{"id":486971,"date":"2026-07-11T10:43:53","date_gmt":"2026-07-11T10:43:53","guid":{"rendered":"https:\/\/savepearlharbor.com\/?p=486971"},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-29T21:00:00","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=486971","title":{"rendered":"Yet another Rust VPN (TUN-QUIC-TUN)"},"content":{"rendered":"<div xmlns=\"http:\/\/www.w3.org\/1999\/xhtml\">\n<p>\u041d\u0430 \u043f\u043e\u0434\u0435\u043b\u043a\u0435 \u0438\u0437 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 <a href=\"https:\/\/habr.com\/ru\/articles\/1055582\" rel=\"noopener noreferrer nofollow\">\u0441\u0442\u0430\u0442\u044c\u0438<\/a> \u0432\u0434\u043e\u0445\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u043d\u0435 \u0437\u0430\u043a\u043e\u043d\u0447\u0438\u043b\u043e\u0441\u044c, \u0440\u0435\u0448\u0438\u043b \u043d\u0430\u043f\u0438\u0441\u0430\u0442\u044c VPN. \u0411\u044b\u043b \u043e\u043f\u044b\u0442 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 shadowsocks <a href=\"https:\/\/github.com\/veshutov\/shadowzig\" rel=\"noopener noreferrer nofollow\">\u0441\u0435\u0440\u0432\u0435\u0440\u0430<\/a>, \u0447\u0442\u043e \u043d\u0435 \u043f\u043e\u043d\u0440\u0430\u0432\u0438\u043b\u043e\u0441\u044c: \u043f\u043e\u0434 \u043a\u0430\u0436\u0434\u043e\u0435 TCP \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435, \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c\u043e\u0435 \u043a\u0430\u043a\u0438\u043c-\u043d\u0438\u0431\u0443\u0434\u044c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432, VPN \u043a\u043b\u0438\u0435\u043d\u0442 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0435 TCP c\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0430 \u0442\u043e\u0442 \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0441\u0442\u043e\u043b\u044c\u043a\u043e \u0436\u0435 \u0434\u043e \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 + \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0440\u0443\u043a\u0430\u043c\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u0442\u044c\/\u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u0442\u044c payload. \u0417\u0430\u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0447\u0442\u043e-\u0442\u043e \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u043e\u0441\u0442\u043e\u0435 + \u0441\u0430\u043c\u0438\u043c \u043d\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0438 \u043a\u043b\u0438\u0435\u043d\u0442.<\/p>\n<blockquote>\n<p>\u0414\u0438\u0441\u043a\u043b\u0435\u0439\u043c\u0435\u0440: \u043f\u0440\u043e\u0435\u043a\u0442 \u0438 \u0441\u0442\u0430\u0442\u044c\u044f \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432 \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0446\u0435\u043b\u044f\u0445, \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0432 \u0441\u0435\u0442\u044f\u0445 \u0438 \u043f\u043e\u043f\u0440\u0430\u043a\u0442\u0438\u043a\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0430 Rust, \u043d\u0438\u0447\u0435\u0433\u043e \u043d\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u0438\u0440\u0443\u044e, \u043d\u0438 \u043a \u0447\u0435\u043c\u0443 \u043d\u0435 \u043f\u0440\u0438\u0437\u044b\u0432\u0430\u044e.<\/p>\n<\/blockquote>\n<h2>\u041f\u043e\u0442\u043e\u043a \u0434\u0430\u043d\u043d\u044b\u0445<\/h2>\n<p>\u041f\u043e\u0441\u043b\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u0440\u0435\u0441\u0435\u0440\u0447\u0430 \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u0441\u044f \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0439 \u0441\u0445\u0435\u043c\u0435:<\/p>\n<figure class=\"full-width \"><img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/getpro\/habr\/upload_files\/56a\/4a9\/9cf\/56a4a99cff92b508f85cc2e81421f738.png\" alt=\"\u0422\u0440\u0430\u0444\u0438\u043a \u0434\u043e \u0441\u0430\u0439\u0442\u0430 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435\" title=\"\u0422\u0440\u0430\u0444\u0438\u043a \u0434\u043e \u0441\u0430\u0439\u0442\u0430 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435\" width=\"1325\" height=\"481\" sizes=\"auto, (max-width: 780px) 100vw, 50vw\" srcset=\"https:\/\/habrastorage.org\/r\/w780\/getpro\/habr\/upload_files\/56a\/4a9\/9cf\/56a4a99cff92b508f85cc2e81421f738.png 780w,&#10;       https:\/\/habrastorage.org\/r\/w1560\/getpro\/habr\/upload_files\/56a\/4a9\/9cf\/56a4a99cff92b508f85cc2e81421f738.png 781w\" loading=\"lazy\" decode=\"async\"\/><\/p>\n<div><figcaption>\u0422\u0440\u0430\u0444\u0438\u043a \u0434\u043e \u0441\u0430\u0439\u0442\u0430 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435<\/figcaption><\/div>\n<\/figure>\n<p>\u0414\u0430\u0432\u0430\u0439\u0442\u0435 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u0437\u0434\u0435\u0441\u044c \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442.<\/p>\n<blockquote>\n<p>\u0412 \u043c\u043e\u0435\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043a\u043b\u0438\u0435\u043d\u0442 \u2013 Mac OS, \u0441\u0435\u0440\u0432\u0435\u0440 \u2013 Ubuntu, \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u044d\u0442\u043e \u0432\u043b\u0438\u044f\u0435\u0442 \u043b\u0438\u0448\u044c \u043d\u0430 \u0442\u043e, \u043a\u0430\u043a\u0438\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438 \u0431\u0443\u0434\u0443\u0442 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u044b \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 (route, nftables, etc).<\/p>\n<\/blockquote>\n<p>\u0421\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u043a\u043b\u0438\u0435\u043d\u0442\u0430, VPN:<\/p>\n<ul>\n<li>\n<p>\u041f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442 TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 <strong>utun1<\/strong><\/p>\n<\/li>\n<li>\n<p>\u0414\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043c\u0430\u0440\u0448\u0440\u0448\u0443\u0442\u044b:<\/p>\n<ul>\n<li>\n<p><code>route add -net 0.0.0.0\/1 -interface utun1<\/code> + <code>route add -net 128.0.0.0\/1 -interface utun1<\/code> \u0437\u0430\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u044e\u0442 \u0432\u0435\u0441\u044c \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u0447\u0435\u0440\u0435\u0437 \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 (\u0434\u0432\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u0442\u0440\u043e\u0433\u0430\u0442\u044c \u0434\u0435\u0444\u043e\u043b\u0442\u043d\u044b\u0439 0.0.0.0\/0)<\/p>\n<\/li>\n<li>\n<p><code>route add -host 1.1.1.1 {default_gw}<\/code> \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0442\u0440\u0430\u0444\u0438\u043a \u0434\u043e VPN \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0430 <strong>utun1<\/strong> (\u0432\u043c\u0435\u0441\u0442\u043e <strong>default_gw<\/strong> \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0430\u0434\u0440\u0435\u0441 \u0448\u043b\u044e\u0437\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e)<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u041f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u0435\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c\u044b\u0439 \u043d\u0430 <strong>utun1<\/strong> \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 VPN \u0441\u0435\u0440\u0432\u0435\u0440, \u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u0438\u0440\u0443\u044f \u0432 QUIC \u0434\u0430\u0442\u0430\u0433\u0440\u0430\u043c\u043c\u044b, \u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c\u044b\u0439 \u043f\u043e QUIC \u0442\u0440\u0430\u0444\u0438\u043a \u043e\u0431\u0440\u0430\u0442\u043d\u043e \u0432 <strong>utun1<\/strong><\/p>\n<\/li>\n<\/ul>\n<p>\u0421\u0435\u0440\u0432\u0435\u0440:<\/p>\n<ul>\n<li>\n<p>\u041f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442 TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 <strong>utun1<\/strong><\/p>\n<\/li>\n<li>\n<p>\u0427\u0442\u043e\u0431\u044b <strong>utun1<\/strong> \u043c\u043e\u0433 \u0445\u043e\u0434\u0438\u0442\u044c \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442, \u0431\u0443\u0434\u0442\u043e \u043e\u043d <strong>en0<\/strong> (\u0434\u0435\u0444\u043e\u043b\u0442\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441), \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 ruleset \u0432 <strong>nftables<\/strong> (\u0432\u043c\u0435\u0441\u0442\u043e <strong>vpn_net<\/strong> \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0435\u0442\u044c, \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043f\u0440\u043e \u043d\u0435\u0435 \u0431\u0443\u0434\u0435\u0442 \u043d\u0438\u0436\u0435):<\/p>\n<pre><code>table ip vpn_natflush table ip vpn_nattable ip vpn_nat {{    chain postrouting {{        type nat hook postrouting priority 100;        ip saddr {vpn_net} oifname en0 masquerade    }}}}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:87px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<\/li>\n<li>\n<p>\u041f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u0435\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c\u044b\u0439 \u043f\u043e QUIC \u0442\u0440\u0430\u0444\u0438\u043a \u0432 <strong>utun1<\/strong>, \u0430 \u0438\u0437 \u043d\u0435\u0433\u043e \u043e\u0431\u0440\u0430\u0442\u043d\u043e \u043f\u043e QUIC<\/p>\n<\/li>\n<\/ul>\n<h2>\u041d\u044e\u0430\u043d\u0441\u044b<\/h2>\n<p>\u0422\u0440\u0430\u0444\u0438\u043a \u043c\u0435\u0436\u0434\u0443 VPN \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u043c \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c \u0447\u0435\u0440\u0435\u0437 QUIC \u0434\u0430\u0442\u0430\u0433\u0440\u0430\u043c\u043c\u044b, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0439 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043d\u0435\u0442 (\u0437\u0430\u0442\u043e \u0435\u0441\u0442\u044c TLS). \u042d\u0442\u043e \u043d\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0434\u043b\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u0442.\u043a. \u0440\u0435\u0442\u0440\u0430\u0438 \u0431\u0443\u0434\u0435\u0442 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0442\u044c \u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b (\u0435\u0441\u043b\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442). \u041e\u0434\u043d\u0430\u043a\u043e \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u0442\u0435\u0440\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0434\u0435\u0441\u044c \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0441\u044f QUIC bidirectional stream.<\/p>\n<p>\u0421\u0435\u0440\u0432\u0435\u0440 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442 \u043d\u0438\u043a\u0430\u043a \u043d\u0435 \u043c\u0435\u043d\u044f\u044e\u0442 \u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0442\u0440\u0430\u0444\u0438\u043a, \u0442.\u0435. source IP \u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0431\u0443\u0434\u0435\u0442 \u043e\u0442 \u0438\u0445 TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430. \u0422\u0430\u043a \u043a\u0430\u043a \u043c\u044b \u0437\u0430\u0440\u0430\u043d\u0435\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c ruleset \u0434\u043b\u044f nftables, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e, \u0447\u0442\u043e\u0431\u044b \u044d\u0442\u043e\u0442 IP \u0431\u044b\u043b \u0438\u0437 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 <strong>vpn_net<\/strong>. \u041f\u043e\u043c\u0438\u043c\u043e \u044d\u0442\u043e\u0433\u043e, \u043a\u043e\u0433\u0434\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u043e\u043b\u0443\u0447\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u0442\u0440\u0430\u0444\u0438\u043a, \u043f\u043e destination IP \u043f\u0430\u043a\u0435\u0442\u0430 \u043d\u0430\u0434\u043e \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c, \u043a\u043e\u043c\u0443 \u0438\u0437 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0435\u0433\u043e \u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c. \u0412\u044b\u0432\u043e\u0434: IP TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432 \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b, \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u0439 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 + \u0441\u0435\u0440\u0432\u0435\u0440 \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u043d\u0430\u0442\u044c \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 \u043a\u043b\u0438\u0435\u043d\u0442 &#8212; IP. \u0421\u0430\u043c\u043e\u0435 \u043f\u0440\u043e\u0441\u0442\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u2013 \u0441\u0442\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f:<\/p>\n<pre><code class=\"bash\">\/\/ \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435tun = \"10.0.0.1\/24\"client1 = \"10.0.0.2\"client2 = \"10.0.0.3\"...\/\/ \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 client1tun = \"10.0.0.2\/24\"\/\/ \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 client2tun = \"10.0.0.3\/24\"<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<p>\u0425\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u043c\u0435\u043d\u044c\u0448\u0435 \u0440\u0443\u0447\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432\u043c\u0435\u0441\u0442\u043e \u0441\u0442\u0430\u0442\u0438\u043a\u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043c IPAM (IP Address Management): \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0432\u044b\u0434\u0430\u0435\u043c \u0435\u043c\u0443 IP \u0438\u0437 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0435\u0442\u0438, \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0435\u0435 \u0440\u0430\u0437\u043c\u0435\u0440 \u0438 \u0432\u044b\u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u0430, \u043f\u0440\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u2013 &#171;\u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0430\u0435\u043c&#187; \u0430\u0434\u0440\u0435\u0441. \u041a\u043b\u0438\u0435\u043d\u0442 \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442 TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0438\u043c\u0435\u043d\u043d\u043e \u0441 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u043c \u043e\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 IP.<\/p>\n<h2>\u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438<\/h2>\n<ul>\n<li>\n<p><a href=\"https:\/\/crates.io\/crates\/tokio\" rel=\"noopener noreferrer nofollow\"><strong>tokio<\/strong><\/a> \u2013 async runtime<\/p>\n<\/li>\n<li>\n<p><a href=\"https:\/\/crates.io\/crates\/tun-rs\" rel=\"noopener noreferrer nofollow\"><strong>tun-rs<\/strong><\/a> \u2013 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430\u043c\u0438<\/p>\n<\/li>\n<li>\n<p><a href=\"https:\/\/docs.rs\/quinn\/latest\/quinn\" rel=\"noopener noreferrer nofollow\"><strong>quinn<\/strong><\/a> \u2013 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f QUIC \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430<\/p>\n<\/li>\n<\/ul>\n<h2>\u041a\u043b\u0438\u0435\u043d\u0442<\/h2>\n<p>\u0422.