Nebula: gudbinta waa la habeeyay laakiin lama isticmaalin — saddex goobo oo la hubiyo

Waxaad ku dartay host gudbineed, ciwaanka Nebula ku qortay habaynta, haddana labada peer ma wada hadlaan. Tani waxay dhacdaa sababtoo ah waddada gudbinta waxay u baahan tahay saddex odhaah oo kala duwan inay is waafaqaan, oo mid keliya ayaa ku jira mashiinka aad u badan tahay inaad tafatirtay. Laba jeer ayaan tan dabagalay: hal mar hostka gudbinta waligiis lama siin doorka gudbinta, mar kale goobaha waxaa lagu qoray dhinaca khaldan ee xiriirka. Taxanaha hoose wuxuu hubiyaa doorka, xayeysiinta iyo ogolaanshaha isla nidaamkaas, oo tallaabo kastaa waxay leedahay amar kuu sheegaya inaad sii waddo iyo in kale.

Samee khariidad saddexda door ka hor intaadan tafatirin habayn

Nebula waxay siisaa host kasta shaqo, shaqooyinkuna lama dhaxlaan. Laydhka waxaa ka jawaaba su'aalaha 'xaggee buu peer-kan joogaa' si host-yadu isu helaan. Gudbintu waxay u gudbisaa taraafikada laba peer oo aan lahayn waddo toos ah oo shaqaysa. Host caadi ah labadaba ma sameeyo. Saddexda goobood ee muhiimka ah waxay ku nool yihiin saddex mashiin oo kala duwan, taasina waa sababta habaynta macmiilka ee u muuqata mid dhamaystiran ay labada peer uga tagi karto sugitaan.

# on the discovery host
lighthouse:
  am_lighthouse: true
  hosts: []

# on every other host, point at the discovery host's Nebula address
lighthouse:
  hosts:
    - 10.42.0.1

Calaamad keliya ayaa kala soocda labada nooc ee guuldarada. Haddii labada peer ay is liis gareeyaan oo diiwaanku muujiyo isku dayo gacan-qabsi oo waligood dhammaan, baaritaanku wuu shaqaynayaa oo waddada xogta waxaa xannibay NAT ama shidaal-dab. Haddii peer-ku waligiis baran waayo ciwaanka kale, dhibaatadu waxay ku jirtaa laydhka ama khariidadda host-ka ee taagan, oo goobaha gudbintu ma hagaajin karaan taas.

Hubi habaynta kasta oo host kastaa runtii soo rartay ka hor intaadan wax kale tafatirin. Unugga akhriya waddo ka duwan faylka aad tafatirtay waa sabab caadi ah oo ceeb leh oo ku saabsan 'isbeddelku wax ma qaban':

systemctl cat nebula | grep ExecStart
nebula -version
journalctl -u nebula -n 20 --no-pager

Sadarka nooca ayaa muhiim u ah duulimaad isku dhafan. Maaraynta gudbinta, dhaqanka daloolinta iyo furayaasha habaynta ee la aqbalay kuma wada eg yihiin noocyada, marka ha u malayn in dhismo hore uu fahmo qayb aan loo qorin isaga. Isku beeg host-yada hal taxane yar, ka dib ku socodsii nebula -test -config /etc/nebula/config.yml host kasta oo isbarbar dhig wax soo saarka ka hor intaadan dhibaato ka raadin gaadiidka uusan koodhku hirgelin.

Ku shid doorka gudbinta hostka gudbinta

Doorka gudbintu waa hal calan oo ku yaal hostka gudbinta, oo ka duwan inuu laydh yahay. Host leh baaritaan shidan iyo gudbin la dansay weli waa adeeg baaritaan keliya. Gudbinta:

relay:
  am_relay: true

Calankan wuxuu caddeeyaa ujeeddo; ma abuurto gaarsiin. Gudbintu waa in laga gaaro labada peer, taas oo ficil ahaan macnaheedu yahay ciwaan dadweyne, UDP soo gal ah oo ku furan dekedda Nebula ee shidaal-dabka hostka iyo koox kasta oo amni oo daruuro ah, iyo inaan NAT labanlaab ah ka horreeyn. Hubi socket-ka dhegeysanaya, ka dib fiiri imaatinka baakadaha peer-ka:

ss -lunp | grep nebula
tcpdump -ni any udp port 4242 and host 198.51.100.7

Laba xaddidaad ayaa waqti badbaadiya gudaha. Gudbinta lama gaari karo gudbin kale, marka silsilad magacyo gudbin ah oo ku jirta habayn ma beddelo in hostka gudbinta la siiyo waddo la isticmaali karo. Oo gudbintu waxay gudbisaa baakado; ma bixiso ogolaansho, marka qawaaniinta soo galka ee goobta lafteedu waxay go'aansadaan in qulqulka la gudbiyay la ogolaaday. Doorka iyo shuruudihiisa waxaa lagu sheegay diiwaanka habaynta gudbinta.

Ku xayeysii gudbinta goobta, ma aha macmiilka

Kani waa rogidda cunaysa saacadaha ugu badan. Liiska gudbinta waxaa iska leh hostka aad isku dayayso inaad gaarto, sababtoo ah waxay u sheegtaa peer-yada kale gudbin noocee ah ayaa loo isticmaali karaa in hostkaas lagu gaaro. Ku dhejinta macmiilka bilaaba xiriirka wax ma qabto jihada macmiilku u baahan yahay:

# on the DESTINATION host: relays others may use to reach me
relay:
  relays:
    - 10.42.0.5

Peer-yadu waxay soo sheegaan liiskaas iyaga oo wata ciwaannadooda marka ay laydhka iska diiwaangeliyaan, marka xayeysiintu waxay ku faaftaa baaritaanka halkii ay ku faafi lahayd is-dhaafsiga tooska ah. Haddii goobtu gaari karin laydh, liiskeeda gudbinta waligiis ma faafo oo gudbin si sax ah loo habeeyay ayaa shaqo la'aan noqota. Guuldaradaas waxay u egtahay sida gudbin jabtay oo kale mana aha sidaas.

