Emulaatorka Android iyo VPN-ga martigeliyaha: Muuqa DNS iyo NAT

Marka emulaatarku uusan gaari karin server-ka build-ka ee browser-ka martigeliyaha si caadi ah u furo, su'aasha faa'iidada leh ma aha in VPN-du shaqeyso iyo in kale. Su'aashu waa kee labada hab mid ka maqan martida. Qalabka virtual-ka ah wuxuu ku shaqeeyaa stack-kiisa shabakadeed oo ka dambeeya NAT-ga emulaatarka, oo liiska resolver-kiisa waa koobi la qaaday waqtiga boot-ka, sidaas darteed tunnel-ka dambeeya wuxuu beddelaa wadada martigeliyaha laakiin ma beddelo waxa martidu weydiiso. Fahanka labadan lakab waxay sharraxaan ku dhawaad dhammaan noocyada dhibaatadan.

Martidu waa stack gooni ah oo ka dambeeya NAT go'an

Shabakadda QEMU ee habka isticmaalaha waxay martida dhigtaa 10.0.2.15, gateway-ga 10.0.2.2, iyo adeegga DNS 10.0.2.3 ilaa 10.0.2.6. Taraafikga baxa ee martida kama gudbo kernel-ka martigeliyaha; waxaa loo rogaa socket-yo dhinaca martigeliyaha, mid kasta oo xiriirka martida ah, oo socket-yadaas waxay ka soo baxaan meesha cinwaanka martigeliyaha. Taasi waa sababta xiriirka martidu uu dhaxlo go'aanka routing-ga martigeliyaha marka la abuurayo, iyo sababta martidu u aanay lahayn gelin shaxda route-ka oo magacaabaya tunnel-kaaga.

Isla habkaas wuxuu martida siinayaa baxsad faa'iido leh. 10.0.2.2 waa magac kale oo loo yaqaan interface-ka loopback-ga martigeliyaha, sidaas darteed adeeg dhageysanaya 127.0.0.1 ee laptop-ka ayaa laga gaari karaa martida cinwaankaas. Wax kasta oo macmiilku u soo bandhigo kaliya loopback-ga waa laga gaari karaa jidkan, waana aasaaska habaynta proxy-ga ee hoos lagu sharraxay.

Waxa martidu aanay samayn karin waa in ay u fiirsato shabakadda martigeliyaha sidii in ay tahay namespace-keeda. Ma jiro buundo, ma jiro shax route la wadaago iyo ma jiro resolver la dhaxlay; waxaa kaliya jira adeegga NAT ee aqbala packet-yadeeda iyo snapshot-ka uu launcher-ku qaaday markii qalabka virtual-ku bilaabmay.

DNS waa snapshot, ma aha aragti nool

Bilowga emulaatarku wuxuu akhriyaa liiska resolver-ka martigeliyaha oo siiyaa martida ilaa afar server, oo lagu soo bandhigo cinwaannada 10.0.2.3 ilaa 10.0.2.6. Haddii tunnel-ku hoos ku jiray waqtigaas, snapshot-ku wuxuu ka kooban yahay resolver-ka dadweynaha ee laptop-ku isticmaalayay, martiduna way weyddiinaysaa inta ay nooshahay. Magacyada dadweynaha waa la xalliyaa, magacyada gudaha way guuldareystaan, iyo calaamadaha oo dhan waxay tilmaamaan VPN-ga halka qiimaha dhabta ah ee duugoobay uu yahay liis resolver-ka la qabtay dhowr daqiiqo ka hor inta tunnel-ku soo kacay.

Sidaas darteed hagaajinta nidaamka ma aha sheeko. Marka hore ku xidh tunnel-ka, ka dib dib u bilow emulaatarka, oo ka door bid bilow qabow hagaajinta snapshot-ka, sababtoo ah sawirka quick-boot wuxuu ku soo noqon karaa xaaladda resolver-ka iyo route-ka ee hore loo kaydiyay. Haddii aad rabto inaad aragto waxa martidu hadda isticmaalayso, weydii qalabka, ma aha martigeliyaha:

adb shell dumpsys connectivity | grep -i -A2 dns
adb shell ping -c 1 build.internal.example

Emulaatarku wuxuu sidoo kale aqbalaa resolver cad marka la bilaabayo, taas oo faa'iido leh marka aad si sax ah u taqaan server-ka ay martidu isticmaali lahayd, oo khatar ah marka server-kaas uu dadweyn yahay:

emulator -avd Pixel_API_34 -dns-server 203.0.113.53

Resolver dadweyne ma laha koobi zone gudaha ah, sidaas darteed mid ku dhejinta waxay dhibaatada nidaamka u beddelaysaa cilad joogto ah. Haddii profile-ku u riixo DNS gaar ah, u ogolow tunnel-ka inuu bixiyo oo bilow qabow ku samee martida halkii aad cinwaanka si adag u qori lahayd.

