Me ya sa kwandon Docker ba ya iya isa ga sabarorin da ke bayan VPN

Kwandon da ba ya isa ga kome a bayan VPN na kamfani yakan zauna a wani yankin suna na cibiyar sadarwa dabam da tunel ɗin. Hanyoyin abokin ciniki na host, sabarorin DNS da alamun katangar wuta na cikin tarin host ne; kwandon cibiyar gada yana da nasa. Wannan gaskiya ɗaya tana bayyana yawancin rahotannin da ke isa ga ƙungiyar dandamali, kuma ita ce dalilin da ya sa «VPN ɗin ya lalace» da «Docker yana ƙetare VPN ɗin» duka biyu na iya zama kuskure a lokaci ɗaya. Tsare-tsare biyu mabambanta sosai suna ɓoye a bayan alama ɗaya, don haka gano wanne kake da shi kafin ka canza wani saiti.

Gano wanda yankin sunansa ya mallaki tunel ɗin

A Docker Desktop na macOS ko Windows, kwanduna suna gudana a cikin wata na’urar Linux ta kama-da-wane. Abokin ciniki na VPN da aka sanya a tebur yana ƙirƙirar tunel a cikin tsarin aiki na tebur, kuma na’urar kama-da-wane ba ta taɓa ganinsa. Babu wani tsarin kwando da zai gyara hakan, domin muƙun da kwandon zai buƙata babu shi kwata-kwata a yankin sunansa na cibiyar sadarwa.

A kan host ɗin Linux tunel ɗin yana zaune a yankin sunan host, kuma kwandunan gada yawanci suna isa gare shi ta hanyar teburin tuƙi na host tare da NAT na tushe da ake amfani da shi yayin fita. Lokacin da wannan hanya ta kasa, sanadin yawanci manufar turawa, tacewar hanyar baya ko wani yankin cibiyar sadarwa mai rikicewa ne maimakon hanyar da ta ɓace. Tabbatar a wace duniya daga cikin biyun kake kafin ka ci gaba da karatu:

docker info --format '{{.OperatingSystem}}'
docker run --rm --net=host alpine ip route | head -5
docker run --rm alpine ip route | head -5

Bambanci tsakanin waɗannan teburin tuƙi biyu shine duk matsalar a allo ɗaya. Idan ganin host yana ɗauke da muƙun tunel ɗin kuma ganin gada ba ya ɗauke da shi, kana kallon keɓewar yankin suna, kuma duk sauran zaɓi ne kan yadda za a tsallake shi.

Cibiyar sadarwar host gwaji ce, ba ƙira ba

Gudanar da kwando da cibiyar sadarwar host, wadda Docker ke rubuta ta a matsayin raba yankin sunan cibiyar sadarwar host, yana sa ya gaji muƙun tunel ɗin da hanyoyinsa kai tsaye. Idan wannan buƙata ɗaya ta yi nasara bayan haka, ka’idar hanyoyi ta tabbata kuma gazawar ita ce keɓewar yankin suna, ba takardun shaidar shiga, DNS ko dokar shiga ba.

docker run --rm --net=host curl -sS -o /dev/null -w '%{http_code}\n' https://api.internal/health

Ka riƙe shi a matsayin bincike. Cibiyar sadarwar host tana watsi da buga tashoshi da yawancin keɓewar da kake so daga kwando, kuma a Docker Desktop «host» yana nufin na’urar kama-da-wane, ba tebur ba, don haka nasara ko gazawa a can na iya yaudarar ka idan ka manta wace host kake magana da ita.

Na’urar tun da alfarmar da ke tare da ita

Abokin ciniki na VPN a cikin kwandon yana buƙatar na’urar tunel da izinin daidaita ta. Hanyar gajeruwar da aka saba ita ce --privileged, wadda ke ba da kowace na’ura kuma tana sassauta manufar tsaro a duk kwandon. Wannan ya fi abin da wannan aiki ke buƙata da yawa, kuma yana da wahalar bayar da hujja a bita.

sudo modprobe tun
docker run --rm -it --device /dev/net/tun --cap-add NET_ADMIN myvpn-client

Sigar da ta fi ƙunci tana tsara guntun na’ura ɗaya kuma tana ƙara ikon gudanar da cibiyar sadarwa kawai. Fara loda module ɗin a kan host don guntun ya kasance. Idan kwandon ya tashi kuma abokin ciniki ya bayar da rahoton cewa ba zai iya buɗe na’urar tunel ɗin ba, duba taswirar kafin ka yi zargin bayanin martaba, domin wannan kuskuren yawanci na zahiri ne.

