Kwantenan Windows da VPN: me ya sa sadarwar cikin gida ke karyewa
Kwantenan Windows yana amfani da teburin hanya na mai masaukin, don haka VPN da ke toshe subnet ɗin cikin gida yana ɗaukar prefix ɗin kwantenan tare da shi. Yanayin Linux yana bin wata hanya.
A kan kwamfutar hannu ɗaya, tare da abokin ciniki VPN ɗaya da aka haɗa, kwantenan Linux suna ci gaba da magana da juna kuma kwantenan Windows suna tsayawa. Hoton ba shi ne mai canzawa ba; hanyar da fakiti ke bi zuwa mai masaukin ita ce. Kwantenan Windows a kan hanyar sadarwar da ba a zaɓa ba suna aron teburin hanya da fassarar mai masaukin, don haka manufar da ke canza tuƙin hanya na mai masaukin tana canza su ma. Tabbatar da hakan da binciken hanya kafin sake shigar da wani abu.
Inda fakiti na kwantenan Windows ke shiga mai masaukin
Kwantenan da ke kan hanyar sadarwar da ba a zaɓa ba nat yana samun adireshi daga prefix na sabis ɗin Host Networking Service, yawanci wani wuri cikin 172.16.0.0/12, kuma yana isa mai masaukin ta hanyar adafta ta haɗin gani. Mai masaukin ne ya mallaki hanyar wannan prefix ɗin kuma yana fassara zirga-zirga zuwa adaftar da ke aiki a yanzu. Babu wata na'urar gani daban a tsakiyar wannan hanya.
Wannan ƙira ce ke sa gazawar ta zama ta inji. Lokacin da kwantenan ya aika fakiti, mai masaukin yana yin binciken hanya don prefix ɗin kwantenan. Duk hanyar da ta yi nasara, nan ne fakitin ke zuwa, kuma kwantenan ba shi da ra'ayi a kan haka.
Abin da abokin ciniki VPN ke canzawa a wannan hanya
Abokin ciniki na kamfani yakan shigar da tarin hanyoyi da yawa da matattara da ke hana shiga cikin-gida subnet yayin da ramin ke buɗe. Manufar ita ce ta tsaro: hanyar sadarwar cikin gida da aka lalata bai kamata ta isa na'urar da aka kare ba. Sakamakon gefe shi ne hanyar mai masaukin zuwa prefix ɗin kwantenan ba ita ce hanyar NAT ta cikin gida ba kuma.
A maimakon haka binciken ya dace da ramin kuma an miƙa fakitin ga ƙofar, wadda ba ta taɓa jin wannan adireshin kwantenan ba. Ping ya kasa, aikace-aikacen ya ƙare lokaci, kuma kwantenan ya yi kama da karye yayin da alamar VPN ke haskakawa. Duba teburin mai masaukin yayin da kake haɗe kuma hanyar da ke hamayya tana bayyana.
| Container mode | Outbound path | Typical result behind the VPN |
|---|---|---|
| Windows, default nat | Host routes and translates container traffic | Container prefix follows the tunnel and fails |
| Windows, transparent | Container sits on the physical link | Depends on the local subnet being allowed |
| Linux engine on Docker Desktop | VM egress proxied by a host process | Often keeps working |
Me ya sa kwantenan Linux ke yin hali daban
Injin Linux yana gudanar da kwantena a cikin wata na'urar gani mai sauƙi, kuma hanyoyin fita daga wannan na'urar wakili ne a gefen mai masaukin ke buɗe su a madadin kwantenan. Mai masaukin ne ke fara soket ɗin, don haka dokar VPN game da prefix ɗin kwantenan ba ta shafe shi haka ba, kuma aikin yana ci gaba da isa ga hanyar sadarwa.
Wannan bambanci kuma yana bayyana me ya sa girke-girken Linux ba sa miƙawa. Kwantenan Linux da ke buƙatar ramin kansa ana ba shi na'urar TUN tare da iyawar NET_ADMIN. Kwantenan Windows ba sa bayyana wata fuska a matsayin na'ura, don haka wannan tsarin ba shi da kwatankwaci a wancan gefen.
Tabbatar da hanyar, sannan zaɓi ƙira
Tattara shaida daga mai masaukin, ba daga kwantenan ba, domin mai masaukin ne ke yin binciken:
docker network inspect nat --format "{{range .IPAM.Config}}{{.Subnet}}{{end}}"
route print -4
Get-NetRoute -AddressFamily IPv4 | Where-Object DestinationPrefix -like "172.16.*"Gudanar da fitarwar hanyoyi sau ɗaya kafin VPN ya haɗa da kuma sau ɗaya bayan. Idan a fitarwa ta biyu prefix ɗin kwantenan ya nuna adaftar ramin, ganewar asali ya cika kuma sake kunna kwantena ba zai taimaka ba.
Zaɓi na farko shi ne shawarar manufa: tambayi mai hanyar sadarwar ko za a iya ba da izinin shiga LAN ta cikin gida ga wannan na'urar. Abokan ciniki na kamfani da yawa suna bayyana hakan a matsayin saiti, amma hakan yana raunana iyaka da aka yi da gangan. Nemi shi a matsayin keɓancewa da aka rubuta tare da mai shi da ranar bita. Maɓalli na kowane na'ura wanda babu wanda ke dawowa gare shi shi ne yadda manufar tsaro ke ɓacewa a hankali.
Inda manufar dole ta tsaya, matsa aikin maimakon yin yaƙi da hanyar. Hanyar sadarwa bayyananna tare da subnet da ƙofa bayyanannu tana sanya kwantena a kan mahaɗin cikin gida, aikin Linux yana gudana a bayan wakilin na'urar gani, kuma wata na'urar gani daban tare da nata abokin ciniki yana riƙe da manufarsa. Zaɓi ɗaya da gangan kuma gwada shi daga cikin kwantenan, domin a nan ne buƙatar mai amfani ta samo asali.