Bin diddigin zirga-zirgar mai masauki ta VPN a cikin VM: gwaje-gwaje shida

Gwaje-gwaje shida, da aka yi su a jere, suna yanke shawara ko VM zai iya zama ƙofar VPN ga mai masaukinsa. Hypervisor ba ya yin wani abu daga cikin wannan a madadinka: baƙo ne ya mallaki ramin, mai masauki ne ya mallaki hanya, kuma hanyar sadarwa a tsakaninsu ita ce hanya ta yau da kullum. Ina riƙe da jerin saboda tsallake mataki ɗaya koyaushe yana haifar da alama ɗaya, shiru, inda mai masauki yake ping ɗin baƙo cikin farin ciki kuma bai isa wani abu na ciki ba.

Fara da dalili. Ko dai an shigar da abokin ciniki na kamfani a cikin baƙo kawai, ko manufofin suna riƙe shi a can, kuma har yanzu kana buƙatar uwar garken gini na ciki daga mai masauki. Idan an ba mai masauki izinin abokin cinikinsa, yi haka maimakon: rami ɗaya a kan mai masauki yana cin nasara kan hanyoyin sadarwa biyu da NAT kowace rana.

Gwaji 1: mai masauki yana buƙatar hanyar da zai iya ba da adireshi

Dole mai masauki ya mallaki interface ɗin da ke cikin prefix ɗaya da adafta na biyu na baƙo. Host-only a cikin VirtualBox, host-only ko VMnet na musamman a cikin VMware Workstation, gada ta ciki ko na'urar tap a cikin QEMU/KVM, da Internal switch a cikin Hyper-V duk sun cancanta. Baƙo 192.168.56.2, mai masauki 192.168.56.1, prefix 192.168.56.0/24 shine tsarin da nake amfani da shi a dakunan gwaji.

Hanyar sadarwar QEMU ta yanayin mai amfani (-netdev user, SLIRP backend na asali) da NAT na VirtualBox sun kasa wannan gwajin gaba ɗaya. Fakitin baƙo suna isa wani tsari na wakili a kan mai masauki, don haka mai masauki ba ya ganin na'urar da ke ɗauke da adireshin baƙo kuma ba shi da abin da zai nuna hanya zuwa gare shi. Default Switch na Hyper-V ita ce irin wannan labari. Idan ping 192.168.56.2 daga mai masauki ya kasa, tsaya: babu wata hanya da za a ƙara daga baya da za ta gyara shi.

Gwaji 2: baƙo yana turawa kuma yana fassara

Fakitin da suka fito daga mai masauki suna zuwa da adireshin tushe na host-only da manufa ta ciki, don haka baƙo dole ya tura su sannan ya ɓoye su a bayan adireshin raminsa. A kan baƙon Linux wannan yana nufin turawa, biyu na FORWARD accept, da source NAT zuwa ramin:

sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -A FORWARD -i eth1 -o tun0 -j ACCEPT
sudo iptables -A FORWARD -i tun0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s 192.168.56.0/24 -o tun0 -j MASQUERADE

Dokar MASQUERADE ita ce sashin da mutane suke watsi. Routers na kamfani ba safai suke sanin cewa 192.168.56.0/24 akwai; da dokar, uwar garken ciki suna ganin adireshin ramin baƙo kuma suna amsa shi, kuma amsar tana samun hanyar komawa ga baƙo.

Baƙon Windows ya fi rashin hankali. IPEnableRouter=1 a ƙarƙashin SYSTEM\CurrentControlSet\Services\Tcpip\Parameters yana kunna turawa ba tare da fassara ba, don haka yana aiki ne kawai a inda bin hanyoyin kamfani ya riga ya nuna baya ga prefix ɗin host-only ɗinka. Internet Connection Sharing yana fassara, amma yana sake lambar adaftar da aka raba zuwa 192.168.137.1, don haka karanta adireshin da ya karɓa da gaske kafin rubuta hanyoyin mai masauki.

Gwaji 3: hanyoyin mai masauki suna ambaton baƙo, ba ramin ba

Aika kawai prefix ɗin da mai masauki yake buƙata ta cikin baƙo. A kan Linux hanya ɗaya ga kowane prefix ta isa kuma tana juyawa da tsafta:

sudo ip route add 10.20.0.0/16 via 192.168.56.2
ip route get 10.20.30.40

A kan Windows makamancin shine route add 10.20.0.0 mask 255.255.0.0 192.168.56.2. Bar -p yayin da kake gwaji, domin mummunar hanya ta mutu a lokacin sake kunnawa, kuma ƙara shi da zarar hanyar ta yi aiki. Kada ka cire tsohuwar hanyar mai masauki sai dai idan kowane aikace-aikace a kan mai masauki ya kamata ya yi amfani da ramin; idan cikakken rami ne ainihin buƙata, ƙara hanyoyin /1 guda biyu kuma ka riƙe hanyar kai tsaye zuwa hanyar sadarwar hypervisor:

sudo ip route add 0.0.0.0/1 via 192.168.56.2
sudo ip route add 128.0.0.0/1 via 192.168.56.2

A kan mai masaukin Windows, duba ma'aunin interface ma. Hanyar da aka ƙara yayin da adaftar host-only ke kashe tana zama a cikin tebur amma ba ta taɓa ɗaukar zirga-zirga ba, kuma adafta na biyu mai ƙaramin ma'auni na iya cin nasarar binciken prefix ɗaya.

