I-DNAT kukhontheynara ye-VPN: ukudlulisa, hhayi i-INPUT

Ngemva kwe-DNAT, isicelo esiya kukheli lomhubhe siba ugudlu oludlulisiwe. Nciphisa umthetho wokudlulisa, funda uchungechunge lwe-Docker futhi ukhethe indlela yokubuya ngamabomu.

Isicelo sifika sibhekiswe kukheli le-IP yomhubhe bese sipuma kulelo khonteyina sibhekiswe kusevisi engumakhelwane. Phakathi kwalezi zikhathi ezimbili i-DNAT yabhala kabusha indawo okuyiwa kuyo, futhi iphakethe layeka ukuba ukufakwa kwekhonteyina ye-VPN. Manje usewugudlu oludlulisiwe, olwahlulelwa ngomthetho ohlukile. Lolo shintsho luchaza ukuthi kungani umthetho we-firewall obonakala ulungile kukheli lomhubhe ungenamphumela kuxhumano oluhunyushiwe.

Landela iphakethe ngemva kokuhumusha

Thatha iqoqo lamaklayenti 10.90.0.0/24 nekheli lomhubhe 10.90.0.1. Amakhonteyina amabili asebhulohweni elilodwa: i-192.0.2.2 isebenza i-VPN kanti i-192.0.2.3 isebenza uhlelo lokusebenza. Iklayenti lixhuma ku-10.90.0.1:8080, futhi umthetho we-DNAT endaweni yamagama yekhontheyna ye-VPN uyibhala kabusha kukheli langempela nembobo yohlelo lokusebenza. Bese umzila uthumela iphakethe phezu kwebhuloho. Lawo makheli ayizibonelo, akuyona iresiphi yokusetshenziswa.

Imbobo uhlelo lokusebenza olalela kuyo ngempela ingahluka kunoma iyiphi imbobo eshicilelwe kumsingathi. Funda umlaleli ngaphakathi kwekhonteyina esikhundleni sokucabanga ukuthi izinombolo zombili ziyafana.

Imvume ingeyendlela yokudlulisa

Ikhonteyina ye-VPN idinga ukudlulisa kwe-IP nesinqumo sokudlulisa esilinganiselwe eqoqweni lamaklayenti, ekhelini lohlelo lokusebenza nasembotsheni ehlosiwe. Izimpendulo ezisunguliwe zidinga imvume yazo. Umthetho ohambisana nekheli lomhubhe wangempela ngeke uhambisane ngemva kwe-DNAT, ngoba indawo okuyiwa kuyo isishintshile. Imvume ye-INPUT iyihawu elingalungile kugudlu olungasabhekiswe kulo msingathi.

Gcina ububanzi buncane: ibanga elilodwa lomthombo, indawo eyodwa okuyiwa kuyo, isevisi eyodwa. Umthetho wokudlulisa ovulekile ulula ukuwubhala futhi unzima kakhulu ukuwuvikela kamuva.

docker exec vpn-container ip route get 192.0.2.3
docker exec vpn-container iptables -t nat -S
docker exec vpn-container iptables -S FORWARD

Uchungechunge lwe-Docker akulona uchungechunge lwekhonteyina yakho

Imithetho engaphakathi kwendawo yamagama yekhontheyna ayiyona imithetho yomsingathi we-Docker. Lapho ugudlu lunqamula lusuka kusixhumi somhubhe luya ebhulohweni, i-firewall yebhuloho kumsingathi ingathatha esinye isinqumo. Nge-backend ye-iptables ye-Docker, uchungechunge lokudlulisa olubhaliwe kanye namaphoyinti okufanisa ngemva kwe-DNAT yiwo lapho leso sinqumo sibonakala khona.

Isiqondiso se-firewall se-Docker sichaza lezo chungechunge nokufanisa ngemva kwe-DNAT. Ungalungisi ukwamukelwa okungekho ngokucisha ukuphathwa kwe-firewall ye-Docker noma ngokwenza uchungechunge ngalunye luvuleke, ngoba lokho kususa umngcele ozama ukuwusebenzisa.

Yenza indlela yokubuya ibe ukukhetha ngamabomu

Uma ikheli lomthombo ligcinwa, uhlelo lokusebenza lubona i-10.90.0.x futhi kufanele luqondise izimpendulo zibuyele ngakhonteyina ye-VPN. Uma kungenjalo i-gateway yayo ejwayelekile ye-Docker izozithumela kumsingathi, ongenawo umhubhe. Enye indlela ukuhunyushwa komthombo okuncane ekhontheyneni ye-VPN, okwenza impendulo ibe lula kodwa kufihle iklayenti kuhlelo lokusebenza. Khetha ngamabomu futhi ubhale ukuthi ukhethe okukuphi.

Hlola uxhumano olusha oluvunyelwe kusuka kuklayenti elijwayelekile, bese uqinisekisa ukuthi izimbobo ezingahlobene zihlala zivaliwe. Lapho iphakethe lanyamalala, hlola indawo yamagama ye-VPN, indawo yamagama yohlelo lokusebenza kanye nelogi yohlelo lokusebenza uqobo. I-ping eya ku-gateway yebhuloho akuyona isivivinyo sokwamukela sesevisi.

Gcina imithetho kusimo sokuqala esisekelwayo sekhontheyna, ngoba izinguquko zokuxhumana ziyanyamalala lapho yakhiwa kabusha. Ukushicilela imbobo yomsingathi kungenye indlela yokuchayeka futhi akudingekile nje ngoba isevisi ifinyeleleka ngomhubhe.

Izihloko ezihlobene