WireGuard mai zurfi: tsakiyar tsalle ba za ta iya amsa tashar nata ba
Lokacin da tsakiyar tsalle ta aika komai cikin rami daya, amsoshin sabis dinta na shigowa suna fita ta hanyar da ba daidai ba. Dokar tashar tushe a kan makulli tana gyara hakan.
Tsalle uku na WireGuard suna isa hanyar sadarwa da ba ta da adireshin jama'a, sannan injin tsakiyar ya daina amsawa a tashar da ya kamata ya saurara. Ramin gaba yana aiki har yanzu, babban mai masaukin nesa yana amsawa har yanzu, kuma sai sabar tsakiyar da kanta ta yi shiru daga waje. Wannan hadin yana da rudani don shi kansa ne ya haifar da shi: tsakiyar tsalle tana bin teburin hanyarta, kuma teburin yana aika amsoshinta zuwa wajen da ba daidai ba.
Sarkar da ke aiki har sai kun yi magana da akwatin tsakiya
Dauki sarka ta misali: abokin ciniki A ya isa sabar B a kan UDP 500, kuma B ya ci gaba zuwa sabar C a kan UDP 500. C yana karbar zirga-zirga daga adireshin abokin hanyarsa daya kawai, wanda hakan ya mai da shi ganye kuma ya rike halinsa da sauki. B ba ganye ba ne, kuma duk wani abu mai ban sha'awa game da wannan gazawa yana faruwa a wurin.
Bambancin yana da muhimmanci domin matsayin ganye da na tsakiya suna ja zuwa bangarori daban-daban. Ganye na iya aika komai cikin rami daya ba tare da wani sakamako ba, tunda babu wani abu da ya dogara da shi. Tsakiyar tsalle ita ce duka karshen wuri ga abokan ciniki da abokin ciniki zuwa wajen nesa, kuma wadannan ayyuka biyu suna son hanyar daban.
Me ya sa amsar ke fita ta ramin
A kan B, makullin da ke fuskantar C yana dauke da AllowedIPs = 0.0.0.0/0 tare da hanyar da ta dace ta asali. Saboda haka kowane fakiti da B ya kirkira yana shiga wannan ramin, sai dai idan wani abu mafi takamaimai ya sami fifiko.
Fakiti daga A da aka nufa B ya iso kuma an karba shi, domin B shi ne manufa kuma isar da gida yana faruwa da farko. Amsar sabuwar fakiti ce da aka kirkira a gida kuma an nufa ta adireshin jama'a na A, kuma wannan manufar ta yi daidai da hanyar asali cikin ramin. C ya karba shi, bai mallaki wannan adireshin ba, kuma ya watsar da shi.
Alamar tana karantawa kamar matsalar wutar bango ko rashin daidaituwar maballi, kuma babu daya daga cikinsu da ya tabbata a nan. Daukar hoto a ramin zuwa C yana nuna amsoshin suna tafiya wajen da ba daidai ba. Wannan kallo daya yana ceton lokaci fiye da kowane irin karatun tsari, don haka rubuta shi kafin ka fara canza maballai. Duk wanda bai ga hoton ba zai dauka cewa ramin da kansa ya lalace.
Kunkwarar gyara: dokokin manufa wadanda suka dace da tashar tushe
Amsoshi daga soket din sauraro na B suna fita da tashar tushe 500. Dokar manufa za ta iya dacewa da hakan kuma ta mayar da wadannan fakiti zuwa teburin talakawa:
ip rule add sport 500 table main priority 100
ip rule add sport 8080 table main priority 101Ana duba dokokin manufa bisa ga fifiko, kuma babban teburin yana a 32766, don haka ana tambayar doka a 100 kafin hanyar asali ta ramin ta sami wani abu da za ta ce. Kara shigarwa daya ga kowace tashar da dole ta kasance ana iya isa gare ta daga waje kuma ba wani abu fiye da haka, domin zirga-zirgar da ake turawa ta ci gaba da amfani da ramin da aka gina ta dominsa.
San iyakar wannan dabara. Mai zabi sport yana dacewa da fakiti da aka kirkira a gida, wanda hakan ya rufe daidai yanayin amsa kuma da gangan bai rufe zirga-zirgar da B kawai ke turawa don wani ba. Sabis da aka shirya bayan B har yanzu yana bukatar amsarsa, kuma yin riya da akasin haka yana haifar da gyara da ke aiki ga sabis na farko kuma ya kasa ga na biyu.
Ba dokar mai shi
Dokar da aka buga a umarni tana bacewa lokaci na gaba da aka sake gina makullin. A tsarin WireGuard, sanya ta inda ake kirkira makullin kuma ake cire shi:
PostUp = ip rule add sport 500 table main priority 100
PostDown = ip rule del sport 500 table main priority 100Idan NetworkManager, kugiya ta rarrabawa ko wurin shigar kwantena ne ya mallaki makullin, biyun na wannan mai shi ne maimakon fayil da aka gyara da hannu. Duba dokokin da ke aiki bayan sake hadawa, ba kawai bayan farkon farawa ba, domin farkon farawa shi ne yanayin da koyaushe ke aiki.
Kwatanta zabubbukan da gaskiya
Dokar tashar tushe daya ce daga hanyoyi hudu na fita, kuma ita ce mafi kunci daga cikinsu. Tana da fa'ida ta rashin taba manufar ramin kwata-kwata, wanda shi ya sa take jure wa sauye-sauyen da suka zo daga baya. Kunkwararrun gyare-gyare kuma suna kasawa da karfi lokacin da suka daina aiki, yayin da babban kebewa ke ci gaba da aiki a hankali da dadewa bayan dalilinsa ya bace. Wannan bambancin yana da muhimmanci fiye da kyau lokacin da wani ya mallaki akwatin cikin shekaru biyu.
| Approach | What it costs | Where it breaks |
|---|---|---|
| Source-port policy rule | One rule per exposed port | Anything B forwards rather than originates |
| Destination exception route | A route pinned to specific client addresses | Clients whose address changes |
| Stop full-tunnelling on B | Loses the catch-all path toward C | Designs that depend on it |
| Split into two tunnels | More interfaces and more policy | Nothing, at the cost of complexity |
Tabbatar daga bangarori biyu da zarar ka zaba. Daga A, fara hadi zuwa tashar B kuma ka rike shi aiki na dan lokaci. A kan B, sa kernel ya ba da hujjar hanyar amsa da wani abu kamar ip route get <address-of-A> sport 500, kuma tabbatar yana ambaton makullin WAN maimakon ramin. Bayan haka, duba cewa wani abu bayan C har yanzu yana amsawa ta sarkar, wanda ke tabbatar da cewa kebewar ta kasance kunci maimakon ta zama hanyar kewayawa. A karshe, rubuta tashoshin a cikin bayanan kira, in ba haka ba mai aiki na gaba zai sake gano wannan a wani sabis.