Kungani umthetho wakho we-iptables ungayiboni neze ithrafikhi ye-VPN edlula ebhulohweni
Amafreyimu adlula ebhulohweni angadlula uchungechunge lwe-IP olubhekile. Qhathanisa umndeni wendabuko we-bridge ne-br_netfilter endala ngaphambi kokwengeza omunye umthetho.
Amamashini amabili angokoqobo asendaweni eyodwa afinyelela ku-LAN ngokusebenzisa ibhuloho, futhi umthetho obekwe ochungechungeni lwe-ip forward ubonisa isibali esinganyakazi neze. Amafreyimu angempela, ithrafikhi iyadlula, futhi umthetho awukho endleleni yayo. Ukuqhathanisa izindlela ezimbili i-Linux eveza ngazo ithrafikhi yebhuloho kuchaza lokhu kuthula, futhi kuchaza nokuthi kungani ukulayisha imojuli eyodwa endala kuyimpendulo embi kunalokho okubonakala kuyikho.
Izindlela ezimbili phakathi kwesokhela esisodwa
Iphakethe lingaphuma kulesi sokhela ngezindlela ezimbili ezihluke kakhulu, futhi umehluko unquma ukuthi yimaphi amahuku azolibona. Uma indawo ekuyiwa kuyo ingaphesheya kwembobo yomzimba futhi ifreyimu ishintshwa phakathi kwemibobo emibili yebhuloho, isokhela sidlulisa ifreyimu ye-Ethernet; ikhodi yomzila ayibuzwa, futhi akukho kugxuma okuhlelwe ngomzila okwenzekayo. Uma indawo ekuyiwa kuyo iyisokhela uqobo, noma inethiwekhi efinyelelwa ngesixhumi se-tunnel, iphakethe lihlelwa ngomzila futhi amahuku kasinga le-IP ayasebenza ngempela. Khumbula le nhlangano, ngoba wonke umbuzo olandelayo mayelana namaketanga nemindeni uvela ekutheni ifreyimu ithatha yiphi kulezi zindlela ezimbili.
Lowo mehluko uyiyo yonke indaba engemuva komthetho ongabali lutho. Ifreyimu edlula ebhulohweni isuka ku-veth9a1 iye ku-enp3s0 inqamula ibhuloho, hhayi isitaki se-IP, ngakho uchungechunge lwe-ip forward aluboni lutho olungaluqhathanisa. Amagama ezixhumi esibonelo esidala awanqumi ukuthi uyiphi indlela onawo, futhi yingakho isinyathelo sokuqala siwukubheka i-topology hhayi isethi yemitherho.
I-tunnel yengeza icala lesithathu elifanele igama. Idivayisi ye-TUN inikeza amaphakethe e-IP kusokhela, ngakho ayahlelwa ngomzila futhi adlula ngempela emaketangeni e-IP, kuyilapho idivayisi ye-TAP exhunywe ebhulohweni inikeza amafreyimu futhi iziphatha njengecala lebhuloho. Uhlobo lwedivayisi lunquma, hhayi igama lomkhiqizo.
Qhathanisa imindeni emibili engabona ifreyimu edlula ebhulohweni
I-Linux isekela ukuhlunga kwebhuloho kwendabuko ngomndeni we-bridge we-nftables, futhi ayidingi imojuli endala ukuhlola nokulahla amafreyimu asendleleni. Imibhalo yebhuloho ye-kernel uqobo inikeza leso sincomo ngqo, okuyinto okufanele uyazi ngaphambi kokuba umphumela wokusesha ukutshele ukulayisha imojuli.
| Observation point | What it sees | What it costs |
|---|---|---|
nftables bridge family chains | Ethernet frames forwarded between bridge ports, in both directions | Rules must be written in bridge syntax with link-layer matches |
Legacy br_netfilter plus an ip chain | Bridged IPv4 and IPv6 packets, re-exposed through IP-layer hooks | Existing host rules may begin matching traffic they never saw before |
inet chain for routed traffic | Packets the host routes, including traffic arriving from a TUN device | No visibility into purely switched frames |
Ukusebenzisa umyalo we-nft esikhundleni se-iptables akubeki umthetho emndenini ofanele ngokwako. Uchungechunge olumenyezelwe emndenini we-bridge lubona amafreyimu; uchungechunge olumenyezelwe ku-ip, ip6 noma inet aluwaboni, kungakhathaliseki ukuthi iyiphi ibhinari eluwenzile. Umndeni uyisici sochungechunge, hhayi sethuluzi elawubhalayo.