Routing-ku wuxuu raacaa martigeliyaha waqtiga xiriirka

Maadaama xiriirrada martidu noqdaan socket-yo martigeliyaha, go'aanka routing-ga waxaa la qaataa marka socket-ka la abuurayo. Tunnel-ka oo kacsan ka hor codsiga waxay ka dhigan tahay in codsigu uu ka baxo tunnel-ka, isagoo raacaya route-yada profile-ka. Profile-ka split-tunnel ee qaata kaliya prefix-yada la doortay wuxuu si farxad leh uga tegi doonaa subnet-kaaga gaarka ah dibadda, sidaas darteed gaaritaanka martigeliyaha waa mala-awaal ku saabsan martida, ma aha natiijo. Xiriirrada martida ee jira waxay hayaan wadada lagu abuuray, taasina waa sababta macmiilka dib u xirma uusan mar walba hagaajin karin soo dejinta ku xanibtay emulaatarka.

Xaqiijinta waxay ku taal interface-ka martigeliyaha, ma aha tirakoobka martida:

sudo tcpdump -ni tun0 'host 203.0.113.10'

Haddii codsiga martida uu ka soo muuqdo interface-ka tunnel-ka, routing-ku wuu shaqeynayaa oo dhibaatadu way ka sarreysaa. Haddii uu ka soo muuqdo interface-ka jirka, profile-ku ma daboolo prefix-kaas, oo dib-u-habayn kasta oo dhinaca martida ah ma beddeli doonto.

Marka macmiilku bixiyo kaliya proxy loopback

Macmiillyada ganacsi qaarkood ma abuuraan tunnel nidaam ah gabi ahaanba. Waxay soo bandhigaan dhageyste HTTP ama SOCKS 127.0.0.1 oo waxay filayaan in barnaamijyadu isticmaalaan. Martidu si toos ah uma arki karto socket-kaas, laakiin emulaatarka waxaa loo sheegi karaa inuu isticmaalo, ama iyada oo loo marayo kontoroolka la fidiyay (Settings, ka dib Proxy, hab gacanta, martigeliyaha 127.0.0.1 iyo port-ka uu macmiilku daabaco) ama marka la bilaabayo:

emulator -avd Pixel_API_34 -http-proxy http://127.0.0.1:8080

Koobi port-ka daaqadda macmiilka; port la qiyaasay si aamusan ayuu u guuldareystaa oo wuxuu u eg yahay tunnel jabay. Xusuusnow waxa kan daboolayo: goobta proxy HTTP waxaa ixtiraama barnaamijyada garanaya proxy, socket-yada ceyriinka ahna gabi ahaanba way iska indhatiraan. Haddii shaqadu tahay native binary iskiis u fura xiriirkiisa, wadada proxy-ga lama mid ah tunnel-ka oo isbarbardhigga waa in si cad loo sameeyaa.

Natiijada ka caddee gudaha martida

Kala sooc xallinta iyo routing-ga laba tijaabo oo isla fadhi ah. Magac guuldareysta halka cinwaanka tirooyinku jawaabayo waa dhibaatada snapshot DNS, xalkuna waa nidaamka ama resolver cad. Haddii labaduba guuldareystaan waxay tilmaamaysaa routing ama siyaasad, baaritaanka xigaana waa in barnaamijku ku shaqeeyo work profile leh xaddidaad shabakadeed u gaar ah.

Ugu dambayntii, ogaaw martida aad tijaabinayso. Sawirrada emulaatarka ee aadka u duug ah waxaa lagu soo saaray iyada oo aan lahayn taageerada tun ee macmiilka VPN ee dhinaca martida u baahan yahay, sidaas darteed profile kuma shaqeyn karin halkaas; sawirrada hadda jira way leeyihiin. Macmiil ku guuldareysta sawirka hadda jira waa dhibaatada macmiilka ama profile-ka, dib u dhiska tunnel-ka martigeliyahaana ma beddeli doono natiijada.