Yadda za a bi da zirga-zirgar kwantena Docker kawai ta OpenVPN

Ka bar uwar garken a kan hanyarta ta yau da kullum ka sa yankin kwantena ɗaya a cikin rami: tsarin NAT, dokokin tushe, iroute na OpenVPN da binciken MSS.

Fakitin kwantenan ba ya taɓa isa tun0, kuma ƙarin dama a kan kwantenan ba zai canza hakan ba. Akwai binciken hanya biyu tsakanin baƙo da rami: ɗaya a cikin sararin sunan cibiyar sadarwar baƙo, ɗaya a kan uwar garke bayan firam ɗin ya sauka a kan gada, na biyu kuma yana duba wani tebur da wasu dokokin daidaitawa. Tsarin da nake amfani da shi shine uwar garken Linux da ke gudanar da OpenVPN abokin ciniki wanda ke riƙe 10.8.0.10 a kan tun0, gadar Docker a kan 172.18.0.0/16, da adireshin sirri wanda kawai gefen rami zai iya isa. Manufar ta kasance mai kunkuntu: wannan yankin baƙo yana fita ta rami yayin da uwar garke ke riƙe da hanyarta ta yau da kullum.

Gudanar da abokin ciniki VPN a cikin kwantenan wani tsari ne daban, ba gajeriyar hanya ba. Sa'an nan kwantenan ya mallaki raminsa da takardun shaidarsa, kuma aikin yana ƙaura zuwa Dockerfile maimakon zama a iptables.

Tura yana zaɓar hanya bisa inda ake so, sannan NAT yana sake rubuta tushen

Idan an saita net.ipv4.ip_forward=1, fakitin da aka tura ana bi da shi bisa inda ake so kawai, a cikin babban tebur. Tushen ba shi da wani bangare a wannan shawarar. Bayan an zaɓi hanyar ne kawai kernel ke gudanar da POSTROUTING, kuma a nan ne dokar Docker take: -s 172.18.0.0/16 ! -o br-appnet -j MASQUERADE. Duk abin da ya bar gada zuwa wata fuska ana fassara shi, kuma adireshin da ya zama ya dogara da fuskar da hanyar ta aika shi zuwa gare ta.

Wannan doka tana bayanin yawancin alamun da ake tambayata. Idan babban tebur ba shi da hanya zuwa inda ake so na sirri, fakitin yana fita ta hanyar ɗauke da adireshin jiki na uwar garke. Mai ba da sabis ɗinka yana watsar da inda ake so, ko shafin nesa yana watsar da tushen RFC 1918 da bai taɓa tsammani ba, kuma kwantenan ya ƙare lokaci yayin da ramin ya tsaya lafiya. Riƙo a kan tun0 ba ya nuna komai, kuma wannan shine alamar. Idan hanyar tana nufin tun0 da gaske, MASQUERADE yana sake rubuta tushen zuwa 10.8.0.10 kuma kwantenan ɗaya yana aiki ba tare da ka taɓa komai ba.

Ka nemi binciken da ke ambaton tushen baƙo. Ba tare da from da iif uwar garke tana amsa don soket ɗinta kuma tana ba da labarin hanyar da fakitin da aka tura ba zai taɓa ɗauka ba:

ip route get 192.168.11.222 from 172.18.0.5 iif br-appnet

Idan wannan amsar ta ambaci hanyar, ramin ba ya cikin hoton kuma babu wani saitin gefen rami da zai taimaka.

Ka matsar da baƙo zuwa adireshin ramin kansa

Mafi ƙarancin canji da ke aiki shine sake rubuta tushe a fili yayin fita. Ka saka shi maimakon ƙara shi: Docker ya riga ya zauna a kan POSTROUTING, don haka dokar da aka ƙara da -A ana kimanta ta bayan ta Docker kuma ba ta taɓa aiki.

iptables -t nat -I POSTROUTING 1 -s 172.18.0.0/16 -o tun0 -j SNAT --to-source 10.8.0.10

Sharuɗɗa biyu ne ke yanke shawarar ko wannan zai tsaya. Adireshin dole ne ya kasance wanda abokin ciniki ya riƙe da gaske, don haka ka liƙa shi da shigarwa ga kowane abokin ciniki wanda ya ƙunshi ifconfig-push 10.8.0.10 255.255.255.0; dokar da ke ambaton adireshin da ba a taɓa bayar ba tana haifar da watsi a shiru, ba kuskure ba. Kuma gefen nesa dole ne ya karɓi wannan tushen kuma ya tura amsoshi baya, shi ya sa jerin izini a can ke ambaton adireshin rami maimakon yankin baƙo. Lokacin da adireshin abokin ciniki yake canzawa, -j MASQUERADE tare da -o tun0 yana bin abin da fuskar take da shi, a kan farashin manufar nesa da ba za ka iya rubuta ƙayyadadden ƙima a kanta ba.

