Kungani ikhonteyina ye-macvlan ingakwazi ukuphendula iklayenti ye-VPN

Cabanga ngehodi le-Linux eliqeda i-VPN futhi ngesikhathi esifanayo lisebenzisa ikhonteyina kunethiwekhi ye-macvlan. I-LAN yi-192.168.60.0/24, ikhonteyina ino-192.168.60.210, futhi amaklayenti e-VPN afika evela ku-10.95.0.0/24. Iklayenti lifinyelela isevisi, impendulo ayibuyi nakanye, futhi wonke umthetho we-firewall kuhodi ubukeka ulungile. Lezi zimo ezimbili ezihlukene zidala lesi sibonakaliso, futhi ukulungisa esisodwa kushiya esinye endaweni yaso.

Izimo ezimbili, isibonakaliso esisodwa

Isimo sokuqala ukuhlukaniswa: umshayeli we-macvlan we-Docker akavumeli ikhonteyina ukukhuluma nehodi yayo ngokusebenzisa i-interface yomzali. Ukuhamba phakathi kwesitaki sehodi nekhonteyina akunandlela, noma ngabe imizila kuhodi ibhalwe kanjani.

Isimo sesibili indlela yokubuya. Igesi elizenzakalelayo lekhonteyina ngokuvamile iyirutha ye-LAN, ngakho impendulo ethunyelwe kuklayenti ye-VPN iphuma ngale ritha. Uma irutha ingenayo imizila ebuyela echibini le-VPN, impendulo ilahlwa endaweni ethile phakathi.

Lezi zehluleka ezimbili zibukeka zifana ngokweso leklayenti: isicelo esifika nempendulo engafiki nakanye. Zidinga ukulungiswa okuhlukene, futhi umthetho obanzi we-masquerade ungafihla ukuthi yiwuphi osaphukile. Yingakho ukuhlolwa kokuqala kuwukubamba ohlangothini lwekhonteyina hhayi olunye ushintsho lwe-firewall. Uma isicelo singabonakali lapho nakanye, isimo sokuhlukaniswa siyasebenza.

Yakha i-shim ohlangothini lwehodi, ngokuncane

I-interface yesibili ye-macvlan kuhodi, exhunywe kumzali ofanayo kumodi yebhuloho, inikeza isitaki sehodi ubunikazi baso kuleyo ngxenye ye-LAN. Beka eceleni ikheli elingaphandle kwechibi le-DHCP nangaphandle kobubanzi bekhonteyina, futhi udlulise ikhonteyina kuphela ngayo.

ip link add macvlan-vpn link eth0 type macvlan mode bridge
ip address add 192.168.60.250/32 dev macvlan-vpn
ip link set macvlan-vpn up
ip route add 192.168.60.210/32 dev macvlan-vpn src 192.168.60.250

Umyalo wokuqala wakha i-interface kumodi yebhuloho, okuyisimo esizenzakalelayo esibhaliwe salo mshayeli kanye nemodi oyifunayo yokuhamba phakathi kwehodi nekhonteyina. Owesibili unikeza i-/32 ukuze ikheli lingashayisani nesiqalo se-LAN, futhi owesine uthumela kuphela ikheli lekhonteyina ngokusebenzisa i-shim.

Ungaqondisi lonke i-LAN ngokusebenzisa i-interface entsha. Umzila oxhunyiwe ojwayelekile uhlala njengoba unjalo, futhi umzila wehodi mncane ngamabomu ukuze ikhonteyina elilodwa lithole indlela ngaphandle kokuba ingxenye esele yengxenye iguqule ukuziphatha kwayo. Umzila ozenzakalelayo okhomba ku-shim ubungaba uwumklamo ohlukile nemiphumela ehlukile. Yigcine icacile futhi ububanzi bomonakalo buhlala buncane.

Le miskelo ishintsha izilungiselelo zenethiwekhi kuhodi elisebenzayo. Kudivayisi noma kupulatifomu ephethwe, sebenzisa indlela yokuhlela esekelwayo yaleyo pulatifomu, ngoba ushintsho olusebenzisanayo ku-root shell lungase lungaphili ngemva kokuthuthukiswa.

