Ukushicilelwa kwezimbobo ze-Docker nemithombo ye-VPN: ukufana okubili okukushiyayo

Umthetho uthi vumela ikheli leseva ye-VPN esebenzini eshicilelwe, kanti ukuxhumana kusaqhamuka. Lowo mphumela uvamile, futhi akulona iphutha le-Docker. Ukufana okubili okwehlukile kungalungile: umthombo oyibhalile kungenzeka ukuthi awuwona umthombo owamukelwa isiphathi, futhi imbobo oyibhalile kungenzeka ukuthi ayiyona imbobo ebonwa isihlungi. Ukulungisa kokubili kudinga ukubheka umzila wephakethe esikhundleni somdwebo wesevisi.

Inganekwane: vumela iseva ye-VPN futhi usuqedile

I-VPN enomzila ingagcina ikheli lethunjeli lekhasimende kuze kufike isiphathi se-Docker. Isango elenza ukuhumusha komthombo lingashintsha lelo kheli libe elalo. Zombili izakhiwo zisemthethweni, futhi zikhiqiza imithombo ehlukene esenzweni esisodwa somsebenzisi.

Ngakho-ke ibinzana le-IP yeseva ye-VPN lichaza umcabango, hhayi ukubuka. Kuze kube yilapho wazi ukuthi yisiphi salezi zakhiwo ezimbili esiphambi kwakho, umthetho uwukucabanga.

Umthombo: ichibi lamakhasimende noma isango elihunyushiwe

Hlola izinto ezine ngokulandelana. Okokuqala, ichibi lamakheli amakhasimende, isibonelo 10.90.0.0/24. Okwesibili, ingabe isango lihumusha lelo chibi ngaphambi kokuba lifike esiphathini. Okwesithathu, umthombo isiphathi esiwubona ngempela ekuxhumaneni okusha okukodwa. Okwesine, ingabe ukuqinisekiswa kohlelo lokusebenza kuhlukanisa abasebenzisi ngabanye, ngoba ikheli elihunyushiwe elabiwe angeke akwazi lokho.

Uma ichibi ligcinwa, umthetho ofana kuphela nekheli lomphakathi lesango uzogeja ikhasimende ngalinye. Uma isango lihumusha ngamabomu, ukuvumela ikheli elihunyushiwe kufaka wonke umsebenzisi ongemuva kwalo, okungase kwamukeleke kusevisi enokungena kwayo futhi kungamukeleki kwanoma yini enye.

Imbobo: i-DNAT ishintsha inombolo oyifanisayo

Ekushicilelweni okuvamile kwebhuloho le-Linux ne-iptables ye-Docker, ukumephwa kwesiphathi kusuka ku-8443 kuya embotsheni yekhontheyna 443 kuhunyushwa ngaphambi kokuba isihlungi sokudlulisela sisebenze. Iphakethe lifika esihlungini linembobo yendawo ekuyiwa kuyo 443. Umthetho ofana no-8443 ngaleso sikhathi awukaze uvuleke, nakuba u-8443 kuyilo elabhalwa yikhasimende.

Imbobo eshicilelwe isekhona ekulandeleleni kokuxhumana, yingakho indawo yokuqala ekuyiwa kuyo ingafaniswa lapho uma uyidinga ngempela.

Nquma ukuthi iyiphi inombolo ekhombisa inhloso. Fanisa imbobo yekhontheyna ngemva kwe-DNAT lapho umthetho uvikela isevisi engaphakathi kwekhontheyna. Fanisa indawo yokuqala ekuyiwa kuyo ngokukhetha i-conntrack lapho umthetho kufanele uchaze lokho okucelwe yikhasimende, futhi wamukele izindleko ezengeziwe zokufanisa nokunakekela ukulandelana kwemithetho okuhamba nakho.

Uchungechunge: i-DOCKER-USER, hhayi i-INPUT

Umhlahlandlela we-iptables we-Docker ubeka inqubomgomo yokudlulisela yomsebenzisi ochungechungeni lwe-DOCKER-USER, oluhlolwa ngaphambi kwemithetho yokudlulisela ye-Docker uqobo. Umthetho okopishwe kusevisi yesiphathi wafakwa ochungechungeni lwe-INPUT uhlunga ithrafikhi eqondiswe esiphathini, hhayi ithrafikhi edluliselwa ekhontheynini. Lelo phutha likhiqiza umthetho obonakala ulungile futhi ongenamthelela emzileni wekhontheyna.

Gcina ndawonye emthethweni owodwa ububanzi bomthombo, imbobo yendawo ekuyiwa kuyo esebenzayo, iphrothokholi nesixhumi esibonakalayo sokungena. Ukuvumela ngomthombo kuphela kuyo yonke indawo ekuyiwa kuyo edluliselwe kubanzi kunokuvumela isevisi eyodwa eshicilelwe.

Qinisekisa ngezixhumano ezintsha

Hlola izinhlangothi zombili ngezixhumano ezintsha: ikhasimende le-VPN elivunyelwe nomunye umthombo okufanele uhlale unqatshiwe. Isimo sokuxhumana esikhona singagcina isikhathi siphila ngemva kokuba inqubomgomo ishintshile, ngakho-ke ukuxhumana okudala akufakazi lutho mayelana nomthetho omusha. Bese uhlola umzila wempendulo, ngoba ikhontheyna kusamele ixhumane ibuyele emthonjeni ewubonayo.

Ukulandelana kochungechunge nokuziphatha kokuhumusha kwezimbobo ngemuva kwalezi zivivinyo kuchazwa umhlahlandlela we-iptables we-Docker. Yifunde ngaphambi kokukopisha iresiphi, futhi uqinisekise ukuthi iyiphi i-backend esetshenziswa yi-Docker efakiwe, ngoba i-backend ye-nftables ihlanganisa inqubomgomo ngendlela ehlukile.