Ingabe i-HTTP phezu kwe-ZeroTier ibethelwe? Hlola lapho i-overlay iphela khona

Landela lezi zihlolo ngokulandelana futhi ume kwesokuqala esihlulekayo, ngoba impendulo ngayinye ishintsha incazelo yesinyathelo esilandelayo. Umbuzo wangempela mncane: ingabe i-HTTP ejwayelekile kunethiwekhi ye-ZeroTier ihamba ngokucacile nge-inthanethi? Phakathi kwama-peer amabili e-ZeroTier ngokuvamile akwenzi, ngoba i-overlay ibethela lokho kugxuma. Kodwa leso isitatimende mayelana namaphoyinti amabili okugcina, hhayi mayelana nayo yonke ingxenye isicelo esiyidlulayo. I-router, i-bridge noma i-proxy ehlanekezayo isusa iphoyinti lokugcina, futhi ngaphesheya kwayo umbhalo ocacile uqala kabusha.

Isihlolo 1: thola ikheli isiphequluli esishayayo

Qhathanisa i-URL nalokho umshini onawo ngempela. ip -brief addr show ibala i-interface zt nekheli le-overlay elinikezwe isilawuli senethiwekhi; uma i-URL isebenzisa lelo kheli, isokhethi yesiphequluli ingena ku-overlay.

Uma igama lixazululeka ekhelini le-LAN esikhundleni salokho, i-overlay ingase ingahlanganyeli nhlobo, noma isikhombisi sesimo somthengi siphakamisa ini. ip route get 10.147.20.5 iphrinta i-interface nekheli lomthombo ikherneli engayikhetha, ngakho i-interface zt lapho isho ukuthi iphakethe lingena ku-overlay futhi igama le-NIC yakho ebonakalayo lisho ukuthi alingeni. Amagama angeza enye ingqimba: irekhodi elikhomba ekhelini le-overlay liziphatha ngendlela ehlukile kunelikhomba ekhelini le-LAN, futhi isijobelelo sokusesha noma okufakiwe kufayela le-hosts kungase kunqume ngokuthule ukuthi uthola liphi.

Isihlolo 2: qinisekisa ukuthi zombili iziphelo zingama-peer, hhayi i-relay evula ukubethela

I-ZeroTier ibethela phakathi kwama-peer, futhi lapho kungekho ndlela eqondile amaphakethe adluliswa nge-root ewadlulisela phambili esaboshiwe. zerotier-cli peers imaka indlela ye-peer ngayinye njenge-DIRECT noma i-RELAY ngesibalo sokulibaziseka. Indlela edlulisiwe ibiza ukuhamba nokubuya, hhayi ubumfihlo.

Okushintsha impendulo yilungu elingesona isiphelo sangempela. Uma uhlangothi olungaphesheya kuyilungu le-ZeroTier elihambisa noma elixhumanisa ngebhuloho ku-LAN ebonakalayo, i-overlay iphela kulelo lungu futhi ukugxuma okulandelayo i-Ethernet ejwayelekile.

Isihlolo 3: bheka lapho isicelo siba khona sifundeka

Kusibungazwa okholelwa ukuthi sihlinzeka ikhasi, bamba i-interface ye-overlay ngenkathi uphinda ulayishe: sudo tcpdump -i ztxxxxxxx -A -c 5 'tcp port 80'. Umugqa wesicelo ofundekayo kulokho okukhishiwe ufakazela ukuthi ithrafikhi yafika ivuliwe kuleso sibungazwa, futhi lowo umngcele oyofuna.

Bese ubamba ku-interface ebheke ingxenye esele ye-LAN. Uma isicelo esifanayo sivele lapho ngokucacile, sishiye i-overlay ngaphambi kokufika kuhlelo lokusebenza futhi idivayisi ngayinye kuleyo ngxenye ingasifunda. Uma kungabonakali lutho ohlangothini lwe-LAN futhi ikhasi lisalayisha, uhlelo lokusebenza luphela kusibungazwa se-ZeroTier uqobo.

Ukubamba i-loopback nakho kubalulekile uma i-proxy ehlanekezayo ingaphambili, ngoba i-proxy eyamukela i-HTTPS futhi idlulisele i-HTTP ihambisa umngcele ngemuva kwayo.

Isihlolo 4: bala ukugxuma ngakunye ngemuva kwe-router noma i-bridge

Ilungu elilungiselelwe ukuhambisa phakathi kwe-overlay ne-LAN liwumklamo ojwayelekile futhi yindawo lapho iningi lalezi zicabango liphuka khona. I-overlay ivikela ingxenye isuka kusiphequluli iye ku-router futhi akukho okunye ngemuva kwayo. I-bridge ixoxa indaba efanayo ngendlela ehlukile: i-overlay nengxenye ebonakalayo ziba yisizinda sokusalaza esisodwa, ngakho isicelo esivela kukhompyutha ephathekayo exhunywe ngebhuloho sidlula nge-Ethernet ejwayelekile ngisho noma leyo khompyutha isenethiwekhi ye-ZeroTier.

Landelela esikhundleni sokucabanga. traceroute isuka kumthengi iye ekhelini lesevisi kanye nethebula yokuhambisa kusilungu se-gateway kubonisa ukuthi ukugxuma kokugcina i-zt noma i-eth.

I-ZeroTier futhi inikeza imodi ye-trusted-path engase yehlise ukuphepha kokudluliswa emizileni yasendaweni eqokiwe ukuze kusebenze kahle. Inethiwekhi eyisebenzisayo ayitholi isicabango esijwayelekile somzila oboshiwe, ngakho funda ukulungiselelwa kwenethiwekhi ngaphambi kokucaphuna owodwa. Idokhumenti yephrothokholi ichaza kokubili ukubethela phakathi kwama-peer nalokho kukhetho.

Isihlolo 5: nquma ukuthi uhlelo lokusebenza kusamele lwenze ini

Ubulungu be-overlay buqinisekisa idivayisi kunethiwekhi futhi akusho lutho mayelana nokuthi isevisi ngaphesheya iyona obuhlose ukuyifinyelela. I-HTTPS iphendula omunye umbuzo ngokubopha igama lesibungazwa kukhiye, ngakho lezi zivikelo ezimbili ziyahlangana ngaphandle kokushintshana. I-peer egunyaziwe isengaba isevisi engalungile, futhi isiphelo esihlaselwe sifunda isicelo ngaphambi kokubethela nangemuva kokuvula ukubethela. Akukho ndlela ehlola ukuthi uhlelo lokusebenza luqopha ini.

Kukho konke okunesikhathi esisebenzisekayo futhi noma iphasiwedi, qeda i-TLS kuhlelo lokusebenza noma ku-proxy oyilawulayo futhi ushiye ukuqinisekiswa kwesitifiketi kuvuliwe. Lapho isevisi endala kufanele ihlale ku-HTTP ejwayelekile, bhala indlela eqondile yokusuka kusibungazwa kuye kusibungazwa evunyelwe ukuyisebenzisa, ukuthi ubani angayifinyelela nokuthi iyiphi ingxenye ehlala ingavikelwe; lowo mbhalo yiwona odingwa umhloli wakusasa.

"I-VPN ixhunyiwe" akusona isilinganiso salokhu. Inguqulo ethembekile ibala zombili iziphelo, indlela ephakathi kwazo nokugxuma kokuqala okungamboziwe.

Gcina okukhishiwe kokubamba kanye nohlu lwama-peer eduze kwedokhumenti yesevisi, ukuze noma ubani oshintsha umzila noma engeza ibhuloho abone ukuthi isiphi isicabango asizoshaya.