Yadda za a tura zirga-zirgar uwar gida ta kwandon Docker VPN

Kwandon ramin ku yana aiki, docker compose exec vpn curl -s https://ifconfig.me yana amsa da adireshin mai bayarwa, kuma har yanzu burauzar da ke kan teburinku tana fita ta ISP ɗinku. Wannan gibin abin tsammani ne. Kwandon da ke gudanar da abokin ciniki na VPN yana riƙe da sararin sunan cibiya, hanyoyi da fuskar rami, kuma babu abin da ke magana da HTTP ko SOCKS; wallafa tashar jiragen ruwa a kansa ba zai iya ƙirƙirar mai sauraro da bai taɓa kasancewa ba.

Inda abokin ciniki ke gudana yana ƙayyade ƙira. Kwandon maƙwabci zai iya shiga sararin sunan ramin, aikace-aikacen tebur ba zai iya ba, kuma na'urar hanya tana buƙatar hanyoyi maimakon filin wakili. Idan ka yi kuskuren taswira, alamar ita ce ɗaya: an ƙi haɗi, ko zirga-zirgar da ke ɗaukar tsohuwar hanya a hankali.

Daidaita tsarin da inda abokin ciniki ke gudana

Yi tambaya ɗaya kafin gyara Compose: shin ana iya fara abokin ciniki a cikin sararin sunan cibiyar kwandon VPN? Duk abin da ke gudana a matsayin kwandon Linux zai iya. Burauza, IDE ko CLI a teburinku ba zai iya ba, domin saitin wakilinsa yana tsammanin sabis ɗin yarjejeniya, ba sararin suna ba.

Waɗannan uku ba sa haɗuwa. Filin wakilin HTTP da aka nuna zuwa adireshin gada na kwandon ba ya isa kome sai dai idan wakili yana saurare a can, kuma mai sauraron wakili ba ya tura zirga-zirgar na'urar hanya. Fara yanke shawara, sannan bi sashin da ya dace.

Raba sararin sunan ramin da kwandon maƙwabci

Wannan shine mafi arha zaɓi domin babu yarjejeniyar wakili a ciki. Aikace-aikacen yana shiga sararin sunan sabis ɗin vpn kuma yana gado fuskoinsa, hanyoyinsa da sararin tashar jiragen ruwa:

services:
  vpn:
    image: your-vpn-client
    cap_add:
      - NET_ADMIN
    healthcheck:
      test: ["CMD-SHELL", "ip link show tun0 >/dev/null"]
      interval: 10s
      retries: 5
  app:
    image: your-app
    network_mode: service:vpn
    depends_on:
      vpn:
        condition: service_healthy

Ƙuntatawa uku sun biyo daga kasancewar sararin sunan na wani sabis. Aikace-aikacen ba ya samun mabuɗin networks nasa, domin ba shi da sararin suna da zai manne da shi. Wallafa tashar jiragen ruwa na vpn ne, domin a can ne sararin sunan yake. Kuma sake ƙirƙirar vpn yana lalata sararin sunan da aikace-aikacen ya shiga, don haka docker compose up -d --force-recreate vpn yana barin ku sake ƙirƙirar app kuma; sake kunnawa kawai ba koyaushe ya isa ba. Bayanin sabis na Compose ya shafi wannan tsari da ƙuntatawar wallafa tashar jiragen ruwa.

Kada ku ɗauka cewa mai warwarewa yana zuwa tare. /etc/resolv.conf fayil ne na kowane kwando, ba wani ɓangare na sararin sunan cibiya ba, don haka aikace-aikacen zai iya tambayar mai warwarewar uwar gida yayin da fakitinsa ke fita ta ramin. Karanta shi daga cikin kwandon kuma saita dns: a kan aikace-aikacen lokacin da sunaye masu zaman kansu dole su warware ta ramin.

docker compose exec app ip route
docker compose exec app cat /etc/resolv.conf
docker compose exec app curl -s https://ifconfig.me

Idan jerin hanyoyi ya ƙunshi fuskar ramin kuma adireshin na mai bayarwa ne, aikace-aikacen yana cikin ramin. Idan fuskar ba ta nan, app ya fara kafin vpn ya sami rami, don haka sake ƙirƙirar app da zarar vpn ya ba da rahoton lafiya.

