Vumela ukuxhumana kwe-TLS passthrough kumongo we-stream we-NGINX

I-NGINX inganqaba ukudluliswa kwe-TCP TLS ngaphandle kokuqeda i-TLS. Beka umthetho wemvume ku-stream, hhayi ku-HTTP location, futhi uhlole ukuthi iyiphi ikheli le-peer elifikayo.

Ukudlulisa amabhayithi abethelwe ngaphandle kokuphatha isitifiketi noma nini yikho okwenziwa i-relay ye-TLS passthrough, futhi leli lungiselelo lihle futhi liyadida kancane ngasikhathi sinye. Njengoba kungabhalwanga lutho, akukho into emise okwe-HTTP yokuhlunga, ngakho ibhlokhi ye-location evamile nemithetho yayo yokufinyelela akusizi lutho lapha. Isinqumo i-NGINX enaso sikhuluma ngokuxhumana uqobo: iyiphi i-peer yenethiwekhi engqongqozile, nokuthi kufanele idluliswe noma cha.

Isinqumo siku-stream, hhayi ku-HTTP

Kumongo we-stream i-NGINX isebenza ngamaseshini e-TCP. Ibone ikheli le-peer lokuxhumana futhi ingasebenzisa imithetho ehleliwe ye-allow ne-deny kulo ngaphambi kokuba noma iyiphi ibhayithi ifike ku-backend. Lesi yisinqumo esiphelele sokwamukela futhi asidingi ukhiye oyimfihlo, isitifiketi noma ukuhlaziya kwe-HTTP.

MechanismWhat it decidesWhere it lives
stream allow/denyWhether this TCP peer is relayedstream server block
ssl_preread mapWhich backend a named connection goes tostream, with the preread module
HTTP location ruleWhether an HTTP request is servedhttp server block

Leyo mitsara emithathu ayikaze ishintshane. Ukukopisha umyalo wokufinyelela we-HTTP kunoma iyiphi ifayela elikhuluma ngephothi 443 akushintshi lutho, ngoba iseva ye-stream ayilifundi neze umongo we-http.

Yamukela ukuxhumana ngaphambi kokukudlulisa

Cabanga ukuthi kukhona ukufakwa okukhona okunamamoduli e-stream ne-stream-access, amakhasimende e-VPN agcina amakheli omthombo ku-10.90.0.0/24, kanti i-backend iku-192.168.50.20:443 isivele ihlinzeka ngobunikazi be-HTTPS obuhlosiwe.

stream {
    server {
        listen 443;

        allow 10.90.0.0/24;
        deny all;

        proxy_pass 192.168.50.20:443;
    }
}

Funda lokhu njengengxenye ye-listener entsha, hhayi njengokushintsha okuqondile kokucushwa okusebenzayo. Hlola kuqala ama-listener nama-include akhona, ngoba i-listener yesibili ephothini eselithathiwe iyahluleka ku-reload, hhayi ngesikhathi sesicelo.

Qaphela okungekho: akukho listen ... ssl, akukho myalo wesitifiketi. I-NGINX idlulisa umfudlana obethelwe, futhi i-backend iqeda i-TLS futhi yethula isitifiketi esiqinisekiswa yikhasimende. Ikhasimende elihluleka ku-allowlist linqatshelwa iseshini yalo ye-TCP, hhayi ikhasi le-HTTP 403, futhi noma iyiphi ithuluzi elilindele ikhodi yesimo izobika into engenamsebenzi.

Okukuhlanganiswa yi-allowlist nokungakuhlanganiswa

Uma i-relay isivele ikhetha ama-backend ngegama leseva, i-ssl_preread ne-map zingaqhubeka ngalowo msebenzi, inqobo nje uma imoduli itholakala. Igama lisenikezwa yikhasimende, futhi akukho okukwethula igama okufakazela ukuthi ikhasimende lijoyine i-VPN.

Umthetho wesibonelo uhlanganisa yonke i-listener ye-stream. Lokho kuyenza ingafaneleki endaweni eyodwa yokungena esebenzela ingxube yamasayithi omphakathi namasayithi e-VPN kuphela, lapho kuzodingeka ukukhishwa kwesinye ngesinye igama; ama-listener ahlukene ngokuvamile acaca kunequbulo elincike egameni elingekho umuntu ongalifunda.

Kukhona ezinye izikhala ezimbili okufanele zishiwo. Ukufana kwe-prefix akusho lutho ngokuthi iphakethe langena ngakuphi ukuxhumana, futhi umthetho we-HTTP kwenye indawo awukwazi ukukhawulela le listener. Kokubili kuyizizathu zokugcina inqubomgomo ye-ingress esezingeni le-host esithombeni esikhundleni sokuthatha umugqa we-allow njengomngcele wonke. Bhala umngcele njengezilawuli ezimbili okufanele zivumelane, ukuze noma yiluphi ushintsho kwelinye lazo lubuyekezwe.

I-NGINX ibona ikheli likabani ngempela?

Isilinganisi somthwalo, enye i-proxy noma i-source NAT kungabeka umxhumanisi phambi kwe-NGINX, ngakho i-peer ebonwayo akuyona ikheli langaphakathi lekhasimende le-VPN. Hlola indlela yangempela ngaphambi kokukhetha i-prefix, ngoba i-allowlist ebhalelwe ikheli elingalungile iyavumela wonke umuntu ongemva komhumushi noma akekho.

Iphrothokholi ye-PROXY nokuphathwa kwe-IP yangempela yizimpendulo ezisemthethweni, futhi kufanele zicushwe kuphela kubathumeli abahambisanayo nabathenjwa ngokusobala. Zombili izindlela zikholelwa kulokho okushiwo umthumeli, futhi yikho okwenza uhlu lwabathumeli kufanele lube lufushane. Ukwethemba isihloko sobunikazi esivela kunoma yiliphi ikhasimende le-inthanethi akukwenzi ulwazi lomthombo luthembeke futhi; kushintsha ukwenqaba okulungile kube ukwamukela okukhwabanisiwe.

Hlola yomibili imiphumela ngaphambi kwe-reload

Qinisekisa ukucushwa, yenza i-reload, bese uhlola kabili: iseshini entsha evunyelwe okufanele isebenze, neseshini enqatshelwe okungafanele isebenze. Gcina ukuqinisekiswa kwesitifiketi se-backend okuvamile esivivinyweni esivunyelwe, ngoba i-relay exhuma kodwa engakwazi ukuqinisekisa i-backend ixazulule inkinga eyodwa futhi yadala enye.

nginx -t
ss -tnp | grep ':443'

Hlola futhi indlela eya ku-backend nempendulo ngokwahlukene. Ukudlula ku-allowlist kufakazela kuphela ukuthi i-NGINX yamukele iseshini; ayikwazi ukuphoqa i-backend engafinyeleleki ukuba iphendule, futhi ayikwazi ukulungisa indlela yokubuya eyayingekho ngaphambi kokuba uqale.

Izihloko ezihlobene