OpenVPN a cikin Docker: yarjejeniyar gudanarwa da ƙaramin abokin ciniki ke bukata

Saka abokin ciniki na VPN a cikin kwantena sai ka sami wurin suna ɗaya da tunel a ciki, ba mai ɗaukar nauyin da ke bin duk zirga-zirgarsa ta VPN ba. Waɗannan ayyuka ne daban-daban, kuma ɗaukar su a matsayin ɗaya shine yadda kwantena ke ƙarewa da gata bisa kuskure. Wannan jagorar tana magana ne kawai kan na farko: hoto ɗaya da aka duba, bayanin martaba ɗaya mai kariya, da tsarin abokin ciniki da aka iyakance ga wurin sunansa na cibiyar sadarwa.

Fara da wani kayan aiki da wani ya riga ya amince da shi. Matakan da ke ƙasa suna ɗauka cewa hoton yana ɗauke da fayil ɗin da ake aiwatarwa na openvpn da cikakken bayanin martabar abokin ciniki wanda aka riga aka warware takardar shaidarsa da kayan maɓalli a cikin haɗin. Ba sa gina manhaja, ba sa fitar da takaddun shaida, kuma ba sa rufe yanayin gudanarwa marasa tushe ko kwantenan Windows na asali, waɗanda kowanne yana canza amsar.

Abin da kwantena ke samu da abin da ba ya samu

Riƙe bayanin martaba da duk abin da yake magana da shi a cikin wani babban fayil na gida mai iyakantattun izini, wanda aka haɗa azaman karatu kawai. Dole hanyoyin dangi a cikin bayanin martabar su warware a cikin wannan haɗin; wannan shine dalla-dalla da mutane ke watsi da shi lokacin da takardar shaida ta kasance babban fayil ɗaya sama da bayanin martaba kuma kwantenan bai taɓa ganinta ba.

services:
  vpn:
    image: ${VPN_CLIENT_IMAGE:?set the reviewed image reference}
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - ./vpn:/vpn:ro
    working_dir: /vpn
    entrypoint: ["openvpn"]
    command: ["--config", "/vpn/client.ovpn"]

Wannan fayil ɗin yana ba da abubuwa uku kuma ba ya neman wani abu. Ya kamata a ƙulla maganar hoton da digest idan manufofin tura ku sun faɗi haka, kuma bayanin martabar ya kamata ya zama wanda aka duba ba kwafin da wani ya gyara a wurinsa a kan mai ɗaukar nauyi ba.

Karatu kawai a nan yana nufin kwantenan ba zai iya canza fayilolinka a kan mai ɗaukar nauyi ba; ba yana nufin kwantenan ba zai iya karanta maɓallin sirri da ka haɗa ba. Wannan shine dukkan manufar haɗin, kuma shine dalilin da ya sa izinin fayil, mallaka da yadda sirrin ya isa kan mai ɗaukar nauyi har yanzu suna da mahimmanci. Kada ka taɓa wuce kalmar sirri a kan layin umarni ko ka toya ta a cikin layin hoto, domin dukansu suna rayuwa a wuraren da ba za ka iya tsaftacewa daga baya ba.

Ƙarfi, entrypoint da tarko da ke tsakaninsu

Ana buƙatar saituna biyu kuma suna yin ayyukan da ba su da alaƙa. NET_ADMIN yana ba da izinin sarrafa mu'amala da hanyoyi a cikin wurin sunan kwantena. Shigar da na'urar /dev/net/tun yana ba tsarin damar buɗe na'urar tunel kwata-kwata. Ba da ɗaya ba tare da ɗayan ba yana haifar da bayyanannen gazawa, wanda ya dace: rashin na'urar TUN yana gazawa lokacin buɗewa, yayin da rashin ƙarfi yana gazawa lokacin da abokin ciniki ya yi ƙoƙarin daidaita mu'amalar.

