I-OpenVPN ku-Docker: isivumelwano sesikhathi sokusebenza esidingwa yiklayenti elincane

Faka iklayenti le-VPN esitsheni bese uthola indawo eyodwa yamagama enomhubhe ngaphakathi, hhayi umsingathi ohambisa yonke ithrafikhi yaso nge-VPN. Lawa amaphrojekthi ahlukene, futhi ukuwabheka njengowodwa yiyo indlela izitsha ezihlala zithola amalungelo ngokungazelelwe. Lo mhlahlandlela uhlanganisa eyokuqala kuphela: isithombe esisodwa esibuyekezwe, iphrofayili eyodwa evikelwe kanye nenqubo yeklayenti ekhawulelwe endaweni yayo yamagama yenethiwekhi.

Qala ngento esetshenzisiwe osekuvele kwagunyazwa othile. Izinyathelo ezingezansi zithatha isithombe esinefayela elisebenzayo le-openvpn kanye nephrofayili yeklayenti ephelele enesitifiketi nempahla yokhiye osekuvele yaxazululwa ngaphakathi kokufakwa. Azakhi isofthiwe, azikhiphi ubufakazi futhi azihlanganisi izindawo zokusebenza ezingenayo i-root noma izitsha zase-Windows zomdabu, ngayinye yazo ishintsha impendulo.

Okutholwa yisitsha nokungakutholi

Gcina iphrofayili nakho konke ekubhekisayo kumfolda lendawo elinezimvume eziwilingiwe, elifakwe ngendlela yokufunda kuphela. Izindlela ezihlobene ngaphakathi kwephrofayili kufanele zixazululwe ngaphakathi kwalokho kufakwa; lena iyiminingwane abantu abayigeji lapho isitifiketi siseduze ngefolda elilodwa ngaphezulu kwephrofayili futhi isitsha singasiboni nakancane.

services:
  vpn:
    image: ${VPN_CLIENT_IMAGE:?set the reviewed image reference}
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - ./vpn:/vpn:ro
    working_dir: /vpn
    entrypoint: ["openvpn"]
    command: ["--config", "/vpn/client.ovpn"]

Leyo fayela inikeza izinto ezintathu futhi ayiceli okunye. Isethenjwa sesithombe kufanele siboshelwe nge-digest uma inqubomgomo yakho yokuthunyelwa isho kanjalo, futhi iphrofayili kufanele kube yileyo ebuyekezwe, hhayi ikhophi othile ayihlele endaweni yakho kumsingathi.

Ukufunda kuphela lapha kusho ukuthi isitsha asikwazi ukushintsha amafayela akho kumsingathi; akusho ukuthi isitsha asikwazi ukufunda ukhiye oyimfihlo okuwufakile. Yilokho okungumgomo wokufakwa, futhi yingakho izimvume zamafayela, ubunikazi nendlela imfihlo efike ngayo kumsingathi kusabalulekile. Ungalokothi udlulise iphasiwedi emgqeni womyalo futhi ungayibhaki kusendlalelo sesithombe, ngoba kokubili kuhlala ezindaweni ongakwazi ukuzihlanza kamuva.

Amakhono, i-entrypoint kanye nomgibe phakathi kwazo

Kudingeka izilungiselelo ezimbili futhi zenza umsebenzi ongahlobene. I-NET_ADMIN ivumela ukusetshenziswa kwezixhumanisi nemizila ngaphakathi kwendawo yamagama yesitsha. Ukufakwa kwedivayisi le-/dev/net/tun kuvumela inqubo ukuthi ivule idivayisi yomhubhe nakancane. Ukunikeza okukodwa ngaphandle kokunye kuletha ukwehluleka okucacile, okuwusizo: idivayisi ye-TUN engekho yehluleka lapho ivulwa, kanti ikhono elingekho lehluleka lapho iklayenti lizama ukumisa isixhumanisi.

