I-NAT noma i-bridged kwinethiwekhi ye-VM: iyiphi ethwala ithrafikhi ye-VPN?
Izivakashi ze-NAT ziboleka ithaneli lomsingathi kuphela uma iklayenti lihamba ngomzila; izivakashi ze-bridged zizihambela ngomzila zazo. Hlola isivakashi, bese ukhetha imodi efanele.
I-bridged ne-NAT akuzona izindlela ezimbili zokuxhuma isivakashi esisodwa ku-VPN yakho; zinquma ukuthi ngubani umnikazi wamaphakethe esivakashi ngaphambi kokuba noma iyiphi ithaneli ingene. Kumodi ye-NAT, i-hypervisor ibhala kabusha ithrafikhi yesivakashi futhi iyikhipha kusuka kukhodi yohlangothi lomsingathi, ngakho isivakashi sihamba ngomzila othi umsingathi awunike leyo khodi. Kumodi ye-bridged, isivakashi sithola ubunikazi baso bezinga lokuxhumana esigabeni esibonakalayo futhi sikhetha isango laso elizenzakalelayo, okwenza ithaneli lomsingathi lingabi nandaba kuso, ngaphandle uma iwutha ye-LAN iyona eyenza ithaneli. Ngiyekile ukubheka i-VM njengento eseku-VPN ngaqala ukuyibheka njengombuzo wokuthi umzila wezinto ezenzakalelayo waleso sivakashi ukhomba kuphi. Ukuhlola okungezansi kuthatha imizuzu embalwa ngemodi ngayinye futhi kuyixazulula ngaphandle kokuqagela.
I-NAT igcina isivakashi ngemuva kwekhodi ye-hypervisor, lapho imizila yomsingathi isebenza khona
Ku-VirtualBox, isivakashi se-NAT sihlala ku-10.0.2.0/24 sinesango elibonakalayo ku-10.0.2.2, i-proxy ye-DNS ku-10.0.2.3, futhi asinawo umzila waso oya kunethiwekhi ebonakalayo. Amaphakethe aphumayo athathwa yinjini ye-NAT, abhalwa kabusha ukuze umthombo ube umsingathi, bese edluliswa ku-stack ye-IP yomsingathi. Kusukela lapho ithrafikhi yesivakashi iwukugeleza komsingathi, futhi ukuseshwa komzila kwenzeka ngendawo ekuyiwa kuyo: iklayenti elinethaneli eligcwele elifaka u-0.0.0.0/1 no-128.0.0.0/1 kumsingathi liyibamba ngaphandle kokwazi ukuthi ikhona i-VM. Isahluko se-Oracle senethiwekhi ye-VirtualBox sibala lawa maxabiso ezenzakalelayo uma ufuna ukuqinisekisa amakheli kukho build yakho.
Inethiwekhi yezenzakalelayo ye-libvirt ifika endaweni efanayo isuka ku-192.168.122.0/24, lapho i-dnsmasq inikeza khona izivumelwano zokuqasha futhi umsingathi ufihla i-subnet, ngakho amaphakethe esivakashi aphinda afike esinqumweni somzila womsingathi. Okuhlukile iklayenti elikhetha ithrafikhi ngenqubo hhayi ngomzila. Uma uhlu lwethaneli elihlukanisiwe luqukethe isiphequluli sakho kuphela, injini ye-NAT ayikho kulolo hlu, futhi isivakashi siphuma emshinini ngaphandle kwethaneli ngenkathi isiphequluli kumsingathi sisabonakala simboziwe. I-subnet efanayo, umphumela ohlukile.
I-bridged inika isivakashi indawo yaso ku-LAN ebonakalayo
Isivakashi se-bridged sinikezwa i-NIC ebonakalayo exhunywe ku-adaptha yangempela, sithola ikheli laso le-MAC, futhi sithatha isivumelwano se-DHCP kunethiwekhi ebonakalayo. Isango laso elizenzakalelayo iwutha ye-LAN, hhayi i-hypervisor, futhi amafreyimu aso aya ocingweni ngaleyo adaptha. Imizila yethaneli lomsingathi isetafuleni lomsingathi futhi ayikaze ibuzwe, ngoba amafreyimu esivakashi awangenisi ku-stack ye-IP yomsingathi.
