Ikhonteyina enamanethiwekhi amabili ikhetha isango elingalungile

Ikhonteyina yakho isaphendula ebhulohweni layo lokulawula, kodwa zonke izingwengwezi eziphumayo ziphuma nge-macvlan yasehhovisi. Akukho okuhlulekile. Ukuxhumana okubili kunikeza isango ngalinye, futhi umzila owodwa wokuzenzakalela waya kunethiwekhi obungayihlosile, ngakho insizakalo iyaqhubeka isebenza ngenkathi uhambo lwayo luthatha indlela ende. Lapho othile eqaphela, ubufakazi yithebula yomzila hhayi umlayezo wephutha.

Incazelo ejwayelekile ukuthi i-Docker yakhetha inethiwekhi ngengozi. Empeleni isinqumo sakudala sasilandela ukuhleleka kwezinhlamvu zamagama eminethiwekhi exhunyiwe, okwenza umzila waba umphumela oseceleni wophawu. I-gw_priority ishintsha lokho ngenombolo oyikhetha ngamabomu, futhi ukuyithatha kuthatha cishe umzuzu lapho ukuhlelwa sekubhaliwe.

Kungani umzila wokuzenzakalela uwela kunethiwekhi engalungile

Yonke inethiwekhi insizakalo ehlanganyela nayo inganikeza isango layo, futhi ikhonteyina igcina inomzila owodwa wokuzenzakalela. Ngaphambi kwe-Compose 2.33.1 ukulingana kwakuxazululwa ngokuhlela amagama eminethiwekhi, ngakho uphawu olufana ne-control olufika ngaphambi kwe-office lwalunquma ukuthi uhambo luya kuphi. Akukho lutho ngaphakathi kwekhonteyina olubhala phansi ukuthi isinqumo sasivamile, yingakho sidlula ekubuyekezweni kwekhodi futhi kamuva sivele njengomzila ongaqondakali. Ukubeka inqubomgomo efayeleni le-compose iyona ndlela kuphela yokwenza ukukhetha kuhlolwe.

Izinto ezimbili zishintsha ngempela ukuthi iyiphi inethiwekhi enqobayo: amanani e-gw_priority owabelayo, nokuthi imiphi iminethiwekhi exhunyiwe nhlobo. Faka inethiwekhi yesithathu bese iqoqo labagqugquzeli likhula; susa i-macvlan bese akukho lutho olusalayo oluzoncintisana nebhuloho. Azikho zombili lezi zinyathelo ezivela kumalogi wohlelo lokusebenza, ngoba umzila wokuzenzakalela ongalungile awuvamisile ukunqamula uxhumano ngokuphelele. Kwenza kuphela ukuthi izimpendulo zifike zisuka ekhelini okungenzeka ukuthi olunye uhlangothi alulilindele.

Bopha isango nge-gw_priority

I-Compose iveza i-gw_priority kukho konke ukuxhumana kwensizakalo-kuya-kunethiwekhi kusukela kunguqulo 2.33.1, futhi inombolo enkulu iyanqoba. Akukho ukhiye wesango wensizakalo ngayinye, ngakho inani lingaphansi kwebhulokhi ye-networks yensizakalo. Isibonelo esingezansi sinikeza umzila wokuzenzakalela ku-control ngenkathi i-office ihlala ifinyeleleka ku-LAN yayo exhunyiwe ngqo.

services:
  vpn:
    networks:
      control:
        gw_priority: 1
      office:
        gw_priority: 0

networks:
  control:
    driver: bridge
    ipam:
      config:
        - subnet: 172.30.50.0/24
  office:
    driver: macvlan
    driver_opts:
      parent: eno1.120
      macvlan_mode: bridge
    ipam:
      config:
        - subnet: 192.168.120.0/24
          ip_range: 192.168.120.192/27
          gateway: 192.168.120.1

Funda ibhulokhi njengezilawuli ezimbili ezihlukene: i-gw_priority inquma umzila wokuzenzakalela, futhi ingxenye ye-ipam inquma ikheli. Ukushintsha i-subnet kuphela kushiya ukukhetha indlela yokuphuma kungathintwanga, futhi lena iyona ndlela ejwayelekile yokuthi lokhu kulungiswa kusetshenziswe ngesigamu. Gcina izinto eziza kuqala eduze kwenethiwekhi ezilawulayo ukuze umfundi olandelayo angadingi ukufuna isinqumo.

Ungadidanisi i-gw_priority nesakhiwo esijwayelekile se-priority esiseduze kwaso. Leso sihlela ukudalwa kokuxhumana futhi asisho lutho ngomzila, ngakho asikwazi ukukhetha isango lokuzenzakalela futhi asilungisi amagama ezixhumi. Uma othile encoma ukukhulisa i-priority ukuze aqondise uhambo, isincomo asilungile ngisho nalapho ukuhleleka okuphumayo kubonakala kulungile ngenhlanhla.

