I-WireGuard ku-LXC noma ku-VM ku-Proxmox: kufanele isebenze kuphi?

I-WireGuard idinga i-kernel eyodwa ngqo engumnikazi we-interface yayo, futhi lelo qiniso lixazulula iningi lempikiswano yokubekwa ku-Proxmox ngaphambi kokuthi ukusebenza kungene ekukhulumeni. I-container ye-LXC iwumbono wendawo yamagama ye-kernel yesibungu, kuyilapho i-VM iqalisa eyayo i-kernel. Ngakho umbuzo owusizo awukona ukuthi yikuphi okuwukhetho olula, kodwa ukuthi iyiphi i-kernel ozimisele ukuyishintsha futhi iyiphi indlela yokubuyisela ongaphila nayo. Phendula lokho, futhi ukukhetha phakathi kwesibungu, i-container noma i-VM ngokuvamile kuzizenzela kona.

Isivakashi se-LXC sisebenza ngaphakathi kwe-kernel yesibungu

Ukufaka wireguard-tools ngaphakathi kwe-container kukunikeza uhlelo lokulawula, hhayi i-kernel eyimfihlo. I-interface wg0 oyidalayo ibhaliswa ku-stack yenethiwekhi yesibungu futhi ivela ohlwini lwama-module esibungu. Yingakho i-container ingadlula zonke izivivinyo zamaphakethe kodwa yehluleke kumyalo wokuqala we-wg lapho i-kernel yesibungu ingenayo i-module. Futhi incwadi yereferensi yama-container e-Proxmox ibhala leyo modeli ye-kernel eyabiwe kanye nemingcele yendawo yamagama namalungelo osebenza ngaphakathi kwayo.

Igunya liwumkhawulo wesibili. Ukuphakamisa i-interface nokunamathisela amakheli kuyo kudinga amalungelo okuphatha inethiwekhi ngaphakathi kwendawo yamagama eyinikaziwe, futhi i-container engenalo ilungelo ihlela lawo malungelo ngokusebenzisa indawo yamagama yomsebenzisi wayo esikhundleni sokuwaqoga ngqo. Ungalokothi ufune ilungelo eliphelele njengempendulo yokuqala; bheka ukuthi yini eqondile efunwa ku-container, bese unikeza lokho.

I-kernel yesibungu nayo iwukuncika okwabiwe. Ukubuyekezwa kwe-kernel ye-Proxmox kushintsha ukuqaliswa kwe-WireGuard ngaphansi kwawo wonke ama-container ngesikhathi esisodwa, okuwusizo kuze kube ukubuyekezwa kanye nokulindelwe yi-container akuhambisani.

Isibungu, i-container, i-VM: yini ngayinye eyinikaziwe ngempela

Ukubeka esibungwini kubeka i-VPN kunethiwekhi ye-hypervisor uqobo. Imizila, imithetho ye-firewall kanye nomhubhe kuba yingxenye yokubuyiselwa kwesibungu, futhi iphutha lapho lingathatha i-interface yokuphatha. Lokho kwamukelekile ekuhambiseni kwengqalasizinda esibungwini ongafinyelela kuso nge-console, futhi kubuhlungu kumshini okude ongenakho ukufinyelela ngaphandle kwebhendi.

I-container igcina insizakalo ipakishiwe futhi inokuqalwa kabusha kuyilapho isaboleka i-kernel yesibungu. Ilungele insizakalo ehlanganyelwe ngamabomu ye-kernel futhi ikunikeza iyunithi encane yokwakha kabusha. Ayinikezi i-kernel ezimele, ngakho noma yini edinga ukwakhiwa kwe-module ethile ikhomba kude nalokhu kukhetha.

I-VM ibiza imemori eyengeziwe kanye nohlelo olunye lokufakwa izichibiyelo, futhi njengoba kunjalo umhubhe uthola i-kernel yawo, ithebula lawo lemizila kanye nomngcele wesithombe esisheshayo. Lapho i-VPN iyiyo into oyibuyisela emuva ngemva koshintsho olubi, leso sithombe esisheshayo sifanele umthwalo owengeziwe.

Imibandela emithathu ekukhethela

Uma umhubhe udinga inguqulo ye-kernel noma isici se-WireGuard esingakunikezwa isibungu se-Proxmox, hlala lapha futhi usebenzise i-VM. Awukwazi ukufaka i-kernel entsha ku-container, futhi akufanele ushintshe i-kernel ye-hypervisor ukukholisa isivakashi esisodwa.

Uma umhubhe uyisango lesayithi lezandulela ze-LAN zangempela, buza ukuthi ngubani osenayo indlela yokubuyela emuva. I-container ingahambisa ithrafikhi, kodwa ama-interface ayo ahlala ku-stack yesibungu, ngakho isibungu ekugcineni sithwala ingxenye yokulungiselela, kungakhathaliseki ukuthi ubuhlelile noma cha. Ukubeka esibungwini kuyathembeka ngalokhu; ukubeka ku-container ngokuvamile akuthembeki.

Bese ukala ubukhulu bomthelela wephutha. Ukuqalisa kabusha i-container kushibhile, ukubuyisela isithombe esisheshayo se-VM kuyabikezelwa, futhi ukulungisa inethiwekhi yesibungu kungadinga ukufinyelela ngokomzimba noma nge-console. Ukukhetha okulungile yilokho isimo sako esibi kakhulu ongakwazi ngempela ukukubuyisela ngehora okwenzeka ngalo.

Umbuzo wesine awuvamisile ukuba unqume kodwa kufanele ushiwo: ingabe enye into esibungwini idinga ukubona i-interface yomhubhe? Uma kunjalo, ukubeka esibungwini noma ku-container kugcina lokho kubonakala kusendaweni, kuyilapho i-VM ikhoqisa ukuhambisa phakathi kwesivakashi nesibungu.

Fakazela ukubeka ngaphambi kokuhambisa ithrafikhi kukho

Ngemva kokufakwa, qinisekisa ukuthi iyiphi i-kernel esebenzela i-interface ngempela nokuthi i-container yanikezwa igunya elanele lokuyigcina:

$ pct config 101 | grep -E 'unprivileged|features'
unprivileged: 1
$ pct exec 101 -- wg show
interface: wg0
  listening port: 51820
$ pct exec 101 -- ip -4 addr show wg0
inet 10.60.0.2/24 scope global wg0

Bese uhlola uhlangothi lokudlulisela kusuka esibungwini, ngoba ukuxhawulana kukodwa kufakazela kuphela ukuthi umhubhe umile. Sebenzisa i-ip route get ekhelini leklayenti futhi uqinisekise ukuthi isinyathelo esilandelayo ne-interface kuhambisana nomklamo, nokuthi indlela yokubuyela emuva ikhona ohlangothini olukude.

Shiya ukusetshenziswa kunomnini obhaliwe: iyiphi i-kernel ethwala ukuqaliswa, iyiphi indawo yamagama egcina i-interface, futhi yiziphi izandulela isango elivunyelwe ukuzidlulisela. Lowo musho uvimbela izehlakalo eziningi kunanoma yikuphi ukuqhathanisa kwebhentshimakhi kwalezi zindawo ezintathu.