Sanya ainihin mai sauraron wakili a cikin sararin suna don abokan cinikin uwar gida

Burauzar tebur ba za ta iya shiga sararin suna ba, don haka dole a bayyana ramin a matsayin sabis. Gudanar da ainihin wakilin SOCKS ko HTTP a cikin sararin sunan vpn kuma wallafa tasharsa kawai:

services:
  vpn:
    ports:
      - "127.0.0.1:1080:1080"
  proxy:
    image: your-proxy
    network_mode: service:vpn
    command: ["--socks", "0.0.0.0:1080"]

Adireshin gefen uwar gida shine muhimmin rabin wannan taswirar. 127.0.0.1:1080 a hagu yana kiyaye mai sauraro daga LAN ɗinku; "1080:1080" tsirara yana wallafa wakili buɗaɗɗe ga kowace na'urar da za ta iya isa injin ku.

Gefen kwandon yana da nasa tarkon. Ana isar da tashoshin da aka wallafa zuwa adireshin kwandon a kan gada, ba zuwa loopback ɗinsa ba, don haka wakilin da aka fara da --socks 127.0.0.1:1080 a cikin sararin suna yana karɓar haɗin maƙwabta kuma yana ƙin duk abin da ya zo ta tashar da aka wallafa. Daure shi zuwa 0.0.0.0 kuma dogara ga ɗaurin loopback na gefen uwar gida don keɓewa. Wannan ka'ida ɗaya ta shafi adireshin saurare a cikin fayil ɗin saitin wakili.

Sannan yanke shawara inda ake warware sunaye. A cikin curl --socks5 yana warware sunan uwar gida a gida kuma --socks5-hostname yana aika sunan zuwa wakili; burauzoci suna nuna maɓalli ɗaya a ƙarƙashin wani lakabi. Warwarewar gida tana yada tambayar ko da shafin yana lodawa ta ramin.

Dauki kwandon a matsayin ƙofa kawai tare da hanyar dawowa

Na'urorin hanya, VM da wayoyi ba za su yi amfani da filin wakilin HTTP ba, kuma wasu aikace-aikace suna watsi da masu canjin wakili gaba ɗaya. Tura zirga-zirgarsu yana nufin Layer 3: kwandon yana tura fakitoci kuma yana fassara adireshi a fuskar ramin.

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

Abu biyu ana mantawa da su cikin sauƙi. Abokin ciniki yana buƙatar hanyar da za ta nuna ƙofarsa ta asali zuwa wannan uwar gida, kuma amsoshi dole su sami hanyar dawowa, ko ta hanyar tsayayyiya a kan na'urar hanya ta sama ko ta NAT a fuskar da ke fuskantar abokan ciniki. Idan babu ɗaya daga cikinsu, ramin yana ɗaukar buƙatar waje kuma amsar ta ɓace.

Yana kuma da mafi faɗin tasiri. Uwar gidan da ke aiki a matsayin ƙofa ga dukan LAN yana aika kowane abokin ciniki mara ingantaccen saiti ta asusun VPN ɗinku, kuma faɗuwar rami ko ya rufe LAN ko ya koma ISP dangane da kill switch.

Tabbatar da hanyar fita, sannan ja da baya bisa tsari

Duba cikin wannan tsari kuma tsaya a gazawar farko: adireshin fita cikin sararin suna, adireshin fita daga uwar gida ta wakili, sannan warware suna don uwar gida mai zaman kanta.

docker compose exec vpn curl -s https://ifconfig.me
curl -s -x socks5h://127.0.0.1:1080 https://ifconfig.me
curl -s -x socks5h://127.0.0.1:1080 http://internal.example/health

Adireshi biyu na farko ya kamata su dace da mai bayarwa, kuma na uku ya kamata ya warware ta wakili maimakon gazawa da kuskuren suna. Daidaiton layi na farko da gazawar layi na biyu yana nufin mai sauraro ko tashar da aka wallafa ba daidai ba ne, ba ramin ba.

Ja da baya shine kishiyar saitin. Cire masu canjin muhalli na wakili daga bayanin shell da kowane rukunin systemd, sannan saukar da tarin don sararin sunan da aka raba ya ɓace tare da mai shi. Share tashar da aka wallafa kafin share sabis ɗin wakili, in ba haka ba uwar gida za ta riƙe mai sauraron loopback wanda babu wanda ke karantawa.

Kafin ku ci gaba, tabbatar da abu huɗu: abokin cinikin da kuke damu da shi ya isa ramin da gaske, mai sararin suna ne kaɗai ke wallafa tashoshi, sunaye masu zaman kansu suna warware a inda kuka yi niyya, kuma babu abin da ke saurare a adireshin uwar gida wanda ba loopback ba. Kowanne daga cikinsu yana gazawa cikin shiru a samarwa, kuma kowanne dubawa ne na layi ɗaya a sama.