Qinisekisa ukuthi iyiphi inethiwekhi ethwala umzila wokuzenzakalela ngempela

Hlola ngaphakathi kwekhonteyina esebenzayo, ngoba ithebula yomzila yomsingathi ichaza umsingathi hhayi indawo yamagama esetshenziswa insizakalo. Qala ngokugijima ukuhlolwa kokuhlelwa ukuze iphutha lokubhala lihluleke ngaphambi kokuqalisa kabusha, bese ufunda umzila ikhonteyina ewufake ngempela.

docker compose config --quiet
docker exec vpn ip -4 route show default
docker exec vpn cat /proc/net/route

Umphumela olungile usho idivayisi yebhuloho kanye no-172.30.50.1; ongalungile usho u-192.168.120.1 nedivayisi ye-macvlan. Uma isithombe singenayo iphakheji ye-iproute2, ifayela le-/proc lisabika umzila wokuzenzakalela, ngomgomo ongu-00000000 namabhayithi esango ehlehlisiwe. Qhathanisa ikholomu yesixhumi ne-docker inspect lapho amagama ezinto engacacile.

I-macvlan iyimbobo yomzimba, hhayi ikhophi yebhuloho

I-macvlan inika ikhonteyina ubunikazi besibili ocingweni, futhi yikho kanye okwenza ukufinyelela kumadivayisi endawo kusebenze. Kusho futhi ukuthi imbobo yesitshixo kanye ne-hypervisor kumele zamukele ikheli le-MAC elengeziwe, futhi amanethiwekhi amaningi asefu awamukeli lokho ngokuthula. Hlola ikhonteyina elilodwa ngaphambi kokuhlela iqembu, ngoba i-MAC enqatshiwe ivamise ukuvela njengesixhumanisi esiphezulu kodwa esingadlulisi lutho.

Isilungiselelo se-macvlan_mode: bridge siyimodi yomshayeli we-macvlan, hhayi ibhuloho lesofthiwe le-Docker, futhi i-passthru iyimodi ekhethekile ehlukile hhayi okuzenzakalelayo. I-Linux ivimbela nekhonteyina ye-macvlan ukuthi ifinyelele umsingathi wayo ngokusebenzisa umzali ofanayo, yingakho ibhuloho lokulawula ligcinwa esikhundleni sokulindela ukuthi ukuxhumana okukodwa kwenza imisebenzi yomibili.

Qamba umzali we-VLAN ngaphambi kokuba i-Compose ibone

I-Docker ithatha umzali onephuzu njenge-eno1.120 njenge-subinterface ye-802.1Q futhi yona uqobo idala idivayisi ye-VLAN. Lokho kulula kunemingcele: igama elisuselwe kulo lincike egameni lesixhumi somzimba, futhi amagama amade angaphusha umphumela ngale kwalokho okulindelwe amathuluzi azungezile. Ukwakha isixhumi se-VLAN esinegama ekuhlelweni kwenethiwekhi yomsingathi nokukhomba i-parent kuso kugcina iziphetho zombili zilindelekile.

Khumbula ukuthi ukhiye ongaphansi kwe-networks igama le-Compose, hhayi idivayisi ye-Linux. Ukufuna kumsingathi isixhumi esibizwa nge-office kuzohluleka, ngoba i-kernel ibona kuphela isixhumi somzali kanye nopende we-veth ngemuva kwekhonteyina.

Yenza isikhala se-VPN phezulu

Iklayenti le-VPN lixhumanisa ngemuva kokuba lezi nethiwekhi zikhona, ngakho lingangeza imizila eqondile kakhulu, imithetho yenqubomgomo nezihlungi kungakhathalekile i-gw_priority. Hlela amaphrefiksi akude ngokuqhathanisa nama-subnet amabili endawo, kuhlanganise nezimpendulo ezidingwa umzila wokulawula. Uma iphrefikisi elikude lihlangana ne-LAN yasehhovisi, lungisa uhlelo lwamakheli esikhundleni sokuklebhula lonke ububanzi obuyimfihlo emhubeni.

Hlola futhi amakheli, imizila nomzila wensizakalo ngemuva kokuthi i-VPN iqale nangemuva kokuthi ixhumane kabusha, ngoba yisikhathi sokuxhumana kabusha lapho umzila owengezwe ngesandla unyamalala. Bhala ithebula elilindelekile ngaphambi kokuhlolwa kokuqala ukuze ukuqhathanisa kamuva kube yi-diff hhayi umsebenzi wokukhumbula. Gcina ubunikazi benethiwekhi obuhlala njalo ku-Compose futhi uvumele ukuhlelwa kwe-VPN ukuthi kube ngumnikazi wenqubomgomo yayo kuphela.