Tura tashar 25 kawai cikin tunnel, ba host ba

Abubuwa huɗu dole su daidaita kafin Linux host ya aika SMTP nasa kawai ta cikin tunnel: hanya a cikin tebur da aka keɓe, ƙa'idar manufa da ke zaɓar zirga-zirgar, adireshin tushe da peer zai karɓa, da hanyar dawowa da ke jure rashin daidaituwa. Kowane saitin daban ne da nasa yanayin gazawa. Tsarin da ke ƙasa shi ne wanda ke sa gazawa ta nuna sashin da ya yi kuskure da gaske. Aikin sarrafa hanya na musamman ga tasha ne, ba buƙatar hanyar da aka saba ta VPN ba.

Ƙa'idar tasha ba ita ce hanyar da aka saba ba

Ƙa'idar da ke daidaita TCP da aka samar a gida da tashar manufa 25 tana aika wannan zirga-zirgar zuwa tebur da ka ambata. Ƙa'idar ba ta ƙirƙirar komai da kanta: tana zaɓe, kuma tebur dole ya riƙe hanyar da za ta iya ɗaukar fakiti. Haɗa biyun yana rufe alkiblar fita ta yare ɗaya kawai, don haka tura wa sauran hosts, haɗin wasiƙa masu shigowa da IPv6 suna waje da wannan tsari. Kiranta manufar musamman ga tasha maimakon VPN na asali yana kiyaye wannan iyaka da gaskiya.

Saiti biyu na wg-quick sharuɗɗa ne, ba ɓangare na manufar ba. AllowedIPs = 0.0.0.0/0 yana ba peer damar ɗaukar duk wata manufa ta IPv4, kuma Table = off yana hana wg-quick shigar da nasa hanyar asali ga wannan prefix. Kada ka haɗa waɗannan umarni da manaja da ke amfani da nasa manufar hanya, domin biyun ba za su yarda kan wanda ya mallaki babban tebur ba.

Rubuta hanya, mai zaɓe da mai gadi

Zaɓi lambar tebur da ma'aunin fifiko guda biyu da babu wani abu da ke amfani da su, sannan ka yi amfani da hanya, mai zaɓe da mai gadi a wannan tsari. Lambobin da ke ƙasa misalai ne, ba ƙayyadaddun ƙima ba:

ip -4 route add default dev wg0 src 10.77.0.2 table 51825
ip -4 rule add priority 10000 iif lo ipproto tcp dport 25 lookup 51825
ip -4 rule add priority 10001 iif lo ipproto tcp dport 25 unreachable

iif lo yana iyakance ƙa'idar ga zirga-zirgar da ta samo asali a gida, kuma ipproto tcp dport 25 yana gano alkiblar haɗin; tushen ip-rule yana rubuta duka masu zaɓe biyu. Suna nan a cikin kernels na yanzu da fitarwar iproute2, kuma a tsohon tsari ana ƙin ƙa'idar gaba ɗaya, wanda ya fi gazawa bayyananne fiye da ƙa'idar da ke lodawa kuma ba ta dace da komai.

Ƙa'idar unreachable a fifiko na gaba ita ce mai gadi. Idan babu ita, hanyar da ta ɓace a cikin tebur 51825 tana faɗuwa zuwa na asali na yau da kullum, kuma wasiƙa tana fita ta hanyar jiki yayin da tunnel ya yanke, wanda shi ne ainihin yanayin da aka gina manufar don hana shi.

Adireshin tushe dole ya daidaita

Fifikon src na hanya yana cika tushe ne kawai ga haɗin da ba su ɗaure nasu ba. Ba fassara ba ce, kuma ba ta ketare ɗaurin bayyananne ba, don haka daemon da aka ɗaure da adireshin jiki yana ci gaba da aikawa daga wannan adireshin. Idan wannan ne abin da ka samu, canza saitin daemon ɗin kansa ko tsara manufar fassara da gangan, domin masquerade na gama-gari da ya yi latti wata hanya ce daban da sakamako daban.

A ƙofar, peer na abokin ciniki dole ya ba da izini ga tushen da yake karɓa a zahiri, wato 10.77.0.2/32 maimakon babban prefix na manufa. Kwafin 0.0.0.0/0 na abokin ciniki cikin kowane peer na ƙofa yana rikitar da wanda ya mallaki wace zirga-zirga. Ƙofar kuma tana buƙatar turawa, manufar firewall da ke ba da izinin kwarara, da hanyar dawowa, gami da fassarar fita lokacin da na sama ba zai iya sarrafa adireshin tunnel na sirri ba.

Duba hanyar dawowa, sannan dawwama

Karanta binciken kafin ka amince da komai, domin suna nuna wane tebur da wace tushe kowace alkibla ke samu. Manufa ɗaya a tashar 25 da ita a tashar 443 sun isa:

ip -4 route get 198.51.100.25 ipproto tcp dport 25
ip -4 route get 198.51.100.25 ipproto tcp dport 443

Binciken farko ya kamata ya ambaci wg0 da tushen da aka nufa, na biyu kuma ya riƙe hanyar sama ta yau da kullum. Lokacin da aikace-aikacen ya ɗaure nasa adireshin, ƙara from da wannan adireshin ga binciken. Alkiblar amsa da ta isa wg0 sannan aka watsar da ita a gida tana nuna tacewar hanyar baya ta IPv4, domin ƙa'idar fita ta tasha kawai ba ta sa binciken baya ya zaɓi tunnel ɗin.

Inda aka ba da izinin sarrafa hanya mara daidaituwa, yanayin sako-sako da aka iyakance ga interface ta net.ipv4.conf.wg0.rp_filter=2 na iya dacewa, kuma yana da kyau a fara duba mafi girman tasiri na all da ƙimar interface. Kada ka kashe tabbatarwa a duk duniya a matsayin gajeriyar hanya. Sannan ka miƙa tebur, fifiko da mai gadi ga wanda ya mallaki saitin, kuma buɗe sabbin haɗi bayan sake haɗawa don tabbatar da zaɓin har yanzu yana nan. Ka tuna cewa amsoshin mai sauraron SMTP na gida suna ɗauke da tashar tushe 25 maimakon tashar manufa 25, wanda tambayar manufa ce daban.