Nebula: i-relay ilungisiwe kodwa ayisetshenziswa — izilungiselelo ezintathu okufanele zihlolwe

Wengeze i-host ye-relay, wafaka ikheli layo le-Nebula kusilungiselelo, kodwa ama-peer amabili awakakhulumisani. Lokhu kwenzeka ngoba indlela ye-relay idinga izitatimende ezintathu ezihlukene ukuze zivumelane, futhi eyodwa kuphela yazo isemishinini okungenzeka ukuthi uyihlolile. Ngikulandele lokhu kabili: kwesinye isikhathi i-host yokudlulisa yayingakaze inikezwe indima ye-relay, kwesinye isikhathi izilungiselelo zazibhalwe ohlangothini olungalungile lokuxhumana. Ukulandelana okungezansi kuhlola indima, isimemezelo kanye nemvume ngalolo hlobo, futhi isinyathelo ngasinye sinomyalo okutshela ukuthi uqhubeke yini.

Yenza ibalazwe lemisebenzi emithathu ngaphambi kokuhlela isilungiselelo

I-Nebula inikeza i-host ngayinye umsebenzi, futhi imisebenzi ayidluliselwa ngofuzo. Indlu yokukhanyisa iphendula imibuzo ethi 'iphi le peer' ukuze amahhosti akwazi ukutholana. I-relay idlulisa ithrafikhi phakathi kwama-peer amabili angenayo indlela eqondile esebenzayo. I-host evamile ayikwenzi kokubili. Izilungiselelo ezintathu ezibalulekile zihlala emishinini emithathu ehlukene, yingakho isilungiselelo sekhasimende esibonakala siphelele singashiya womabili ama-peer elindile.

# on the discovery host
lighthouse:
  am_lighthouse: true
  hosts: []

# on every other host, point at the discovery host's Nebula address
lighthouse:
  hosts:
    - 10.42.0.1

Uphawu olulodwa luhlukanisa izigaba ezimbili zokwehluleka. Uma womabili ama-peer ehlisa elinye, futhi ilogi ikhombisa imizamo yokuxhawula engaqedi, ukutholakala kuyasebenza futhi indlela yedatha ivinjwe yi-NAT noma i-firewall. Uma i-peer ingakaze lifunde ikheli lelinye, inkinga isendlu yokukhanyisa noma kumephu ye-host emile, futhi izilungiselelo ze-relay azikwazi ukulungisa lokho.

Qinisekisa ukuthi i-host ngayinye ilayishe yiphi isilungiselelo ngempela ngaphambi kokuhlela enye into. Iyunithi efunda indlela ehlukile kunefayela oluhlelile iyimbangela evamile futhi eyihlazo yokuthi 'ushintsho alwenzi lutho':

systemctl cat nebula | grep ExecStart
nebula -version
journalctl -u nebula -n 20 --no-pager

Umugqa wenguqulo ubalulekile emkhakheni oxubile. Ukuphathwa kwe-relay, indlela yokubhoboza kanye nokhiye besilungiselelo abamukelwayo akufani phakathi kwezinguqulo, ngakho ungacabangi ukuthi ukwakhiwa okudala kuqonda isigaba esingakubhalelwanga. Linganisa amahhosti ochungechungeni oluncane olulodwa, bese usebenzisa i-nebula -test -config /etc/nebula/config.yml ku-host ngayinye futhi uqhathanise okukhiphayo ngaphambi kokulungisa ukudluliswa okungakwenziwa yikhodi.