\u043a. \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f self signed \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442, \u0435\u0433\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043f\u043e\u0434\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0438 \u043f\u0440\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 QUIC \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u0430 \u043d\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0435. <\/p>\n<details class=\"spoiler\">\n<summary>Client QUIC endpoint<\/summary>\n<div class=\"spoiler__content\">\n<pre><code class=\"rust\">use anyhow::Error;use quinn::{ClientConfig, Endpoint, MtuDiscoveryConfig, TransportConfig, congestion::BbrConfig};use rustls::pki_types::CertificateDer;use std::sync::Arc;use crate::config::QuicConfig;pub fn make_client_endpoint(config: &amp;QuicConfig) -&gt; Result&lt;Endpoint, Error&gt; {    let mut client_cfg = configure_client(config)?;    client_cfg.transport_config(Arc::new(build_transport_config(config)));    let mut endpoint = Endpoint::client(config.endpoint_address)?;    endpoint.set_default_client_config(client_cfg);    Ok(endpoint)}fn configure_client(config: &amp;QuicConfig) -&gt; Result&lt;ClientConfig, Error&gt; {    \/\/ \u0447\u0438\u0442\u0430\u0435\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0441 \u0434\u0438\u0441\u043a\u0430    let cert_bytes = std::fs::read(&amp;config.server_cert)?;    let server_cert = CertificateDer::from(cert_bytes);    let mut certs = rustls::RootCertStore::empty();    certs.add(server_cert)?;    Ok(ClientConfig::with_root_certificates(Arc::new(certs))?)}fn build_transport_config(quic_config: &amp;QuicConfig) -&gt; TransportConfig {    let mut transport = TransportConfig::default();    transport.mtu_discovery_config(Some(MtuDiscoveryConfig::default()));    transport.datagram_receive_buffer_size(Some(quic_config.receive_buffer_size_kb * 1024));    transport.datagram_send_buffer_size(quic_config.send_buffer_size_kb * 1024);    transport.max_concurrent_uni_streams(0u32.into());    transport.max_concurrent_bidi_streams(10u32.into());    transport.congestion_controller_factory(Arc::new(BbrConfig::default()));    transport}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<\/div>\n<\/details>\n<p>\u0412 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0446\u0438\u043a\u043b\u0435 \u043f\u0440\u043e\u0441\u0442\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u043c\u0441\u044f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c \u0442\u0443\u043d\u043d\u0435\u043b\u044c<\/p>\n<pre><code class=\"rust\">tokio::spawn(async move {    loop {        let connecting = match endpoint.connect(server_address, &amp;server_name) {            Ok(c) =&gt; c,            Err(e) =&gt; {                error!(\"connect failed: {e:#}, retrying in {backoff:?}\");                sleep(backoff).await;                continue;            }        };        let connection = match connecting.await {            Ok(c) =&gt; c,            Err(e) =&gt; {                error!(\"handshake failed: {e:#}, retrying in {backoff:?}\");                sleep(backoff).await;                continue;            }        };        info!(\"connected to server {}\", connection.remote_address());        match run_tunnel(connection.clone(), &amp;config).await {            Ok(_) =&gt; error!(\"session ended, reconnecting...\"),            Err(e) =&gt; error!(\"error running tunnel: {e:#}\"),        };        connection.close(CLOSE_CODE_NORMAL, &amp;[]);        sleep(backoff).await;    }})<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<p>\u041e\u0431\u043c\u0435\u043d \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 handshake: \u043a\u043b\u0438\u0435\u043d\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0432\u043e\u0438 credentials, \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0438\u0445 \u0438 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u0441\u043f\u0435\u0445\u0430 \u043d\u0430\u0437\u043d\u0430\u0447\u0430\u0435\u0442 IP \u0430\u0434\u0440\u0435\u0441<\/p>\n<pre><code class=\"rust\">pub struct ClientHello {    pub user: String,    pub secret: String,}pub struct ServerHello {    pub addr: Ipv4Addr,    pub prefix: u8,}async fn handshake(    connection: &amp;Connection,    config: &amp;VpnConfig,) -&gt; Result&lt;ServerHello, anyhow::Error&gt; {    \/\/ QUIC stream, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u0442\u0435\u0440\u044f\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a    let (mut send, mut recv) = connection.open_bi().await?;    \/\/ \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438    let client_hello_bytes: Vec&lt;u8&gt; = ClientHello {        user: config.user.name.clone(),        secret: config.user.secret.clone(),    }    .into();    info!(\"sending client hello\");    send.write_all(&amp;client_hello_bytes).await?;    send.finish()?;    let server_hello_bytes = recv.read_to_end(MAX_HANDSHAKE_DATA).await?;    let server_hello = ServerHello::from(server_hello_bytes);    info!(\"authentication succeeded\");    \/\/ \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0430\u0434\u0440\u0435\u0441 \u0434\u043b\u044f TUN    Ok(server_hello)}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<p>\u041f\u043e\u0441\u043b\u0435 handshake \u0441\u043e\u0437\u0434\u0430\u0435\u043c TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441, \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u044e<\/p>\n<pre><code class=\"rust\">pub async fn run_tunnel(connection: Connection, config: &amp;VpnConfig) -&gt; Result&lt;()&gt; {    let handshake = handshake(&amp;connection, config).await?;    let addr: Ipv4Addr = handshake.addr;    let prefix: u8 = handshake.prefix;    info!(\"registring tun {addr}\/{prefix}\");    let device_name = &amp;config.tun.name;    let server_address = &amp;config.quic.server_address.ip().to_string();    let mtu = config.tun.mtu;    let device = Arc::new(        DeviceBuilder::new()            .name(device_name)            .ipv4(addr, prefix, None)            .mtu(mtu)            .build_async()?,    );    \/\/ \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u044b, drop _guard \u0438\u0445 \u043f\u043e\u0447\u0438\u0441\u0442\u0438\u0442    let _guard = if config.tun.setup_routes {        Some(setup_vpn_routes(server_address, device_name)?)    } else {        None    };    \/\/ \u0437\u0430\u0434\u0430\u0447\u0430 \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435 \u0438\u0437 TUN \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u043f\u043e QUIC    let mut device_recv_task = {        let device = device.clone();        let connection = connection.clone();        tokio::spawn(async move {            let mut buf = vec![0u8; READ_BUF_SIZE];            loop {                let n = device.recv(&amp;mut buf).await?;                connection.send_datagram(Bytes::copy_from_slice(&amp;buf[..n]))?;            }            #[allow(unreachable_code)]            Ok::&lt;(), anyhow::Error&gt;(())        })    };    \/\/ \u0437\u0430\u0434\u0430\u0447\u0430 \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435 \u043f\u043e QUIC \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0432 TUN    let mut connection_read_task = {        let connection = connection.clone();        if let Some(max_datagram_size) = connection.max_datagram_size() {            info!