Hagaaji taraafikada Docker iyo WSL ee iska indhatira VPN-ka martigeliyaha

Waqtigan gu'ga waxaan ku qaatay inta badan subax kowdii dabagalka konteenar aan xallin karin xitaa hal magac gudaha ah, halka biraawsarka dihin uu wiki-ga furay isagoo aan caban. Tunnel-ku wuu sarreeyay, biraawsarku taas wuu caddeeyay, konteenarkuna wuxuu ku jiray meel magac shabakadeed kale oo leh shax waddooyin kale iyo xalliye kale. Tan soo socota waa nidaamka aan hadda hubiyo: marka hore shaxanka waddooyinka, marka labaad xallinta magacyada, marka saddexaad gudbinta iyo ugu dambayn madal martigeliyaha. Joogso tallaabada ugu horreysa ee hore u guuldareysatay, sababtoo ah ku darista xeerar hoos ku jira stack-ka waxay qarinaysaa xadka halkii ay dhaqaajin lahayd.

Isbarbar dhig saddexda shax waddooyin ka hor inta aadan beddelin xeer

Konteenar ku jira buundada caadiga ah ee Docker wuxuu leeyahay hal waddo caadi ah oo u jeedda iridda docker0, mana oga in tun0 jiro. Martigeliyaha wuxuu leeyahay tun0, waddooyinka VPN-ku riixay, iyo laga yaabo xeer siyaasadeed oo taraafikada tijaabada u diraaya interface ka duwan kan aad filayso. WSL wuxuu ku daraa shax saddexaad gadaashiisa adapter-kiisa macmalka ah. Daabac saddexda ka hor inta aadan wax ka beddelin midkood.

Haddii waddada kaliya ee konteenarku tahay buundada oo tun0 uusan waligiis ka soo muuqan meesha magaciisa, waxba hoos ku qoran ma caawin doonaan: ma jiro beddelaad server magac oo waddo abuuraya, mana jiro waddo abuuraya aqoonsiga tunnel ee ay partner-ku aqbali doonto. Nidaamka ayaa muhiim ah sababtoo ah guuldarada DNS iyo guuldarada waddo isku mid ayay ka muuqdaan gudaha shell.

U jihee xalliyaha tunnel-ka halkii aad u jiheen mid dadweyne

Martigeliyaha, resolvectl status wuxuu liisaa server-yada DNS xiriir kasta, iyo readlink -f /etc/resolv.conf wuxuu kuu sheegaa in faylku yahay systemd stub, fayl NetworkManager, ama wax uu macmiil iibiyey dib u qoray. Gudaha konteenar ku jira shabakad isticmaaluhu qeexay, /etc/resolv.conf wuxuu magacaabaa 127.0.0.11, xalliyaha Docker ee dhexdiisa ku jira, kaasoo u gudbiya upstream-ka daemon-ka lagu habeynayay. Konteenarka buundada caadiga ah wuxuu se isagu helay nuqul faylka martigeliyaha markii la abuuray, wuuna hayaa.

Nuqulkaas ayaa sabab u ah in tunnel-ka soo baxa ka dib bilowga konteenarku wuxuu konteenarka uga tago weyddiinaya upstream-kii hore. Ama u gudbi xalliyaha VPN si cad adigoo isticmaalaya docker run --dns 10.8.0.53, ama dhig "dns": ["10.8.0.53"] gudaha /etc/docker/daemon.json oo dib u bilow daemon-ka, ama dib u abuur konteenarka marka tunnel-ku sarreeyo. Dib u abuurista sida caadiga ah way ka jaban tahay xalliyaha hal saac ka hor saxnaa in la debug-gareeyo.

Beddelka xalliye dadweyne waa hagaajinta calaamadda haysta. Wuxuu xalliyaa internet-ka wuuna ku guuldareystaa aag kasta oo gaar ah, wuuna si aamusnaan ah uga gudbi karaa shaandhaynta tunnel-ku u jiro. Haddii aad isku daydo inaad wax ku qorto gudaha /etc/resolv.conf konteenar socda, filo Device or resource busy: Docker wuxuu bind-mount ku sameeyaa faylkaas, sidaas darteed wax ka beddelka wuxuu u baahan yahay unmount marka hore. Dhigista --dns waqtiga abuurista waa nidaamka ka badbaada dib u bilowga.

