Ukushicilelwa kwamachweba e-Docker ngokumelene ne-VPN: impendulo iya kuphi

Isitsha esishicilelwe siphendula sisuka ekhelini laso ngaphambi kwe-NAT ehlanekezelwe. Imiklamo emibili ingagcina leyo mpendulo isendleleni yomphakathi, ngezindleko ezihlukene.

Umethuli uyaqhubeka ephendula i-SSH ngemva kokuba i-VPN enomhubhe ogcwele isiphakamile, kuyilapho insizakalo eshicilelwe nge-Docker kulo lowo mshini ithula. Akukho okungalungile kumlaleli: isitsha siyasebenza, ukuhlelwa kwamachweba kukhona, futhi iphakethe liyafika. Isitsha sinempilo futhi isicelo siyayifinyelela ngempela. Umehluko ukuthi impendulo iqala kuphi lapho i-Linux ikhetha umzila wayo, futhi lowo mehluko unquma ukuthi iyiphi kulezi zakhiwo ezimbili ezingezansi oyidingayo.

Landela i-tuple ngokusebenzisa i-NAT yendawo ekuyiwa kuyo

Thatha umethuli oku-192.0.2.10 okushicilela i-TCP 2222 kuya esitsheni esiku-172.30.240.5:22. Isicelo esivela ku-198.51.100.25 siyasetshenziswa ngaphambi kokuba sifinyelele esitsheni, futhi isitsha siphendula njengaso uqobo.

WAN request:      198.51.100.25 -> 192.0.2.10:2222
after DNAT:       198.51.100.25 -> 172.30.240.5:22
container reply:  172.30.240.5:22 -> 198.51.100.25

Esinqumweni somzila womethuli impendulo isagcina ikheli lomthombo wesitsha. Ukuhumusha okuhlanekezelwe kubuyisela i-tuple eshicilelwe kamuva, yingakho iphakethe libonakala lingalungile ngaso leso sikhathi lapho umzila ukhethwa khona.

Kungani umthetho womethuli kuphela uwushiya

Umthetho okhetha ithebula le-WAN kuphela kumaphakethe avela ku-192.0.2.10 uhlanganisa ama-daemon omethuli uqobo futhi uwushiya ngokuphelele lo mpendulo odlulisiwe. Ikheli lomthombo empendulweni ngu-172.30.240.5, hhayi umethuli.

Ukulungisa ngokweqile ukuhambisa konke okuvela esitsheni nge-WAN, lokho futhi kukhulula i-VPN kuzixhumaniso zangaphandle ezingahlobene zesitsha. Leyo inqubomgomo ehlukile kunaleyo eyayiceliwe, futhi ngokuvamile iyamangaza umuntu kamuva.

Ukufanisa ngemva kwe-DNAT kungenye i-hook

Imibhalo ye-Docker mayelana nezivikelo zomlilo iphawula ukuthi ukuhlunga okujwayelekile komsebenzisi kubona indawo ekuyiwa kuyo ngemva kwe-DNAT, ngakho ukufanisa ichweba elishicilelwe 2222 emthethweni ojwayelekile akufani nokufanisa ichweba lesitsha 22. Uma i-tuple yasekuqaleni ibalulekile, sebenzisa indlela esekelwayo yendawo yasekuqaleni esikhundleni sokuqagela ukuthi iyiphi ichweba ebonakalayo.

Lokhu kudideka kwe-hook kukhiqiza imithetho ebukeka ilungile futhi engafani neze. Hlola izibali kumthetho uqobo ngaphambi kokubhala kabusha inqubomgomo. Umthetho ongenakho ukushaya utshela ukuthi uhlolwa endaweni iphakethe elingafiki kuyo.

Umklamo A: thwala isinqumo njengesimo soxhumano

Uphawu loxhumano lungathwala isinqumo sokungena ngokusebenzisa ukuhumusha, kodwa kufanele kubuyiselwe kuphakethe ngaphambi kokusesha komzila obalulekile. Izigaba yilezi:

  1. Gcina indawo yophawu nokubaluleka komthetho okungashayisani ne-Docker, i-VPN noma omunye umnikazi wenqubomgomo.
  2. Khomba kuphela uxhumano olusha lwe-WAN oluhlosiwe endaweni engaphambi kwe-DNAT lapho ukulandelela uxhumano kukhona khona.
  3. Rekhoda isinqumo kuphawu loxhumano, ngaphandle kokuphoqa isicelo sasekuqaleni ngokwaso kuthebula le-WAN.
  4. Ngakwindlela yempendulo, buyisela kuphela amabhithi akho ophawu kuphakethe ngaphambi kokuhambisa.
  5. Khetha ithebula le-WAN eliphelele ngokushesha okwanele ukuze umthetho we-VPN ungakwazi ukunqoba kuqala.

Lelo thebula lidinga imizila exhumekile yangempela nesango. Lidinga futhi ukuziphatha okuchaziwe lapho umzila ungekho. Ukuwela buthule engxenyeni yomhubhe kuwumphumela omubi kakhulu, ngoba ukulungiselelwa kubonakala kusasebenza. Esikhundleni salokho hluleka ngokuvaliwe futhi ukulobele.

Umklamo B: qeda kumethuli

Ingxenye engaphambili yohlangothi lomethuli elungiselelwe ngamabomu, njenge-proxy ye-TCP noma i-proxy ehlanekezelwe phambi kwesitsha, igcina impendulo isuka ekhelini lomethuli. Khona-ke imithetho ebhalelwe umethuli iziphatha ngendlela elindelekile, futhi isitsha sihlala kunethiwekhi yaso yangasese.

Izindleko ezinye ingxenye enyakazayo enokulungiselelwa kwayo, ukuphathwa kwekheli lomthombo nezilawuli zokufinyelela. Ngokuvamile iwumngcele osekelwayo olula, futhi ngokuvamile iyimpendulo efanele lapho inqubomgomo yokuhambisa ibizogcinwa umuntu oyedwa ongase ahambe.

Qinisekisa ushintsho, hhayi inhloso

Vula uxhumano olusha olugunyaziwe oluvela ohlangothini lomphakathi bese uqinisekisa ukuthi impendulo iphuma ngesixhumi esibonakalayo esihlosiwe. Bese uhlola ukuthi isicelo esingahlobene esiqalwe isitsha sisalandela i-VPN yini.

Ungasuli ithebula lokuxhumana lomshini ukuze uhlole umthetho owodwa: okufakiwe okukhona kugcina ukuhlelwa kwangaphambilini, futhi ukusula kuphula konke okunye kumethuli. Ukushicilela ichweba kuchaza ukufinyeleleka. Akuchazi indlela yempendulo. Bhala phansi umklamo okhethiwe namagama awo ethebula, ukuze umuntu olandelayo angadingi ukuwuthola futhi phakathi kwesigameko.

Izihloko ezihlobene