Shabakadda VM ee NAT iyo bridged: keebaa qaada taraafikada VPN?
Martida NAT waxay amaahdaan tunnel-ka martigeliyaha kaliya haddii macmiilku tunnel ku sameeyo waddo ahaan; martida bridged naftooda ayay waddo u qaataan. Tijaabi martida, kadibna dooro habka ku habboon.
Bridged iyo NAT ma aha laba siyaabood oo isla martidaas loogu xiro VPN-kaaga; waxay go'aamiyaan cidda leh baakadaha martida ka hor inta aan tunnel kasta soo galin. Habka NAT, hypervisor-ku wuxuu dib u qoraa taraafikada martida oo wuxuu ka soo saaraa koodh dhanka martigeliyaha ah, sidaas darteed martidu waxay raacdaa waddo kasta oo martigeliyuhu koodhkaas siiyo. Habka bridged, martidu waxay heshaa aqoonsi lakab-ku-xirka u gaar ah oo ku yaal qaybta jireed oo waxay doorataa gateway-keeda caadiga ah, taas oo tunnel-ka martigeliyaha uga dhigta mid aan muhiim ahayn, haddii aan router-ka LAN-ka ahayn kan tunnel-ka sameeya. Waxaan ka joogay inaan VM-ka u arko mid VPN-ka ku jira oo waxaan u arko su'aal ku saabsan halka waddada caadiga ah ee martidaas ay u jeeddo. Tijaabada hoose waxay qaadataa dhowr daqiiqo hab kasta waxayna xallinaysaa iyada oo aan mala-awaal la isticmaalin.
NAT waxay martida ka haysaa gadaal koodhka hypervisor-ka, halkaas oo waddooyinka martigeliyaha lagu dabaqo
VirtualBox gudaheed, martida NAT waxay ku fadhiisataa 10.0.2.0/24 oo leh gateway fudud oo 10.0.2.2 ah, DNS proxy 10.0.2.3 ah, oo aan lahayn waddo u gaar ah oo shabakadda jireed. Baakadaha baxa waxaa qaata mishiinka NAT, waxaa dib loo qoraa si isha ay tahay martigeliyaha, waxaana loo gudbiyaa stack-ga IP ee martigeliyaha. Halkaas, taraafikada martidu waa socodka martigeliyaha, raadinta waddada waxaa lagu sameeyaa goobta: macmiil tunnel buuxa leh oo martigeliyaha ku rakibaya 0.0.0.0/1 iyo 128.0.0.0/1 wuu qabtaa isagoo aan waligiis ogeyn in VM jirto. Cutubka shabakada ee VirtualBox ee Oracle wuxuu taxayaa tilmaamahan caadiga ah haddii aad rabto inaad xaqiijiso cinwaannada build-kaaga.
Shabakadda caadiga ah ee libvirt waxay isla meeshaas ka gaadhaa 192.168.122.0/24, halkaas oo dnsmasq bixiyo kiraynta oo martigeliyuhu mask-gareeyo subnet-ka, sidaas darteed baakadaha martidu mar kale waxay gaadhaan go'aanka waddada ee martigeliyaha. Marka laga reebo macmiil taraafikada ku dooranaya hab-socod halkii waddo. Haddii liiska tunnel-ka qaybsan uu ka kooban yahay browser-kaaga oo keliya, mishiinka NAT kuma jiro liiskaas, martiduna waxay ka baxdaa mishiinka iyada oo aan tunnel lahayn halka browser-ka martigeliyaha uu wali u muuqdo mid daboolan. Isla subnet, natiijo ka duwan.
Bridged waxay martida siisaa meel u gaar ah oo ku taal LAN-ka jireed
Martida bridged waxaa la siiyaa NIC fudud oo ku xiran adapter dhab ah, waxay heshaa cinwaan MAC u gaar ah, waxayna ka qaadataa kiraynta DHCP shabakadda jireed. Gateway-keeda caadiga ah waa router-ka LAN, ma aha hypervisor-ka, frame-yadeeduna waxay u gudbaan siligga iyada oo loo marayo adapter-kaas. Waddooyinka tunnel-ka martigeliyaha waxay ku jiraan shaxda martigeliyaha oo waligood lama tashado, sababtoo ah frame-yada martidu waligood ma galaan stack-ga IP ee martigeliyaha.