Gudbi oo turjun marka konteenaradu amaahdaan tunnel-ka

Buundada caadiga ah, martigeliyahu waa router u dhexeeya docker0 iyo tun0, mana sameeyo midkoodna shaqooyinka sida caadiga ah. Shid gudbinta oo turjun ciwaanka isha si partner-ku u arko ciwaanka tunnel-ka martigeliyaha halkii uu arki lahaa mid aan waddo ku noqosho lahayn (ku beddel tun0 magaca macmiilkaagu interface-ka u bixiyo):

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -A FORWARD -i docker0 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o docker0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Xeerarka FORWARD waxay muhiim u yihiin martigeliyayaasha ay siyaasadooda gudbintu tahay DROP. Docker wuxuu geliyaa silsilado u gaar ah, sidaas darteed ku tijaabi baakad halkii aad akhrin lahayd iptables -S: konteenarka, ip route get 10.8.0.20 waa inuu magacaabaa iridda buundada, iyo nc -vz 10.8.0.20 443 waa inuu ku xirmaa ama wakhtigu ka dhamaadaa tunnel-ka halkii xalliyaha.

MASQUERADE la'aan partner-ku wuxuu u baahan yahay waddo ku noqosho 172.17.0.0/16, taasoo inta badan VPN-yada gelitaanka fog aanay riixin doonin. Halkan sidoo kale macmiil ku salaysan siyaasad ayaa qorshaha jebiya: haddii uu qabto oo kaliya taraafikada UID ama cgroups gaar ah, xeerarkaaga gudbintu waligood ma arkaan baakadda gudaha tunnel-ka, hagaajintuna waxay ku qoran tahay siyaasadda waddo-marinta macmiilka ee ma aha iptables. Xeerarka gacanta lagu daray waxay meesha ka baxaan dib u bilowga, sidaas darteed ku dhig systemd unit ama shax netfilter-persistent oo dib u tijaabi ka dib dib u bilow, maadaama tunnel-ka goor dambe soo baxa uu qaadi karo.

Dhig tunnel-ka gudaha konteenarka marka yoolku yahay go'doomin

Haddii konteenar uu ku bixi doono noodh gaar ah, ku ordi macmiilka konteenarkaas. Wuxuu u baahan yahay --cap-add NET_ADMIN iyo --device /dev/net/tun, ka dibna wuxuu leeyahay tun0, waddooyin iyo dab-damis u gaar ah. Haddii konteenarro kale ay dhex maraan, wuxuu sidoo kale u baahan yahay gudbin iyo xeer MASQUERADE gudaha konteenarka, partnerradaasna waxay u baahan yihiin waddo cad ama proxy u jeedda isaga; buundada caadiga ah ee Docker ma ku darto waddadaas adiga.

Shabakada martigeliyaha, docker run --network host, waa nooca jaban: konteenarku wuxuu ku biiraa meesha magaca martigeliyaha oo si toos ah u arka waddooyinka tunnel-ka. Waxay sidoo kale tuurtaa go'doominta shabakada, waxay casuunaysaa isku dhaca dekedaha, oo ficil ahaan waa ikhtiyaar Linux. Deked la daabacay ma aha beddel. -p 8080:80 wuxuu adeeg ka dhigaa mid laga gaari karo martigeliyaha; kama dhigto ciwaannada gudaha 10.x mid laga gaari karo gudaha konteenarka, isku darka labadaana waa dariiqa ay dhibaatada waddo-marintu u noqoto deked xogta furan.

Kala sooc guuldarada magac iyo subnetwork is-dulsaar ah

Buundada caadiga ah ee Docker waa 172.17.0.0/16, iyo badi bakadaha VPN ee shirkadaha waxay ku jiraan 172.16.0.0/12. Marka tunnel-ku leeyahay baaxaddaas, taraafikada loogu talagalay konteenarka waxaa loo waddo-gelin karaa tunnel-ka halkii. Magacyadu way guuldareystaan, khaladku wuxuu u eg yahay DNS, dhibaataduna waxay ku jirtaa ciwaannada. Hubi halka loo socdo, ma aha xalliyaha: ip route get 172.17.0.5 martigeliyaha, ka dib isbarbar dhig prefix-ka buundada bakada VPN iyo docker network inspect bridge --format '{{range .IPAM.Config}}{{.Subnet}}{{end}}'.