(\"connection max_datagram_size = {max_datagram_size}\");        }        let device = device.clone();        tokio::spawn(async move {            loop {                let data = connection.read_datagram().await?;                device.send(&amp;data).await?;            }            #[allow(unreachable_code)]            Ok::&lt;(), anyhow::Error&gt;(())        })    };    let result = tokio::select! {        res = &amp;mut device_recv_task =&gt; res.unwrap_or_else(|e| Err(e.into())),        res = &amp;mut connection_read_task =&gt; res.unwrap_or_else(|e| Err(e.into())),    };    device_recv_task.abort();    connection_read_task.abort();    result}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<h2>\u0421\u0435\u0440\u0432\u0435\u0440<\/h2>\n<pre><code class=\"rust\">pub struct VpnServerState {    \/\/ \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f    config: VpnConfig,    \/\/ TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441    device: AsyncDevice,    \/\/ QUIC endpoint, \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u044e\u0442\u0441\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u044b    endpoint: Endpoint,    \/\/ IPAM    ip_pool: IpPool,    \/\/ \u0412\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u0430\u0434\u0440\u0435\u0441 -&gt; \u043a\u043b\u0438\u0435\u043d\u0442, \u0434\u043b\u044f \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430    connections: DashMap&lt;Ipv4Addr, Connection&gt;,    \/\/ \u0414\u043b\u044f graceful shutdown    cancellation_token: CancellationToken,    task_tracker: TaskTracker,}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<details class=\"spoiler\">\n<summary>IPAM<\/summary>\n<div class=\"spoiler__content\">\n<pre><code class=\"rust\">use std::collections::VecDeque;use std::net::Ipv4Addr;use std::sync::Mutex;pub struct IpPool {    pub subnet_base: Ipv4Addr,    pub subnet_prefix: u8,    available: Mutex&lt;VecDeque&lt;Ipv4Addr&gt;&gt;,}impl IpPool {    pub fn new(subnet_base: Ipv4Addr, subnet_prefix: u8) -&gt; Self {        let base_u32 = u32::from(subnet_base);        let host_bits = 32 - subnet_prefix as u32;        let num_addrs = 1u32 &lt;&lt; host_bits;        \/\/ \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u043c 0, 1 \u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439 \u0430\u0434\u0440\u0435\u0441        let mut queue = VecDeque::new();        for i in 2..(num_addrs - 1) {            queue.push_back(Ipv4Addr::from(base_u32 + i));        }        IpPool {            subnet_base,            subnet_prefix,            available: Mutex::new(queue),        }    }    pub fn server_ip(&amp;self) -&gt; Ipv4Addr {        let base_u32 = u32::from(self.subnet_base);        return Ipv4Addr::from(base_u32 + 1);    }    pub fn allocate(&amp;self) -&gt; Option&lt;Ipv4Addr&gt; {        self.available.lock().unwrap().pop_front()    }    pub fn release(&amp;self, ip: Ipv4Addr) {        self.available.lock().unwrap().push_back(ip);    }}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<\/div>\n<\/details>\n<p>\u041f\u0440\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 QUIC endpoint \u043f\u043e\u0434\u0433\u0440\u0443\u0436\u0430\u0435\u043c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0438\u043b\u0438 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u043c \u043d\u043e\u0432\u044b\u0439 self signed \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442<\/p>\n<details class=\"spoiler\">\n<summary>Server QUIC endpoint<\/summary>\n<div class=\"spoiler__content\">\n<pre><code class=\"rust\">use anyhow::Result;use quinn::congestion::BbrConfig;use quinn::{Endpoint, MtuDiscoveryConfig, ServerConfig, TransportConfig};use rustls::pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer};use tracing::info;use std::fs;use std::path::Path;use std::sync::Arc;use crate::config::QuicConfig;pub fn make_server_endpoint(config: &amp;QuicConfig) -&gt; Result&lt;Endpoint&gt; {    let server_config = configure_server(config)?;    let endpoint = Endpoint::server(server_config, config.endpoint_address)?;    Ok(endpoint)}fn configure_server(config: &amp;QuicConfig) -&gt; Result&lt;ServerConfig&gt; {    let (cert_der, key_der) = load_or_generate_cert(config)?;    let mut server_config = ServerConfig::with_single_cert(vec![cert_der.clone()], key_der)?;    server_config.transport_config(Arc::new(build_transport_config(config)));    Ok(server_config)}fn load_or_generate_cert(    quic_config: &amp;QuicConfig,) -&gt; Result&lt;(CertificateDer&lt;'static&gt;, PrivateKeyDer&lt;'static&gt;)&gt; {    let cert_path = &amp;quic_config.server_cert;    let key_path = &amp;quic_config.server_key;    if Path::new(cert_path).exists() &amp;&amp; Path::new(key_path).exists() {        info!(\"loading existing cert + key\");        let cert_bytes = fs::read(cert_path)?;        let key_bytes = fs::read(key_path)?;        let cert = CertificateDer::from(cert_bytes);        let key = PrivateKeyDer::Pkcs8(PrivatePkcs8KeyDer::from(key_bytes));        Ok((cert, key))    } else {        info!(\"generating new cert + key\");        let subject_alt_names = vec![quic_config.server_name.clone().into()];        let cert = rcgen::generate_simple_self_signed(subject_alt_names)?;        let cert_der = cert.cert.der().to_vec();        let key_der = cert.signing_key.serialize_der();        fs::write(cert_path, &amp;cert_der)?;        fs::write(key_path, &amp;key_der)?;        let cert = CertificateDer::from(cert_der);        let key = PrivateKeyDer::Pkcs8(PrivatePkcs8KeyDer::from(key_der));        Ok((cert, key))    }}fn build_transport_config(quic_config: &amp;QuicConfig) -&gt; TransportConfig {    let mut transport = TransportConfig::default();    transport.mtu_discovery_config(Some(MtuDiscoveryConfig::default()));    transport.datagram_receive_buffer_size(Some(quic_config.receive_buffer_size_kb * 1024));    transport.datagram_send_buffer_size(quic_config.send_buffer_size_kb * 1024);    transport.max_concurrent_uni_streams(0u32.into());    transport.max_concurrent_bidi_streams(10u32.into());    transport.congestion_controller_factory(Arc::new(BbrConfig::default()));    transport}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<\/div>\n<\/details>\n<p>\u041b\u043e\u0433\u0438\u043a\u0430 \u0432 \u0446\u0435\u043b\u043e\u043c \u043f\u043e\u0445\u043e\u0436\u0430 \u043d\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0443\u044e, \u0442\u043e\u0436\u0435 \u0434\u0432\u0435 \u0437\u0430\u0434\u0430\u0447\u0438, \u043e\u0434\u043d\u0430 \u2013 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u043d\u043e\u0432\u044b\u0445 QUIC \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439, \u0434\u0440\u0443\u0433\u0430\u044f \u2013 \u0447\u0442\u0435\u043d\u0438\u0435 \u0438\u0437 TUN \u0438 \u0437\u0430\u043f\u0438\u0441\u044c \u0432 QUIC<\/p>\n<pre><code class=\"rust\">pub async fn run(&amp;self) -&gt; Result&lt;()&gt; {    let subnet = format!(        \"{}\/{}\",        self.ip_pool.subnet_base, self.ip_pool.subnet_prefix    );    \/\/ \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c nftables, drop _nat_guard \u043f\u043e\u0447\u0438\u0441\u0442\u0438\u0442 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438    let _nat_guard = if self.config.tun.setup_nat {        Some(apply_vpn_nat(&amp;subnet)?)    } else {        None    };    let device_worker = {        let server = self.clone();        self.task_tracker            .spawn(async move { listen_device(server).await })    };    let connection_worker = {        let server = self.clone();        self.task_tracker            .spawn(async move { accept_connections(server).await })    };    tokio::select! {        r = device_worker =&gt; r.unwrap_or_else(|e| Err(e.into())),        r = connection_worker =&gt; r.map_err(|e| anyhow::anyhow!