Indlela yokuqondisa kuphela ithrafikhi yamakontena e-Docker nge-OpenVPN

Iphakethe lekhonteyina alifiki tun0 , futhi amakhono engeziwe kukhonteyina awasoze akushintsha lokho. Phakathi kwesivakashi nethumbu kunezinto ezimbili zokufuna umzila: esisodwa ngaphakathi kwendawo yamagama yenethiwekhi yesivakashi, esisodwa kumphathi ngemva kokuba uhlaka lwehla ebhulohweni, futhi okwesibili kubuza ithebula elihlukile elinemithertho yokufanisa ehlukile. Isakhiwo sami esiyisibonelo ingumphathi we-Linux ogijima OpenVPN iklayenti eliphethe 10.8.0.10 ku- tun0 , ibhuloho le-Docker ku- 172.18.0.0/16 , kanye nekheli eliyimfihlo okungafinyelela kulo uhlangothi lwethumbu kuphela. Umgomo uhlala umncane: leyo sethi yekhonteyina yesivakashi iphuma ngethumbu ngenkathi umphathi egcina i-uplink yakhe ejwayelekile.

Ukugijimisa iklayenti le-VPN ngaphakathi kukhonteyina kuwumklamo ohlukile , hhayi indlela emfushane. Ngaleso sikhathi ikhonteyina liphethe ithumbu lalo kanye nobufakazi balo, futhi umsebenzi udlulela ku-Dockerfile esikhundleni sokuhlala ku-iptables.

Ukudlulisa kukhetha umzila ngendawo ekuyiwa kuyo, bese i-NAT ibhala kabusha umthombo

Lapho net.ipv4.ip_forward=1 isethiwe, iphakethe elidlulisiwe liqondiswa ngendawo ekuyiwa kuyo kuphela, kuthebula eliyinhloko. Umthombo awunandima kuleso sinqumo. Kuphela ngemva kokukhethwa komzila inqubo eyinhloko yekhompyutha isebenzisa POSTROUTING , futhi yilapho umthetho we-Docker ngokwawo ukhona: -s 172.18.0.0/16 ! -o br-appnet -j MASQUERADE . Konke okuphuma ebhulohweni kuya kwenye i-interface kuyahunyushwa, futhi ikheli eliba lona lincike ku-interface umzila owathumele kuyo.

Lowo mthetho uchaza izimpawu eziningi engibuzwa ngazo. Uma ithebula eliyinhloko lingenawo umzila wendawo eyimfihlo, iphakethe liphuma nge-uplink liphethe ikheli lomzimba lomphathi. Umhlinzeki wakho ulahla indawo ekuyiwa kuyo, noma isayithi elikude lilahla umthombo we-RFC 1918 elingazange likulindele, futhi ikhonteyina liphelelwa isikhathi ngenkathi ithumbu limile futhi linempilo. tun0 akubonisi lutho, futhi yilokho okuyisibonakaliso. Uma umzila ukhomba tun0 , i-MASQUERADE ibhala kabusha umthombo ku- 10.8.0.10 , futhi ikhonteyina elifanayo lisebenza ngaphandle kokuthi uthinte lutho.

Cela ukufuna okusho umthombo wesivakashi. Ngaphandle kwe- from ne- iif umphathi uphendula ngesokhethi yakhe futhi ubika umzila iphakethe elidlulisiwe elingasoze liwuthatha:

ip route get 192.168.11.222 from 172.18.0.5 iif br-appnet

Uma leyo mpendulo isho i-uplink, ithumbu alikho esithombeni futhi akukho sethi ngohlangothi lwethumbu ezosiza.

Hambisa isivakashi ekhelini lethumbu ngokwalo

Ushintsho oluncane olusebenzayo ukubhala kabusha umthombo ngokusobala lapho kuphuma. Faka esikhundleni sokwengeza: i-Docker isivele ihlezi ekhanda le- POSTROUTING , ngakho umthetho owengezwe nge- -A uhlolwa ngemuva kowakwa-Docker futhi awusoze wasebenza.

iptables -t nat -I POSTROUTING 1 -s 172.18.0.0/16 -o tun0 -j SNAT --to-source 10.8.0.10

Izimo ezimbili zinquma ukuthi lokhu kuzohlala yini. Ikheli kufanele kube yilelo iklayenti elinalo ngempela, ngakho libophe ngegama lek layenti ngalinye eliqukethe i- ifconfig-push 10.8.0.10 255.255.255.0 ; umthetho osho ikheli elingakaze labelwa udala ukudonsa buthule, hhayi iphutha. Futhi uhlangothi olukude kufanele lamukele lowo mthombo futhi luqondise izimpendulo emuva, yingakho uhlu lwemvume lapho lusho ikheli lethumbu hhayi isethi yesivakashi. Uma ikheli leklayenti liguquguquka, -j MASQUERADE ne- -o tun0 ilandela okuphethwe yi-interface, ngezindleko zenqubomgomo ekude ongenakho ukubhala inani eliqinile ngokumelene nayo.

