Ukuhambisa ithrafikhi yomsingathi nge-VPN ku-VM: izivivinyo eziyisithupha

Izivivinyo eziyisithupha, ezenziwa ngokulandelana, zinquma ukuthi i-VM ingaba isango le-VPN kumsingathi wayo yini. I-hypervisor ayikwenzi lutho kwalokhu kuwe: ithuneli ingeyomuntu oyisivakashi, umzila ungowomsingathi, futhi inethiwekhi ephakathi kwabo iwukuhamba okujwayelekile. Ngigcina lolu hlu ngoba ukweqa isinyathelo esisodwa kuhlala kunikeza uphawu olufanayo, ukuthula, lapho umsingathi ephindisela kahle isivakashi kodwa angafinyeleli lutho lwangaphakathi.

Qala ngesizathu. Kungenzeka ukuthi iklayenti lebhizinisi lifakwa ngaphakathi kwesivakashi kuphela, noma inqubomgomo iligcina lapho, futhi usadinga iseva yokwakha yangaphakathi evela kumsingathi. Uma umsingathi uvunyelwe ukuba neklayenti lakhe, yenza lokho esikhundleni salokho: ithuneli elilodwa kumsingathi lihlula amanethiwekhi amabili kanye ne-NAT njalo.

Isivivinyo 1: umsingathi udinga isixhumanisi angasinikeza ikheli

Umsingathi kufanele abe ne-interface kusiphiwo esifanayo ne-adaptha yesibili yesivakashi. I-host-only ku-VirtualBox, i-host-only noma i-VMnet yangokwezifiso ku-VMware Workstation, ibhuloho langaphakathi noma idivayisi ye-tap ku-QEMU/KVM, kanye ne-Internal switch ku-Hyper-V konke kuyafaneleka. Isivakashi 192.168.56.2, umsingathi 192.168.56.1, isiphiwo 192.168.56.0/24 yilokho engikulungisa endlini yokucwaninga.

Inethiwekhi yemodi yomsebenzisi ye-QEMU (-netdev user, i-SLIRP backend ezenzakalelayo) kanye ne-NAT ye-VirtualBox kwehluleka ngokuphelele kulesi sivivinyo. Amaphakethe esivakashi afinyelela inqubo ye-proxy kumsingathi, ngakho umsingathi akakaze abone idivayisi ethwala amakheli esivakashi futhi akanalutho angakhomba umzila kulo. I-Default Switch ye-Hyper-V iyindaba efanayo. Uma i-ping 192.168.56.2 evela kumsingathi ihluleka, misa: awukho umzila owengezwa kamuva ozolungisa lokho.

Isivivinyo 2: isivakashi siyadlulisa futhi siyahumusha

Amaphakethe avela kumsingathi afika nekheli lomthombo le-host-only kanye nendawo yokuyisa yangaphakathi, ngakho isivakashi kufanele siwadlulise bese siwafihla ngemuva kwekheli lethuneli laso. Kusivakashi se-Linux lokho kusho ukudlulisa, ipheya ye-FORWARD accept, kanye ne-source NAT ebheke ethunelini:

sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -A FORWARD -i eth1 -o tun0 -j ACCEPT
sudo iptables -A FORWARD -i tun0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s 192.168.56.0/24 -o tun0 -j MASQUERADE

Umthetho we-MASQUERADE uyingxenye abantu abayishiya. Amarowutha ebhizinisi awavamile ukwazi ukuthi i-192.168.56.0/24 ikhona; ngomthetho, amaseva angaphakathi abona ikheli lethuneli lesivakashi futhi ayaphendula, futhi impendulo ithola indlela yokubuyela esivakashini.

Isivakashi se-Windows asinamusa. I-IPEnableRouter=1 ngaphansi kwe-SYSTEM\CurrentControlSet\Services\Tcpip\Parameters ivula ukudlulisa ngaphandle kokuhumusha, ngakho isebenza kuphela lapho ukuhamba kwebhizinisi sekuvele kukhomba emuva kusiphiwo sakho se-host-only. I-Internet Connection Sharing iyahumusha, kodwa iphinda inombola i-adaptha ehlanganyelwe iyise ku-192.168.137.1, ngakho funda ikheli eyalithola ngempela ngaphambi kokubhala imizila yomsingathi.

Isivivinyo 3: imizila yomsingathi ibiza isivakashi, hhayi ithuneli

Dlulisa iziphiwo ezidingwa umsingathi kuphela ngaphakathi kwesivakashi. Ku-Linux umzila owodwa ngesiphiwo sanele futhi ubuyela emuva ngokuhlanzekile:

sudo ip route add 10.20.0.0/16 via 192.168.56.2
ip route get 10.20.30.40

Ku-Windows okulingana nakho yi-route add 10.20.0.0 mask 255.255.0.0 192.168.56.2. Shiya i--p ngaphandle ngenkathi usahlola, ukuze umzila omubi ufe lapho kuqalwa kabusha, bese uwengeza lapho indlela isisebenza. Ungasusi umzila ozenzakalelayo womsingathi ngaphandle uma zonke izinhlelo zomsingathi kufanele zisebenzise ithuneli; uma ithuneli eliphelele liyisidingo ngempela, engeza imizila emibili ye-/1 bese ugcina umzila oqondile oya kunethiwekhi ye-hypervisor:

sudo ip route add 0.0.0.0/1 via 192.168.56.2
sudo ip route add 128.0.0.0/1 via 192.168.56.2

Kumsingathi we-Windows, hlola futhi imethrikhi ye-interface. Umzila owengezwe ngenkathi i-adaptha ye-host-only ivaliwe uhlala kuthebula kodwa awukaze uthwale ithrafikhi, futhi i-adaptha yesibili enemethrikhi ephansi ingawina ukusesha kwesiphiwo esifanayo.

