Uhlelo lwasendaweni, umthetho we-VPN: kungani ucingo lwakho lwe-FORWARD lungaqali neze
Inqubo kumshini isebenzisa i-OUTPUT, hhayi i-FORWARD. Khetha i-hook ku-namespace efanele, bese unquma ukuthi i-mark noma umzila ojwayelekile wanele yini.
Wengeza umthetho wethrafikhi ye-VPN ocingweni lwe-FORWARD, usebenzisa isicelo kusuka kumshini ofanayo we-Linux, futhi isibali sihlala kuqanda. Umthetho cishe ulungile. Iphakethe alikaze lihambe ngaleyondlela, ngoba isicelo esikhiqizwe kumshini uqobo asisidluliseli phambili. Ukulandela impilo yephakethe kusuka ku-socket kuya kuyintambo kuchaza ukuthi kungani, nokuthi umthetho kufanele ube kuphi esikhundleni salokho.
Thola ukuthi iphakethe lazalwa kuphi
Ukulandelana kwe-hook kwe-Netfilter kuhlukanisa izimo ezintathu, futhi kunye kuphela kuzo okuhilela i-FORWARD:
| Origin | Path | Hook that sees it |
|---|---|---|
| Local process | OUTPUT then POSTROUTING | OUTPUT, POSTROUTING |
| Addressed to a local service | PREROUTING then INPUT | PREROUTING, INPUT |
| Received for another host | PREROUTING, FORWARD, POSTROUTING | FORWARD |
Uhlelo lwasendaweni luqala emzileni we-OUTPUT, ngoba i-kernel isivele yathola ukuthi iphakethe livela lapha futhi alikaze libe yilungu elifanele lokudluliswa. Ukwakha i-tunnel akushintshi lokho kuhlukanisa; i-tunnel iyithuluzi iphakethe elingaphuma ngayo, akuyona isigaba esishintsha okukhishwayo kwasendaweni kube ukudlula.
Amaphakethe amabili, indaba eyodwa
Lapho i-tunnel isimi, iphakethe langaphakathi lohlelo kanye nephakethe langaphandle elibethelwe kuyizinto ezihlukene. Iphakethe langaphakathi lithwala indawo yokuyawokanye umthwalo okhethwe uhlelo. Iphakethe langaphandle lithwala umbhalo obethelwe kuya ekhelini nasekupotsheni kozakwethu, futhi yilona eliwela ngempela isixhumanisi somzimba.
Inqubomgomo yakho iphathelene nelilodwa lazo, futhi ukukhetha elingalungile kuyisizathu esivamile sokuba umthetho ubonakale ungenzi lutho. Umthetho ohambisana nekheli langaphandle lozakwethu ubona iphakethe ngalinye le-tunnel ngendlela efanayo, noma ngabe uhlelo lwangaphakathi lwenzani. Umthetho ohambisana nendawo yangaphakathi ubona ithrafikhi oyikhathazayo, futhi uzosebenza kuphela uma lelo phakethe lifinyelela i-hook owabeka kulo umthetho.
Ama-namespace asusa umngcele
I-container yenza lokhu kube nzima ngaphandle kokushintsha umgomo. Isicelo sohlelo siwukukhishwa kwasendaweni ngaphakathi kwe-namespace yenethiwekhi ye-container. Umsingathi uthola leyo thrafikhi kusixhumanisi se-Ethernet esingelona elangempela futhi angayidlulisela phambili, ngakho umthetho we-FORWARD kumsingathi ungaba nencazelo noma ngabe inqubo eyakha isicelo ayizange ithinte ucingo lwe-OUTPUT lomsingathi.
Ngaphambi kokukhetha i-hook, thola ukuthi isethi yemithertho kanye ne-tunnel kuhlala kuphi ngempela. I-tunnel ngaphakathi kwe-container, i-tunnel kumsingathi ne-container elandeliswa ngayo, kanye ne-tunnel ku-namespace ehlukile kuyizakhiwo ezintathu ezihlukene kanye nezindawo ezintathu zemithertho ezihlukene. Funda imithertho ngaphakathi kwe-namespace engumnikazi wethuluzi, hhayi kuphela kweyokuqala.
Buza ukuthi ngabe uyayidinga yini i-mark
Uma inhloso kuwukuthumela isandiso sendawo eyodwa nge-tunnel, umzila waleso sandiso kungenzeka wanele. Hlola kuqala imizila esebenzayo, kufaka nakho konke okwasunduzwa iseva: umzila wokuqala oqondisiwe uthumela ithrafikhi eningi kakhulu nge-VPN kunenqubomgomo emincane obuyicabanga, futhi asikho isilinganiso se-mark esizokwenza umphumela uhambisane nenhloso.
Ukuhlukanisa kuyadingeka lapho isinqumo sincike kokuthile umzila ongakwazi ukukuchaza, njengomthombo, umsebenzisi noma inqubo. Ethrafikhini eyamukelwayo, i-mark ku-PREROUTING iyasebenza. Ethrafikhini yasendaweni, i-mark kufanele yenzeke esigabeni sokukhishwa esingaqala ukusesha umzila omusha ngemuva kokubekwa kwe-mark. Ku-nftables lokho kuyikethi yohlobo lwe-route ku-hook yokukhishwa; ikethi evamile yokuhlunga okukhishwayo izobeka inani futhi ishiye umzila unjalo.
Ku-iptables, okulingana nakho kuhlala ekuhlelweni kwe-mangle OUTPUT, futhi kusebenza imfuneko efanayo: isinqumo sokuhambisa kufanele sibuyekezwe ngemuva kokuba i-mark ikhona. Bese umthetho wenqubomgomo kufanele usebenzise i-mark futhi ukhombe ithebula eliqukethe umzila osebenzisekayo. Ukubeka i-mark ye-conntrack kungumsebenzi wesithathu, ohlukile; igcina inani emfudlaneni futhi ayilifaki ngokwayo lelo nani kuphakethe lamanje ukuze ukuhambisa kukwazi ukulifunda.
Qinisekisa ukusesha nesibali ndawonye
nft list ruleset
ip route get 198.51.100.25
ip route get 198.51.100.25 mark 0x1Ikheli ne-mark kuyizibonelo, futhi imibuzo emibili yomzila iphendula imibuzo ehlukene. Eyesibili ibuza ukuthi i-kernel ibingenzani uma iphakethe belithwele leyo mark; ayibonisi ukuthi isethi yakho yemithertho inikeza enye. Kuyithathe njengokuhlolwa komqagabavu, hhayi njengobufakazi bokuthi inqubomgomo iyasebenza.
Bese usebenzisa isicelo esingenabungozi futhi ubheke izinto ezimbili ngasikhathi sinye: isibali ku-hook oyikhethile, kanye nomgudu wokuphuma iphakethe eliwuthathile ngempela. Uma isibali sikhula futhi iphakethe liphuma kwenye indawo, i-mark noma ithebula akulungile. Uma kokubili kungakhuli, iphakethe alifinyeleli kuleyo hook nhlobo, futhi umbuzo olandelayo yi-namespace noma umzila.
Ekugcineni, khawulela ukuhlolwa kulokho umshini ongakuchaza. Umzila owodwa wekheli elilodwa awuboni uba inqubomgomo ehlala njalo yesevisi amakheli ayo ashintshayo. Qala ngokunquma ububanzi bamaphakethe, bese uhlola ukuthi idizayini yomzila ne-mark ingakugcina yini lokho kububanzi ngemuva kokuxhumana kabusha.