Uhlelo olungaphakathi kwesikhala samagama se-VPN alufinyeleleki kusuka ku-LAN

Insizakalo yakho isebenza emshinini, umhubhe uphakeme, kodwa isiphequluli etafuleni lakho sisalindile impendulo. Akukho okugqekeziwe ngomqondo ojwayelekile: uhlelo lulalela ngaphakathi kwesikhala samagama senethiwekhi, futhi leso sitaki asibonakali ku-LAN. I-loopback yaso ingeyesikhala samagama, ngakho iklayenti kwenye imshini ayinalo ikheli elifinyelela embotsheni. Ukugxuma okukodwa okuhlosiwe, noma ipheya elilodwa le-veth, kulungisa lokhu ngaphandle kokuhambisa ingxenye esele ye-host.

Kungani kungekho okuphendulayo ekhelini le-LAN

Isikhala samagama siyisitaki senethiwekhi esiphelele: ama-interface, imigwaqo, imithetho ye-firewall kanye ne-loopback eyimfihlo. Inqubo eqalwe nge-ip netns exec ibona leso sitaki kuphela futhi ayiboni okunye, ngakho ikheli elixhumayo lixazululwa ngaphakathi kwesikhala samagama kuphela. I-127.0.0.1 ye-host uqobo iyi-loopback ehluke ngokuphelele.

Yingakho i-curl ku-host yehluleka kuyilapho umyalo ofanayo ngaphakathi kwesikhala samagama uphumelela. Uhlelo luphelele; ikheli alikho esitakini se-host, yikho kuphela.

Shicilela imbobo eyodwa ngokugxuma kwe-socat

socat ixhumanisa izitaki ezimbili esikhaleni somsebenzisi, okwanele lapho imbobo eyodwa ye-TCP kufanele iwele. Uhlangothi lwe-host lulalela ku-LAN futhi, kukho konke ukuxhumana okwamukelwe, luqala i-socat yesibili ngaphakathi kwesikhala samagama exhumanisa ne-loopback yohlelo. Inqubo yangaphakathi ifinyelela uhlelo ngendlela efanayo neklayenti lendawo. Akukho okushintshayo ekuhlelweni kwemigwaqo yesikhala samagama, ngakho uhlelo luqhubeka lusebenzisa umhubhe njengokuphuma kwalo kuphela.

socat TCP-LISTEN:9100,reuseaddr,fork EXEC:'ip netns exec vpn socat STDIO tcp-connect:127.0.0.1:9100',nofork

Inqubo yangaphandle idinga i-root noma amandla okungena esikhaleni samagama. Uma i-VPN iwa, uhlelo lulahlekelwa umgwaqo wabo futhi imbobo eshicilelwe yehluleka ivaliwe, futhi yilokho ukuziphatha okufunayo ejele.

Sebenzisa ipheya le-veth lapho kudlula imibobo engaphezu kweyodwa

Ipheya le-veth iyimpendulo efanele lapho amabhobo amaningi noma amaphrothokholi kufanele awele, noma lapho amanye ama-host kufanele aqale ukuxhumana. Uhlangothi olulodwa luhlala ku-host, olunye ludlulela esikhaleni samagama, futhi i-/30 encane inikeza izinhlangothi zombili ikheli elizinzile. Bese umgwaqo we-host uthumela ikheli lesikhala samagama ngaphezu kwepheya.

ip link add veth0 type veth peer name veth1
ip link set veth1 netns vpn
ip addr add 10.77.0.1/30 dev veth0
ip link set veth0 up
ip netns exec vpn ip addr add 10.77.0.2/30 dev veth1
ip netns exec vpn ip link set veth1 up

Ungangezi umgwaqo ozenzakalelayo ngokusebenzisa i-host ngaphandle uma uhlose ukwephula ijele. Umhubhe kufanele uhlale ukuphuma, ngakho ngaphezu kwepheya kufinyeleleka kuphela ikheli lensizakalo eshicilelwe. Nikeza isikhala samagama nefayela laso lokuxazulula, ngoba i-ip netns exec ifunda i-/etc/netns/vpn/resolv.conf futhi ngaphandle kwayo ukuxazululwa kwamagama ngaphakathi ejele kungenalutho.

Hlola kusuka kwenye imshini, hhayi ku-host

Qhuba ukuhlolwa kusuka kwenye imshini, ngoba i-host ingafinyelela isilaleli sendawo ngemigwaqo engasho lutho nge-LAN. Qala uhlole ukuthi uhlelo luxhumeke ngani ngempela ngaphakathi kwesikhala samagama, bese uxhuma kusuka ngaphandle ekhelini elishicilelwe. Ukuxhuma kuwo wonke amakheli lapho akukwandisi ijele, ngoba i-wildcard iseng eyesikhala samagama futhi i-LAN ayikwazi ukuyibona.

ip netns exec vpn ss -lntp

Uma ukuxhumana kusuka ku-host kusebenza futhi okusuka ku-LAN kungasebenzi, ingxenye engekho ukugxuma noma umgwaqo, hhayi ikheli lokuxhuma. Qala i-OpenVPN ngaphakathi kwesikhala samagama esikhundleni sokuhambisa idivayisi ye-tun ephilayo ingene kuso, ngoba ukuhambisa i-interface kuyayicisha futhi kungasusa imigwaqo ongayilungisi ngaphandle kamuva. Gcina imiyalo yokubuyisela kukhonkoso, hhayi ngaphakathi ejele.