I-PPTP ku-Docker iyaqinisekisa kodwa ayithwali traffic

Iklayenti liyaqinisekisa, i-PPP ixoxisana ngekheli, bese kungabi nalutho olunyakazayo. I-Ping iyahluleka, isiphequluli siyahluleka, futhi i-container ibonakala ixhunyiwe ngaso sonke isikhathi. Leli phatheni akusiyo inkinga yethebula lokuhamba, ngoba izinkinga zokuhamba zivame ukuphula nokuxhumana kokulawula. Kuyindlela yomthwalo, futhi ku-PPTP umthwalo uwuphrotokholi ohlukile kunalowo osanda kuphumelela.

Izivivinyo ezinhlanu, ngokulandelana okonga isikhathi esiningi.

Ukuvivinya 1: hlukanisa isiteshi sokulawula nomthwalo

I-PPTP iqinisekisa nge-TCP 1723 bese ithwala umthwalo we-PPP ngaphakathi kwe-GRE, iphrotokholi ye-IP 47. I-GRE ayiyona i-TCP noma i-UDP, ngakho wonke umthetho odlulisa imbobo yokulawula awusho lutho ngayo. I-NAT noma i-firewall edlulisa i-1723 ingalahla iphrotokholi 47 ngaphandle kwesikhalo, futhi iseshini ihlala yakhiwe ngokwengxenye ngendlela ebonakala njengempumelelo.

Uma ukungena kusebenza futhi kungekho phakethe olubuyayo, cabanga nge-GRE kuqala bese uyikhipha.

Ukuvivinya 2: qinisekisa umsizi ku-kernel yomsingathi

Ukulandelela ukuxhumana akukwazi ukuxhumanisa ukuxhumana kokulawula kwe-TCP nokugeleza kwe-GRE ngaphandle komsizi. Imodyuli yi-nf_conntrack_pptp, ihlala ku-kernel yomsingathi, futhi ukuyilayisha ngaphakathi kwesithombe se-container akuzuzi lutho ngoba amamodyuli asebenza kumsingathi wonke. I-lsmod | grep nf_conntrack_pptp kumsingathi we-Docker iwukuvivinya. Uma ingekho, i-modprobe nf_conntrack_pptp iyilayisha ye-kernel esebenzayo futhi ayisho lutho ngokuqalisa okulandelayo, ngakho yengeza futhi ekucushweni komsingathi.

Imodyuli enyamalalayo lapho iqalwa kabusha iba yithikithi elifanayo ngenyanga ezayo.

Ukuvivinya 3: funda inqubomgomo ye-kernel eyicishayo

Ngisho nemodyuli ikhona, ama-kernel kusukela ku-4.7 abeka i-net.netfilter.nf_conntrack_helper ku-0 ngokuzenzakalela, okucisha ukwabiwa komsizi okuzenzakalelayo kuyo yonke iphrotokholi. Lokho kuzenzakalela yisizathu sokuthi imodyuli efakwe kahle ayenzi lutho: ikhodi ikhona futhi inqubomgomo ithi ungayisebenzisi. I-sysctl net.netfilter.nf_conntrack_helper ibika inani lamanje, futhi ukuyibeka ku-1 ngesikhathi sokusebenza kwenza umsizi atholakale futhi. Gcina inani ngokucushwa kwe-sysctl komsingathi uma umklamo uvumela.

Ukwabiwa okuzenzakalelayo kuvumela i-traffic ukuthi yakhe okulindelekile ngendlela engaqondile, futhi yikho kanye isizathu sokuthi okuzenzakalelayo kwashintshwa. Kukhawulele kumsingathi othembekile, noma sebenzisa umthetho ocacile oqondise kumsizi.

Ukuvivinya 4: bheka indlela ye-container ngokwehlukile

Umsizi olayishiwe awakhi ndlela. I-container idinga indlela eya kuseva ye-PPTP, futhi ukudluliswa kumsingathi kufanele kuvume i-GRE kuzo zombili izinhlangothi: i-iptables -L FORWARD -v -n ikhombisa ukuthi iphrotokholi 47 iyamukelwa yini nokuthi izibali ziyanyakaza yini. Imithetho ye-masquerade ye-Docker ihumusha i-TCP ne-UDP, hhayi iphrotokholi 47, ngakho i-container enebhuloho ingase idinge ukwamukelwa kwe-forward okucacile futhi, kwabanye omsingathi, umthetho wayo wokuhumusha. Qinisekisa futhi ukuthi i-container inokwesekwa kwedivayisi ye-PPP okulindelwe isithombe sayo.

Funda izibali hhayi umbhalo womthetho. Umthetho okhona ongahambisani nalutho uwumhlobiso.

Ukuvivinya 5: khombisa ukuthi i-GRE iyalandelelwa, bese unquma nge-PPTP

Ngesikhathi iklayenti lisebenza, funda ithebula lokulandelela. Umugqa wokulawula we-PPTP osunguliwe kanye nomugqa we-GRE ohlobene kusho ukuthi umsizi uxhuma ukugeleza futhi iphutha elisele likwenye indawo. Umugqa wokulawula ongenawo umugqa we-GRE kusho ukuthi umthwalo uyalahlwa noma awulandelelwa, okukubuyisela kuzivivinyo 2 no-3.

I-PPTP ngokwayo yifa futhi i-MS-CHAPv2 ibuthakathaka. Uma iseva inikela nge-L2TP/IPsec, IKEv2 noma i-WireGuard, ukuthuthela kwenye yazo kususa lesi sigaba sonke sezinkinga.

Lapho i-PPTP kufanele ihlale khona, ukusebenzisa iklayenti kumsingathi esikhundleni sangaphakathi kwe-container kususa ungqimba olulodwa lwe-NAT nokuhlunga, okuvame ukuba yisinqumo esishibhile.