(e)),    }}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<p>\u041f\u0440\u0438 \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0443\u044e \u0437\u0430\u0434\u0430\u0447\u0443, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c handshake \u0438 \u0432 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c \u0446\u0438\u043a\u043b \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 connection -&gt; device<\/p>\n<pre><code class=\"rust\">async fn register(&amp;self, connection: &amp;Connection) -&gt; Result&lt;Session&gt; {    let ip = self        .ip_pool        .allocate()        .ok_or_else(|| anyhow!(\"ip pool exhausted\"))?;    self.connections.insert(ip, connection.clone());    \/\/ drop session \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u0442 \u043a \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044e \u0430\u0434\u0440\u0435\u0441\u0430 \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044e \u0438\u0437 connections    let session = Session::new(ip, connection.clone(), self.clone());    self.handshake(connection, ip).await?;    Ok(session)}async fn handle_session(&amp;self, session: Session) -&gt; Result&lt;()&gt; {    let mut consecutive_errors = 0;    loop {        let read = session.read().await?;        if source_match(session.ip, &amp;read) {            match self.device.send(&amp;read).await {                Ok(_sent) =&gt; {                    consecutive_errors = 0;                }                Err(e) =&gt; {                    consecutive_errors += 1;                    if consecutive_errors &gt; MAX_CONSECUTIVE_ERRORS {                        return Err(e.into());                    }                    sleep(Duration::from_millis(                        ERROR_BACKOFF_BASE_MS * consecutive_errors,                    ))                    .await;                }            }        }    }}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<h2>\u0422\u0435\u0441\u0442\u0438\u0440\u0443\u0435\u043c<\/h2>\n<p>\u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c \u043e\u0442\u0435\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 <a href=\"https:\/\/yandex.ru\/internet\" rel=\"noopener noreferrer nofollow\">\u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u043e\u043c\u0435\u0442\u0440<\/a>, \u0442\u0435\u0441\u0442\u0438\u0440\u0443\u0435\u043c \u0434\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0438 \u043f\u043e\u0441\u043b\u0435 (\u0447\u0435\u0440\u0435\u0437 \u0410\u043c\u0441\u0442\u0435\u0440\u0434\u0430\u043c)<\/p>\n<figure class=\"full-width \"><img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/getpro\/habr\/upload_files\/01e\/6f5\/89d\/01e6f589d8c5237433a7f8295919442b.png\" alt=\"\u0414\u043e\" title=\"\u0414\u043e\" width=\"989\" height=\"487\" sizes=\"auto, (max-width: 780px) 100vw, 50vw\" srcset=\"https:\/\/habrastorage.org\/r\/w780\/getpro\/habr\/upload_files\/01e\/6f5\/89d\/01e6f589d8c5237433a7f8295919442b.png 780w,&#10;       https:\/\/habrastorage.org\/r\/w1560\/getpro\/habr\/upload_files\/01e\/6f5\/89d\/01e6f589d8c5237433a7f8295919442b.png 781w\" loading=\"lazy\" decode=\"async\"\/><\/p>\n<div><figcaption>\u0414\u043e<\/figcaption><\/div>\n<\/figure>\n<figure class=\"full-width \"><img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/getpro\/habr\/upload_files\/a3b\/7ee\/6fc\/a3b7ee6fcf726ac9d0138801ca62b582.png\" alt=\"\u041f\u043e\u0441\u043b\u0435\" title=\"\u041f\u043e\u0441\u043b\u0435\" width=\"962\" height=\"498\" sizes=\"auto, (max-width: 780px) 100vw, 50vw\" srcset=\"https:\/\/habrastorage.org\/r\/w780\/getpro\/habr\/upload_files\/a3b\/7ee\/6fc\/a3b7ee6fcf726ac9d0138801ca62b582.png 780w,&#10;       https:\/\/habrastorage.org\/r\/w1560\/getpro\/habr\/upload_files\/a3b\/7ee\/6fc\/a3b7ee6fcf726ac9d0138801ca62b582.png 781w\" loading=\"lazy\" decode=\"async\"\/><\/p>\n<div><figcaption>\u041f\u043e\u0441\u043b\u0435<\/figcaption><\/div>\n<\/figure>\n<p>\u041d\u0430\u0432\u0435\u0440\u043d\u044f\u043a\u0430 \u0435\u0441\u0442\u044c, \u0447\u0442\u043e \u043f\u043e\u0434\u043a\u0440\u0443\u0442\u0438\u0442\u044c \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 QUIC + \u043d\u0435 \u0441\u0430\u043c\u044b\u0439 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0442\u0435\u0441\u0442, \u043d\u043e \u0432\u0441\u0435 \u0440\u0430\u0432\u043d\u043e \u043d\u0435\u043f\u043b\u043e\u0445\u043e.<\/p>\n<h2>\u0415\u0449\u0435 \u043d\u0435\u043c\u043d\u043e\u0433\u043e \u0434\u0435\u0442\u0430\u043b\u0435\u0439<\/h2>\n<p>MTU (Maximum Transmission Unit) TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432 \u0438 QUIC \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u044b, \u0434\u0430\u0431\u044b \u043d\u0435 \u043f\u044b\u0442\u0430\u0442\u044c\u0441\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u043e QUIC \u043f\u0430\u043a\u0435\u0442, \u043d\u0435 \u0432\u043b\u0435\u0437\u0430\u044e\u0449\u0438\u0439 \u0432 MTU, \u0438 \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u043c\u043e\u0440\u043e\u043a\u0438 \u0441 \u0447\u0430\u0441\u0442\u0438\u0447\u043d\u043e\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u043e\u0439.<\/p>\n<p>\u041f\u0440\u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0441\u0432\u0435\u0440\u044f\u0442\u044c IP \u043f\u0430\u043a\u0435\u0442\u0430 \u0441 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043d\u044b\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0443 IP, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u0432\u044b\u043b\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043c\u0438\u043c\u0438\u043a\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434 \u0434\u0440\u0443\u0433\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432.<\/p>\n<p>\u0418 \u0434\u043b\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0430, \u0438 \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d graceful shutdown, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u043f\u043e\u0441\u043b\u0435 \u0441\u0435\u0431\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 (nftables\/route)<\/p>\n<details class=\"spoiler\">\n<summary>await_shutdown()<\/summary>\n<div class=\"spoiler__content\">\n<pre><code class=\"rust\">pub async fn await_shutdown() {    let ctrl_c = async {        signal::ctrl_c()            .await            .expect(\"Failed to install Ctrl+C handler\");    };    #[cfg(unix)]    let terminate = async {        signal::unix::signal(signal::unix::SignalKind::terminate())            .expect(\"Failed to install SIGTERM handler\")            .recv()            .await;    };    #[cfg(not(unix))]    let terminate = std::future::pending::&lt;()&gt;();    tokio::select! {        _ = ctrl_c =&gt; {            info!(\"received SIGINT, initiating shutdown...\");        }        _ = terminate =&gt; {            info!(\"received SIGTERM, initiating shutdown...\");        }    }}<\/code><div class=\"code-explainer\"><a href=\"https:\/\/sourcecraft.dev\/\" class=\"tm-button code-explainer__link\" style=\"visibility: hidden;\"><img style=\"width:14px;height:14px;object-fit:cover;object-position:left;\"\/><\/a><\/div><\/pre>\n<\/div>\n<\/details>\n<p>\u041f\u0440\u043e\u0435\u043a\u0442 \u0441\u043e\u0437\u0434\u0430\u043d \u0432 \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0446\u0435\u043b\u044f\u0445, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0442\u043e\u0447\u043d\u043e \u0435\u0441\u0442\u044c, \u0447\u0442\u043e \u0434\u043e\u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c:<\/p>\n<ul>\n<li>\n<p>\u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0431\u043e\u043b\u0435\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u043e\u0431\u043c\u0435\u043d \u0441\u0435\u043a\u0440\u0435\u0442\u0430\u043c\u0438<\/p>\n<\/li>\n<li>\n<p>\u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c rate limiter \u0434\u043b\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439<\/p>\n<\/li>\n<li>\n<p>\u0443\u043b\u0443\u0447\u0448\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c<\/p>\n<\/li>\n<li>\n<p>\u0438 \u0442.