Izihlungi zendlu yesibani ye-Nebula ne-firewall: yini evinjwa yilowo nalowo

Bheka ukuxhawulana kwe-Nebula kusuka kwelinye icele elingalungile futhi izindlela ezimbili zibonakala zishintshana. Eyokuqala inquma ukuthi iyiphi indawo i-node eyazisa ngayo indlu yesibani nokuthi iyiphi indawo ekude eyozama; eyesibili inquma ukuthi yini engadlula lapho umhubhe usukhona. Isihlungi singamisa ukuxhumana ngaphambi kokuba noma yimuphi umthetho we-firewall uhlolwe, futhi umthetho we-firewall awukwazi ukuvusa iphuzu lokugcina elisuswe ukutholwa. Izendlalelo ezimbili ziphendula imibuzo ehlukene, futhi ukulandelana kwazo kokusebenza ukhiye.

Landela ukuxhumana okukodwa ezigabeni ezine: ikheli lasendaweni elimenyezelwe, iphuzu lokugcina elikude elicatshangelwayo, ukuxhawulana kanye nokuhamba ku-overlay. Isigaba ngasinye sinesilungiselelo saso kanye nophawu lwaso lokwehluleka.

Qala ekhelini lasendaweni elimenyezelwa i-node

local_allow_list ihlunga amakheli asendaweni ale ndawo ngaphambi kokuba abikwe ezindlini zesibani. Okufakiwe kungaba amazinga amakheli, futhi isilungiselelo sisekela namaphethini wamagama e-interface. Lokhu kuyasiza lapho indawo inamabhuloho ekhonteyina noma ama-interface omhubhe engeziwe okungafanele abe amaphuzu okugcina wabalingani.

Hamba kuma-interface ale ndawo futhi ubuze ukuthi yikuphi umlingani okude angafinyelela ngempela kukho. Ikheli lebhuloho le-Docker lingelendawo yaleyondawo futhi aliwusizo kumlingani kwenye inethiwekhi. Ukulimemezela kumosha ukutholwa futhi kungathumela umlingani ekhelini elingaphenduli neze. Konke umlingani angeke akwazi ukukuhambisa kukho umsindo empendulweni yendlu yesibani.

Uhlu lwemvume oluncane luphephile lapha kunohlu olubanzi lokwenqaba. Uma kukhona okufakiwe kwemvume kuphela, okusele okungacacisiwe kuyakhishwa; ukufaka okwenqabayo kamuva kushintsha umqondo ojwayelekile futhi kudinga ukubuyekezwa kwako. Lokho kushintsha kufanele ukubhekwa okwesibili enanini elijwayelekile.

Bese ubheka ukukhethwa kwephuzu lokugcina elikude

remote_allow_list ihlunga amakheli le ndawo ezocabangela umlingani okude ngesikhathi sokuxhawulana. Kusebenza ekhelini lesendlalelo esingezansi, hhayi ekhelini le-overlay umlingani azolisebenzisa ngemva kokuba umhubhe unyuke.

Ibanga langasese lingaba usizo ngokuphelele kunethiwekhi yehhovisi eyabiwe futhi lingabi nasincazelo lapho izindawo ezimbili zikunethiwekhi ezingahlobene ezisebenzisa zombili i-10.0.0.0/8. Isihlungi sikuvumela ukuthi ukhethe indlela ehambisekayo futhi ungayinaki imvela.

Lapho umlingani wehluleka ukuxhuma, qhathanisa ikheli elizamayo nomthetho ohambisana nalo. Vula amalogi okuxhawulana futhi ufunde ikheli elikude elikhethiwe; umugqa welogi ubiza iphuzu lokugcina elasinda ekuhlungeni, futhi lokho kuyasiza kunohlu lwamakheli umlingani anayo.

Isihlungi segama le-interface ohlangothini olumemezelayo singasusa iphuzu lokugcina ngaphambi kokuba uhlangothi olwamukelayo lubone. Hlola zombili izindawo lapho kwehluleka uhlangothi olulodwa kuphela.