Indlela endala isebenza ngendlela ehlukile, futhi yingakho kufanele uqhathanise esikhundleni sokukhetha uhlangothi ngomkhuba. Ukulayisha i-br_netfilter nokuvula izilungiselelo ze-bridge-nf-call kubuye kuveze ithrafikhi ye-IPv4 ne-IPv6 edlula ebhulohweni ngamahuku kasinga le-IP, ukuze umthetho ojwayelekile we-iptables ekugcineni ukwazi ukuwuhambisa. Amafreyimu awashintshi; isethi yamahuku adlula kuwo iyashintsha, okusho ukuthi wonke umthetho okhona wesokhela manje unababukeli abasha.
Funda indlela esebenzayo ngaphambi kokwengeza umthetho
Imiyalo emithathu inquma ukuthi ukuphi: ibhuloho lixhunywe kuyiphi into, ingabe imojuli endala iyasebenza, nokuthi yimaphi amaketanga avele akhona emndenini we-bridge. Yisebenzise ngaphambi kokubhala noma yini, ngoba impendulo inquma ukuthi yiluphi uhlobo lwemiklamo emibili olwandisayo. Ukweqa lesi sinyathelo yiyo indlela umthetho olungile ogcina ungene ngayo ochungechungeni okungadluli lutho kulo.
bridge link show
lsmod | grep br_netfilter
nft list ruleset | grep -A4 "chain forward"Umphumela wehlukanisa amacala ngokuhlanzekile. Imibobo ebhalwe ngaphansi kwebhuloho ikutshela ukuthi yiziphi izixhumi ezishintshwayo; umphumela ongenalutho we-lsmod usho ukuthi akukho ukubonakala kasinga le-IP kwamaafreyimu adlula ebhulohweni; uchungechunge lwe-forward lomndeni we-bridge olukhona selivele lusho ukuthi umnikazi wenqubomgomo usekhona futhi umthetho wakho ungowalapho hhayi wochungechunge olusha lwakho.
Bese wengeza umthetho owodwa okulula ukuwufunda futhi, onesibali futhi ungashintshi isinqumo, bese udlulisa ukugeleza okukodwa okumelela ebhulohweni. Isibali esinyakazayo sifakazela ukuthi ifreyimu yafinyelela kumthetho. Yilokho kuphela esikufakazelayo, ngakho landela nendlela enqatshiwe, ngoba inqubomgomo eyamukela yonke into nayo ikhiqiza isibali esinyakazayo.
nft add rule bridge filter forward iifname "veth9a1" oifname "enp3s0" counter acceptLapho imojuli endala ishintsha ukuziphatha
Ukuvula indlela endala ebhulohweni elisebenzayo akusiyo isenzo esingathathi hlangothi sokwengeza ukubonakala. Imithetho eyayifinyeleleki ngaphambili kuyo ithrafikhi yebhuloho iyafinyeleleka, kuhlanganise nemithetho yesokhela ebhalelwe esinye isixhumi, futhi inqubomgomo ye-drop ezenzakalelayo ochungechungeni lwe-ip forward ingase igcine isebenza kumafreyimu ayedlula ngaphandle kokuthintwa. Kusokhela olawulwa ngalelo bhuloho, umphumela uwukuvalelwa ngaphandle kwekhonsoli. Lokhu akusilo isimo sokwehluleka esicatshangelwayo; kuwumphumela ojwayelekile wokwandisa isethi yamahuku emshinini ofinyelela kuwo ngendlela osanda kuyandisa.
Ukulandelana okuphephile ukuquma ukuthi yimuphi umndeni ongumnikazi wenqubomgomo, bhala imithetho lapho, futhi gcina indlela yokululama ezimele ngaphambi kokushintsha noma iyiphi i-sysctl. Uma imindeni emibili iphethe imithetho, bhala phansi ukuthi yimuphi ogunyaziwe; izinqubomgomo ezimbili ezihlangana ziyindlela iphakethe elamukelwa ngayo endaweni eyodwa futhi lilahleke kwenye ngaphandle kwefayela elilodwa ongalifunda.
Ukwehlukanisa uqobo kusadinga umklamo ophelele. Ukuvumela umthombo owodwa ukuya endaweni eyodwa kufakazela kuphela ukuthi ukugeleza okukodwa kuyasebenza, kuyilapho imfuneko ngokuvamile iwukuthi i-VM ayikwazi ukufinyelela omakhelwane bayo noma isokhela. Izibali kumithetho yokwenqaba zibaluleke ngaphezu kwesibali kumthetho wokwamukela, ngoba isibali sokwamukela yisona obukade ulindele ukuthi sinyakaze.
Ekugcineni, gcina icala lokungeniswa kwesokhela lihlukile. Ithrafikhi eqondiswe ku-IP yebhuloho uqobo ifika ku-input, hhayi ku-forward, futhi umthetho ku-forward awusoze wayibona, kungakhathaliseki ukuthi ukhetha umndeni upi. Amacala amathathu, imindeni emibili, isifundo esisodwa: indlela inquma ihuku, futhi ihuku linquma ukuthi umthetho wakho ukhona ngempela noma cha.