\u0434.<\/p>\n<\/li>\n<\/ul>\n<h2>\u0421\u0441\u044b\u043b\u043a\u0438<\/h2>\n<ul>\n<li>\n<p>\u041a\u043e\u0434 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u2013 <a href=\"https:\/\/github.com\/veshutov\/tuic\" rel=\"noopener noreferrer nofollow\">https:\/\/github.com\/veshutov\/tuic<\/a><\/p>\n<\/li>\n<li>\n<p>\u0415\u0441\u043b\u0438 \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u043f\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u043f\u0440\u043e \u0447\u0442\u043e-\u0442\u043e \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u043e\u0435 \u2013 <a href=\"https:\/\/habr.com\/ru\/articles\/1052536\/\" rel=\"noopener noreferrer nofollow\">https:\/\/habr.com\/ru\/articles\/1052536<\/a><\/p>\n<\/li>\n<\/ul>\n<\/div>\n<p>\u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438 <a href=\"https:\/\/habr.com\/ru\/articles\/1058104\/\">https:\/\/habr.com\/ru\/articles\/1058104\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u041d\u0430 \u043f\u043e\u0434\u0435\u043b\u043a\u0435 \u0438\u0437 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u0432\u0434\u043e\u0445\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u043d\u0435 \u0437\u0430\u043a\u043e\u043d\u0447\u0438\u043b\u043e\u0441\u044c, \u0440\u0435\u0448\u0438\u043b \u043d\u0430\u043f\u0438\u0441\u0430\u0442\u044c VPN. \u0411\u044b\u043b \u043e\u043f\u044b\u0442 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 shadowsocks \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0447\u0442\u043e \u043d\u0435 \u043f\u043e\u043d\u0440\u0430\u0432\u0438\u043b\u043e\u0441\u044c: \u043f\u043e\u0434 \u043a\u0430\u0436\u0434\u043e\u0435 TCP \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435, \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c\u043e\u0435 \u043a\u0430\u043a\u0438\u043c-\u043d\u0438\u0431\u0443\u0434\u044c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432, VPN \u043a\u043b\u0438\u0435\u043d\u0442 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0435 TCP c\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0430 \u0442\u043e\u0442 \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0441\u0442\u043e\u043b\u044c\u043a\u043e \u0436\u0435 \u0434\u043e \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u0438 + \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c \u0440\u0443\u043a\u0430\u043c\u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u0442\u044c\/\u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u0442\u044c payload. \u0417\u0430\u0445\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0447\u0442\u043e-\u0442\u043e \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u043e\u0441\u0442\u043e\u0435 + \u0441\u0430\u043c\u0438\u043c \u043d\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0438 \u043a\u043b\u0438\u0435\u043d\u0442.\u0414\u0438\u0441\u043a\u043b\u0435\u0439\u043c\u0435\u0440: \u043f\u0440\u043e\u0435\u043a\u0442 \u0438 \u0441\u0442\u0430\u0442\u044c\u044f \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432 \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0446\u0435\u043b\u044f\u0445, \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0432 \u0441\u0435\u0442\u044f\u0445 \u0438 \u043f\u043e\u043f\u0440\u0430\u043a\u0442\u0438\u043a\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0430 Rust, \u043d\u0438\u0447\u0435\u0433\u043e \u043d\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u0438\u0440\u0443\u044e, \u043d\u0438 \u043a \u0447\u0435\u043c\u0443 \u043d\u0435 \u043f\u0440\u0438\u0437\u044b\u0432\u0430\u044e.\u041f\u043e\u0442\u043e\u043a \u0434\u0430\u043d\u043d\u044b\u0445\u041f\u043e\u0441\u043b\u0435 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u0440\u0435\u0441\u0435\u0440\u0447\u0430 \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u0441\u044f \u043d\u0430 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0439 \u0441\u0445\u0435\u043c\u0435:\u0422\u0440\u0430\u0444\u0438\u043a \u0434\u043e \u0441\u0430\u0439\u0442\u0430 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435\u0414\u0430\u0432\u0430\u0439\u0442\u0435 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u0437\u0434\u0435\u0441\u044c \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442.\u0412 \u043c\u043e\u0435\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043a\u043b\u0438\u0435\u043d\u0442 \u2013 Mac OS, \u0441\u0435\u0440\u0432\u0435\u0440 \u2013 Ubuntu, \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u044d\u0442\u043e \u0432\u043b\u0438\u044f\u0435\u0442 \u043b\u0438\u0448\u044c \u043d\u0430 \u0442\u043e, \u043a\u0430\u043a\u0438\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438 \u0431\u0443\u0434\u0443\u0442 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u044b \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 (route, nftables, etc).\u0421\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u043a\u043b\u0438\u0435\u043d\u0442\u0430, VPN:\u041f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442 TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 utun1\u0414\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043c\u0430\u0440\u0448\u0440\u0448\u0443\u0442\u044b:route add -net 0.0.0.0\/1 -interface utun1 + route add -net 128.0.0.0\/1 -interface utun1 \u0437\u0430\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u044e\u0442 \u0432\u0435\u0441\u044c \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u0447\u0435\u0440\u0435\u0437 \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 (\u0434\u0432\u0430 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u0442\u0440\u043e\u0433\u0430\u0442\u044c \u0434\u0435\u0444\u043e\u043b\u0442\u043d\u044b\u0439 0.0.0.0\/0)route add -host 1.1.1.1 {default_gw} \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0442\u0440\u0430\u0444\u0438\u043a \u0434\u043e VPN \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0430 utun1 (\u0432\u043c\u0435\u0441\u0442\u043e default_gw \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0430\u0434\u0440\u0435\u0441 \u0448\u043b\u044e\u0437\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e)\u041f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u0435\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c\u044b\u0439 \u043d\u0430 utun1 \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 VPN \u0441\u0435\u0440\u0432\u0435\u0440, \u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u0438\u0440\u0443\u044f \u0432 QUIC \u0434\u0430\u0442\u0430\u0433\u0440\u0430\u043c\u043c\u044b, \u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c\u044b\u0439 \u043f\u043e QUIC \u0442\u0440\u0430\u0444\u0438\u043a \u043e\u0431\u0440\u0430\u0442\u043d\u043e \u0432 utun1\u0421\u0435\u0440\u0432\u0435\u0440:\u041f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442 TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 utun1\u0427\u0442\u043e\u0431\u044b utun1 \u043c\u043e\u0433 \u0445\u043e\u0434\u0438\u0442\u044c \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442, \u0431\u0443\u0434\u0442\u043e \u043e\u043d en0 (\u0434\u0435\u0444\u043e\u043b\u0442\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441), \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 ruleset \u0432 nftables (\u0432\u043c\u0435\u0441\u0442\u043e vpn_net \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0435\u0442\u044c, \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u043f\u0440\u043e \u043d\u0435\u0435 \u0431\u0443\u0434\u0435\u0442 \u043d\u0438\u0436\u0435):table