Mareynta gaadiidka martigeliyaha iyada oo loo marayo VPN gudaha VM: lix baaritaan

Lix baaritaan, oo si isku xigta loo sameeyo, ayaa go'aamiya in VM ay noqon karto iridka VPN ee martigeliyahooda. Hypervisor-ku waxba kama qabto tan adiga: tunnel-ka waxaa leh martida, waddada waxaa leh martigeliyaha, shabakadda u dhexeeyana waa marin caadi ah. Liiska waan hayaa sababtoo ah hal tallaabo in la boodo waxay had iyo jeer keenaysaa isla calaamadda, aamusnaan, halkaas oo martigeliyahu si farxad leh ugu ping-gareeyo martida oo aan waxba gudaha ah gaarin.

Ka bilow sababta. Ama macmiilka shirkadu wuxuu ku rakibmaa oo kaliya martida gudaha, ama siyaasadu halkaas ayuu ku hayaa, oo weli waxaad u baahan tahay server-ka build-ka gudaha ee martigeliyaha. Haddii martigeliyaha loo ogolaado macmiilkiisa, samee taas: hal tunnel oo martigeliyaha ku yaal ayaa had iyo jeer ka sarreeya laba shabakad iyo NAT.

Baaritaan 1: martigeliyaha wuxuu u baahan yahay xiriir uu cinwaan siin karo

Martigeliyahu waa inuu lahaadaa interface ku jira isla prefix-ka adapterka labaad ee martida. Host-only gudaha VirtualBox, host-only ama VMnet gaar ah gudaha VMware Workstation, buundada gudaha ama qalabka tap gudaha QEMU/KVM, iyo switch-ka Internal gudaha Hyper-V dhammaantood way u qalmaan. Martida 192.168.56.2, martigeliyaha 192.168.56.1, prefix 192.168.56.0/24 waa habka aan shaybaadhka ku isticmaalo.

Shabakadda QEMU ee habka isticmaalaha (-netdev user, backend-ka SLIRP ee caadiga ah) iyo NAT-ka VirtualBox ayaa si buuxda ugu guuldarraysta baaritaankan. Baakadaha martida waxay gaadhaan geedi socod proxy ah oo martigeliyaha ku yaal, sidaas darteed martigeliyahu marnaba ma arko qalab sidan cinwaannada martida oo waxba ma hayo uu waddo ku tilmaamo. Default Switch-ka Hyper-V waa isla sheekada. Haddii ping 192.168.56.2 martigeliyaha ka guuldarraysto, istaag: ma jiro waddo dambe lagu daro oo taas hagaajinaysa.

Baaritaan 2: martidu waxay gudbisaa oo tarjuntaa

Baakadaha martigeliyaha ka yimaada waxay la yimaadaan cinwaan isha host-only iyo meel gudaha ah, sidaas darteed martidu waa inay gudbisaa ka dibna ka qariso gadaashiisa cinwaanka tunnel-keeda. Martida Linux taas waxay ka dhigan tahay gudbin, lammaane FORWARD accept, iyo source NAT dhanka tunnelka:

sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -A FORWARD -i eth1 -o tun0 -j ACCEPT
sudo iptables -A FORWARD -i tun0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s 192.168.56.0/24 -o tun0 -j MASQUERADE

Qaanuunka MASQUERADE waa qaybta dadku ka tagaan. Router-yada shirkaduhu marar dhif ah ayay ogaadaan in 192.168.56.0/24 jiro; qaanuunka la socodka, server-yada gudaha waxay arkaan cinwaanka tunnelka martida oo ka jawaabaan, jawaabtuna waxay heshaa waddo ku noqota martida.

Martida Windows waa ka xun. IPEnableRouter=1 hoosta SYSTEM\CurrentControlSet\Services\Tcpip\Parameters waxay shiday gudbin aan tarjumaad lahayn, sidaas darteed waxay kaliya ka shaqaysaa meesha marinka shirkadu horey ugu tilmaamayso prefix-kaaga host-only. Internet Connection Sharing way tarjuntaa, laakiin waxay dib u nambareysaa adapterka la wadaago 192.168.137.1, sidaas darteed akhri cinwaanka uu dhab ahaan qaatay ka hor inta aadan qorin waddooyinka martigeliyaha.

Baaritaan 3: waddooyinka martigeliyaha waxay magacaabaan martida, ma aha tunnelka

Kaliya prefix-yada martigeliyahu u baahan yahay ka soo mar martida. Linux hal waddo prefix kasta waa ku filan tahay oo si nadiif ah ayay u noqotaa:

sudo ip route add 10.20.0.0/16 via 192.168.56.2
ip route get 10.20.30.40

Windows waxa u dhiganta waa route add 10.20.0.0 mask 255.255.0.0 192.168.56.2. Ka tag -p inta aad tijaabinayso, si waddo xun ay u dhinto marka dib loo kiciyo, oo ku dar marka waddadu shaqeyso. Ha tirtirin waddada caadiga ah ee martigeliyaha haddii aanay ahayn in barnaamij kasta oo martigeliyaha ku yaal uu isticmaalo tunnelka; haddii tunnel buuxa uu dhab ahaan yahay shuruudda, ku dar labada waddo ee /1 oo hayso waddada tooska ah ee shabakadda hypervisor-ka:

sudo ip route add 0.0.0.0/1 via 192.168.56.2
sudo ip route add 128.0.0.0/1 via 192.168.56.2

Martigeliyaha Windows sidoo kale hubi mitirka interface-ka. Waddo lagu daray intii adapterka host-only uu damnaa waxay ku sii hartaa shaxda laakiin marnaba ma qaaddo gaadiid, oo adapter labaad oo mitir hooseeya ayaa ku guuleysan kara raadinta isla prefix-ka.

