Docker da VM a bayan OpenVPN: hanya ko sake lamba?

Kwantenawa da baƙi a kan uwar garke mai abokin ciniki na OpenVPN ko dai sun rasa hanyar dawowa ko sun yi karo da farkon ramin. Tambayoyi uku suna zaɓar maganin.

Uwar garke tana burauz ta ramin, kwantenan da ke gefenta kuma bai isa kome ba. Buga tashar jiragen ruwa daga kwantena da ke gudanar da nata abokin ciniki na VPN ya fi muni: buƙatar tana isowa kuma amsar ba ta taɓa fita ba. Dukansu shawarwari ne na hanya a kan uwar garke, kuma Docker manzo ne kawai.

Tambayoyi uku suna yanke shawara wanne daga cikin biyun kuke kallo, kuma suna ɗaukar kusan minti ɗaya.

Rashin nasara biyu da suke kama da juna

Na farko matsala ce ta hanyar dawowa. Ana fassara buga tashar zuwa cikin kwantenan, buƙatar tana isowa, kuma ana tafiyar da amsar ta hanyar da ta dace ta uwar garke, wadda OpenVPN abokin ciniki ya nuna ta zuwa tun0. Amsar tana fita daga adireshin da abokin nesa ba ya tsammani, kuma ana watsar da ita. Na biyu karo ne na farko: gadar da ta dace ta Docker tana da 172.17.0.0/16 kuma ramin kamfani yana tura irin wannan kewayon.

Ana gyara ɗaya da teburin hanya, ɗayan kuma ta sake lambar gada. Gyara kafin ka san wanne ne wanne shine yadda ake karya kwantena mai aiki.

Yanke shawara da tambayoyi uku

Tambaya ta ɗaya: shin rashin nasarar yana ɓacewa lokacin da ka dakatar da VPN? Idan komai yana aiki da ramin a kashe, yi zargin hanyar dawowa. Tambaya ta biyu: shin ip route show table all yana jera farkon ɗaya sau biyu, sau ɗaya a kan gada kuma sau ɗaya a kan tun0? Wannan shine karon. Tambaya ta uku: adireshin da abin ya shafa kwantena ne, baƙon NAT ko baƙon da aka haɗa da gada?

Tambaya ta uku tana da muhimmanci domin kowanne yana da ingantaccen magani daban, kuma yin amfani da maganin kwantena a kan baƙon libvirt yana ɓata maraice.

ip route
ip route show table all | grep -E '172\.1[7-9]|10\.8'
docker network inspect bridge --format '{{.IPAM.Config}}'

Hanyar dawowa: tebur don adireshin tushe ɗaya

Lokacin da traffic ɗin kwantena dole ya fita ta hanyar jiki yayin da uwar garke da kanta ke amfani da ramin, hanya bisa tushe shine mafi ƙarancin canji. Ƙara doka da ta dace da adireshin kwantena kuma ka tura ta zuwa tebur na musamman. Babu wani abu a uwar garke da ke motsi.

ip rule add from 172.22.0.3 lookup 10
ip route add default via 172.22.0.1 table 10

Kowane fakiti wanda tushensa shine wannan adireshin yana duba tebur 10 da farko, kuma tebur 10 yana tura shi zuwa ƙofar gada maimakon ramin.

Tabbatar da ip route get 1.1.1.1 from 172.22.0.3. Amsar dole ta ambaci hanyar gada, ba tun0 ba. Dokokin da aka ƙara haka suna ɓacewa lokacin sake kunnawa, don haka saka su a cikin unit ko ƙugiyar hanyar sadarwa da ke da kwantenan.

Irin wannan tsari yana aiki ga kwantenan WireGuard, inda hanyar amsawa ita ma tana buƙatar doka bayyananna.

Karon farko: sake lambar gada

Teburin hanya yana tura farkon ɗaya zuwa wuri ɗaya. Idan VPN yana tura 172.17.0.0/16 yayin da gadar Docker tana can, ƙananan metric yana cin nasara: Docker yana girka hanyar da aka haɗa a metric 0, kuma hanyar da aka tura tana zuwa a 50. Sannan ramin yana kama da ya karye yayin da Docker ke ci gaba da aiki, ko akasin haka, dangane da tsarin girka. Sake lambar gada maimakon yin gwagwarmaya da metric.

{
  "bip": "10.200.0.1/24",
  "default-address-pools": [{"base": "10.201.0.0/16", "size": 24}]
}

Sake kunnawa Docker bayan canjin kuma sake ƙirƙirar hanyoyin sadarwar da aka gina da tsohon tafki. Canza metric a maimakon haka yana motsa rikicin ne kawai zuwa tashin gaba.

VM suna buƙatar wata amsa daban kuma

Baƙon libvirt a kan hanyar sadarwar NAT da ta dace yana gadon tafiyar uwar garke kuma yana daina isa waje da zarar ramin uwar garke ya mallaki hanyar da ta dace. Canza baƙon zuwa na'urar gada ko macvtap yana ba shi hanyarsa a hanyar sadarwar jiki. A cikin virt-manager, ƙara kayan aiki, zaɓi Network, saita tushen zuwa na'urar uwar garke macvtap, riƙe virtio a matsayin samfurin, sannan kashe tsohuwar hanyar NAT.

Baƙon macvtap yawanci ba zai iya isa ga uwar garkensa ba. Wannan ɗabi'a ce da ake tsammani ba kuskure ba, kuma tana cikin bayanin da kuke bari.

Ga baƙon da kawai yake buƙatar LAN na uwar garke, abokin ciniki na mai siyar yana iya samun maɓallin da ya ɓace: tare da Mullvad, mullvad lan set allow yana dawo da isar da gida ba tare da taɓa libvirt ba. Kuma lokacin da kwantena dole ya zama mai isa ta rami kawai, ɗaure buga tashar zuwa adireshin ramin, -p 10.8.0.5:8080:8080, maimakon buga shi a kowane adireshi.

Labarai masu alaƙa