Lokho kusika ngazo zombili izinhlangothi. Ukuphequlula kwe-mDNS ne-SMB kuqala ukusebenza ngoba isivakashi sibona ithrafikhi yokusakaza ye-LAN, futhi isivakashi siyafinyeleleka kusuka kweminye imishini esigabeni esifanayo ngaphandle kwe-firewall yomsingathi phakathi. I-bridging futhi akuyona indlela yokucindezela isivakashi ngetaneli elikhona: ukuxhuma i-VM ku-interface ye-WireGuard noma ye-OpenVPN yomsingathi akuyona into eyenziwa yi-VirtualBox noma i-libvirt kuwe. Uma isivakashi se-bridged kufanele sibe nethaneli, ithaneli kufanele liphele endaweni ethile kuleyo LAN.
Ukuhlola okuqeda impikiswano
Gijimisa ukuhlola okufanayo kuzo zombili izimodi bese ubhala phansi izimpendulo:
- Kumsingathi,
curl -s https://ifconfig.mekunikeza ikheli lomphakathi le-v4. - Esivakashini, umyalo ofanayo, kanye ne-
ip routeku-Linux nomaGet-NetRoute -DestinationPrefix 0.0.0.0/0ku-Windows yesango elizenzakalelayo. - Ubunikazi besixazululi:
resolvectl statusnomacat /etc/resolv.confesivakashini, ukubona ukuthi ikhomba ku-10.0.2.3 noma kuseva ye-LAN. - Umndeni wamakheli:
ip -6 addr show scope globalkanye nesicelo esisodwa se-v6, ngoba ithaneli le-v4 alisho lutho ngekheli le-v6 lomhlaba wonke okungenzeka ukuthi isivakashi sinayo.
Amakheli omphakathi afanayo asho ukuthi isivakashi sisendleleni yomsingathi. Ikheli lesivakashi elihambisana nokuphuma okuvamile kwe-LAN lisho ukuthi akekho. Isinyathelo abantu abasidlulayo ukulawula: yehlisa ithaneli lomsingathi bese uphinda isicelo sesivakashi. Uma isivakashi siqhubeka nokuphequlula, asikaze sincike ethanelini lomsingathi, noma ngabe igama lemode lithini. Kumodi ye-NAT, isivakashi kufanele silahlekelwe i-inthanethi uma ithaneli lomsingathi lehliwe, ngaphandle uma iklayenti licushashwe ukuthi livumele ithrafikhi engaphandle kwethaneli, okuyinto efanele kwaziwe ngokwayo.
Izimpawu ezimbili ziyaqamba amanga. I-ping ephumelelayo ifakazela ukufinyeleleka, hhayi indlela yokuphuma. Futhi i-DNS ingaphendulwa i-proxy ye-10.0.2.3 ngesixazululi somsingathi ngenkathi i-TCP ithatha umzila ohlukile, futhi yileyo indlela okuthola ngayo ikhasi elilayishayo nokungena okungapheli nhlobo.
Iyiphi imodi elingana nomsebenzi
Imode yisinqumo somzila, ngakho ikhetha ngokwesidingo hhayi ngomkhuba:
| Requirement | Mode that fits |
|---|---|
| Every guest flow must exit through the host tunnel | NAT, with a host client that tunnels by route, verified from inside the guest |
| The guest needs its own VPN account or profile | Bridged, or NAT with a client running inside the guest, not both |
| The guest must serve SSH, SMB, or a dev server to the LAN | Bridged; NAT needs a port forward, which does not change the outbound path |
| The guest must stay invisible to the LAN | NAT; a bridged guest is another host on the segment |
| The guest needs a real public IPv6 address | Bridged; VirtualBox NAT mode has no IPv6 forwarding |
| Isolation from the LAN with access to the host | Host-only adapter, not NAT |
Umugqa wokuqala yindawo lapho abantu babanjwa khona: i-NAT kanye neklayenti lethaneli eligcwele kumsingathi kuyasimbosa isivakashi ngempela, kodwa kuphela uma iklayenti lihamba ngomzila futhi isixhumi esibonakalayo esiphezulu somsingathi siyilo thaneli. Hambisa iklayenti ohlwini lwezimvume lwesiphequluli kuphela, ukumboza kuyanyamalala ngaphandle kwanoma yiphi iphutha noma kuphi. Umugqa wesine iphutha eliphambene, isivakashi esenziwe i-bridged ukuze kube lula esiqala ngasese ukuphendula i-SMB noma i-SSH ku-LAN yasehhovisi.
