Waa maxay awoodaha Linux ee habkaaga VPN uu u baahan yahay?
Dejinta interface-ka, waddooyinka, gelitaanka qalabka iyo sockets-ka caadiga ah waa xuquuqo kala duwan. Magacow hawshii fashilantay ka hor intaadan bixin CAP_NET_ADMIN.
Daemon-ka VPN wuxuu u baahan yahay hawlo shabakadeed oo mudnaan leh inkastoo barnaamijyada caadiga ah ay furaan sockets-ka baxa iyagoon lahayn wax mudnaan ah. Farqigaas ayaa ka bilaabma inta badan khaladaadka awoodda: qof wuxuu arkaa khalad fasax, wuxuu bixiyaa dhammaan setka, adeegguna wuxuu u shaqeeyaa sababo aan cidna u sharraxin karin. Socodka hoose wuxuu ka bilaabmaa hawshii fashilantay, wuxuu ku xiraa hal awood, ka dibna wuxuu baarayaa macnaha ay process-ku dhab ahaan ku shaqeynayso. Ku shaqeynta root aan xaddidnayn waa jawaab ansax ah qaar ka mid ah deployment-yada, laakiin waa inay tahay go'aan oo aan ahayn qiime caadi ah.
Ka bilow hawshii fashilantay
Akhri khaladka ka hor intaadan akhrin tutorial. «Hawsha lama ogola» marka interface la beddelayo, diidmada furitaanka node-ka qalabka iyo fashilka bind ee port hoose waa saddex dhibaato oo kala duwan oo leh saddex fasax oo kala duwan. Haddii process-ku bilaabmo oo uu ku fashilmo kaliya beddelka waddada koowaad, taasi waxay sidoo kale sheegaysaa in abuurista interface-ka horey u guulaysatay, taas oo jawaabta aad u yareysa.
Ku celi fashilka adeeggu xiran yahay, ka dibna ku bilow hore isagoo isla isticmaalaha hoostiisa haddii fulinta ogolaato. Khaladka aad arki karto wuu ka fiican yahay line log ah oo aad qiyaasayso, wuxuuna caddeeyaa farqiga u dhexeeya dhibaatada awoodda iyo diidmada SELinux ama AppArmor.
Ku xir hawlo kasta hal awood
Shaxdu waa khariidad bilow ah, ma aha beddelka dukumeentiga fulinta:
| Operation | Usual authority | Watch for |
|---|---|---|
| Create or configure tun/tap | CAP_NET_ADMIN in the relevant namespace | Creating the device and opening it are separate steps |
| Add routes, rules, firewall entries | CAP_NET_ADMIN | Same capability, different namespace than you think |
| Open /dev/net/tun | Device permissions, not a capability | Group membership or a udev rule may be enough |
| Raw sockets | CAP_NET_RAW | Needed by some user-space tunnel implementations |
| Bind a port below 1024 | CAP_NET_BIND_SERVICE | Irrelevant for most modern tunnel ports |
Laba saf oo shaxdaas ku jira ayaa ah kuwa dadku isku qaldaan. Furitaanka /dev/net/tun waa su'aal fasax fayl; ka codsashada kernel-ka inuu dejiyo waxa aad furtay waa su'aal awood. Bixinta CAP_NET_ADMIN ma hagaajiso node qalab oo isticmaalaha adeeggaagu aan akhrin karin, hagaajinta node-kuna ma ku siiso awood waddo. Hubi labadaba ka hor intaadan beddelin midkoodna.
WireGuard-ka kernel-ka iyo barnaamijyada tunnel-ka ee meesha isticmaalaha sidoo kale ma laha shuruudo isku mid ah. Jidka module-ka kernel-ku wuxuu netlink ku dejiyaa interface jira, halka fulinta meesha isticmaalaha laga yaabo inay sidoo kale u baahato qalabka iyo, qaar ka mid ah gaadiidka, sockets ceyriin ah.