Nquma ukuthi umthombo ugcinwa kanjani

Uma i-shim isendaweni yayo, ikhonteyina lingafinyelela ihodi, futhi umbuzo uba ukuthi iyiphi ikheli lomthombo impendulo eyithwalayo. Ukugcina umthombo wangempela we-VPN iyimodeli ehlanzekile: ikhonteyina libona ikheli langempela leklayenti, futhi amarekhodi nemithetho yokufinyelela yesevisi ingayisebenzisa.

Ukuze lokho kusebenze, ukuhlela kwenethiwekhi yekhonteyina kufanele kuthumele ukuhamba kwe-10.95.0.0/24 kuya ku-192.168.60.250 njengegesi lalo mzila. Lesi silungiselelo somzila noma segesi esisekelwayo ngaphakathi kokuhlela kwekhonteyina uqobo, hhayi icebo ohlangothini lwehodi. Kuqinisekise ngaphakathi kwekhonteyina esikhundleni sokucabanga ukuthi isilungiselelo sisebenza. Igesi elizenzakalelayo elisakhomba kurutha ye-LAN lizoqhubeka nokuthumela izimpendulo emgodini ofanayo.

Uma umklamo ogunyaziwe ufihla imithombo ye-VPN esikhundleni salokho, nciphisa ukuhumusha: ichibi le-VPN langempela, i-shim njenge-interface ephumayo, kanye nekhonteyina nesevisi ethile.

iptables -t nat -A POSTROUTING -s 10.95.0.0/24 -o macvlan-vpn -j SNAT --to-source 192.168.60.250

Fanisa i-shim njenge-interface yokuphuma, hhayi ithuneli. Umthetho obiza ithuneli njenge-interface yokuphuma ngeke uhambisane nephakethe elibheke ekhonteyina, futhi yilowo mphutha ojwayelekile kulezi zilungiselelo. Gcina umthetho umncane njengomusho ongenhla futhi uwubuyekeze uma ichibi lishintsha.

Qinisekisa kusuka kuklayenti, hhayi kuhodi

Isicelo esivela kuhodi uqobo, esiboshelwe ekhelini le-shim, sifakazela ukuthi i-shim ingafinyelela ikhonteyina. Asifakazeli ukuthi ikhonteyina lingabuyisela ukuhamba kumthombo ogciniwe we-10.95.0.x, ngoba ikheli lomthombo kulolo hlolo ngelayo i-shim.

curl -sS --interface 192.168.60.250 -o /dev/null -w '%{http_code}\n' http://192.168.60.210:8080/health
sudo tcpdump -ni macvlan-vpn host 192.168.60.210

Umyalo wokuqala uhlola ingxenye esuka kuhodi iya ekhonteyina, futhi owesibili ukhombisa okudlula ku-shim ngempela ngenkathi iklayenti le-VPN langempela lenza isicelo. Bheka ikheli lomthombo endleleni yokungena nokuthi impendulo ivela ngokugeleza okufanayo.

Ukudlulisela kufanele kuvunyelwe kuhodi, futhi indlela yokudlulisela idinga imvume yechibi le-VPN eya ku-shim embobeni yesevisi kanye nezimpendulo ezisunguliwe. Umthetho we-INPUT kuhodi awugunyazi ukuhamba okudlulisiwe, futhi yisizathu esivamile sokuthi iphakethe lilahliwe ngemva kokuba umzila ubonakala ulungile.

Sebenzisa uhlelo lokusebenza lwangempela ngezifakazelo zangempela, bese uhlola ukuthi isevisi yesibili, engahlobene, ekulowo khonteyina isakwenqaba yini. Uma indlela eyodwa yokukwenza kusebenze kwakuwukuvula wonke umthetho wokudlulisela, umklamo awukapheli. Phawula futhi ukuthi iyiphi ikheli lomthombo isevisi eyilirekhodile, ngoba yilona imithetho yayo yokufinyelela ezolisebenzisa kusukela manje.