ip vpn_natflush table ip vpn_nattable ip vpn_nat {{    chain postrouting {{        type nat hook postrouting priority 100;        ip saddr {vpn_net} oifname en0 masquerade    }}}}\u041f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u0435\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c\u044b\u0439 \u043f\u043e QUIC \u0442\u0440\u0430\u0444\u0438\u043a \u0432 utun1, \u0430 \u0438\u0437 \u043d\u0435\u0433\u043e \u043e\u0431\u0440\u0430\u0442\u043d\u043e \u043f\u043e QUIC\u041d\u044e\u0430\u043d\u0441\u044b\u0422\u0440\u0430\u0444\u0438\u043a \u043c\u0435\u0436\u0434\u0443 VPN \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u043c \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c \u0447\u0435\u0440\u0435\u0437 QUIC \u0434\u0430\u0442\u0430\u0433\u0440\u0430\u043c\u043c\u044b, \u0430 \u0437\u043d\u0430\u0447\u0438\u0442 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0439 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043d\u0435\u0442 (\u0437\u0430\u0442\u043e \u0435\u0441\u0442\u044c TLS). \u042d\u0442\u043e \u043d\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0434\u043b\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u0442.\u043a. \u0440\u0435\u0442\u0440\u0430\u0438 \u0431\u0443\u0434\u0435\u0442 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0442\u044c \u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b (\u0435\u0441\u043b\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442). \u041e\u0434\u043d\u0430\u043a\u043e \u0434\u043b\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u0442\u0435\u0440\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0437\u0434\u0435\u0441\u044c \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0441\u044f QUIC bidirectional stream.\u0421\u0435\u0440\u0432\u0435\u0440 \u0438 \u043a\u043b\u0438\u0435\u043d\u0442 \u043d\u0438\u043a\u0430\u043a \u043d\u0435 \u043c\u0435\u043d\u044f\u044e\u0442 \u0438\u043d\u043a\u0430\u043f\u0441\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0442\u0440\u0430\u0444\u0438\u043a, \u0442.\u0435. source IP \u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0431\u0443\u0434\u0435\u0442 \u043e\u0442 \u0438\u0445 TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430. \u0422\u0430\u043a \u043a\u0430\u043a \u043c\u044b \u0437\u0430\u0440\u0430\u043d\u0435\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c ruleset \u0434\u043b\u044f nftables, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e, \u0447\u0442\u043e\u0431\u044b \u044d\u0442\u043e\u0442 IP \u0431\u044b\u043b \u0438\u0437 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 vpn_net. \u041f\u043e\u043c\u0438\u043c\u043e \u044d\u0442\u043e\u0433\u043e, \u043a\u043e\u0433\u0434\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u043e\u043b\u0443\u0447\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u0442\u0440\u0430\u0444\u0438\u043a, \u043f\u043e destination IP \u043f\u0430\u043a\u0435\u0442\u0430 \u043d\u0430\u0434\u043e \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c, \u043a\u043e\u043c\u0443 \u0438\u0437 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0435\u0433\u043e \u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c. \u0412\u044b\u0432\u043e\u0434: IP TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432 \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b, \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0442\u044c \u043e\u0434\u043d\u043e\u0439 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 + \u0441\u0435\u0440\u0432\u0435\u0440 \u0434\u043e\u043b\u0436\u0435\u043d \u0437\u043d\u0430\u0442\u044c \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 \u043a\u043b\u0438\u0435\u043d\u0442 &#8212; IP. \u0421\u0430\u043c\u043e\u0435 \u043f\u0440\u043e\u0441\u0442\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u2013 \u0441\u0442\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f:\/\/ \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435tun = &#171;10.0.0.1\/24&#8243;client1 = &#171;10.0.0.2&#187;client2 = &#171;10.0.0.3&#187;&#8230;\/\/ \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 client1tun = &#171;10.0.0.2\/24&#8243;\/\/ \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 client2tun = &#171;10.0.0.3\/24&#8243;\u0425\u043e\u0442\u0435\u043b\u043e\u0441\u044c \u0431\u044b \u043f\u043e\u043c\u0435\u043d\u044c\u0448\u0435 \u0440\u0443\u0447\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0432\u043c\u0435\u0441\u0442\u043e \u0441\u0442\u0430\u0442\u0438\u043a\u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043c IPAM (IP Address Management): \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0432\u044b\u0434\u0430\u0435\u043c \u0435\u043c\u0443 IP \u0438\u0437 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u0441\u0435\u0442\u0438, \u0443\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0435\u0435 \u0440\u0430\u0437\u043c\u0435\u0440 \u0438 \u0432\u044b\u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043e \u044d\u0442\u043e\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u0430, \u043f\u0440\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u2013 &#171;\u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0430\u0435\u043c&#187; \u0430\u0434\u0440\u0435\u0441. \u041a\u043b\u0438\u0435\u043d\u0442 \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u043f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442 TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0438\u043c\u0435\u043d\u043d\u043e \u0441 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u043c \u043e\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 IP.\u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438tokio \u2013 async runtimetun-rs \u2013 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430\u043c\u0438quinn \u2013 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f QUIC \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u041a\u043b\u0438\u0435\u043d\u0442\u0422.\u043a. \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f self signed \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442, \u0435\u0433\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043f\u043e\u0434\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0438 \u043f\u0440\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 QUIC \u044d\u043d\u0434\u043f\u043e\u0438\u043d\u0442\u0430 \u043d\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0435. Client QUIC endpointuse anyhow::Error;use quinn::{ClientConfig, Endpoint, MtuDiscoveryConfig, TransportConfig, congestion::BbrConfig};use rustls::pki_types::CertificateDer;use std::sync::Arc;use crate::config::QuicConfig;pub fn make_client_endpoint(config: &amp;QuicConfig) -&gt; Result&lt;Endpoint, Error&gt; {    let mut client_cfg = configure_client(config)?;    client_cfg.transport_config(Arc::new(build_transport_config(config)));    let mut endpoint = Endpoint::client(config.endpoint_address)?;    endpoint.set_default_client_config(client_cfg);    Ok(endpoint)}fn configure_client(config: &amp;QuicConfig) -&gt; Result&lt;ClientConfig, Error&gt; {    \/\/ \u0447\u0438\u0442\u0430\u0435\u043c \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0441 \u0434\u0438\u0441\u043a\u0430    let cert_bytes = std::fs::read(&amp;config.server_cert)?;    let server_cert = CertificateDer::from(cert_bytes);    let mut certs = rustls::RootCertStore::empty();    certs.add(server_cert)?;    Ok(ClientConfig::with_root_certificates(Arc::new(certs))?)