Taasi labada dhinac bay gooynaysaa. mDNS iyo SMB daawashadu way bilaabataa shaqo sababtoo ah martidu waxay aragtaa taraafikada faafinta LAN-ka, martiduna waxay ka gaari kartaa mishiinada kale ee isla qaybta iyada oo aan firewall martigeliyaha dhexdhexaad ahayn. Bridging sidoo kale ma aha si loo riixo martida tunnel jira: in VM lagu xiro interface-ka WireGuard ama OpenVPN ee martigeliyaha ma aha wax VirtualBox ama libvirt adiga kuu qabta. Haddii martida bridged ay tahay in tunnel la sameeyo, tunnel-ku waa inuu ku dhammaadaa meel ku taal LAN-kaas.
Tijaabada soo afjarta doodda
Isku samee hubinta isku mid ah labada hab oo qor jawaabaha:
- Martigeliyaha,
curl -s https://ifconfig.mewaxay soo saartaa cinwaanka guud ee v4. - Martida gudaheed, isla amarka, oo lagu daray
ip routeLinux amaGet-NetRoute -DestinationPrefix 0.0.0.0/0Windows ee gateway-ka caadiga ah. - Aqoonsiga xalliyaha:
resolvectl statusamacat /etc/resolv.confmartida gudaheed, si aad u aragto haddii uu u jeedo 10.0.2.3 ama server LAN. - Qoyska cinwaannada:
ip -6 addr show scope globaliyo hal codsi v6, sababtoo ah tunnel v4 waxba kama sheegto cinwaan v6 guud oo martidu yeelan karto.
Cinwaanno guud oo isku mid ah waxay ka dhigan yihiin in martidu ku jirto waddada martigeliyaha. Cinwaanka martida oo la mid ah bixitaanka caadiga ah ee LAN-ka waxay ka dhigan yihiin in aanay ku jirin. Tallaabada dadku boodaan waa xakamaynta: hoos u dhig tunnel-ka martigeliyaha oo ku celi codsiga martida. Haddii martidu sii wado daawashada, waligeed kama ay tiirsanayn tunnel-ka martigeliyaha, si kastaba ha magaca habku u sheego. Habka NAT, martidu waa inay lumisaa internet-ka marka tunnel-ka martigeliyaha hoos loo dhigo, haddii aan macmiilku loo habayn inuu oggolaado taraafikada tunnel-la'aan, taas oo iyaduna mudan in la ogaado.
Laba calaamadood ayaa been sheegta. Ping guuleysta waxay caddeynaysaa gaaritaan, ma aha waddada bixitaanka. DNS-na waxaa laga jawaabi karaa proxy 10.0.2.3 iyada oo loo marayo xalliyaha martigeliyaha halka TCP uu qaadanayo waddo kale, taasina waa sida aad u hesho bog soo shubma iyo gelitaan waligiis dhammaan.
Habka ku habboon shaqada
Habku waa go'aan waddo, sidaas darteed ka dooro shuruudda halkii caado:
| Requirement | Mode that fits |
|---|---|
| Every guest flow must exit through the host tunnel | NAT, with a host client that tunnels by route, verified from inside the guest |
| The guest needs its own VPN account or profile | Bridged, or NAT with a client running inside the guest, not both |
| The guest must serve SSH, SMB, or a dev server to the LAN | Bridged; NAT needs a port forward, which does not change the outbound path |
| The guest must stay invisible to the LAN | NAT; a bridged guest is another host on the segment |
| The guest needs a real public IPv6 address | Bridged; VirtualBox NAT mode has no IPv6 forwarding |
| Isolation from the LAN with access to the host | Host-only adapter, not NAT |
Sadarka kowaad waa halka dadku ku dhiciyaan: NAT oo ay la socoto macmiil tunnel buuxa oo martigeliyaha ku yaal dhab ahaan wuu daboolaa martida, laakiin kaliya inta macmiilku tunnel ku sameeyo waddo ahaan iyo inta xiriirka sare ee martigeliyaha uu yahay tunnel-kaas. U rar macmiilka liiska oggolaanshaha browser-ka kaliya oo daboolka ayaa lumaya iyada oo aan khalad meelna ka muuqan. Sadarka afraad waa khaladka lidka ku ah, martida bridged oo loo sameeyay raaxaysi oo si aamusnaan ah u bilaabta jawaabta SMB ama SSH ee LAN-ka xafiiska.
