U maroojin taraafikga VM ee shabakadda host-only iyada oo loo marayo serverka TUN OpenVPN

Adabtarada host-only waxay abuuraan shabakad macmal ah oo maxalli ah, tunnelada TUN ee la maroojiyayna waxay qaadaan baakadaha IP ee u dhexeeya cinwaannada. Midkoodna ma aha buundo u socota kan kale, sidaas darteed qaabeynta shaqaynaysa waa inay sheegto cidda gudbisa iyo cidday leedahay wadada soo noqodka. Haddii labadaas hawlo la qaldo, martidu waxay tunnel-ka kaga jawaabtaa isha tunnel-ka macmiilkiisu waligiis weydiisan. Naqshadda hoose waxay kala haysaa labada horgale oo waxay caddaynaysaa wadada soo noqodka.

Laba shabakad, laba horgale

Sii barkada tunnel-ka iyo shabakadda host-only horgale kala duwan oo waligaa mid u isticmaalin kan kale. Tusaalahan barkada VPN waa 10.44.0.0/24 shabakadda host-only-na waa 192.168.99.0/24, host-ku wuxuu ku yaal 192.168.99.1 martiduna 192.168.99.20. Horgalaha isku mid ah siinta qalabka TUN iyo adabtarada host-only labadaba ma isku daro. Waxay abuurtaa laba sheegasho oo ku saabsan hal baaxad cinwaan ah, miiska maroojintuna markaas wuxuu uga jawaabaa sheegashada uu si kadis ah u haystay.

Adabtarada host-only waxay ku taal host-ka iyo gudaha martida labadaba, lana ma lihid waddo ay iyadu ka baxdo mishiinka. Xidhiidhada buundo iyo NAT waxay leeyihiin soo-gaadhista kala duwan, u gudubka qaabka buundo ma aha shuruud lagu gaaro hal adeeg oo martida ah.

Host-ku horey ayuu u hayaa wadada

Fiiri waxa jira ka hor intaadan wax ku darin. Host-ku wuxuu leeyahay interface ku yaal shabakadda host-only iyo waddo horgalahaas, labadaba waxaa la abuuray markii adabtaradu kacday.

ip -br addr show
ip route show 192.168.99.0/24
sysctl net.ipv4.ip_forward

Sadarrada saddexaad waa habka host-ka u beddela booddo. La'aanteed, baakad ka imanaya tunnel-ka waxaa loo cinwaanayaa shabakad uu host-ku gaari karo laakiin aanu gudbin doonin. Gudbintu waa lagama maarmaan mana ku filna. Siyaasadda shaandhaynta ayaa wali go'aamisa in qulqul gaar ah oo u dhexeeya interface-ka tunnel-ka iyo interface-ka host-only la oggol yahay, go'aankaasna waa inuu qoraal ku jiraa halkii uu ku jiri lahaa siyaasad caadi ah oo aan cidina akhriyin.

Riix wadada, ka dibna shaandhee waxa ay gaarto

Serverku wuxuu siin karaa horgalaha host-only macmiilada aqbala waddooyinka la riixay, taas oo ah isla habka loo isticmaalo shabakad kasta oo hoose oo ka dambeysa tunnel-ka.

push "route 192.168.99.0 255.255.255.0"
iptables -A FORWARD -i tun0 -o vboxnet0 -d 192.168.99.20 -p tcp --dport 5432 -j ACCEPT
iptables -A FORWARD -i vboxnet0 -o tun0 -s 192.168.99.20 -p tcp --sport 5432 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Labada sharci waxay oggolaadaan hal adeeg oo hal jiho ah iyo jawaabihiisa. Waddo gaarta horgalaha oo dhan iyo shaandheyn oggolaanaysa hal deked waa isku-dar ula kac ah; waddo iyo aqbal aan shuruud lahayn waa habka adeeg shaybaadh uu u noqdo adeeg furan. Waddada la riixay sidoo kale ma aha fasax. Macmiilku wuu aqbalaa, host-ku wuu gudbiyaa, derbiga dabka ee martida iyo adeegga laftiisuna wali waxay leeyihiin cod.

Martidu waxay u baahan tahay waddo soo noqod

Martida laga gaaro 10.44.0.x waa inay jawaabahaheeda u dirto cinwaanka host-only ee host-ka, ama host-ku waa inuu turjumo isha. Cinwaan ka helista DHCP VirtualBox wax wax kama sheegto mid ka mid ah labada habayn.

ip route add 10.44.0.0/24 via 192.168.99.1 dev enp0s8
ip route get 10.44.0.15

Ku darista waddadaas gudaha martida waxay ilaalisaa isha asalka ah, taas oo siyaasadda iyo diiwaannada macmiil kasta u ilaalisaa macne. Turjumaad isha oo xaddidan oo host-ka ah waa beddelka, waana shaqaysaa, laakiin waxay ku kacdaa qarinta macmiilka isku xidhay. Is-dul-saarnaan waa qaabka kale ee guul-darro. Macmiil fog oo LAN-giisu horey u isticmaalo 192.168.99.0/24 wuxuu waddada la riixay u akhrinayaa shabakaddiisa, waxna ka beddela dhanka serverka ma xallinayo madmadowgaas. Dib u nambaree hal dhinac ama dooro horgale aan u dhowayn inuu isku dhaco.

Qalabka TUN wuxuu qaadaa baakadaha IP, sidaas darteed ku darista gateway caadi ah gudaha martida ma ka dhigto tunnel-ka qayb Ethernet oo la socota adabtarada host-only. Buundada TAP waa naqshad kale oo leh taageeradeeda macmiil iyo lahaanshaha cinwaannadeeda, isku-darka labada sharaxaadna wuxuu horseedaa qaabaynno aan waligood isku iman.

Xaqiiji, ka dibna ka dhig mid u adkaysta dib u bilaabid

Tijaabi hal adeeg oo aan waxyeello lahayn oo ka yimaada macmiil fog oo caadi ah, hubi wadada soo noqodka martida, oo xaqiiji in adeeg aadan oggolaan la diido halkii uu gaabis ahaan lahaa.

ss -lntp '( sport = :5432 )'
conntrack -L | grep 192.168.99.20

Ka dib dib u bilaab adeegga VPN iyo shabakadda mishiinka macmal, oo ku celi saddexda hubin ee la mid ah. Waddo gacan lagu daray waxay noolaataa ilaa dib u bilaabidda xigta, qaabayn shaqeeya oo keliya fadhi diiran ma aha naqshad. Qor labada horgale, siyaasadda gudbinta iyo wadada martida wada. Cid kasta oo ku darto mishiinka macmal ee xiga waxay u baahan doontaa saddexda oo dhan, haddii kalena wuu dib u ogaan doonaa mid kasta oo xidhiidh guul-darraysan.