Isku mar isla goobta sii waddo bilow ah. Khariidadda host-ka ee taagan waxay ciwaanka Nebula ku xidhaa barta ugu dambeysa ee dadweynaha si gacan-qabsiga ugu horeeya uu meel u tago, oo waxay u baahan tahay galitaan gudbinta haddii goobtu ay tahay inay ka aqbasho taraafikada la gudbiyay host-yada aysan si toos ah u gaari karin:

static_host_map:
  "10.42.0.5": ["203.0.113.10:4242"]

U ogolow peer-ka xirma inuu isticmaalo gudbinta

Dhinaca bilaabaa wuxuu u baahan yahay ogolaansho u gaar ah. relay.use_relays waa shidan yahay sida caadiga ah, marka kiiska mudan in la raadiyo waa false cad, oo inta badan laga soo koobiray qaab la qoray ka hor inta aanay gudbinta jirin ama ka haray isku day hore oo lagu qasbay waddooyin toos ah:

relay:
  use_relays: true

Ogolaanshaha dhinacan ma aha albaabka keliya. Qawaaniinta soo galka ee goobta wali waxay khuseeyaan baakadda la gudbiyay, oo isha ay isbarbar dhigaan waa aqoonsiga ku jira tunnel-ka ma aha ciwaanka gudbinta lafteeda. Marka gacan-qabsiga la gudbiyay dhammaado oo codsigu wali guuldareysto, akhri diiwaanka goobta isha ay diiwaan galisay ka hor intaadan qawaaniinta dib u qorin.

Goobaha dhaqaaqa NAT waxay la falgalaan waxan oo dhan. punchy.punch wuxuu ka caawiyaa laba peer inay furaan waddo toos ah, oo marka uu guuleysto ma jiro taraafik gudbin ah oo la fiiriyo; taasi waa guul, ma aha gudbin maqan. Lammaane si goosgoos ah u shaqeeya badanaa waxay ka dhigan tahay daloolintu mararka qaar way guuleysataa, marka lammaankaas dhowr jeer tijaabi halkii aad hal isku day ka soo saari lahayd gabagabo.

Ku xaqiiji lammaanka guuldareystay, ka dib dib u rartii

Tijaabi labada host ee runtii guuldareystay, iyaga oo wata codsiga ay u baahan yihiin. ping guuleysta oo ka yimaada shaqadaada ilaa adeegga gudbinta lafteeda wax ma caddeeyo gudbinta u dhexeysa laba peer oo kale, oo kani waa natiijada been-abuurka ah ee ugu caansan dhammaan habkan.

journalctl -u nebula -f | grep -iE "relay|handshake"
ping -c 3 10.42.0.9

Dib u rartii halkii aad dib u bilaabi lahayd, oo xaqiiji in habka socda uu qaatay faylka aad tafatirtay. Dib u bilaabista waxay jebisaa tunnel kasta oo waxay ka dhigtaa tijaabada xigta mid adag in la akhriyo, halka SIGHUP uu hayo habka oo uu ku qasbo inuu dib u akhriyo habaynta:

sudo systemctl kill -s HUP nebula
# same signal when nebula runs in the foreground
kill -HUP $(pidof nebula)

systemctl reload wuxuu shaqeeyaa keliya marka unugga maxalliga ah uu qeexo ExecReload, unugga la socda mashruucuna sidaas ma sameeyo, marka tallaabada ku guuleysata rakibaadda caadiga ah waa systemctl kill -s HUP. Dib u rartii ka dib akhri diiwaanka waddada habaynta ee habku furay, si aad u ogaato in faylka cusub la akhriyay ma aha kii aad u malaynayay.

Goobaha gudbinta iyo daloolinta NAT labaduba waxay saameeyaan waddada; midkoodna ma saameeyo aqoonsiga. Haddii lammaanku wali ku guuldareysto gacan-qabsiga ka dib marka am_relay, relays iyo use_relays lagu xaqiijiyay habaynta socota, hubi in labada host ay soo bandhigaan shahaadooyin loo soo saaray magacyada lagu habeeyay iyo in CA isku mid yahay labada dhinac. Hayso shahaadada iyo habaynta shidaal-dabka mid taagan inta aad beddelayso hal goob oo gaadiid ah isku mar, sababtoo ah tafatirka shahaadada iyo tafatirka gudbinta oo isku tijaabo dhaca wax ma kuu sheegaan kee u dhaqaajiyay gacan-qabsiga. Magac ama CA aan is waafaqsanayn wuxuu ku guuldareystaa isla meesha gudbin waligiis la helin ku guuldareysto, marka hubinta ka-hortagga ahayd waxay isla tallaabadaas ku jirtaa.

Ka dib xaqiiji in odhaah kastaa ku jirto faylka uu iska leh:

• am_relay: true hostka gudbinta, oo hostkaas laga gaari karo UDP labada dhinac.
• relays: oo ku sheega ciwaanka Nebula ee hostkaas goobta.
• use_relays: true peer-ka bilaaba xiriirka.
• Qawaaniinta soo galka ee goobta wali waxay u ogolaadaan isha dhabta ah ka dib marka waddadu is beddesho.