Ukwehluleka okubekwa e-VPN
Ku-Windows, ukuhumusha kwe-NAT kugijima ngaphakathi kwenqubo ye-VM ye-VirtualBox, ngakho iklayenti elisebenza ngohlelo ngalunye lidinga leso sithombe ngqo ohlwini, hhayi umthetho ojwayelekile wemishini ebonakalayo. Uma ukubuyekezwa kweklayenti kwakha kabusha uhlu lwezinqubo ezivunyelwe, izivakashi ze-NAT zilahlekelwa ukumboza kuqala, futhi umbiko ufana ne-VM efinyelela i-LAN kodwa hhayi i-inthanethi ngenkathi umsingathi ephilile.
I-bridging ku-Wi-Fi ingesinye isigameko esijwayelekile. Amaphoyinti okufinyelela awavamile ukudlulisa amafreyimu ane-MAC yomthombo yangaphandle, ngakho ibhuloho eliku-wlan0 lihluleka ngokushesha noma lisebenza kuze kube ukuqhubeka kokwahlukanisa iklayenti ku-AP kuqala ukulilahla. I-VirtualBox isazokwethula i-adaptha engenantambo ohlwini lwayo. Uma umsingathi eku-Wi-Fi futhi isivakashi kufanele sibe i-bridged, hlela ukuhlola esikhundleni sokucabanga.
I-MTU ingeyesithathu. Isivakashi se-bridged sigcina i-MTU ye-LAN yamabhayithi angu-1500, futhi uma sigijimisa iklayenti laso le-WireGuard ku-1420, ukuxhawulana okukhulu kwe-TLS kuyama ngenkathi izicelo ezincane zidlula. Ngaphansi kwe-NAT, i-MTU yethaneli lomsingathi inkinga yomsingathi, kodwa isivakashi sisakholwa ku-1500, futhi i-UDP enebhithi ye-don't-fragment iphonswa emgodini omnyama ngendlela efanayo.
Bhala phansi imode, bese uphinda uhlole ngemva kwanoma yiluphi ushintsho lwe-adaptha
Rekhoda imode, i-interface yomsingathi esetshenziswa yibhuloho, isango lesivakashi elizenzakalelayo, isixazululi saso, kanye namakheli aso okuphuma e-v4 nase-v6. Lelo rekhodi yilona elenza ukwehluleka okulandelayo kube kushibhile: uma i-laptop isuka ku-dock iya ku-Wi-Fi, isivakashi se-bridged silandela ibhuloho siye kwenye i-adaptha ebonakalayo futhi singase siphinde siqashe kwelinye i-subnet, ngenkathi isivakashi se-NAT sigcina ikheli laso le-10.0.2.x futhi sizuze njengefa isixhumi esiphezulu esihlukile ngokuthula.
Ngaphambi kokuvala ithikithi, qinisekisa ngakunye kwalokhu:
- Ikheli lokuphuma lesivakashi lihlukile kulekheli lokuphuma lomsingathi, ngakho asikho ethanelini lomsingathi.
- Isixazululi yi-proxy ye-10.0.2.3 noma iseva ye-LAN, futhi uyazi ukuthi iyiphi ephendulile.
- Alikho ikheli le-v6 lomhlaba wonke esivakashini uma idizayini yethaneli ingeye-v4 kuphela.
- Uma ithaneli lomsingathi lehliwe, isivakashi siyeka ukuphequlula, noma manje uyazi ukuthi asikaze sincike kulo.
- Isivakashi asiboni ithrafikhi yokusakaza ye-LAN ekungafanele sibone.