Indlela yokuqondisa ithrafikhi yesibungu ngokusebenzisa isiqukathi se-Docker VPN

Isiqukathi se-VPN siyindawo yamagama wenethiwekhi, hhayi i-proxy. Khetha i-netns eyabiwe, isilaleli sangempela se-SOCKS noma isango eliqondisiwe, bese uqinisekisa indlela yokuphuma.

Isiqukathi sakho somhubhe siyasebenza, i-docker compose exec vpn curl -s https://ifconfig.me iphendula ngekheli lomhlinzeki, kodwa isiphequluli esikudeskithophu yakho sisaphuma nge-ISP yakho. Lelo gebe lilindelekile. Isiqukathi esisebenzisa iklayenti le-VPN siphethe indawo yamagama wenethiwekhi, imizila kanye nesixhumi esibonakalayo somhubhe, futhi akukho lutho olukhuluma i-HTTP noma i-SOCKS; ukushicilela iphothi kuso akukwazi ukudala isilaleli esingakaze sibe khona.

Lapho iklayenti lisebenza khona kunquma umklamo. Isiqukathi esingumakhelwane singangena endaweni yamagama yomhubhe, uhlelo lwedeskithophu alukwazi, futhi umzila udinga imizila hhayi inkambu ye-proxy. Uma wenza iphutha ekuhlelweni, uphawu luyafana: ukuxhumana kunqatshiwe, noma ithrafikhi ethatha ngokuthula indlela endala.

Vumelanisa isakhiwo nendawo lapho iklayenti lisebenza khona

Buza umbuzo owodwa ngaphambi kokuhlela i-Compose: ingabe iklayenti lingaqalwa ngaphakathi kwendawo yamagama yenethiwekhi yesiqukathi se-VPN? Noma yini esivele isebenza njengesiqukathi se-Linux iyakwazi. Isiphequluli, i-IDE noma i-CLI etafuleni lakho akukwazi, ngoba ukulungiselelwa kwayo kwe-proxy kulindele isevisi yephrothokholi, hhayi indawo yamagama.

ClientArrangementWhat must already exist
Another Compose serviceShares the vpn namespace via network_mode: service:vpnA working tunnel and correct start order
Host browser, IDE or CLIProxy listener inside the namespace, published to host loopbackA configured SOCKS or HTTP proxy and its access rules
Router, VM or phoneThe container as a layer-3 gatewayForwarding, NAT and a return route

Lezi zintathu azixubani. Inkambu ye-proxy ye-HTTP eqondiswe ekhelini lebhuloho lesiqukathi ayifinyeleli lutho ngaphandle uma i-proxy ilalela lapho, futhi isilaleli se-proxy asiqondisi ithrafikhi yomzila. Quma kuqala, bese ulandela isigaba esifanele.

Yabelana ngendawo yamagama yomhubhe nesiqukathi esingumakhelwane

Lena iyindlela eshibhile kakhulu ngoba akukho phrothokholi ye-proxy ehilelekile. Uhlelo lungena endaweni yamagama yesevisi ye-vpn futhi lizuze njengefa izixhumi zayo, imizila kanye nendawo yamaphothi:

services:
  vpn:
    image: your-vpn-client
    cap_add:
      - NET_ADMIN
    healthcheck:
      test: ["CMD-SHELL", "ip link show tun0 >/dev/null"]
      interval: 10s
      retries: 5
  app:
    image: your-app
    network_mode: service:vpn
    depends_on:
      vpn:
        condition: service_healthy

Imikhawulo emithathu ilandela ekutheni indawo yamagama ingeyesevisi enye. Uhlelo alutholi ukhiye walo networks, ngoba alunandawo yamagama yokunamathela kuyo. Ukushicilelwa kwamaphothi kungokwe-vpn, ngoba yilapho kuhlala khona indawo yamagama. Futhi ukwakhiwa kabusha kwe-vpn kubhubhisa indawo yamagama uhlelo olungene kuyo, ngakho i-docker compose up -d --force-recreate vpn ikushiya wena ukuba wakhe kabusha ne-app; ukuqala kabusha okulula akwanele ngaso sonke isikhathi. Incwadi yezinkomba yamasevisi e-Compose ihlanganisa lesi sakhiwo kanye nomkhawulo wakho wokushicilela amaphothi.

Ungacabangi ukuthi isixazululi siza nayo. I-/etc/resolv.conf iyifayela lesiqukathi ngasinye, hhayi ingxenye yendawo yamagama yenethiwekhi, ngakho uhlelo lusengabuza isixazululi sombingeleli ngenkathi amaphakethe alo ephuma ngomhubhe. Yifunde ngaphakathi kwesiqukathi futhi usethe i-dns: kuhlelo lapho amagama ayimfihlo kufanele axazululwe ngomhubhe.

docker compose exec app ip route
docker compose exec app cat /etc/resolv.conf
docker compose exec app curl -s https://ifconfig.me

Uma uhlu lwemizila luqukethe isixhumi somhubhe futhi ikheli lingelomhlinzeki, uhlelo lungaphakathi komhubhe. Uma isixhumi singekho, i-app yaqala ngaphambi kokuba i-vpn ibe nomhubhe, ngakho yakha kabusha i-app lapho i-vpn ibika impilo.

