Weelasha Windows iyo VPN: sababta shabakadda gudaha u go'do
Weelka Windows wuxuu isticmaalaa shaxda dariiqa martigeliyaha, sidaas darteed VPN aan u oggolaan subnetwork-ka gudaha wuxuu qaataa horgalaha weelka. Habka Linux wuxuu qaataa dariiq kale.
Hal laptop, oo leh hal macmiil VPN oo xiran, weelasha Linux way sii wadaan inay wada hadlaan halka weelasha Windows ay joogsadaan. Doorsoome ma aha sawirka; waa dariiqa ay baakaduhu u galaan martigeliyaha. Weelasha Windows ee shabakadda caadiga ah waxay amaahdaan shaxda dariiqa iyo turjumaadda martigeliyaha, sidaas darteed siyaasad beddela dariiqa martigeliyaha ayaa iyagana beddela. Xaqiiji taas iyadoo la raadinayo dariiqa ka hor intaadan dib u rakibin wax.
Halka baakadaha weelka Windows ay ka galaan martigeliyaha
Weel ku jira shabakadda caadiga ah nat wuxuu cinwaan ka helaa horgale ka mid ah adeegga Host Networking Service, badanaa meel gudaha 172.16.0.0/12, wuxuuna martigeliyaha gaaraa isagoo maraaya adapter macmal ah. Martigeliyaha ayaa leh dariiqa horgalahaas wuxuuna u turjumaa taraafikada adapter-ka hadda firfircoon. Ma jiro mishiin macmal oo gooni ah oo ku yaal bartamaha dariiqaas.
Nashqaddan ayaa cilladda ka dhigta mid makaanik ah. Marka weelku baakad diro, martigeliyaha wuxuu sameeyaa raadin dariiq oo loogu talagalay horgalaha weelka. Dariiqa guuleysta ayaa baakadku u socdaa, weelkuna ma laha ra'yi ku saabsan taas.
Maxaa macmiilka VPN u beddelaa dariiqaas
Macmiil shirkadeed wuxuu inta badan rakibaa tiro badan oo dariiqo ah iyo shaandheyn diidaysa gelitaanka subnetwork-ka gudaha inta tunnel-ku furan yahay. Ujeeddadu waa difaac: shabakad gudaha ah oo la waxyeeleeyay waa in aanay gaarin mishiin la ilaaliyay. Saameynta dhinaca kale ayaa ah in dariiqa martigeliyaha ee horgalaha weelka uusan hadda ahayn shabakadda NAT ee gudaha.
Beddelkeeda raadintu waxay la mid tahay tunnel-ka baakadkana waxaa la siiyaa iridda, oo aan waligeed maqal cinwaankaas weelka. Ping wuu guuldareystaa, barnaamijku wuu waqti dhaafaa, weelkuna wuxuu u muuqdaa mid jaban inta calaamadda VPN ay iftiinayso. Fiiri shaxda martigeliyaha adigoo xiran, dariiqa tartamaya waa muuqdaa.
| Container mode | Outbound path | Typical result behind the VPN |
|---|---|---|
| Windows, default nat | Host routes and translates container traffic | Container prefix follows the tunnel and fails |
| Windows, transparent | Container sits on the physical link | Depends on the local subnet being allowed |
| Linux engine on Docker Desktop | VM egress proxied by a host process | Often keeps working |
Sababta weelasha Linux ay u dhaqmaan si kale
Mishiinka Linux wuxuu weelasha ku socodsiiyaa gudaha mishiin macmal oo fudud, iskuxirnaanta baxaysa ee mishiinkaas waxaa fura wakiil dhanka martigeliyaha ah oo matalaya weelka. Martigeliyaha ayaa bilaaba socket-ka, sidaas darteed qaanuunka VPN ee ku saabsan horgalaha weelka si isku mid ah uma khuseeyo, culeyskuna wuu sii gaaraa shabakadda.
Farqigaas waxa uu kaloo sharraxayaa sababta cuntooyinka Linux aanay u gudbine. Weelka Linux oo u baahan tunnel u gaar ah waxaa la siiyaa qalab TUN iyo awoodda NET_ADMIN. Weelasha Windows ma soo bandhigaan interface qalab ahaan, sidaas darteed qaabkaas dhinacaas kuma laha wax u dhigma.
Caddee dariiqa, ka dibna dooro nashqad
Caddaynta ka soo uruuri martigeliyaha, ma aha weelka, sababtoo ah martigeliyaha ayaa sameeya raadinta:
docker network inspect nat --format "{{range .IPAM.Config}}{{.Subnet}}{{end}}"
route print -4
Get-NetRoute -AddressFamily IPv4 | Where-Object DestinationPrefix -like "172.16.*"Soco natiijada dariiqa hal mar ka hor inta uusan VPN xirmin iyo hal mar ka dib. Haddii natiijada labaad horgalaha weelku tilmaamo adapter-ka tunnel-ka, ogaanshaha wuu dhammaaday oo dib u bilaabista weelasha ma caawinayso.
Xulashada koowaad waa go'aan siyaasadeed: weydii milkiilaha shabakadda in gelitaanka LAN gudaha loo oggolaan karo qalabkan. Dhowr macmiil shirkadeed ayaa taas u soo bandhiga dejinta ahaan, laakiin waxay wiiqaysaa xad si ula kac ah loo sameeyay. Codso taas sida ka-reexan la diiwaangeliyay oo leh milkiile iyo taariikh dib u eegis. Beddelka qalab kasta oo aan cidina dib ugu noqon waa dariiqa siyaasad difaac si aamusan u libdhdo.
Meesha siyaasaddu ay tahay inay sii socoto, u rar culeyska halkii aad la dagaallami lahayd dariiqa. Shabakad hufan oo leh subnetwork iyo irid cad waxay weelasha dhigtaa xiriirka gudaha, culeyska Linux wuxuu ku socdaa gadaasha wakiilka mishiinka macmal, iyo mishiin macmal oo gooni ah oo leh macmiilkiisa wuxuu hayaa siyaasaddiisa. Dooro mid si ula kac ah oo ka tijaabi gudaha weelka, sababtoo ah codsiga isticmaalaha halkaas ayuu ka yimaadaa.