Ngemva kokuxhawulana kusebenza imithetho yokufinyelela ye-overlay

Imithetho ye-firewall ye-Nebula isebenza ngaphakathi kwe-overlay, ngemva kokumiswa komhubhe. Ihlanganisa izindawo, amaqembu, izimbobo kanye nezimiso, futhi inquma ukuthi iphakethe lingangena noma liphume endaweni yasendaweni. Ayikhethi iphuzu lokugcina esendlalelweni esingezansi.

Lokhu kwehlukanisa kuchaza ukuxilongwa okungalungile okuvamile. Umshayeli wengeza umthetho we-firewall embobeni futhi akakwazi ukuxhuma, ngoba isihlungi sendlu yesibani sisuse iphuzu lokugcina elingafinyeleleka. Omunye umshayeli uvula isihlungi samakheli futhi akafinyeleli enkonzweni, ngoba i-firewall ye-overlay inqaba imbobo.

Funda ukwehluleka esendlalelweni esifanele. Ukuxhawulana okungapheli kukhomba ekutholweni, ekuhlungeni kwamaphuzu okugcina noma endleleni yenethiwekhi. Ukuxhawulana okuqediwe okulandelwa ukuxhumana kwenkonzo okwaliwe noma okulahliwe kukhomba ku-firewall ye-overlay noma kuhlelo lokusebenza.

Funda inani elijwayelekile lapho uhlanganisa imvume nokwenqaba

Isilungiselelo sendlu yesibani sisekela izinhlu zemvume-kuphela, zokwenqaba-kuphela nezixubile, futhi inani elijwayelekile lalokho okusele okungacacisiwe liyahluka phakathi kwalezo zinhlobo. Uhlu oluxubile ludinga inani elijwayelekile elicacile lomndeni wamakheli; ukucabanga ukuthi okusele kuziphatha njengesilungiselelo sangaphambilini yiyona ndlela iphuzu lokugcina elisebenzayo elinyamalala buthule ngayo.

lighthouse:
  local_allow_list:
    interfaces:
      docker0: false
  remote_allow_list:
    192.168.0.0/16: true
    default: false

Thatha inani elijwayelekile njengengxenye yomthetho, hhayi njengombhalo wesifanekiso. Uma inani elijwayelekile lomndeni kuwukwenqaba, ikheli ngalinye elingafakwanga ohlwini liyakhishwa, kuhlanganise nebanga lehhovisi elisha elengezwe ngemva kokubhalwa kwesilungiselelo.

Bhala phansi ukuthi yimaphi amakheli okwakuhlosiwe ukuthi afinyeleleke futhi uhlole kuzo zombili izinhlangothi. Isihlungi esisebenza kubhangqwana olulodwa lomlingani singehluleka kwelinye ibhangqwana elinomzila waso owodwa ojwayelekile osebenzisa ikheli elikhishwe uhlu.

Sebenzisa i-relay lapho kungekho phuzu lokugcina eliqondile elifinyelelekayo

Uma iphuzu lokugcina ngalinye elingumfakisicelo lihlungiwe noma lingafinyeleleki, impendulo ayilona uhlu olubanzi lwemvume olwamukela futhi amakheli ongawathembi. Isilungiselelo se-relay se-Nebula sinikeza indlela ehlukile yomlingani lapho ukuxhumana okuqondile kungenzeki.

I-relay ixazulula ukuthutha nokutholwa, hhayi ukugunyazwa, futhi ayikhulisi i-firewall. I-firewall ye-overlay isananquma ukuthi yiziphi izinsizakalo ezingasetshenziswa, futhi i-relay ayiguquli ukuhlunga kwendlu yesibani kube yindlela yokulawula ukufinyelela.

Hlola indlela ye-relay ngokuvala amaphuzu okugcina aqondile futhi uqinisekise ukuthi inkonzo ehlosiwe isasebenza kuyilapho engahlosiwe ingasebenzi. Lokho kuhlola okukodwa kwahlukanisa ukulungiswa kokuthutha nokushintshwa kwenqubomgomo futhi kugcina izendlalelo ezimbili zithembekile.