Isiphathi sifinyelela kumlingani we-IPsec, ikhonteyina ye-Docker ayifinyeleli

Uthumela i-ping kusiphathi esikude kusuka kumshini we-Linux futhi siyaphendula, ngakho umhubhe uyasebenza. Ikhonteyina eseceleni kwakho isagcina isikhathi siphelile, futhi isinyathelo esilandelayo esingokwemvelo ukuqala kabusha i-Docker. Ikhonteyina kunethiwekhi yebhuloho ivamise ukuqala ngekheli lomthombo elihlukile futhi ingena kusiphathi ngokudlulisela hhayi ngendlela yokuphuma yohlelo lwesiphathi uqobo, ngakho ukuhlolwa okuphumelelayo kukale iphakethe elihlukile. Emhubheni we-strongSwan osuselwe kumgomo, indlela evamile eya kusubneti ekude ayanele lapho iphakethe elidlulisiwe lingahambisani nomgomo we-IPsec ofakiwe.

Umhlahlandlela ongezansi ulandela indawo eyodwa ngemithombo emibili, ufunda isimo ngaphambi kokushintsha noma yini.

Qala ngendawo eyodwa nemithombo emibili

Qala ngokukhetha insiza eyaziwayo nge-IP, ukuze ungaxazululi i-DNS ngesikhathi esisodwa. Bhala amaqiniso amathathu: isiqalo sebhuloho sekhonteyina, ikheli lomthombo lesicelo sesiphathi esiphumelelayo, kanye nezikhethi zethrafikhi zasekhaya nezikude ezivunyelwene ngazo kumhubhe. Lezo zinombolo ezintathu zichaza cishe zonke izimo zalesi sibonakaliso.

Bese uphinda isicelo esihlulekile ngaphakathi kwekhonteyina futhi ubambe umthombo ewusebenzisayo ngempela. Uma lelo kheli lingamboziwe isikhethi sasekhaya, usuwazi umphumela, futhi akukho ukwakhiwa kabusha kwekhonteyina okuzokushintsha.

Funda imigomo ngaphambi kokuthinta i-Docker

Ukuhlolwa kwesiphathi kokufunda kuphela kuhlanganisa izinqumo zomzila, isizindalwazi semigomo kanye nemithetho ekhetha phakathi kwazo:

ip rule show
ip route show table all
ip xfrm policy

Uhlu lwemigomo lubonisa izikhethi nesiqondiso ngaphandle kwesidingo sedokhumenti yesimo se-IPsec egcwele izinto zokhiye, ngakho kuphephile ukuyinamathisela ethikithini. Funa isikhethi sasekhaya esimboza ikheli lesiphathi kodwa hhayi isiqalo sebhuloho. Hlola nokugqagqana: umzila wekhonteyina othatha indawo ekude njengeyasekhaya awusoze wakhiqiza iphakethe elidlulisiwe elilindelekile, futhi umhubhe usolwa. Gcina lolo hlu eceleni kwekheli lomthombo wekhonteyina, ngoba kokubili kuhlangene kuyisiqhathaniso sonke.

Uma isiqalo sekhonteyina singekho, yima futhi unqume isakhiwo ngaphambi kokuhlela enye into. Umhlahlandlela osele uthatha ukuthi senivumelene ngokuthi yiliphi ikheli lomthombo okufanele livele kunethiwekhi.

Hlola ukuhlunga nokuhumusha ngokulandelana

Ucingo lomlilo lwebhuloho le-Linux le-Docker lungavimbela ukudlulisela ngaphandle kwe-IPsec. Nge-backend ye-iptables, hlola umzila we-FORWARD nezinqumo ze-DOCKER-USER, ukhumbula ukuthi umthetho owengezwe ngemuva kwesinqumo sangaphambilini kungenzeka ungaze usebenze. I-backend ye-nftables ihlangana ngendlela ehlukile, ngakho ungakhi uchungechunge lwe-DOCKER-USER ngenxa nje yokuthi isibonelo se-iptables siliqambe kanjalo; hlola ukuthi iyiphi i-backend esetshenziswa ngempela idaemon yakho.

Bese uhlola ukuhumusha komthombo. Umthetho obanzi we-MASQUERADE ungashintsha iphakethe elalihambisana nesikhethi se-IPsec laba elingasahambisani, futhi ukwehluleka kubonakala njengenkinga yomzila impela. umhlahlandlela wokudlulisela we-strongSwan ubhala ukukhululwa kwe-NAT okudingekayo ngaphambi kokuhumusha okunjalo kuthrafikhi esivele ihambisana nomgomo.

Lokho kukhululwa akusiyo indlela yokwengeza umthombo wekhonteyina ongamboziwe emhubheni. Kuvikela kuphela ithrafikhi esivele ihambisana nomklamo, ngakho qala ngokuxazulula imibuzo yesikhethi nomzila wokubuya, bese wenza i-NAT nokuhlunga kuhambisane nempendulo. Uma uqala ukwandisa ukukhululwa esikhundleni salokho, into okufanele ishintshwe isikhethi, hhayi umthetho we-NAT.

Bese unquma okomzila noma okuhumushiwe

Isubneti yekhonteyina enomzila idinga ukuthi zombili izinhlangothi zamukele leyo subneti futhi kube nomzila wokubuya okude oya kuyo, okumvamisa kusho ukushintsha kwesikhethi kuzo zombili iziphetho kanye nengxoxo nomnikazi wohlangothi olude. Umklamo ohunyushwe ngamabomu kufanele esikhundleni salokho uveze ikheli elisibekelwe umgomo esigabeni sokusesha esifanele, okumvamisa kusho umthetho omncane obhaliwe esikhundleni se-MASQUERADE evamile.

Awekho kulawo malungiselelo amabili aphuma ngokuzenzakalela emhubheni osebenzayo wesiphathi, futhi ukukhetha phakathi kwawo yisinqumo somklamo esinomnikazi. Bhala ukuthi ukhethe yikuphi, ngaphandle kwalokho unjiniyela olandelayo uzokhipha futhi kusuka kubaluli bomlilo.

Bheka nokwehluleka okuxubile: uhhafu wemithetho uhumushiwe kanti uhhafu awuhumushiwe, okukhiqiza impumelelo ephumayo encike embobeni wendawo hhayi kunoma yini enethiwekhi.

Qinisekisa ngoxhumano olusha, hhayi ngokuqala kabusha

Sebenzisa uxhumano lolusha lohlelo ngenkathi ubheka izibaluli ezimncane zomlilo nesamukeli esikude, ukuze konke ukubonwa kube nomthombo. Ukuqala kabusha i-Docker kungashintsha isimo semithetho futhi kuzophazamisa imithwalo yomsebenzi, okukwehlisa isignali ehlanzekile obuzama ukuyithola.

Umphumela ohlala njalo yizitatimende ezine ongazikhombisa: umthombo wekhonteyina, umzila ovikelwe ohambisanayo, ukudlulisela okuvunyelwe, nempendulo ebuya. Lapho zozine zikhona, ikhonteyina ifinyelela kumlingani ngesizathu esifanayo nesiphathi.