Nika amandla indima yokudlulisa ku-host ye-relay

Indima ye-relay iyifulegi elilodwa ku-host yokudlulisa, futhi ihlukile ekubeni yindlu yokukhanyisa. I-host enamandla okutholakala futhi ukudluliswa kwe-relay kuvaliwe iseyisevisi yokutholakala kuphela. Ku-relay:

relay:
  am_relay: true

Leli fulegi limemezela inhloso; alidali ukufinyeleleka. I-relay kufanele ifinyeleleke kusuka kuwo womabili ama-peer, okusho ukuthi ngokomkhuba ikheli lomphakathi, i-UDP engenayo embobeni ye-Nebula evulekile ku-firewall ye-host nakunoma yiliphi iqembu lokuphepha lefu, futhi akukho NAT ephindiwe phambi kwayo. Hlola isokhethi elalelayo, bese ubuka ukufika kwamaphakethe e-peer:

ss -lunp | grep nebula
tcpdump -ni any udp port 4242 and host 198.51.100.7

Imikhawulo emibili yonga isikhathi kamuva. I-relay ayifinyeleleki ngokusebenzisa enye i-relay, ngakho uchungechunge lwamagama e-relay kusilungiselelo aluthatheli indawo yokunikeza i-host yokudlulisa indlela esebenzisekayo. Futhi i-relay idlulisa amaphakethe; ayinikezi imvume, ngakho imithetho yokungena yendawo ekuyiwa kuyo isayinquma into yokuthi ukugeleza okudlulisiwe kuvunyelwe yini. Indima kanye nezidingo zayo kuchazwe kudokhumenti yokulungisa i-relay.

Memezela i-relay kusuka endaweni ekuyiwa kuyo, hhayi kukhasimende

Lokhu ukuhlanekezelwa okudla amahora amaningi. Uhlu lwe-relay lunge-lwe-host oyizama ukufinyelela, ngoba lutshela amanye ama-peer ukuthi yimaphi ama-relay angasetshenziswa ukufinyelela leyo hosti. Ukulubeka kukhasimende oqala ukuxhumana akwenzi lutho ohlangothini oludingwa yikhasimende:

# on the DESTINATION host: relays others may use to reach me
relay:
  relays:
    - 10.42.0.5

Ama-peer abika lolo hlu kanye namakheli awo lapho ezingisa endlu yokukhanyisa, ngakho isimemezelo sisakazeka ngokutholakala hhayi ngokushintshana okuqondile. Uma indawo ekuyiwa kuyo ingakwazi ukufinyelela indlu yokukhanyisa, uhlu lwayo lwe-relay alusoze lwasakazeka futhi i-relay elungiswe kahle ihlala ingenzi lutho. Lokho kwehluleka kubonakala kufana ncamashi ne-relay ephukile futhi akusiyo.

Nikeza indawo ekuyiwa kuyo indlela yokuqala esigabeni esifanayo. Imephu ye-host emile ihlanganisa ikheli le-Nebula nendawo yokugcina yomphakathi ukuze ukuxhawula kokuqala kube nendawo yokuya, futhi idinga ukufakwa kwe-relay uma indawo ekuyiwa kuyo izokwamukela ithrafikhi edlulisiwe evela kumahhosti engakwazi ukuwafinyelela ngqo:

static_host_map:
  "10.42.0.5": ["203.0.113.10:4242"]

Vumela i-peer elixhumayo ukuthi lisebenzise i-relay

Uhlangothi oluqalayo ludinga imvume yalo. I-relay.use_relays ivuliwe ngokuzenzakalela, ngakho icala okufanele lifunwe iyi-false ecacile, evame ukukopishwa kusifanekiso esabhalwa ngaphambi kokuba isici se-relay sibe khona noma esashiywa umzamo wangaphambili wokuphoqa izindlela eziqondile:

relay:
  use_relays: true

Imvume kulolu hlangothi akuwona kuphela umnyango. Imithetho yokungena yendawo ekuyiwa kuyo isasebenza kuphakethe elidlulisiwe, futhi umthombo ewuhambisayo ubuyiswa kumuntu ongaphakathi komhubhe hhayi ikheli le-relay ngokwalo. Uma ukuxhawula okudlulisiwe kuqeda futhi uhlelo lusahluleka, funda ilogi yendawo ekuyiwa kuyo ukuze uthole umthombo eyawubhalayo ngaphambi kokubhala kabusha umthetho.