Ukuhlunga ingxenye enye. I-Docker ibeka inqubomgomo ye- FORWARD ku-drop futhi ikhipha amaketanga ayo njalo lapho i-daemon iqala kabusha, ngakho beka inqubomgomo yendawo ku- DOCKER-USER , ehlala ikhona:

iptables -I DOCKER-USER -i br-appnet -o tun0 -j ACCEPT
iptables -I DOCKER-USER -i tun0 -o br-appnet -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Umthetho wokubuya ubalulekile: impendulo efika ku- tun0 yoxhumano oluvulwe yibhuloho ayamukelwa ngenxa nje yokuthi uhlangothi oluphumayo lwamukelwe.

Gcina umphathi uqondile ngomthetho womthombo

Lapho ibhuloho lonke kufanele lisebenzise ithumbu kodwa lutho olunye kumphathi akufanele, yeqa i-NAT futhi unikeze lowo mthombo ithebula lakhe. Amakheli esivakashi abe esebonakala kusukela ekuqaleni kuze kube sekupheleni.

echo "200 vpnbox" >> /etc/iproute2/rt_tables
ip rule add from 172.18.0.0/16 lookup vpnbox pref 1000
ip route add default dev tun0 table vpnbox

Imithetho ibuzwa ngaphambi kwethebula eliyinhloko, futhi from ifana nomthombo. Amaphakethe angaphandle ethumbu ngokwalo aphethe umthombo womzimba womphathi, ngakho awasoze afane ne- from 172.18.0.0/16 , futhi ithumbu alikwazi ukuziqondisa libuyele kulo ngokwalo. Lokho kuzikhipha ngokwakho kwenza isakhiwo sizinze.

Indlela yokubuya manje idinga usizo. Uhlangothi olukude lubona i- 172.18.0.x engahunyushiwe futhi alunasizathu sokwazi ukuthi ihlala kuphi. Kusiseva, ifayela leklayenti ngalinye lidinga i- iroute 172.18.0.0 255.255.0.0 ukuze ithebula langaphakathi lesiseva linikeze leso siqalo kuleli klayenti, kanye ne- route 172.18.0.0 255.255.0.0 epushiwe ukuze amanye amaklayenti azi ukuthi ikhona.

Izivivinyo ezimbili ngaphambi kokwethemba. Gijimisa ip route show default : nge- redirect-gateway def1 ithebula liphethe 0.0.0.0/1 ne- 128.0.0.0/1 nge- tun0 , futhi umphathi awuqondile nhlobo, ngoba lawo maphelezi asezingeni ayawina ngaphandle kokushintsha i- default . Imithetho eyengezwe nge- ip rule add nayo iyanyamalala ekubuyeleni, ngakho yithwale kuskripthi se-up.

Usayizi wephakethe ukwehluleka kwesibili ohlangana nakho

I-interface yebhuloho ku-1500 byte inikeza ithumbu okungaphezu kwalokho elingakuthwala lapho kwengezwa izihloko ze-UDP ne-IP zangaphandle. Ukushintshana okuncane kuyadlula, ngakho i-DNS iyaxazululeka futhi ukuxhawulana kwe-TLS kuqedwa, bese ukulayisha okukhulu kulenga ngaphandle kwanoma yiliphi iphutha. Umthumeli uqhubeka ephinda usayizi wesigaba ofanayo ngoba umyalezo we-ICMP mayelana nesidingo sokuhlukanisa, obuzomtshela ukuthi ehlise, awufiki nhlobo.

Kulungisa ku-interface, ku-MSS, noma kokubili. Ukucindezela akudingi ukubambisana kwesivakashi:

ip link set dev tun0 mtu 1400
iptables -t mangle -A FORWARD -o tun0 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

Ukucindezela kubhala kabusha i-TCP kuphela. I-UDP, kuhlanganise ne-QUIC, idinga esikhundleni salokho i-interface yesivakashi ephansi, nge- --opt com.docker.network.driver.mtu=1400 lapho kwakhiwa inethiwekhi noma ukhiye we-compose ofanayo.

I-DNS nezi zivivinyo okufanele ziphindwe

Ukuxazululwa kwamagama kulandela indlela efanayo. Isixazululi esifakwe ngaphakathi kwe-Docker ku- 127.0.0.11 sidlulisela kumaseva omphathi amisiwe, ngakho ikhonteyina lizuzwa ngokwalo lokho umphathi akusebenzisayo. Lapho indawo eyimfihlo iphendulwa kuphela isixazululi esifinyeleleka ngethumbu, qondisa isivakashi kulelo kheli, futhi uhlole nge- getent hosts ngaphakathi kukhonteyina hhayi kumphathi.

• Gijimisa isicelo esihlulekayo ngaphakathi kwesivakashi; ukuhlolwa ohlangothini lomphathi kusebenzisa ikheli lomthombo elihlukile futhi kufihla inkinga.
• Funda izibali emithethweni ye-NAT neyokuhlunga oyengezile. Umthetho ongenakho ukufana nakanye iphutha lokuhlela umzila, hhayi iphutha lenqubomgomo.
• Qinisekisa ukuthi ikheli lethumbu emthethweni wakho we-SNAT yilelo iklayenti elinalo ngempela.
• Yehlisa i-MTU yesivakashi noma cindezela i-MSS ngaphambi kokusola iseva ngokuma.

Landela lolo hlu futhi ume ekwehlulekeni kokuqala. Leso sigaba yisona okufanele silungiswe; noma yini engezwe ngezansi ifihla kuphela umngcele ophukayo.