Nciphisa umthetho we-SNAT we-OpenVPN ngaphambi kokuthi wephule i-nginx

Amaklayenti ayazifakazela kodwa akukho okuhambiswayo, noma isayithi liyafa ngemva kokuba i-VPN inyuke. Hlola ukufinyelela kwe-tun, bese ukhawulela ukuhumusha ku-pool kanye ne-interface eyodwa.

Amaphutha amabili ahlala eza ohlotsheni olufanayo lwe-host. Kwelokuqala amaklayenti ayazifakazela bese engafinyeleli lutho ngale kwethumbu. Kwelesibili i-VPN iyenyuka futhi iwebhusayithi yeseva ngokwayo iyeka ukuphendula, okuyikho okukhathaza kakhulu ngoba kubonakala njengomonakalo oseceleni. Ku-VPS esekelwe ku-container kokubili kuvame ukubuyela ohlwini olufanayo olufushane lokuhlola, futhi ukulandelana kubalulekile: idivayisi kuqala, ukuhumusha kwesibili, ububanzi besithathu.

Qinisekisa ukuthi i-container ingakha idivayisi ye-tun

Akukho okunye okubalulekile uma i-interface yethumbu ingenakuba khona. Hlola ukuthi i-/dev/net/tun ikhona nokuthi ukwakhiwa kwedivayisi yokuhlola kuyaphumelela, ngoba abahlinzeki abaningi bacisha i-tun ngaphakathi kwama-container ngokuzenzakalela. Akukho msebenzi we-firewall obuyisela idivayisi engakaze yakhiwe.

Uma idivayisi ingekho, yi-host noma umhlinzeki kuphela ongayivula. Ipulani elihlukile livame ukushibha kunentambo yokusekelwa evulekile ethatha iviki. Qinisekisa lokhu ngaphambi kokufunda ngisho umugqa owodwa we-log ye-OpenVPN. Uma kungenjalo uzochitha ubusuku ulungisa imithetho engasoze ibone iphakethe.

Nquma ukuthi i-MASQUERADE yenzani kule interface

Kumshini wokufakelwa ojingelezele, umthetho ojwayelekile wokuphuma usuka POSTROUTING MASQUERADE ku-interface eyinhloko. Ku-container ye-OpenVZ idivayisi ebonakalayo ivame ukuba yi-venet0, i-interface yokufakelwa elawulwa yi-host hhayi i-NIC ehambisiwe, futhi i-MASQUERADE ayihlali iziphatha lapho njengoba izifundo zicabanga.

Indlela esebenzayo ukuhumusha okucacile okuya ekhelini amaklayenti asefinyelela kulo, kuvunyelwe ukudluliswa nhlangothi zombili. Ukushintsha i-pool kusuka ekulungiselelweni kweseva kubaluleke njengokushintsha ikheli. Funda umugqa ngamunye ngaphambi kokunamathisela.

iptables -t nat -A POSTROUTING -o venet0 -s 10.8.0.0/24 -j SNAT --to-source 203.0.113.10
iptables -A FORWARD -i tun0 -j ACCEPT
iptables -A FORWARD -o tun0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Ngaphandle kwemithetho yokudlulisa ukuhumusha kwenzeka noma kunjalo futhi i-kernel iyala ukudlulisa. Le nhlanganisela idala isimo esididayo lapho izibali kumthetho we-NAT zikhuphuka khona kuyilapho iklayenti lingatholi lutho. Imigqa emibili ye-FORWARD nayo kufanele ime ngaphambi kwanoma yimuphi umthetho we-drop obanzi ochungechungeni olufanayo. Ukulandelana kuyingxenye yokulungiselelwa, akuyona imininingwane yokuqalisa.

Khawulela umthetho ku-pool eyodwa naku-interface eyodwa

Isiphawuli sesibili sinesinye isizathu: umthetho we-POSTROUTING ongenawo umkhawulo womthombo noma wokuphuma. Umthetho onjalo ubhala kabusha iphakethe ngalinye elishiya i-host.

Izinsiza ezincike emthonbeni wangempela zibe seziziphatha kabi. Iseva yewebhu engemuva kwe-proxy yendawo ingayeka ukuphendula, futhi ukuyivuselela akushintshi lutho ngoba umthetho usemgwaqeni. Kuthinteka futhi nokuhamba okuthunyelwa yi-host ekhelini layo lomphakathi, yingakho ukwehluleka kungabonakala njengenkinga ye-DNS noma yesitifiketi hhayi ye-firewall. Umthetho cishe ngokuqinisekile wengezwa ukulungisa isiphawuli sokuqala.

Isixazululo ukunciphisa ukufana ku-pool yethumbu kanye ne-interface yokuphuma, bese wengeza umthetho owodwa ku-pool ngayinye esikhundleni sokwandisa umthetho owodwa ukuze uhlanganise eziningi.

Yenza imithetho ihlale njalo futhi uthole ukuthi ngubani omunye onayo

Imithetho engezwe ngesandla iyanyamalala ekususeni kabusha, ngakho yigcine ku-iptables-save noma uyiphathise ku-netfilter-persistent lapho efakwe khona. Qinisekisa ukuthi ukubuyisela kuyasebenza ngaphambi kokuthi i-OpenVPN iqale. Bese uvuselela kanye ngamabomu esikhundleni sokuthola igebe ngesikhathi sehlakalo.

Ku-host ye-container, qinisekisa futhi ukuthi ifayela lokuqhubeka likhona esitolo se-container esibhalelekayo nokuthi umhlinzeki akashintshi ukuhlunga lapho kuqalwa. Amanye amapulatifomu aphatha inqubomgomo ngaphandle kwe-container, lapho imithetho yendawo inganakwa noma ilwe nemicimbi yase-host uqobo.

Qinisekisa ngezibali nangokugeleza okukodwe kanye

Kusuka kuklayenti oluxhunyiwe, hlola ikheli lomphakathi elibikwa yisevisi yangaphandle. Uma lifana nekheli leseva, ukuhumusha kuyasebenza; uma kungenjalo, iphakethe liphuma ngomunye umgwaqo noma aliphumi nhlobo. Bese uzama kokubili isevisi ephethwe kuseva kanye nensevisi esemkhathini womphakathi, ngoba zithatha imigwaqo ehlukene zidlula kusethi efanayo yemithetho.

Kuseva, funda izibali zamaphakethe emithethweni ye-NAT ne-FORWARD nge-iptables -t nat -L -v -n bese ubuka ukugeleza okukodwe. Uma ikheli leklayenti livela ekukodweni futhi akukho mphendulo elandelayo, igebe lisekhondweni lokubuya noma ekuhlungeni komhlinzeki, hhayi kuphrofayela yeklayenti. Qhathanisa umthombo okodwe nekheli umthetho ohumusha kulo, ngoba ukungafani kusho ukuthi omunye umthetho wafana kuqala. Ukugeleza okukodwe okukodwa kunquma okuningi kunekhasi elilodwa lokufunda ukulungiselelwa.

Gcina i-pool, ikheli elihunyushiwe kanye negama le-interface ndawonye kurekhodi yezinguquko. Umthetho olungile we-pool eyodwa uhumusha ngokungalungile olandelayo.

Izihloko ezihlobene