lalata komai a kan mai masaukin. Buga tasha yana bayyana isarsa. Ba ya bayyana hanyar amsa. Rubuta zanen da aka zaɓa tare da sunayen teburinsa, don kada na gaba ya sake gano shi yayin wani lamari.

Labarai masu alaƙa