I-Dante SOCKS ku-loopback yesevisi ye-HTTPS ehamba nge-WireGuard kuphela

Bopha isilaleli se-SOCKS esikhethekile ku-loopback futhi uvumele indawo eyodwa ye-TCP. Gcina umthombo wokuphuma we-Dante, umzila we-kernel, i-DNS kanye nenqubomgomo yokulahleka kwethumbu zehlukene.

Le ncwadi yokuhola inika uhlelo olwazi i-proxy ukufinyelela kumzila okhona we-WireGuard ngaphandle kokushicilela imbobo ye-proxy kuseva ye-VPN noma ku-inthanethi. I-daemon ye-SOCKS ihlinzeka ngesixhumanisi sohlelo, i-WireGuard ihlinzeka ngomzila we-IP osugunyaziwe, futhi akukho kuzo ezimbili oqinisekisa umsebenzisi esikhundleni sakho. Isinyathelo ngasinye ngezansi sikhiqiza into ongayihlola, futhi ngasinye sinendlela yokuhlehla: misa i-instance, susa umthetho noma susa isilungiselelo se-proxy sohlelo. Akukho lutho lapha olushintsha umzila ozenzakalelayo womsingathi.

Isibonelo sithatha ukuthi i-Dante 1.4.x ifakiwe njenge-instance ekhethekile, elawulwayo esiteshini sokusebenza se-Linux esithenjwayo, kanti i-akhawunti yesevisi nokucushwa kokuloga okuhlinzekwa yiphakheji kushiye endaweni yako. Isiteshi sokusebenza siphethe 10.77.0.2 kusixhumanisi saso se-WireGuard, sifinyelela 10.60.0.20:443 ngale thumbu, futhi igama elifanele lesevisi app.corp.example.

Isinyathelo 1: bopha isilaleli ku-loopback kuphela

Faka izingxenye zenethiwekhi, indlela kanye nemithetho kucushwa okusebenzayo kwe-instance, ushintsha amakheli esibonelo. Zonke izilungiselelo zeseva ziza ngaphambi kwamabhulokhi emithetho:

internal: 127.0.0.1 port = 1080
external: 10.77.0.2
external.protocol: ipv4
clientmethod: none
socksmethod: none

client pass {
    from: 127.0.0.1/32 to: 127.0.0.1/32
}

socks pass {
    from: 127.0.0.1/32 to: 10.60.0.20/32 port = 443
    command: connect
    protocol: tcp
}

Lena iyingxenye, hhayi indawo yezilungiselelo zomsebenzisi nokuloga zephakheji. Khetha imbobo yasendaweni engasetshenzisiwe, futhi qinisekisa ukuthi le instance ekhethekile ayinabo abanye abalaleli, ayinayo imithetho yokudlula ebanzi kanye noma yimiphi imininingwane yochungechunge oluphezulu engashintsha inkontileka. Uma ukucushwa kwangaphambilini kushiye socks pass ngaphandle komkhawulo wendawo, kususe ngaphambi kokuhlola noma yini.

Ukwenza kabusha kwalesi sinyathelo ukuyimisa i-instance; ifayela lokucushwa lingahlala kudiski ngenkathi ulibuyisela.

Isinyathelo 2: bhala imithetho emibili, hhayi eyodwa

I-Dante isandiso sokucushwa sinikeza izinhlobo ezimbili zomthetho imisebenzi ehlukene. Umthetho weklayenti wamukela ukuxhumana nesilaleli se-loopback, futhi indawo yawo ikheli lesilaleli uqobo. Umthetho we-SOCKS uvumela ukuxhumana okulandelayo okuceliwe kuya kumsingathi nembobo ezigunyaziwe. Izicelo ezingafani zivinjelwa ngokuzenzakalelayo, yingakho umthetho ongekho ubonakala ufana nomzila ophukile.