Babu ɗayan waɗannan da ke tabbatar da privileged: true. Kwantena mai gata yana samun kowane ƙarfi da damar na'urori, kuma wannan shine babban bayarwa fiye da abin da wannan aikin ke bukata. bayanin izini da ƙarfin yanayin aiwatarwa yana bayyana yadda wannan bayarwar ta isa. Idan chart ko rubutun blog ya nemi hakan, fara duba ko buƙatar da gaske hanya ce ta na'urar da ta ɓace ko ƙarfin da ya ɓace.

Maye gurbin entrypoint shine ɓangaren da ke cizo. Kira openvpn kai tsaye daidai ne ga hoto na yau da kullum kuma ba daidai ba ga kowane hoton samfur wanda rubutun farawarsa ke shirya dokokin katangar wuta, fayilolin warwarewa ko takaddun shaida kafin aiwatar da daemon. Maye gurbin wannan rubutun yana tsallake shirye-shiryen kuma yana barin ka kana gyara tunel da ya tashi a cikin wurin sunan da ba a kammala ba.

Gudanar da abokin ciniki a gaba kuma bar shi ya zama babban tsarin kwantena. Tsarin da ke zama daemon yana fita nan take, kwantena yana sake farawa a madauki, kuma bayanan da kake buƙata sun warwatse a cikin sake farawa waɗanda duk suna kama da juna.

Tabbatar daga cikin wurin suna, ba daga mai ɗaukar nauyi ba

Ka ɗaga tarin, tabbatar a cikin bayani cewa abokin ciniki ya isa yanayin da aka haɗa, sannan ka duba wurin sunan da ke riƙe da tunel ɗin da gaske.

docker compose up -d
docker compose logs --tail 40 vpn
docker compose exec vpn ip -br addr
docker compose exec vpn ip route

Jerin adireshi ya kamata ya nuna mu'amalar tunel da adireshi daga tafkin, kuma teburin hanyoyi ya kamata ya nuna wuraren da aka tura suna nuni zuwa gare ta. Idan mu'amalar babu, abokin ciniki bai taɓa isa matakin ƙirƙirarta ba. Idan tana nan amma babu hanyar da ke amfani da ita, wurin da za a duba shine push ko zaɓuɓɓukan hanya.

Sannan gwada manufar da ta shafe ka, daga wurin sunan da ya kamata ya yi amfani da tunel, da manhajar ba kawai da ping ba. Warware suna gazawa ce daban wadda ta cancanci a gwada ta sarai: adireshin DNS da aka tura ba ya sabunta mai warwarewar kwantena da kansa, kuma abokin ciniki mai zaman kansa da ya yi watsi da push zai warware sunaye ta hanyar abin da hoton ya daidaita.

Yanayin da aka cire haɗi wani ɓangare ne na yarjejeniyar

Halin sake haɗawa yana buƙatar nasa binciken, domin manufar sake farawa tana tabbatar da cewa tsarin yana sake farawa kuma ba ta faɗi komai game da abin da zirga-zirga ke yi a tsakani ba. Dakatar da tunel, gwada manufar da aka nufa kuma ka lura ko an ƙi haɗin, ya rataye, ko ya yi nasara a shiru ta hanyar da kwantena ke bi. Sakamakon ƙarshe shine wanda ke da mahimmanci, kuma ba a ganinsa a cikin lafiyar bayani.

Idan aikin ba zai taɓa amfani da hanyar yau da kullum ba, tsara hakan a bayyane da dokokin katangar wuta da siginar shiriya a cikin wurin suna. Kill switch manufa ce da kake rubutawa kuma ka gwada, ba dukiya da kake gado ta hanyar gudanar da abokin ciniki a cikin kwantena ba.

A ƙarshe, tuna iyaka: waɗannan hanyoyi suna rayuwa a cikin wurin sunan kwantena kuma ba sa maye gurbin teburin hanyoyin mai ɗaukar nauyi. Dokokin turawa, fassara da katangar wuta na Docker sun kasance wani ɓangare na hanyar waje, kuma tashar da aka buga ba mu'amalar VPN ba ce.