Sida loo maro trafikka martigeliyaha iyada oo loo marayo kontaynar Docker VPN

Kontaynar VPN waa boos magacyo shabakadeed, ma aha proxy. Dooro netns la wadaago, dhegeyste SOCKS dhab ah ama gateway la maro, ka dibna hubi wadada bixitaanka.

Kontaynkayga tunnel-ka ayaa shaqeeya, docker compose exec vpn curl -s https://ifconfig.me wuxuu ku jawaabaa cinwaanka bixiyaha, haddana browser-ka miiskaaga wali wuxuu ku baxaa ISP-gaaga. Farqigaas waa la filayay. Kontaynar ku shaqeeya macmiil VPN wuxuu hayaa boos magacyo shabakadeed, wadooyin iyo interface tunnel, waxna kuma hadlo HTTP ama SOCKS; port ku daabacaad kuma abuuri karto dhegeyste aan waligiis jirin.

Halka macmiilku ku shaqeeyo ayaa go'aamisa naqshadda. Kontaynar deris ah wuu u gudbi karaa booska magacyada tunnel-ka, barnaamij desktop ma gudbi karo, router-na wuxuu u baahan yahay wadooyin halkii uu ka heli lahaa goob proxy. Haddii aad qalad ku sameyso khariidaynta, calaamaddu waa isku mid: xiriir la diiday, ama trafik si aamusan u mara wadada hore.

Habaynta ku habee meesha macmiilku ku shaqeeyo

Hal su'aal weydii ka hor inta aadan tafatirin Compose: macmiilka ma lagu bilaabi karaa gudaha booska magacyada shabakadeed ee kontaymarta VPN? Wax kasta oo horey ugu shaqeeya kontaynar Linux wuu awoodaa. Browser, IDE ama CLI miiskaaga ma awoodo, sababtoo ah dejinta proxy waxay filaysaa adeeg borotokool, ma aha boos magacyo.

ClientArrangementWhat must already exist
Another Compose serviceShares the vpn namespace via network_mode: service:vpnA working tunnel and correct start order
Host browser, IDE or CLIProxy listener inside the namespace, published to host loopbackA configured SOCKS or HTTP proxy and its access rules
Router, VM or phoneThe container as a layer-3 gatewayForwarding, NAT and a return route

Saddexdan isku dhex ma galaan. Goob proxy HTTP oo u jeedda cinwaanka buundada kontaymarta waxba ma gaadho haddii proxy halkaas aanu dhegeysan, dhegeystaha proxyna ma maro trafikka router-ka. Marka hore go'aan qaado, ka dib raac qaybta ku habboon.

Booska magacyada tunnel-ka la wadaag kontaynar deris ah

Kani waa ikhtiyaarka ugu jaban sababtoo ah borotokool proxy ma ku lug leh. Barnaamijku wuxuu ku biiraa booska magacyada adeegga vpn wuxuuna dhaxlaa interfaces-kiisa, wadooyinkiisa iyo booska port-yada:

services:
  vpn:
    image: your-vpn-client
    cap_add:
      - NET_ADMIN
    healthcheck:
      test: ["CMD-SHELL", "ip link show tun0 >/dev/null"]
      interval: 10s
      retries: 5
  app:
    image: your-app
    network_mode: service:vpn
    depends_on:
      vpn:
        condition: service_healthy

Saddex xaddidaad ayaa ka yimaada in booska magacyadu uu leeyahay adeeg kale. Barnaamijku ma helo fure networks u gaar ah, sababtoo ah ma laha boos magacyo uu ku dhego. Daabacaadda port-yada waxaa leh vpn, sababtoo ah halkaas ayaa booska magacyadu ku nool yahay. Iyo dib u abuurista vpn waxay baabi'isaa booska magacyada uu barnaamijku galay, sidaas darteed docker compose up -d --force-recreate vpn wuxuu kuu reebayaa inaad app-ka sidoo kale dib u abuurto; dib u bilaabid caadi ah had iyo jeer kuma filna. Tixraaca adeegyada Compose wuxuu daboolaa habayntan iyo xaddidaadda daabacaadda port-yadeeda.

Ha u malayn in xalliyuhu la yimaado. /etc/resolv.conf waa fayl kontaynar kasta, ma aha qayb ka mid ah booska magacyada shabakadeed, sidaas darteed barnaamijku wali wuu weydiin karaa xalliyaha martigeliyaha inta xirmooyinkiisu ka baxaan tunnel-ka. Ka akhri gudaha kontaymarta oo ku dhig barnaamijka dns: marka magacyo gaar ah lagu xalliyo tunnel-ka.

docker compose exec app ip route
docker compose exec app cat /etc/resolv.conf
docker compose exec app curl -s https://ifconfig.me

Haddii liiska wadooyinku uu ka kooban yahay interface tunnel-ka oo cinwaanku uu yahay kan bixiyaha, barnaamijku wuxuu ku jiraa tunnel-ka. Haddii interface-ku maqan yahay, app wuxuu bilaabmay ka hor inta vpn uusan lahaan tunnel, sidaas darteed dib u abuur app marka vpn uu soo sheego caafimaad.