Qaphela lokho okucushwa okungenzi ngamabomu: akuceli iphasiwedi ye-SOCKS. Lokho kulungele umsingathi wasendaweni othembekile, futhi akukona ukuqinisekiswa komsebenzisi. Noma iyiphi enye inqubo kuleyo mshini ingasebenzisa i-loopback futhi. Gcina ukuqinisekiswa kohlelo olukude ngokwako endaweni yako, futhi ungaphindi usebenzise le fomu engenakuqinisekiswa kubasebenzisi basendaweni abangathenjwayo noma kusilaleli esibheke ku-LAN.

Isinyathelo 3: qinisekisa umzila kusuka kumthombo ofanele

external ikhetha ikheli lomthombo ophumayo; ayifaki umzila we-WireGuard. Ukusesha kokufunda kuphela komthombo nendawo yesibonelo:

ip -4 route get 10.60.0.20 from 10.77.0.2

Gijimisa lokho endaweni yamagama yenethiwekhi yangempela ye-Dante, hhayi kunoma yiliphi igobolondo ovulekile ngalo. Umzila, ukukhethwa kozakwethu we-WireGuard, imvume yohlangothi olukude kanye nendlela yokubuya konke kufanele kuhambisane nalelo kheli lomthombo. Ukusesha okuphumelelayo kuyadingeka futhi akwanele, ngoba akusho lutho mayelana nokuthi ingxenye ekude iyasamukela isicelo.

Mela isilingo sokwengeza umzila ozenzakalelayo ukuze ukusesha kuphumelele. Imbobo ye-proxy ikhona kulesi siteshi sokusebenza kuphela; ukushintsha umzila ozenzakalelayo womsingathi ukuze uyidale kuhlanekezela umklamo wonke.

Isinyathelo 4: hlola ngobunikazi obuhlosiwe

Ngemva kokuba umnikazi eqinisekise ukucushwa okufakiwe futhi eqale i-instance ngomphathi wake wesevisi, isicelo esiyisibonelo yilesi:

curl --proxy socks5h://127.0.0.1:1080 --noproxy '' https://app.corp.example/

Nge- socks5h, i-Dante yenza ukuxazululwa kwendawo, kodwa i-Dante igijima kulesi siteshi sokusebenza, ngakho isilungiselelo asithumeli i-DNS ngokwaso ekupheleni okude kwethumbu. Isixazululi esigunyaziwe esisetshenziswa yi-Dante kufanele sibuyisele ikheli elivunyelwe lalelo gama. Uhlu olungenalutho lwe-no-proxy luvimbela ukukhishwa okuzuzwe njengefa ukudlula i-SOCKS ngokuthula.

Gcina ukuqinisekiswa kwegama lomsingathi nesitifiketi se-HTTPS ekuhloleni, bese uhlola isilaleli sangempela futhi uqinisekise izingxenye zombili zenkontileka: isicelo esivunyelwe siyaphumelela futhi indawo ekhishiwe iyehluleka. Qinisekisa futhi ukuthi imiyalo yokudlulisa engasekelwe ihlala inqatshiwe, ngoba le ngxenye ivumela umyalo we-SOCKS CONNECT phezu kwe-TCP hhayi noma yini efana nethumbu elijwayelekile le-UDP noma ledivayisi yonke.

Isinyathelo 5: ncika ukuthi kwenzekani lapho ithumbu liwa

Hlola ukulahleka kwethumbu nokuqalwa kabusha kwe-instance ngaphambi kokukubiza lokhu njengokukhiqiza. Umbheki oqala i-Dante ngemva kwe-WireGuard akadali ukuhlelwa kwe-fail-closed, futhi akadali i-DNS ye-fail-closed; kokubili kufanele kuphoqelelwe ngomnikazi wenethiwekhi. Buka okwenziwa uhlelo lapho ithumbu liphansi: iphutha elicacile liwumphumela omuhle, ukuwa buthule esixazululini somphakathi akusona.

Xhumanisa izibuyekezo uma ikheli lethumbu eliboshiwe lishintsha, ngoba external linanyathiselwe kulo. Lapho isakhiwo singasadingeki, khipha le instance kanye nesilungiselelo se-proxy sohlelo ndawonye, futhi ushiye umzila we-WireGuard kumnikazi wawo.

Izihloko ezihlobene