Cilladaha lagu eedeeyo VPN-ka
Windows, tarjumaadda NAT waxay ku socotaa gudaha hab-socodka VM ee VirtualBox, sidaas darteed macmiil app kasta u gaar ah wuxuu u baahan yahay isla image-kaas liiska, ma aha qaanuun guud oo loogu talagalay mishiinada fudud. Marka cusboonaysiinta macmiilku dib u dhiso liiska hab-socodka la oggolaaday, martida NAT ayaa ugu horraysa lumiya daboolka, warbixintuna waxay u akhantaa sida VM gaadha LAN laakiin aan gaarin internet halka martigeliyuhu fiican yahay.
Bridging Wi-Fi waa midda kale ee caadiga ah. Meelaha gelitaanka marar dhif ah ayay u gudbiyaan frame-yo sita MAC isha qalaad, sidaas darteed bridge wlan0 ku yaal ama isla markiiba wuu guuldarraystaa ama wuu shaqeeyaa ilaa go'doominta macmiilka ee AP-ga ay bilaabato inay tuurto. VirtualBox wali waxay liiska ku soo bandhigi doontaa adapter-ka wireless. Haddii martigeliyuhu Wi-Fi ku jiro oo martidu tahay in bridged laga dhigo, qorshee tijaabo halkii aad ka malayn lahayd.
MTU waa saddexaad. Martida bridged waxay haysataa MTU 1500 byte ee LAN-ka, haddii ay ku socoto macmiilkeeda WireGuard 1420, gacan-qabsiga TLS ee waaweyn wuu hakadaa halka codsiyada yaryar ay gudbaan. NAT hoostiisa, MTU tunnel-ka martigeliyaha waa dhibaatada martigeliyaha, laakiin martidu wali waxay aaminsan tahay 1500, UDP oo leh bit don't-fragment waxay u dhacdaa god madow si la mid ah.
Qor habka, kadibna dib u hubi ka dib isbeddel kasta oo adapter
Diiwaangeli habka, interface-ka martigeliyaha ee bridge-ku isticmaalo, gateway-ka caadiga ah ee martida, xalliyeheeda, iyo cinwaannadeeda bixitaanka v4 iyo v6. Diiwaankaas waa waxa cilladda xigta ka dhigaya mid jaban: marka laptop-ku ka guuro dock-ka una guuro Wi-Fi, martida bridged waxay raacdaa bridge-ka una guurta adapter jireed kale oo waxay dib u kiraystaa subnet kale, halka martida NAT ay haysato cinwaankeeda 10.0.2.x oo si aamusnaan ah u dhaxasho xiriir sare oo kale.
Ka hor inta aan ticket-ka la xirin, xaqiiji mid kasta oo kuwan:
- Cinwaanka bixitaanka martida wuu ka duwan yahay cinwaanka bixitaanka martigeliyaha, sidaas darteed kuma jiro tunnel-ka martigeliyaha.
- Xalliyuhu waa proxy 10.0.2.3 ama server LAN, oo waad ogtahay kee ka jawaabay.
- Martida gudaheed ma jiro cinwaan v6 guud haddii naqshadda tunnel-ku tahay v4 kaliya.
- Marka tunnel-ka martigeliyaha hoos loo dhigo, martidu way joojisaa daawashada, ama hadda waad ogtahay in aanay waligeed ka tiirsanayn.
- Martidu ma arko taraafikada faafinta LAN-ka oo aanay waxba ka qabin inay aragto.