Ithrafikhi ye-Docker ne-VM ngemuva kwe-OpenVPN: umzila noma ukuphinda inombolo?

Ama-container nezivakashi kusibungu esisebenza ngomxhasi we-OpenVPN zilahlekelwa indlela yokubuya noma zishayisane nephambili lomhubhe. Imibuzo emithathu ikhetha isixazululo.

Isibungu siyaphequlula ngomhubhe kanti i-container eseceleni akafinyeleli lutho. Ukushicilela umnyango kusuka ku-container eqhuba umxhasi wayo we-VPN kubi nakakhulu: isicelo siyafika kanti impendulo ayiphumi neze. Kokubili izinqumo zomzila kusibungu, kanti i-Docker ingumthunywa nje.

Imibuzo emithathu inquma ukuthi yikuphi kulezi zimbili obhekene nakho, futhi kuthatha cishe umzuzu.

Izingxaki ezimbili ezibonakala zifana

Okokuqala inkinga yendlela yokubuya. Umnyango oshicilelwe uhumusha kwi-container, isicelo siyafika, kanti impendulo ihanjiswa ngomzila ozenzakalelayo wesibungu, lowo OpenVPN umxhasi uwuqondise ku-tun0. Impendulo iphuma ekhelini isihlobo esikude esingakulindele, bese ilahliwe. Okwesibili ukungqubuzana kwephambili: ibhuloho elizenzakalelayo le-Docker linayo i-172.17.0.0/16, kanti umhubhe wenkampani usunduza ibanga elifanayo.

Enye ilungiswa ngethebula lomzila, enye ngokuphinda inombolo yebhuloho. Ukuhlela ngaphambi kokwazi ukuthi yikuphi kuyisu lokwephula i-container esebenzayo.

Nquma ngemibuzo emithathu

Umbuzo wokuqala: ingabe ingxaki iyanyamalala uma umisa i-VPN? Uma konke kusebenza ngomhubhe uvaliwe, sosola indlela yokubuya. Umbuzo wesibili: ingabe ip route show table all kubalisa iphambili elifanayo kabili, kanye ebhulohweni futhi kanye ku-tun0? Yikho ukungqubuzana. Umbuzo wesithathu: ikheli elithintekile liyi-container, isivakashi se-NAT noma isivakashi esibhulohiwe?

Umbuzo wesithathu ubalulekile ngoba ngayinye inesixazululo esifanele esihlukile, futhi ukusebenzisa isixazululo se-container kwisivakashi se-libvirt kuchitha ubusuku.

ip route
ip route show table all | grep -E '172\.1[7-9]|10\.8'
docker network inspect bridge --format '{{.IPAM.Config}}'

Indlela yokubuya: ithebula lekheli elilodwa lomthombo

Uma ithrafikhi ye-container kufanele iphume ngesixhumi esibonakalayo ngenkathi isibungu ngokwaso sisebenzisa umhubhe, umzila osuselwa kumthombo ushintsho oluncane kakhulu. Engeza umthetho ohambisana nekheli le-container bese uwuthumela kwithebula elikhethekile. Akukho okunye okunyakazayo esibungwini.

ip rule add from 172.22.0.3 lookup 10
ip route add default via 172.22.0.1 table 10

Iphakethe ngayinye umthombo wayo oyilelo kheli ibheka kuqala ithebula 10, futhi ithebula 10 liyithumela esangweni lebhuloho esikhundleni somhubhe.

Qinisekisa nge ip route get 1.1.1.1 from 172.22.0.3. Impendulo kufanele isho isixhumi sebhuloho, hhayi i-tun0. Imithetho engezwe ngale ndlela iyanyamalala ekubuyiseni, ngakho yibeke ku-unit noma ku-hook yenethiwekhi ephethe i-container.

Iphethini efanayo iyasebenza ku-container ye-WireGuard, lapho nendlela yempendulo idinga umthetho ocacile.

Ukungqubuzana kwephambili: phinda inombolo yebhuloho

Ithebula lomzila lithumela iphambili elilodwa endaweni eyodwa. Uma i-VPN isunduza i-172.17.0.0/16 ngenkathi ibhuloho le-Docker selikhona, kunqoba imethrikhi ephansi: i-Docker ifaka umzila wayo oxhunyiwe kumethrikhi 0, kanti umzila osunduziwe ufika ku-50. Ngaleso sikhathi umhubhe ubonakala uphukile ngenkathi i-Docker iqhubeka isebenza, noma okuphambene, kuye ngokulandelana kokufakwa. Phinda inombolo yebhuloho esikhundleni sokulwa nemethrikhi.

{
  "bip": "10.200.0.1/24",
  "default-address-pools": [{"base": "10.201.0.0/16", "size": 24}]
}

Qalisa kabusha i-Docker ngemuva koshintsho futhi wakhe kabusha amanethiwekhi akhiwe ngedamu elidala. Ukushintsha imethrikhi kudlulisela ukungqubuzana ekumeni okulandelayo kuphela.

Ama-VM adinga impendulo ehlukile futhi

Isivakashi se-libvirt kunethiwekhi ye-NAT ozenzakalelayo sizuzwa umzila wesibungu futhi siyeka ukufinyelela ngaphandle uma umhubhe wesibungu usuphethe umzila ozenzakalelayo. Ukuhambisa isivakashi kudivaysi yebhuloho noma ye-macvtap kusinika indlela yaso kunethiwekhi ebonakalayo. Ku-virt-manager engeza ihadiwe, khetha i-Network, setha umthombo kudivaysi yesibungu se-macvtap, gcina i-virtio njengemodeli, bese ucisha isixhumi se-NAT esidala.

Isivakashi se-macvtap ngokuvamile asikwazi ukufinyelela isibungu saso. Lokho kuwukuziphatha okulindelekile hhayi iphutha, futhi kungena encwadini oyishiyayo.

Kwisivakashi esidinga kuphela i-LAN yesibungu, umxhasi womhlinzeki angase abe neswishi elahlekile: nge-Mullvad, mullvad lan set allow kubuyisela ukufinyeleleka kwasendaweni ngaphandle kokuthinta i-libvirt. Futhi uma i-container kufanele ifinyeleleke kuphela ngomhubhe, bopha umnyango oshicilelwe ekhelini lomhubhe, -p 10.8.0.5:8080:8080, esikhundleni sokuwushicilela kuwo wonke amakheli.

Izihloko ezihlobene