Dhegeyste proxy dhab ah geli booska magacyada macaamiisha martigeliyaha

Browser desktop ma geli karo boos magacyo, marka tunnel-ka waa in loo soo bandhigaa adeeg ahaan. Ku socodsii proxy SOCKS ama HTTP dhab ah gudaha booska magacyada vpn oo daabac oo keliya port-kiisa:

services:
  vpn:
    ports:
      - "127.0.0.1:1080:1080"
  proxy:
    image: your-proxy
    network_mode: service:vpn
    command: ["--socks", "0.0.0.0:1080"]

Cinwaanka dhinaca martigeliyaha ayaa ah qaybta muhiimka ah ee khariidayntaas. 127.0.0.1:1080 dhanka bidix wuxuu dhegeystaha ka ilaaliyaa LAN-kaaga; "1080:1080" qaawan wuxuu daabacaa proxy furan qalab kasta oo gaari kara mishiinkaaga.

Dhinaca kontaymarta wuxuu leeyahay dabin u gaar ah. Port-yada la daabacay waxaa la gaarsiiyaa cinwaanka kontaymarta ee buundada, ma aha loopback-keeda, sidaas darteed proxy lagu bilaabay --socks 127.0.0.1:1080 gudaha booska magacyada wuxuu aqbalaa xiriirada derisyada wuuna diidaa wax kasta oo ka yimaada port-ka la daabacay. Ku xir 0.0.0.0 oo ku tiirsanaaw xidhitaanka loopback ee dhinaca martigeliyaha si aad u go'doomiso. Isla qaanuunkaas waxay quseysaa cinwaanka dhegeysiga ee faylka habaynta proxy.

Ka dib go'aan qaado halka magacyadu ku xallinayaan. curl gudihiisa --socks5 wuxuu magaca martigeliyaha ku xalliyaa gudaha, --socks5-hostname wuxuuna magaca u diraa proxy-ga; browsers-ku waxay isla beddelkaas ku muujiyaan sumad kale. Xallinta gudaha waxay daaha ka qaaddaa weydiinta xitaa marka boggu tunnel-ka ku soo rarto.

Kontaymarta u tixgeli gateway oo keliya marka uu jiro wado soo noqod

Router-yada, VM-yada iyo telefoonadu ma isticmaali doonaan goob proxy HTTP, barnaamijyadana waxay gebi ahaanba iska indhatiraan doorsoomayaasha proxy. Maridda trafikooda waxay ka dhigan tahay lakab 3: kontaymarta ayaa xirmooyinka u gudbisa oo cinwaannada ku tarjuntaa interface tunnel-ka.

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

Laba arrimood ayaa si fudud u dhaafaa. Macmiilku wuxuu u baahan yahay wado u jeedda gateway-kiisa caadiga ah martigeliyahaan, jawaabahuna waa inay helaan wadada soo noqodka, ama wado taagan oo ku yaal router-ka sare ama NAT oo ku yaal interface-ka macaamiisha u jeedda. Midkood la'aan tunnel-ku codsiga ayuu dibadda u qaadaa jawaabtuna way lunto.

Waxay sidoo kale leedahay saameynta ugu ballaaran. Martigeliye u adeega gateway ahaan LAN-ka oo dhan wuxuu macmiil kasta oo si khaldan loo habeeystay u diraa xisaabtaada VPN, tunnel-kuna haddii uu dhaco wuxuu mugdi geliyaa LAN-ka ama wuxuu ku noqdaa ISP-ga iyadoo ku xiran kill switch.

Hubi wadada bixitaanka, ka dib dib u rog si kala horeysan

Ku hubi habkan oo ku joogso marka ugu horeysa ee fashilma: cinwaanka bixitaanka gudaha booska magacyada, cinwaanka bixitaanka martigeliyaha iyada oo loo marayo proxy-ga, ka dib xallinta magacyada martigeliye gaar ah.

docker compose exec vpn curl -s https://ifconfig.me
curl -s -x socks5h://127.0.0.1:1080 https://ifconfig.me
curl -s -x socks5h://127.0.0.1:1080 http://internal.example/health

Laba cinwaan ee ugu horeeya waa inay la jaanqaadaan bixiyaha, kan saddexaadna waa inuu ku xallimaa proxy-ga halkii uu ku fashilmi lahaa qalad magac. Sadarka koowaad oo is waafaqa iyo kan labaad oo fashilma waxay ka dhigan tahay in dhegeystaha ama port-ka la daabacay uu khaldan yahay, ma aha tunnel-ka.

Dib u rogiddu waa ka soo horjeedka habaynta. Ka saar doorsoomayaasha deegaanka proxy-ga profile-ka shell-ka iyo unug kasta oo systemd, ka dib hoos u dhig stack-ka si booska magacyada la wadaago uu la baxo mulkiilaha. Tirtir port-ka la daabacay ka hor inta aadan tirtirin adeegga proxy-ga, haddii kale martigeliyuhu wuxuu hayaa dhegeyste loopback oo aan cidna akhrin.

Ka hor inta aadan sii gudbin, xaqiiji afar arrimood: macmiilka aad danaynayso wuxuu dhab ahaan gaaraa tunnel-ka, mulkiilaha booska magacyada oo keliya ayaa daabacaa port-yada, magacyada gaarka ah waxaa lagu xalliyaa halka aad uga jeeday, oo waxba ma dhegeystaan cinwaanka martigeliyaha oo aan loopback ahayn. Mid kasta oo ka mid ah waxay si aamusan ugu fashilmaa wax soo saarka, mid kastana waa hubin hal sadar oo kor ku xusan.

Maqaallo la xiriira