Izilungiselelo zokweqa i-NAT zihlangana nakho konke lokhu. I-punchy.punch isiza ama-peer amabili ukuthi avule indlela eqondile, futhi uma iphumelela akukho thrafikhi ye-relay okufanele ibukwe; lokho kuyimpumelelo, hhayi i-relay elahlekile. Umbhangqwana osebenza ngezikhathi ezithile ngokuvamile usho ukuthi ukubhoboza kuphumelela ngezinye izikhathi, ngakho hlola lowo mbhangqwana izikhathi eziningi esikhundleni sokuthatha isiphetho emzamweni owodwa.

Qinisekisa nombhangqwana owehlulekile, bese ulayisha kabusha

Hlola amahhosti amabili ahlulekile ngempela, kanye nohlelo eluwudingayo. I-ping ephumelelayo esuka esiteshini sakho sokusebenza iya kusevisi ye-relay ngokwayo ayifakazeli lutho mayelana nokudluliswa phakathi kwamanye ama-peer amabili, futhi lokhu kuyisiphambeko esivamile kakhulu kuyo yonke le nqubo.

journalctl -u nebula -f | grep -iE "relay|handshake"
ping -c 3 10.42.0.9

Layisha kabusha esikhundleni sokuqalisa kabusha, futhi uqinisekise ukuthi inqubo esebenzayo ithathe ifayela oluhlelile. Ukuqalisa kabusha kuphula wonke umhubhe futhi kwenza ukuhlolwa okulandelayo kube nzima ukukufunda, kuyilapho i-SIGHUP igcina inqubo futhi iyiphoqa ukuthi ifunde isilungiselelo kabusha:

sudo systemctl kill -s HUP nebula
# same signal when nebula runs in the foreground
kill -HUP $(pidof nebula)

I-systemctl reload isebenza kuphela uma iyunithi yasendaweni ichaza i-ExecReload, futhi iyunithi ehamba nephrojekthi ayikwenzi lokho, ngakho isinyathelo esiphumelelayo ekufakweni okujwayelekile yi-systemctl kill -s HUP. Ngemva kokulayisha kabusha funda ijurnal yendlela yesilungiselelo eyavulwa inqubo, ukuze wazi ukuthi ifayela elisha lifundiwe hhayi lelo obucabanga ukuthi lifundiwe.

Izilungiselelo ze-relay nokubhoboza i-NAT kokubili kusebenza endleleni; akukho okusebenza kubunikazi. Uma umbhangqwana usahluleka ekuxhawuleni ngemva kokuqinisekiswa kwe-am_relay, i-relays kanye ne-use_relays kusilungiselelo esisebenzayo, hlola ukuthi womabili amahhosti ethula izitifiketi ezikhishwe kwamagama alungiselwe wona nokuthi i-CA iyafana ezinhlangothini zombili. Gcina isitifiketi kanye nesilungiselelo se-firewall kumile ngenkathi ushintsha isilungiselelo esisodwa sokudlulisa ngesikhathi, ngoba ukuhlelwa kwesitifiketi nokuhlelwa kwe-relay okwenzeka esivivinyweni esisodwa akukutsheli ukuthi yikuphi okwasusa ukuxhawula. Ukungafani kwegama noma kwe-CA kwehluleka endaweni efanayo ne-relay engakaze itholakale, yingakho lokhu kuqinisekisa okuphambene nakho kukuleso sigaba.

Bese uqinisekisa ukuthi isitatimende ngasinye sisemfayelini yaso:

• I-am_relay: true ku-host yokudlulisa, futhi leyo hosti ifinyeleleka nge-UDP kusuka ezinhlangothini zombili.
• I-relays: ebiza ikheli le-Nebula laleyo hosti endaweni ekuyiwa kuyo.
• I-use_relays: true ku-peer oqala ukuxhumana.
• Imithetho yokungena endaweni ekuyiwa kuyo isavumela umthombo wangempela ngemva kokushintsha kwendlela.