Me yasa DNAT zuwa 127.0.0.1 ke buƙatar kulawa ta musamman

Wata sabis tana saurare a 127.0.0.1:1080. Dokar DNAT tana tura zirga-zirgar da ke shigowa zuwa wannan adireshin, amma haɗin yana gazawa. Sabis ɗin na iya kasancewa lafiya kuma dokar NAT na iya dacewa: adiresoshin loopback na IPv4 suna samun kulawa ta musamman a hanyar sadarwa.

route_localnet na Linux yana ƙayyade ko ana ɗaukar adiresoshin 127/8 a matsayin adiresoshin Mars yayin tafiyar sadarwa. Ƙimarsa ta asali tana kiyaye iyakar loopback ta yau da kullum. Keɓancewar da ta shafi wata hanya ta musamman na iya zama da muhimmanci ga ƙirar turawa ta gida da aka yi da gangan.

Wannan yana bayanin dalilin da yasa doka mai aiki daga wata na'ura zata iya dogara da sysctl da baka kwafa ba. Amma hakan baya ba da hujjar kunna zaɓin a ko'ina.

Tsammanin tsaro yana canzawa tare da hanyar

Ana amfani da ɗaurewar loopback sau da yawa saboda mataimaki bashi da tabbaci na abokin ciniki mai zaman kansa. Idan zirga-zirgar da ke zuwa daga wata hanya zata iya tafiya zuwa gareta, adireshin ɗaurewar shi kaɗai ba ya bayyana masu isa ga masu sauraro. Iyakance hanyoyin shiga, manufa da tashar jiragen ruwa a cikin ainihin ka'idar, gami da zirga-zirgar da ke iƙirarin adiresoshin tushe ko manufa na loopback inda ya dace.

Bincika sararin sunan cibiyar sadarwa da ke ɗauke da sabis ɗin. Loopback na kwantena ba loopback na uwar gida bane, kuma canza saitin hanyar uwar gida baya ƙirƙirar mai sauraro a cikin kwantenan kai tsaye.

rp_filter yana amsa wata tambaya daban game da tabbatar da hanyar tushe. Kashe shi gaba ɗaya ba shine gama-gari maye gurbin fahimtar tafiyar loopback. Haka nan ip_nonlocal_bind ya shafi ɗaure soketi zuwa adiresoshin da ba na gida ba, ba wai yin wannan hanyar DNAT daidai ba.

A ƙarshe, dole ne ka'idar da aka tura ta dace da mai sauraro. Aika ɗanyen zirga-zirgar HTTP ko TLS zuwa tashar SOCKS har yanzu yana buƙatar mai fassara; keɓancewar hanya ba zata iya samar da tattaunawar da ta ɓace ba.