Gwaji 4: DNS yana bin hanya, ba tsohuwar hanyar ramin ba

Hanyoyi suna motsa fakiti; mai warwarewa ne yake yanke shawarar waɗanne sunaye ne ke haifar da fakiti. Iyakance mai warwarewar kamfani zuwa yankin kamfani maimakon maye gurbin mai warwarewar mai masauki, kuma nuna shi zuwa uwar garken DNS da sabuwar hanya ta riga ta isa. Tare da systemd-resolved a kan mai masauki:

resolvectl dns eth1 10.20.0.53
resolvectl domain eth1 '~corp.example.com'

A kan Windows shigarwa a cikin teburin manufofin warware suna tana yin aikin ɗaya: Add-DnsClientNrptRule -Namespace ".corp.example.com" -NameServers 10.20.0.53. Idan baƙo yana tafiyar da nasa mai warwarewa a adireshin host-only, yi amfani da wannan adireshin maimakon, amma sai bayan ka tabbatar yana amsa a 192.168.56.2 ba a loopback ba.

Sannan duba MTU kafin ka zargi DNS da jinkirin shafuka. Interface ɗin ramin ya fi ƙanƙanta fiye da interface ɗin byte 1500 na mai masauki, don haka mai masaukin da ke aika sassan cikakken girma tare da bit DF a kunne yana ganin an jefa su wani wuri a cikin baƙo. Alamar gargajiya ita ce ping mai aiki da aikace-aikacen yanar gizo na ciki wanda ke tsayawa bayan musafaha TLS. Matsa MSS a hanyar turawa ta baƙo:

sudo iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

Gwaji 5: tabbatar daga ɓangarori biyu

Daga mai masauki, traceroute ko tracert zuwa adireshin ciki ya kamata ya nuna 192.168.56.2 a matsayin tsalle na farko, ba ƙofar zahiri ba. A cikin baƙo, kalli yadda wannan yunƙurin yake fita: tcpdump -ni any host 10.20.30.40 yana nuna buƙatar da aka tura a ɓangaren host-only da wadda aka fassara a kan ramin. Buƙatar da ta fita, ta dawo kuma har yanzu ta bar mai masauki shiru tana nuna hanyar dawowa.

Kasawa biyu ne ke bayanin mafi yawan hakan. Ko dai ramin baƙo ba ya ɗauke da hanyar dawowa ga prefix ɗin host-only saboda babu dokar NAT, ko kuma hanyar mai masauki tana nuna adireshin da baƙo ba ya da shi bayan sake kunnawa. Sake karanta adireshin da ip -br addr da ip route get maimakon dogaro da bayanan zaman da ya gabata.

Gwaji 6: sa ya tsira daga sake kunnawa da haɓaka hypervisor

Riƙe rabin biyun: tsarin hanyoyin netplan ko NetworkManager a kan mai masauki, route add ... -p a kan Windows, da net.ipv4.ip_forward=1 a cikin /etc/sysctl.d/ tare da jerin dokokin wuta waɗanda ke sake lodawa a cikin baƙo. Ɗauki snapshot na baƙo da zarar an tabbatar da tsarin, kafin sabuntawar abokin cinikin kamfani na gaba ta zo.

Ana sake lambar hanyoyin sadarwar host-only lokacin da hypervisor ya sake ƙirƙirar adaftansa, wanda a shiru yake ɓata kowace hanya da dokar NAT da aka gina a kan 192.168.56.0/24. Bayan haɓaka, sake gudanar da gwaje-gwajen uku na farko a jere; wannan yana ɗaukar minti ɗaya kuma yana kama yanayin da mai masauki yana da hanyarsa yayin da baƙo ya koma sabuwar cibiyar sadarwa.

IPv6 yana buƙatar nasa zagayen. Dokokin ip6tables, rikodin AAAA da wani rukunin hanyoyin mai masauki ba sa bin tsarin IPv4, kuma sabis na kamfani da ake samu ta IPv6 zai yi kama da ya lalace har abada yayin da IPv4 ke aiki.

Ya wuce ko ya kasa, a jere: mai masauki zai iya ping adireshin host-only na baƙo; baƙo yana turawa kuma yana yin MASQUERADE zuwa ramin; ip route get yana mayar da baƙo a matsayin ƙofa ga prefix ɗin ciki; ana warware sunayen kamfani ta hanyar mai warwarewa mai iyaka; traceroute yana nuna baƙo da farko; kuma amsoshin shida ɗaya suna tsira daga sake kunnawa.