Beka isilaleli se-proxy sangempela endaweni yamagama sabaklayenti bombingeleli

Isiphequluli sedeskithophu asikwazi ukujoyina indawo yamagama, ngakho umhubhe kufanele uvezwe njengesevisi. Sebenzisa i-proxy yangempela ye-SOCKS noma ye-HTTP ngaphakathi kwendawo yamagama ye-vpn futhi ushicilele iphothi layo kuphela:

services:
  vpn:
    ports:
      - "127.0.0.1:1080:1080"
  proxy:
    image: your-proxy
    network_mode: service:vpn
    command: ["--socks", "0.0.0.0:1080"]

Ikheli ohlangothini lombingeleli liyingxenye ebalulekile yalokho kuhlelwa. I-127.0.0.1:1080 kwesokunxele igcina isilaleli ngaphandle kwe-LAN yakho; i-"1080:1080" enqunu ishicilela i-proxy evulekile kudivayisi ngayinye engafinyelela umshini wakho.

Uhlangothi lwesiqukathi lunogibe lwalo. Amaphothi ashicilelwe alethwa ekhelini lesiqukathi ebhulohweni, hhayi ku-loopback yaso, ngakho i-proxy eqalwe nge---socks 127.0.0.1:1080 ngaphakathi kwendawo yamagama yamukela ukuxhumana kwabangane futhi yenqaba konke okufika ngephothi elishicilelwe. Libophe e-0.0.0.0 futhi uthembele ekubopheni kwe-loopback ohlangothini lombingeleli ukuze uhlukanise. Umthetho ofanayo usebenza ekhelini lokulalela efayeleni lokulungiselela le-proxy.

Bese unquma ukuthi amagama axazululwa kuphi. Ku-curl, i---socks5 ixazulula igama lombingeleli endaweni, futhi i---socks5-hostname ithumela igama ku-proxy; iziphequluli zibonisa isishintshi esifanayo ngaphansi kwelebula ehlukile. Ukuxazululwa kwendawo kuveza umbuzo ngisho nalapho ikhasi lilayishwa ngomhubhe.

Thatha isiqukathi njengesango kuphela uma kunomzila wokubuya

Imizila, ama-VM kanye nomakhalekhikhini ngeke basebenzise inkambu ye-proxy ye-HTTP, futhi ezinye izinhlelo ziyiziba ngokuphelele iziguquli ze-proxy. Ukuqondisa ithrafikhi yazo kusho isendlalelo 3: isiqukathi sidlulisela amaphakethe futhi sihumusha amakheli esixhumini somhubhe.

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

Izinto ezimbili zilahleka kalula. Iklayenti lidinga umzila oqondisa isango laso elizenzakalelayo kuleli bingeleli, futhi izimpendulo kufanele zithole indlela yokubuya, kungaba ngomzila oqinile kumzila ongaphezulu noma nge-NAT esixhumini esibheke kumaklayenti. Ngaphandle kokukodwa kwalokhu, umhubhe ukhipha isicelo ngaphandle futhi impendulo iyanyamalala.

Futhi inendawo ebanzi kakhulu yomthelela. Isibungu esisebenza njengesango le-LAN yonke sithumela iklayenti ngalinye elilungiselelwe kabi ngokusebenzisa i-akhawunti yakho ye-VPN, futhi ukuwa komhubhe kungaba kwenza i-LAN ibe mnyama noma kubuyele ku-ISP kuye nge-kill switch.

Qinisekisa indlela yokuphuma, bese uhlehla ngokulandelana

Hlola ngokulandelana futhi ume ekwehlulekeni kokuqala: ikheli lokuphuma ngaphakathi kwendawo yamagama, ikheli lokuphuma lisuka kubingeleli ngokusebenzisa i-proxy, bese kuxazululwa amagama ombingeleli oyimfihlo.

docker compose exec vpn curl -s https://ifconfig.me
curl -s -x socks5h://127.0.0.1:1080 https://ifconfig.me
curl -s -x socks5h://127.0.0.1:1080 http://internal.example/health

Amakheli amabili okuqala kufanele avumelane nomhlinzeki, futhi elesithathu kufanele lixazululwe nge-proxy esikhundleni sokuwohluleka ngephutha legama. Umugqa wokuqala ovumelanayo nomugqa wesibili ohlulekayo kusho ukuthi isilaleli noma iphothi elishicilelwe alilungile, hhayi umhubhe.

Ukuhlehla kungokuphambene nokulungiselelwa. Susa iziguquli zemvelo ze-proxy kuphrofayela ye-shell nakuyiphi iyunithi ye-systemd, bese wehlisa isitaki ukuze indawo yamagama eyabiwe inyamalale nomnikazi wayo. Susa iphothi elishicilelwe ngaphambi kokususa isevisi ye-proxy, uma kungenjalo isibungu sizogcina isilaleli se-loopback okungekho osifundayo.

Ngaphambi kokuqhubeka, qinisekisa izinto ezine: iklayenti olikhathalelayo lifinyelela ngempela emhubheni, umnikazi wendawo yamagama kuphela oshicilela amaphothi, amagama ayimfihlo axazululwa lapho obuhlosile, futhi akukho lutho olulalela ekhelini lombingeleli elingeyona i-loopback. Ngakunye kwalokhu kwehluleka buthule ekukhiqizeni, futhi ngakunye uhlolo lomugqa owodwa ngenhla.

Izihloko ezihlobene