Hagaajintu waa in mid ka mid ah baaxadaha la dhaqaajiyo: ama bakad ciwaan caadi ah oo kale oo Docker ku leeyahay daemon.json , ama bakad kale oo ku taal isku-dubaridaha. Ku darista server magac kale halkan waxba ma qabato, ssh -b sidoo kale ma qabato: ku xirista macmiilka interface waxay beddeshaa ciwaanka isha, ma aha waddada loo socdo ee tunnel-ka gudaha u gudba. Qaybsi degdeg ah oo shaqada: magac lagu xalliyo martigeliyaha laakiin aan lagu xallin konteenarka waa dhibaatada xalliyaha, halka xiriirka IP tooska ah ee konteenarka ku lamaanaya laakiin martigeliyaha ka shaqeeya uu yahay dhibaatada waddo ama silsilad gudbin.

WSL iyo Docker Desktop ma raacaan xeerarka Linux

Qaabka NAT caadiga ah, WSL wuxuu fadhiyaa gadaashiisa adapter-kiisa macmalka ah mana helo waddooyinka gudaha ama suffix-yada DNS ee VPN-ka Windows, taas ayaa sabab u ah in biraawsarku shaqeeyo iyo ping gudaha qaybinta uusan shaqeyn. Shabakada muraayadda ah, oo laga heli karo builds-ka Windows 11 ee dhawaan, waxay halkii la wadaagtaa interface-yada martigeliyaha, laakiin waa in laga shido .wslconfig qaybintana lagu dib u bilaabo wsl --shutdown. Xaqiiji qaabka firfircoon wslinfo --networking-mode ka hor inta aadan dhaqan gelin hagaajin, sababtoo ah jawaabta NAT waa khalad qaabka muraayadda iyo taa lidkeeda.

Docker Desktop waxay ku darsanaysaa lakab kale. Konteenarrada Linux ee Windows waxay fadhiyaan gadaashiisa hirgelin NAT oo taariikh ahaan loo yaqaan vpnkit, waddadooduna way ka duwan tahay martigeliye Linux asalka ah. Konteenarrada Windows waxay ku xirmaan switch macmal ah oo Hyper-V, macmiil shirkadna wuxuu xannibi karaa taraafikada switch-kaas, sidaas darteed konteenarrada Linux ee isla mishiinka waxay gaari karaan shabakadda halka konteenarrada Windows aanay waxba haysan. Switch dibadeed oo ku xiran adapter-ka jirka ah waa xalka caadiga ah, wuxuuna beddelaa aqoonsiga shabakadda konteenarka siyaabo laga yaabo in siyaasaddu aanay oggolaan.

Ka hor inta aadan qorin xeer kale, dhex mar afar lakab si kastaba oo joogso meesha midkood khalad yahay:

• Gudaha konteenarka: ip route ma gaaraa prefix-ka gaarka ah, oo /etc/resolv.conf ma magacaabaa upstream xalliya?
• Martigeliyaha: gudbintu ma shidan tahay, NAT ma ku xiran yahay interface-ka tunnel-ka, oo silsiladda gudbintu ma aqbashaa buundo ilaa tunnel?
• Partner-ka: ma yaqaan waddo ku noqosho, mise waxaad ku tiirsan tahay NAT si ay u qariso subnetwork-ka konteenarka?
• Madasha: WSL ma ku jiraa NAT ama qaab muraayadeed, konteenarkuna ma Linux baa mise Windows?

Dib u ordi tijaabo kasta konteenar ama shell cusub. Habka dheer ee leh jawaab cache ah ama xiriir hore u aasaasay wuu sii guuldareysan doonaa ka dib marka habayntu sax noqoto, guuldaradaasna waxay u egtahay si sax ah hagaajin aan shaqeyn.