Tacewa shine ɗayan rabin. Docker yana sa manufar FORWARD zuwa drop kuma yana share sarƙoƙin da ya mallaka a kowane sake farawa daemon, don haka ka sa manufar gida a cikin DOCKER-USER, wanda ke rayuwa:

iptables -I DOCKER-USER -i br-appnet -o tun0 -j ACCEPT
iptables -I DOCKER-USER -i tun0 -o br-appnet -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Dokar dawowa tana da muhimmanci: amsar da ta isa tun0 don haɗin da gada ta buɗe ba a karɓe ta kawai saboda an karɓi alkiblar fita.

Ka riƙe uwar garke kai tsaye da dokar tushe

Lokacin da dukan gada ya kamata ta yi amfani da ramin amma babu wani abu a uwar garke, ka tsallake NAT kuma ka ba wannan tushen nasa tebur. Adireshin baƙo sai su kasance a bayyane daga farko zuwa ƙarshe.

echo "200 vpnbox" >> /etc/iproute2/rt_tables
ip rule add from 172.18.0.0/16 lookup vpnbox pref 1000
ip route add default dev tun0 table vpnbox

Ana tuntuɓar dokoki kafin babban tebur, kuma from yana daidaita da tushen. Fakitin waje na ramin kansa suna ɗauke da tushen jiki na uwar garke, don haka ba su taɓa daidaitawa da from 172.18.0.0/16 ba kuma ramin ba zai iya tura kansa baya cikin kansa ba. Wannan keɓewar kai ita ce ke sa tsarin ya tsaya.

Hanyar dawowa yanzu tana buƙatar taimako. Gefen nesa yana ganin 172.18.0.x da ba a fassara ba kuma ba shi da dalilin sanin inda yake. A kan uwar garke, fayil ga kowane abokin ciniki yana buƙatar iroute 172.18.0.0 255.255.0.0 domin tebur na ciki na uwar garke ya ba da wannan prefix ga wannan abokin ciniki, da route 172.18.0.0 255.255.0.0 da aka tura domin sauran abokan ciniki su san akwai shi.

Bincike biyu kafin ka amince da shi. Gudanar da ip route show default: tare da redirect-gateway def1 tebur yana riƙe 0.0.0.0/1 da 128.0.0.0/1 ta hanyar tun0, kuma uwar garke ba ta kai tsaye ko kaɗan, domin waɗannan rabin-tsoffin suna cin nasara ba tare da maye gurbin default ba. Dokokin da aka ƙara da ip rule add ma suna ɓacewa a sake farawa, don haka ka ɗauke su a cikin rubutun up.

Girman fakiti shine gazawar da za ka fuskanta ta biyu

Fuskar gada a 1500 bytes tana ba ramin fiye da abin da zai iya ɗauka da zarar an ƙara manyan kan UDP da IP. Ƙananan musayar suna wucewa, don haka DNS yana warwarewa kuma musafaha TLS yana kammalawa, sannan babban lodawa yana rataye ba tare da wani kuskure a ko'ina ba. Mai aikawa yana maimaita girman sashi ɗaya saboda saƙon ICMP na bukatar rarrabuwa, wanda zai gaya masa ya rage, ba ya taɓa isowa.

Gyara shi a fuska, a MSS, ko duka biyu. Matsewa ba ta buƙatar haɗin kai daga baƙo:

ip link set dev tun0 mtu 1400
iptables -t mangle -A FORWARD -o tun0 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

Matsewar tana sake rubuta TCP kawai. UDP, har da QUIC, yana buƙatar a maimakon haka a saukar da fuskar baƙo, tare da --opt com.docker.network.driver.mtu=1400 lokacin ƙirƙirar cibiyar sadarwa ko maɓallin compose da ya dace.

DNS da binciken da suka cancanci maimaitawa

Warware suna yana bin hanya ɗaya. Mai warware da aka saka na Docker a 127.0.0.11 yana tura zuwa sabar da aka saita na uwar garke, don haka kwantenan yana gado abin da uwar garke take amfani da shi. Lokacin da yankin sirri ke samun amsa daga mai warware da ake iya isa ta ramin kawai, ka nuna wa baƙon wannan adireshin, kuma ka gwada da getent hosts a cikin kwantenan maimakon a kan uwar garke.

  • Gudanar da buƙatar da ta gaza a cikin baƙo; gwaji a gefen uwar garke yana amfani da wani adireshin tushe kuma yana ɓoye matsalar.
  • Karanta ƙididdiga a kan dokokin NAT da tacewa da ka ƙara. Dokar da ba ta da wani daidaito kuskuren turawa ne, ba kuskuren manufa ba.
  • Tabbatar cewa adireshin rami a cikin dokar SNAT ɗinka shine wanda abokin ciniki ya riƙe da gaske.
  • Saukar da MTU na baƙo ko matse MSS kafin ka zargi uwar garke da tsayawa.

Bi jerin zuwa ƙasa ka tsaya a gazawar farko. Wannan Layer ita ce za a gyara; duk abin da aka ƙara a ƙasa yana ɓoye iyakar da ke karyewa kawai.

Labarai masu alaƙa