App ɗaya ta WireGuard: ɗaurewa ba tsarin hanya ba ne

Saitin yana kama da maɓalli na kowace app, don haka mutane suna ɗaure client ɗin da WireGuard interface kuma suna tsammanin wannan client ɗin ne kawai zai yi amfani da tunnel ɗin. Abin da ɗaurewar ke yi a zahiri shi ne zaɓar adireshin tushe. Sa'an nan kernel ɗin ya nemi hanya zuwa inda ake zuwa, ya sami tsohuwar hanyar da aka saba, sannan ya aika fakitin ta hanyar jiki tare da adireshin tunnel ɗin a haɗe. Hanya da aka zaɓa don wannan adireshin tushe ne kawai ke cika manufar.

Tsarin yana da rabi biyu: tebur na hanyoyi wanda tuƙin tunnel ɗin kawai ya kamata ya yi amfani da shi, da wata doka da ke aika madaidaicin tushe zuwa can.

Ɗaurewa yana saita adireshin tushe, ba wani abu ba

Linux yana zaɓar interface na fita ta hanyar neman inda ake zuwa a cikin tebur na hanyoyi, bayan da dokokin manufa suka sami damar juya wannan binciken wani wuri. Dokoki na iya zaɓa bisa adireshin tushe, alamar wutar bango, interface mai shigowa, UID ko ma tashar jiragen ruwa; kowanne wata hanya ce ta faɗin wannan tuƙi maimakon duka. Kanfigareshin client ɗin VPN yana zaɓar teburin da ke ɗauke da hanyoyin tunnel ɗin; dokar tana zaɓar wane tuƙi ne aka ba shi izinin duba ta. Ɗaurewa ita kaɗai ba ta samar da ko ɗaya daga cikinsu.

Shi ya sa gazawar take da ban mamaki. App ɗin tabbas yana amfani da adireshin tunnel ɗin, tunnel ɗin tabbas yana aiki, kuma tuƙin tabbas yana fita ta interface ɗin da ba daidai ba. Kowace magana gaskiya ce, kuma tare suna bayanin wani tsari da babu abin da ya haɗa adireshin da hanyar.

Ba tunnel ɗin nasa tebur

wg-quick yana girka hanyoyi a duk inda bayanin ya ce. Ƙara Table = 40 ƙarƙashin [Interface] yana motsa su zuwa tebur 40 maimakon babban tebur. Ɗaga interface ɗin kuma tabbatar sun isa: ip -4 route ls table 40 ya kamata ya nuna hanyoyin tunnel ɗin, kuma ip -4 route get 10.66.127.142 yana nuna yadda kernel ɗin yake warware ɗaya daga cikinsu a yanzu. Da hanyoyin a cikin nasu tebur, babban tebur yana ci gaba da aiki don duk sauran.

Yi haka don IPv6 maimakon daidaita faffadan prefix. ip -6 rule add from fd00::2/128 lookup 40 yana ƙulla adireshi ɗaya; fc00::/8 na iya yin karo da wasu interfaces a kan host kuma ya haifar da doka da ta fi abin da aka yi niyya.

Ƙara dokar tushe kuma duba masu ƙidaya

Sa'an nan haɗa rabin biyun: ip -4 rule add from 10.66.127.142/32 lookup 40, tare da wannan adireshin a haɗe da WireGuard interface. Saka dokokin biyun a PostUp domin sake haɗawa ya dawo da su. Tabbatar da buƙata ta gaskiya maimakon saiti: ip route get 1.1.1.1 from 10.66.127.142 ya kamata ya faɗi sunan na'urar tunnel ɗin, kuma curl --interface wg0 ifconfig.me ya kamata ya bayar da adireshin tunnel ɗin maimakon na gida.

Idan har yanzu ya kasa, karanta ip -s rule. Dokar da take wanzu amma ba ta taɓa daidaitawa tana nuna masu ƙidaya sifili, kuma hakan yana bambanta kuskuren doka da rashin doka kwata-kwata. Wannan umarni ɗaya yana ceton hasashe da yawa game da ko app ɗin ya yi watsi da saitinsa na interface.

Sabanin haka: ajiye SSH a wajen tunnel ɗin

Matsalar akasin haka ta zama ruwan dare: wg-quick ne ya mallaki tsohuwar hanya kuma zamannin SSH zuwa uwar garken yana mutuwa a tsakiyar zamanni. Dokokinsa suna zaune a ƙaramin lambar fifiko, don haka dole a tantance keɓe kafin su. ip rule add dport 22 ipproto tcp table main priority 123 yana yin hakan a sabon iproute2; inda mai zaɓe ba ya samuwa, yi alama a kan kwarara a nftables kuma a daidaita alamar maimakon haka.

Duba hanyar amsa kuma. Zamannin SSH da ya kafa sannan ya yi shiru yawanci yana da hanyoyi marasa daidaituwa, ɗaya gefen yana fita ta tunnel ɗin ɗayan kuma ta interface na jiki. ip route get don adireshin uwar garken yana gaya maka inda amsar za ta bi.

Rubuta lambar tebur, dokar tushe da keɓewar a cikin bayanin kansa. Duk ukun na ƙira ɗaya ne kuma za a gyara su tare.