Wannan ƙira tana nufin kuma abokin ciniki yana gudana ga kowace kwando. Wannan ita ce amsar da ta dace lokacin da kowane aiki yana buƙatar nasa tunel ɗin, kuma amsar da ba ta dace ba lokacin da kake so kawai tunel ɗin host ya zama bayyane, wanda ƙungiyar dandamali ta yi tsammanin kana yin hakan.

NAT na gada yana canza tushen da VPN ɗin ke gani

Da gada ta asali, zirga-zirgar kwandon da ke fita ana fassara zuwa adreshin host. Don haka a bayan VPN ɓangaren kamfani yana ganin adreshin tunel ɗin host maimakon na kwandon, dokokin shiga bisa tushe suna yin kamar host ɗin ne ya aika buƙatar, kuma kwanduna biyu suna zama marasa bambanci ga sabar VPN ɗin.

macvlan ko ipvlan a maimakon haka yana ba kwandon adreshin LAN, wanda ke taimakawa gano LAN kuma yana sa kwandon ya yi kama da takwaransa a ɓangaren. Hakanan yana ƙetare tunel ɗin host gaba ɗaya, don haka irin wannan kwandon ba zai isa ga prefixes na VPN kawai ba sai idan VPN ɗin yana iya isa daga wannan LAN ɗin ma.

Dukan sifofin biyu halal ne; suna amsa buƙatu daban-daban. Idan buƙatar ita ce «wannan kwandon dole ya isa sabis na VPN kawai», kana zaɓar tsakanin tuƙi ta host da ƙare tunel ɗin a cikin kwandon. Rubuta wannan zaɓin kafin turawa, ba bayan buƙatar farko da ta kasa ba. Duk abin da ka zaɓa, rubuta adreshin tushen da ƙarshen nesa zai gani, domin shi ne abin da dokokinsa na shiga da tarihinsa za su nuna. Ƙirar da ba za ta iya faɗin wannan adreshin ba ba ta cika ba.

DNS yana bin daemon, ba tunel ɗin ba

Kwando yana samun tsarin resolver ɗinsa lokacin da ya fara, an kwafa daga daemon ko daga hoton. Adreshin da VPN ke turawa bayan haɗawa suna zuwa a makare ga wannan kwafin, kuma ana turawa zuwa resolver ɗin host ba cikin kwandon ba.

Saita resolver ɗin a fili don sabis ɗin, ko nuna shi zuwa wani resolver na ciki wanda ake iya isa ta tunel ɗin. Kwandon da ke warware suna na sirri zuwa adreshin jama’a yawanci yana amfani da resolver na jama’a, ba yana shan wahala daga karyayyen hanya ba, kuma gyaran yana cikin fayil ɗin compose ko tsarin daemon.

Wannan tunani ɗaya ya shafi tambayar adreshin fita. Idan kowane kwando dole ya bayyana daga wani adreshin VPN daban, tunel ɗin host ɗaya ba zai iya bayar da shi ba domin NAT yana haɗa su cikin tushe ɗaya. Siffofin da za su iya aiki su ne abokin ciniki a yankin sunan kowane kwando ko sidecar da ke mallakin tunel ɗin kuma yana raba tarinsa, kuma dukansu suna canza yadda ake magana da aikace-aikacen.

Jerin dubawa kafin ka rufe tikit ɗin: gano yankin sunan da ke mallakin tunel ɗin, tabbatar da hanyar da cibiyar sadarwar host, tsara na’urar tun da kake buƙata kawai, tuna adreshin tushe bayan NAT, saita resolver ɗin a fili kuma ɗauki adreshin fita na kowane kwando a matsayin shawarar gine-gine ba tuta ba.