Ama-container e-Windows ne-VPN: kungani inethiwekhi yendawo iyeka ukusebenza
I-container ye-Windows isebenzisa ithebula lomzila lomsingathi, ngakho i-VPN evimba i-subnet yendawo ihamba nayo ingxenye yokuqala ye-container. I-Linux mode ithatha enye indlela.
Kukhompyutha ephathekayo eyodwa, ngokuxhumeka kweklayenti elilodwa le-VPN, ama-container e-Linux aqhubeka ekhuluma, kanti ama-container e-Windows ayama. Okushintshayo akusona isithombe, kodwa indlela amaphakethe angena ngayo kumsingathi. Ama-container e-Windows kunethiwekhi ezenzakalelayo aboleka ithebula lomzila nokuhumusha komsingathi, ngakho inqubomgomo eshintsha umzila womsingathi iyabashintsha nabo. Qinisekisa lokho ngokusesha komzila ngaphambi kokufaka kabusha noma yini.
Amaphakethe e-container ye-Windows angena kuphi kumsingathi
I-container kunethiwekhi ezenzakalelayo nat ithola ikheli kusuka engxenyeni yokuqala yesevisi ye-Host Networking Service, ngokuvamile endaweni ethile ngaphakathi kwe-172.16.0.0/12, futhi ifinyelela umsingathi ngesidluliseli esibonakalayo. Umsingathi ungumnikazi womzila wale ngxenye futhi uhunyushela ithrafikhi kusidluliseli esisebenzayo. Akukho mshini obonakalayo ohlukile phakathi ngalowo mzila.
Yilo mklamo owenza ukwehluleka kube okomshini. Lapho i-container ithumela iphakethe, umsingathi wenza ukusesha komzila wengxenye yokuqala ye-container. Noma yimuphi umzila onqobayo, yilapho iphakethe liya khona, futhi i-container ayinawo umbono ngalokho.
Yini i-VPN client eyishintshayo kulelo mzila
Iklayenti lebhizinisi livamise ukufaka iqoqo elibanzi lemizila kanye nesihlungi esinqaba ukufinyelela ku-subnet yendawo ngenkathi umhubhe usebenza. Inhloso iwukuzivikela: inethiwekhi yendawo ehlanekezelwe akufanele ifinyelele emshinini ovikelwe. Umphumela oseceleni uwukuthi umzila womsingathi oya engxenyeni yokuqala ye-container awuseyona inethiwekhi ye-NAT yendawo.
Kunalokho ukusesha kuhambisana nomhubhe futhi iphakethe linikezwa isango lempoqo, elingakaze lizwe ngalelo kheli le-container. I-Ping yehluleka, uhlelo luphelelwa yisikhathi, futhi i-container ibonakala iphukile ngenkathi isithonjana se-VPN sikhanya. Bheka ithebula lomsingathi ngenkathi uxhumekile futhi umzila oyimbangi ubonakala.
| Container mode | Outbound path | Typical result behind the VPN |
|---|---|---|
| Windows, default nat | Host routes and translates container traffic | Container prefix follows the tunnel and fails |
| Windows, transparent | Container sits on the physical link | Depends on the local subnet being allowed |
| Linux engine on Docker Desktop | VM egress proxied by a host process | Often keeps working |
Kungani ama-container e-Linux eziphethe ngendlela ehlukile
Injini ye-Linux igijimisa ama-container ngaphakathi komshini obonakalayo olula, futhi izixhumanisi eziphumayo kulelo mshini zivulwa i-proxy yohlangothi lomsingathi egameni le-container. Umsingathi uqala isokhethi, ngakho umthetho we-VPN mayelana nengxenye yokuqala ye-container awusebenzi kuso ngendlela efanayo, futhi umthwalo womsebenzi uqhubeka ufinyelela inethiwekhi.
Lomehluko uphinde uchaze ukuthi kungani izindlela ze-Linux zingadluliswa. I-container ye-Linux edinga umhubhe wayo inikezwa idivayisi ye-TUN kanye nekhono le-NET_ADMIN. Ama-container e-Windows awavezi noma isiphi isixhumanisi njengedivayisi, ngakho lelo phatheni alinakulingana ngalolo hlangothi.
Fakazela umzila, bese ukhetha umklamo
Qoqa ubufakazi kumsingathi, hhayi ku-container, ngoba umsingathi wenza ukusesha:
docker network inspect nat --format "{{range .IPAM.Config}}{{.Subnet}}{{end}}"
route print -4
Get-NetRoute -AddressFamily IPv4 | Where-Object DestinationPrefix -like "172.16.*"Gijimisa okuphumayo komzila kanye ngaphambi kokuxhumeka kwe-VPN nakanye ngemuva. Uma ku-output yesibili ingxenye yokuqala ye-container ikhomba kusidluliseli somhubhe, ukuxilongwa kuqediwe futhi ukuqala kabusha ama-container ngeke kusize.
Ukukhetha kokuqala kuyisinqumo senqubomgomo: buza umnikazi wenethiwekhi ukuthi ukufinyelela kwe-LAN yendawo kungavunyelwa yini kule divayisi. Amaklayenti ambalwa ebhizinisi akubeka njengesilungiselelo, kodwa lokho kwenza umngcele ohlosiwe ube buthakathaka. Kucela njengokukhululwa okubhaliwe okunomnikazi nosuku lokubuyekezwa. Isishintshi sedivayisi ngayinye okungekho ozobuyela kuso iyona ndlela inqubomgomo yokuzivikela enyamalala ngayo buthule.
Lapho inqubomgomo kufanele ihlale khona, hambisa umthwalo womsebenzi esikhundleni sokulwa nomzila. Inethiwekhi esobala ene-subnet nesango elicacile ibeka ama-container kusixhumanisi sendawo, umthwalo womsebenzi we-Linux ugijima ngemuva kwe-proxy yomshini obonakalayo, futhi umshini obonakalayo ohlukile oneklayenti lawo ugcina inqubomgomo yayo. Khetha eyodwa ngamabomu futhi uyihlole ngaphakathi kwe-container, ngoba isicelo somsebenzisi siqala khona.