Isivivinyo 4: i-DNS ilandela umzila, hhayi okuzenzakalelayo kwethuneli

Imizila ihambisa amaphakethe; isixazululi sinquma ukuthi yimaphi amagama akha amaphakethe. Khawulela isixazululi sebizinisi endaweni yebhizinisi esikhundleni sokushintsha isixazululi soms ingathi, futhi usikhombise kuseva ye-DNS umzila omusha osuvele ufinyelela kuyo. Nge-systemd-resolved kumsingathi:

resolvectl dns eth1 10.20.0.53
resolvectl domain eth1 '~corp.example.com'

Ku-Windows, okufakwe kuthebula lenqubomgomo yokuxazulula amagama kwenza into efanayo: Add-DnsClientNrptRule -Namespace ".corp.example.com" -NameServers 10.20.0.53. Uma isivakashi sisebenzisa isixazululi saso kukheli le-host-only, sebenzisa lelo kheli esikhundleni salokho, kodwa kuphela ngemva kokuqinisekisa ukuthi liphendula ku-192.168.56.2 hhayi ku-loopback.

Bese hlola i-MTU ngaphambi kokusola i-DNS ngamakhasi anensa. I-interface yethuneli incane kune-interface yamabhayithi angu-1500 yomsingathi, ngakho umsingathi othumela izingxenye ezigcwele evula ibhithi ye-DF ubona zilahlwa ndawana thize ngaphakathi kwesivakashi. Uphawu olujwayelekile i-ping esebenzayo kanye nohlelo lwewebhu lwangaphakathi oluma ngemva kokuxhawulana kwe-TLS. Qinisa i-MSS emzileni wokudlulisa wesivakashi:

sudo iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

Isivivinyo 5: qinisekisa kuzo zombili iziphetho

Kusuka kumsingathi, i-traceroute noma i-tracert eya kukheli langaphakathi kufanele ikhombise i-192.168.56.2 njengehop yokuqala, hhayi isango lomzimba. Esivakashini, bukela umzamo ofanayo uphuma: i-tcpdump -ni any host 10.20.30.40 ikhombisa isicelo esidlulisiwe ohlangothini lwe-host-only nesicelo esihumushiwe ethunelini. Isicelo esiphumayo, esibuya, bese sishiya umsingathi ethule sikhomba endleleni yokubuya.

Izingozi ezimbili zichaza iningi lalokho. Kungenzeka ukuthi ithuneli lesivakashi alinayo imizila yokubuya yesiphiwo se-host-only ngoba umthetho we-NAT awukho, noma umzila womsingathi ukhomba ekhelini isivakashi esingasenalo ngemva kokuqalwa kabusha. Funda kabusha amakheli nge-ip -br addr ne-ip route get esikhundleni sokuthemba amanothi omhlangano odlule.

Isivivinyo 6: yenza ikwazi ukumelana nokuqalwa kabusha nokuthuthukiswa kwe-hypervisor

Gcina izingxenye zombili zihlala njalo: ukulungiswa kwemizila kwe-netplan noma i-NetworkManager kumsingathi, i-route add ... -p ku-Windows, kanye ne-net.ipv4.ip_forward=1 ku-/etc/sysctl.d/ kanye nesethi yemithetho ye-firewall elayishwa kabusha esivakashini. Thatha isithombe sesivakashi ngokushesha lapho ukulungiswa kuqinisekisiwe, ngaphambi kokuthi kufike ukubuyekezwa okulandelayo kweklayenti lebhizinisi.

Amanethiwekhi e-host-only aphinda anombalwa lapho i-hypervisor yakha kabusha ama-adaptha ayo, lokho okwenza kungasebenzi ngokuthule yonke imizila nawo wonke umthetho we-NAT owakhiwe phezu kwe-192.168.56.0/24. Ngemva kokuthuthukisa, phinda izivivinyo ezintathu zokuqala ngokulandelana; lokho kuthatha umzuzu futhi kubamba icala lapho umsingathi usenayo imizila yayo ngenkathi isivakashi sesidlulele kwinethiwekhi encane entsha.

I-IPv6 idinga uhambo lwayo. Imithetho ye-ip6tables, amarekhodi e-AAAA kanye nomndeni wesibili wemizila yomsingathi akulandeli ukulungiswa kwe-IPv4, futhi insiza yebhizinisi efinyeleleka nge-IPv6 izobonakala yephukile unomphela ngenkathi i-IPv4 isebenza.

Iphumelele noma yehlulekile, ngokulandelana: umsingathi unga-ping ikheli le-host-only lesivakashi; isivakashi siyadlulisa futhi senze i-MASQUERADE sibheke ethunelini; i-ip route get ibuyisela isivakashi njengesango lesiphiwo sangaphakathi; amagama ebhizinisi axazululwa ngesixazululi esikhawulelwe; i-traceroute ibonisa isivakashi kuqala; futhi izimpendulo eziyisithupha ezifanayo zisinda ekuqalweni kabusha.