}fn build_transport_config(quic_config: &amp;QuicConfig) -&gt; TransportConfig {    let mut transport = TransportConfig::default();    transport.mtu_discovery_config(Some(MtuDiscoveryConfig::default()));    transport.datagram_receive_buffer_size(Some(quic_config.receive_buffer_size_kb * 1024));    transport.datagram_send_buffer_size(quic_config.send_buffer_size_kb * 1024);    transport.max_concurrent_uni_streams(0u32.into());    transport.max_concurrent_bidi_streams(10u32.into());    transport.congestion_controller_factory(Arc::new(BbrConfig::default()));    transport}\u0412 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0446\u0438\u043a\u043b\u0435 \u043f\u0440\u043e\u0441\u0442\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u043c\u0441\u044f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c \u0442\u0443\u043d\u043d\u0435\u043b\u044ctokio::spawn(async move {    loop {        let connecting = match endpoint.connect(server_address, &amp;server_name) {            Ok(c) =&gt; c,            Err(e) =&gt; {                error!(&#171;connect failed: {e:#}, retrying in {backoff:?}&#187;);                sleep(backoff).await;                continue;            }        };        let connection = match connecting.await {            Ok(c) =&gt; c,            Err(e) =&gt; {                error!(&#171;handshake failed: {e:#}, retrying in {backoff:?}&#187;);                sleep(backoff).await;                continue;            }        };        info!(&#171;connected to server {}&#187;, connection.remote_address());        match run_tunnel(connection.clone(), &amp;config).await {            Ok(_) =&gt; error!(&#171;session ended, reconnecting&#8230;&#187;),            Err(e) =&gt; error!(&#171;error running tunnel: {e:#}&#187;),        };        connection.close(CLOSE_CODE_NORMAL, &amp;[]);        sleep(backoff).await;    }})\u041e\u0431\u043c\u0435\u043d \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 handshake: \u043a\u043b\u0438\u0435\u043d\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0432\u043e\u0438 credentials, \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0438\u0445 \u0438 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0443\u0441\u043f\u0435\u0445\u0430 \u043d\u0430\u0437\u043d\u0430\u0447\u0430\u0435\u0442 IP \u0430\u0434\u0440\u0435\u0441pub struct ClientHello {    pub user: String,    pub secret: String,}pub struct ServerHello {    pub addr: Ipv4Addr,    pub prefix: u8,}async fn handshake(    connection: &amp;Connection,    config: &amp;VpnConfig,) -&gt; Result&lt;ServerHello, anyhow::Error&gt; {    \/\/ QUIC stream, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u0442\u0435\u0440\u044f\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a    let (mut send, mut recv) = connection.open_bi().await?;    \/\/ \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438    let client_hello_bytes: Vec&lt;u8&gt; = ClientHello {        user: config.user.name.clone(),        secret: config.user.secret.clone(),    }    .into();    info!(&#171;sending client hello&#187;);    send.write_all(&amp;client_hello_bytes).await?;    send.finish()?;    let server_hello_bytes = recv.read_to_end(MAX_HANDSHAKE_DATA).await?;    let server_hello = ServerHello::from(server_hello_bytes);    info!(&#171;authentication succeeded&#187;);    \/\/ \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0430\u0434\u0440\u0435\u0441 \u0434\u043b\u044f TUN    Ok(server_hello)}\u041f\u043e\u0441\u043b\u0435 handshake \u0441\u043e\u0437\u0434\u0430\u0435\u043c TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441, \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u044epub async fn run_tunnel(connection: Connection, config: &amp;VpnConfig) -&gt; Result&lt;()&gt; {    let handshake = handshake(&amp;connection, config).await?;    let addr: Ipv4Addr = handshake.addr;    let prefix: u8 = handshake.prefix;    info!(&#171;registring tun {addr}\/{prefix}&#187;);    let device_name = &amp;config.tun.name;    let server_address = &amp;config.quic.server_address.ip().to_string();    let mtu = config.tun.mtu;    let device = Arc::new(        DeviceBuilder::new()            .name(device_name)            .ipv4(addr, prefix, None)            .mtu(mtu)            .build_async()?,    );    \/\/ \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u044b, drop _guard \u0438\u0445 \u043f\u043e\u0447\u0438\u0441\u0442\u0438\u0442    let _guard = if config.tun.setup_routes {        Some(setup_vpn_routes(server_address, device_name)?)    } else {        None    };    \/\/ \u0437\u0430\u0434\u0430\u0447\u0430 \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435 \u0438\u0437 TUN \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u043f\u043e QUIC    let mut device_recv_task = {        let device = device.clone();        let connection = connection.clone();        tokio::spawn(async move {            let mut buf = vec![0u8; READ_BUF_SIZE];            loop {                let n = device.recv(&amp;mut buf).await?;                connection.send_datagram(Bytes::copy_from_slice(&amp;buf[..n]))?;            }            #[allow(unreachable_code)]            Ok::&lt;(), anyhow::Error&gt;(())        })    };    \/\/ \u0437\u0430\u0434\u0430\u0447\u0430 \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435 \u043f\u043e QUIC \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0432 TUN    let mut connection_read_task = {        let connection = connection.clone();        if let Some(max_datagram_size) = connection.max_datagram_size() {            info!(&#171;connection max_datagram_size = {max_datagram_size}&#187;);        }        let device = device.clone();        tokio::spawn(async move {            loop {                let data = connection.read_datagram().await?;                device.send(&amp;data).await?;            }            #[allow(unreachable_code)]            Ok::&lt;(), anyhow::Error&gt;(())        })    };    let result = tokio::select! {        res = &amp;mut device_recv_task =&gt; res.unwrap_or_else(|e| Err(e.into())),        res = &amp;mut connection_read_task =&gt; res.unwrap_or_else(|e| Err(e.into())),    };    device_recv_task.abort();    connection_read_task.abort();    result}\u0421\u0435\u0440\u0432\u0435\u0440pub struct VpnServerState {    \/\/ \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f    config: VpnConfig,    \/\/ TUN \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441    device: AsyncDevice,    \/\/ QUIC endpoint, \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u044e\u0442\u0441\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u044b    endpoint: Endpoint,    \/\/ IPAM    ip_pool: IpPool,    \/\/ \u0412\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u0430\u0434\u0440\u0435\u0441 -&gt; \u043a\u043b\u0438\u0435\u043d\u0442, \u0434\u043b\u044f \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430    connections: DashMap&lt;Ipv4Addr, Connection&gt;,    \/\/ \u0414\u043b\u044f graceful shutdown    cancellation_token: CancellationToken,    task_tracker: TaskTracker,}IPAMuse std::collections::VecDeque;use std::net::Ipv4Addr;use std::sync::Mutex;pub struct IpPool {    pub subnet_base: Ipv4Addr,    pub subnet_prefix:&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-486971","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/486971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=486971"}],"version-history":[{"count":0,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/486971\/revisions"}],"wp:attachment":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=486971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=486971"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=486971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}