Akhri macnaha: adeeg, container ama shell
Awood ku jirta meesha magaca shabakadda host-ka waxay saameyn kartaa wax aad uga badan hawsha isla taas oo ku jirta stack si ula kac ah loo go'doomiyey. Deegaanka socodsiinta container-ka wuxuu caadi ahaan ku bilaabmaa set xadidan oo la dhimay; ku darista NET_ADMIN container la wadaaga shabakadda host-ka waa fasax aad uga weyn marka loo eego ku darista mid leh meesha magaca shabakadiisa iyo mount-yo host ah oo aan lahayn.
Unugyada systemd akhri waxa dhab ahaan lagu dabaqo ee ma aha waxa faylka unuggu u eg yahay inuu sheegayo: systemctl show -p CapabilityBoundingSet -p AmbientCapabilities wuxuu soo sheegaa qiimayaasha waxtarka leh, oo laga yaabo inuu dejiyey drop-in aad illowday. Weydii qiimaha waxtarka leh, weligaa ma weydiiso kan la qorsheeyey. Awoodaha ambient waa muhiim maxaa yeelay adeeg aan root ahayn wuxuu lumiyaa awoodaha exec iyagoon lahayn.
U qaado sal ahaan dejinta la taageeray ee xirmada ama image-ka. Ha ku darin fasaxyada socket ceyriin ama hab mudnaan leh kaliya sababtoo ah tutorial kale ayaa u taxay qalab kale; sababtaas waxba ma gudbiso waxayna ku qaadanaysaa go'doominta aad bixisay. Haddii shaki jiro, waxba ha bixin oo akhri qoraallada fulinta ee hawsha saxda ah ee aad u baahan tahay.
Fiiri waxa dhaca ka dib marka awoodaha hoos u dhacaan
Daemono badan waxay ku bilaabmaan awood, waxay dejiyaan interface-ka, ka dibna waxay u gudbaan isticmaale aan awood lahayn oo ay hayaan tunnel-ka. Waqtigaas ka dib process-ku ma geli karo waddo, ma dib u qori karo qaanuun firewall ama ma furi karo qalab cusub oo mudnaan leh, taas oo hagaagsan ilaa dib u xidhitaanku u baahdo si sax ah taas. Akhriska faylalka iyo fulinta hooks-ka dambe waxay ku fashilmi karaan isla sababta.
Tijaabi dhammaanwareegga nolosha ee ma aha ilbiriqsiyada koowaad: bilaabista, cusboonaysiinta ama dib u xidhitaanka, iyo nadiifinta marka la joojinayo. Guusha koowaad ee abuurista interface-ka ma caddaynayso in hawlo kasta oo mudnaan leh oo dambe ay wali shaqeyn doonaan, fashilkuna wuxuu caadi ahaan soo baxaa saacado ka dib wax soo saarka.
Fulinta tunnel-ka furan ku haysa inta lagu jiro beddelka isticmaalaha waxay caadi ahaan la lammaaneysaa xulashooyin lagu hayo tunnel-ka iyo furaha. Dhinaca systemd, su'aasha u dhiganta waa in setka awoodda unuggu ka badbaado beddelka isticmaalaha aad dejisay.
Diiwaangeli fasaxa la bixiyey iyo sababtiisa
Qor fasaxa saxda ah, hawsha uu suurtageliya iyo khaladka uu hagaajiyey. Hal line oo ku jira qoraallada deployment-ka — «CAP_NET_ADMIN oo ku jira meesha magaca shabakadda unugga, loo baahan yahay beddelka waddooyinka ka dib dib u xidhitaan» — waa ku filan tahay in laga hortago qofka xiga inuu mar kale ballaariyo fasaxa.
Ka dib akhri setka waxtarka leh mar kale ka dib kasta oo casriyeyn ah. Iibiyayaashu waxay ku daraan astaamo, image-yadu waxay beddelaan qiimayaasha caadiga ah, awooddii sanadkii hore aan loo baahnayn waxay noqon kartaa mid xambaarta iyadoon cidna ogaan.