Akukho kulokhu okuthethelela i-privileged: true. Isitsha esinelungelo sithola wonke amakhono kanye nokufinyelela kwedivayisi, futhi lokho kuyinikezelo enkulu kakhulu kunalokho okudingwa yilo mthwalo womsebenzi. isithenjwa samalungelo namakhono endawo yokusebenza sichaza ukuthi leyo nikezelo ifinyelela kude kangakanani. Uma i-chart noma iposi lebhulogi icela lokho, qala uhlole ukuthi imfuneko kwakuyindlela yedivayisi engekho noma ikhono elingekho.

Ukweqa i-entrypoint iyingxenye elumayo. Ukushaya i-openvpn ngqo kulungile esithombeni esijwayelekile futhi akulungile kunoma yisiphi isithombe somkhiqizo esinebhuku laso lokuqalisa elilungiselela imithetho yodonga lomlilo, amafayela esixazululi noma ubufakazi ngaphambi kokusebenzisa i-daemon. Ukweqa leyo mbhalo kweqa ukulungiselela futhi kukushiya udubula umhubhe owaphuma endaweni yamagama emiswe ngokwengxenye.

Gijimisa iklayenti ngaphambili futhi liyeke libe yinqubo eyinhloko yesitsha. Inqubo ephenduka i-daemon iphuma ngokushesha, isitsha siqala kabusha emjikelezweni, futhi amalogi owadingayo asakazekile phakathi kokuqala kabusha okubukeka kufana.

Qinisekisa ngaphakathi kwendawo yamagama, hhayi kumsingathi

Phakamisa isitaki, qinisekisa kulogi ukuthi iklayenti lifinyelele esimweni sokuxhumeka, bese uhlola indawo yamagama ephethe umhubhe ngempela.

docker compose up -d
docker compose logs --tail 40 vpn
docker compose exec vpn ip -br addr
docker compose exec vpn ip route

Uhlu lwamakheli kufanele lubonise isixhumanisi somhubhe esinekheli elivela echibini, futhi ithebula lemizila kufanele libonise izindawo eziqondisiwe ezikhomba kuso. Uma isixhumanisi singekho, iklayenti alizange lifinyelele endaweni yokulakha. Uma sikhona kodwa kungekho mzila oyisebenzisayo, indawo okufanele ibhekwe kuyo i-push noma izinketho zomzila.

Bese uhlola indawo okubalulekile kuwe kusukela endaweni yamagama okufanele isebenzise umhubhe, ngohlelo hhayi nge-ping kuphela. Ukuxazululwa kwamagama kuwukwehluleka okuhlukile okufanele kuhlolwe ngokusobala: ikheli le-DNS eliqondisiwe alilithuthukisi isixazululi sesitsha ngokwalo, futhi iklayenti elizimele elingayinaki i-push lizoxazulula amagama ngalokho okulungiswe isithombe.

Isimo sokungaxhumeki siyingxenye yesivumelwano

Ukwenza kokuxhumeka kabusha kudinga ukuhlola kwako, ngoba inqubomgomo yokuqala kabusha ikhombisa ukuthi inqubo iqala kabusha futhi ayisho lutho mayelana nokwenziwa yithrafikhi phakathi. Misa umhubhe, zama indawo ehlosiwe futhi ubheke ukuthi ukuxhumeka kuyaliwa, kuyalenga noma kuphumelela buthule ngomzila ojwayelekile wesitsha. Umphumela wokugcina yiwona obalulekile, futhi awubonakali kulogi enempilo.

Uma umthwalo womsebenzi ungafanele usebenzise indlela ejwayelekile, yiklame ngokusobala ngemithetho yodonga lomlilo kanye nesiginali yokulungela ngaphakathi kwendawo yamagama. I-kill switch iyinqubomgomo oyibhalayo futhi oyihlolayo, hhayi isici osithola njengefa ngokugijimisa iklayenti esitsheni.

Ekugcineni, khumbula umngcele: le mizila ihlala endaweni yamagama yesitsha futhi ayithathi indawo yethebula lokuhamba kumsingathi. Imithetho ye-Docker yokudlulisela, yokuhumusha kanye nodonga lomlilo ihlala iyingxenye yendlela engaphandle, futhi imbobo eshicilelwe ayisiyo isixhumanisi se-VPN.