Baaritaan 4: DNS waxay raacdaa waddada, ma aha caadiga tunnelka

Waddooyinku waxay dhaqaajiyaan baakadaha; xalliyaha ayaa go'aamiya magacyada kee baakadaha soo saara. Ku xaddid xalliyaha shirkada aagga shirkada halkii aad beddeli lahayd xalliyaha martigeliyaha, oo u tilmaan server DNS uu waddada cusub horey u gaaro. Iyada oo systemd-resolved ku yaal martigeliyaha:

resolvectl dns eth1 10.20.0.53
resolvectl domain eth1 '~corp.example.com'

Windows gudaha gelitaanka shaxda siyaasadda xallinta magacyada ayaa sameeya isla shaqada: Add-DnsClientNrptRule -Namespace ".corp.example.com" -NameServers 10.20.0.53. Haddii martidu ku shaqeyso xalliyeheeda cinwaanka host-only, isticmaal cinwaankaas, laakiin kaliya ka dib markaad xaqiijiso inuu ka jawaabo 192.168.56.2 oo aan ka jawaabin loopback.

Kadib hubi MTU ka hor inta aadan DNS ku eedayn bogagga gaabiska ah. Interface-ka tunnelku wuu ka yar yahay interface-ka 1500 byte ee martigeliyaha, sidaas darteed martigeliyaha soo dira segmento buuxa oo leh bit DF ayaa meel gudaha martida ka lumiya. Calaamadda caadiga ah waa ping shaqeeya iyo barnaamij web gudaha ah oo istaaga ka dib gacan-qaadka TLS. Ku adkee MSS waddada gudbinta martida:

sudo iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

Baaritaan 5: ka xaqiiji labada daraf

Martigeliyaha, traceroute ama tracert cinwaan gudaha waa inay baraan 192.168.56.2 sida boodhka koowaad, ma aha iridka jirka. Martida dhexdeeda, daawasho isla isku dayga oo baxaya: tcpdump -ni any host 10.20.30.40 waxay tusaysaa codsiga la gudbiyay dhinaca host-only iyo kan la tarjumay tunnelka. Codsiga baxa, soo noqda oo weli martigeliyaha aamusan ka taga ayaa tilmaamaya waddada soo noqodka.

Laba guuldarro ayaa sharraxaya inta badan taas. Ama tunnelka martida ma qaado waddo soo noqod oo loogu talagalay prefix-ka host-only sababtoo ah qaanuunka NAT maqan, ama waddada martigeliyaha waxay tilmaamaysaa cinwaan aan martidu haysan ka dib dib u kicinta. Dib u akhri cinwaannada ip -br addr iyo ip route get halkii aad ku kalsoonaan lahayd qoraallada kulanka hore.

Baaritaan 6: ka dhig mid ka badbaada dib u kicinta iyo casriyeynta hypervisor-ka

Hayso labada qaybood: qaabeynta waddooyinka netplan ama NetworkManager martigeliyaha, route add ... -p Windows, iyo net.ipv4.ip_forward=1 gudaha /etc/sysctl.d/ oo ay la socoto xeerar firewall oo martida dib loo rarto. Qaado snapshot martida isla marka qaabeynta la xaqiijiyo, ka hor inta aanay iman cusboonaysiinta macmiilka shirkada ee xigta.

Shabakadaha host-only dib ayaa loo nambareeyaa marka hypervisor-ku dib u abuuro adapter-yadiisa, taas oo si aamusan u burinaysa waddo kasta iyo qaanuun NAT kasta oo lagu dhisay 192.168.56.0/24. Ka dib casriyeyn, dib u socodsii saddexda baaritaan ee ugu horreeya si isku xigta; taas waxay qaadataa hal daqiiqad oo waxay qabataa xaaladda uu martigeliyahu weli waddadiisa hayo halka martidu u guurtay subnet cusub.

IPv6 waxay u baahan tahay wareeggiisa. Xeerarka ip6tables, diiwaannada AAAA iyo qoyska labaad ee waddooyinka martigeliyaha ma raacaan qaabeynta IPv4, iyo adeeg shirkadeed oo lagu gaaro IPv6 wuxuu u muuqan doonaa mid si joogto ah u jaban inta IPv4 shaqeynayo.

Ha gudbo ama ha guuldarraysto, si isku xigta: martigeliyahu wuu ping-gareyn karaa cinwaanka host-only ee martida; martidu waxay u gudbisaa tunnelka oo sameysaa MASQUERADE; ip route get waxay soo celisaa martida sida iridka prefix-ka gudaha; magacyada shirkada waxaa lagu xalliyaa xalliyaha xaddidan; traceroute waxay tusaysaa martida marka hore; iyo isla lixda jawaabood ayaa ka badbaada dib u kicinta.