Karanta tsarin WireGuard layi-layi, daga Interface zuwa Peer

Yawancin lalacewar tsarin WireGuard ba suna kuskure a wata ƙima ba; suna sanya madaidaicin ƙima a gefen da bai dace ba. Maɓallin sirri na wannan na'ura ne, peer yana ɗauke da maɓallin jama'a na ɗaya na'urar, kuma adireshi yana zama a cikin rukunin interface ko da yake yana bayyana inda rami yake. Karanta fayil ɗin a matsayin hanyoyi biyu da suka haɗu, sannan duba abin da rubutun taimako ya ƙara a kai. Ka'idar kanta tana da filaye kaɗan fiye da fayil ɗin, kuma ƙarin filayen sun cancanci a san su daban.

Maɓallan interface suna bayyana wannan na'ura

Rukunin interface yana riƙe da ainihin wannan ƙarshen. PrivateKey shine wannan ainihi kuma ba ya barin mai masaukin; daga gare shi ake samun maɓallin jama'a mai dacewa kuma shine abin da sauran peers suke lissafta. ListenPort shine inda wannan gefen yake karɓar musafaha, don haka abokan ciniki biyu bayan adireshi ɗaya suna buƙatar tashoshi daban-daban.

Address shine adireshin ramin da wannan mai masaukin yake amsawa, an rubuta shi da tsawon prefix domin shi ma shine tushen da zai yi amfani da shi. Kuskure a prefix a nan yana canza waɗanne wurare mai masaukin yake tsammanin suna kan haɗi kai tsaye, wanda ke haifar da gazawa masu kama da tura hanya maimakon tsari.

Duk sauran a cikin [Interface] rukuni tare da ainihin abokin ciniki yawanci wg-quick yake ƙarawa: DNS, MTU, Table, da layukan ƙugiya. Ba filayen ka'ida ba ne, kuma wg tsarin tsirara yana watsi da su gaba ɗaya.

Kowane shigarwar peer yana bayyana wani gefe

Rukunin [Peer] shine ɓangaren nesa. PublicKey shine maɓallin da aka samu na wannan ɓangaren, ba maɓallinsa na sirri ba, kuma PresharedKey wani asiri ne na zaɓi wanda dole bangarorin biyu su riƙe iri ɗaya. Endpoint shine inda za a aika, kuma PersistentKeepalive yana roƙon wannan mai masaukin ya aika fakiti bayan tazara lokacin da babu wani abu da ke fita.

Kuskure biyu ne ke bayyana yawancin ruɗani a nan. Kwafin maɓallin sirrinka cikin rukunin peer yana sa ƙarshen biyu su raba ainihi ɗaya, kuma musafaha yana gazawa ta hanyar da ba ta da kyau a rikodin. Endpoint barin a waje akan abokin ciniki yawanci da gangan ne, domin uwar garke tana koyon adireshin daga musafahar da ke shigowa; barin shi a waje akan uwar garke da dole ta fara ba haka ba ne. Ka tuna kuma keepalive yana riƙe taswirar NAT a buɗe, kuma baya inganta kwarara ko rage jinkiri, don haka daƙiƙa talatin na ƙarin fakiti ba ya sayen komai lokacin da zirga-zirga ke gudana.

AllowedIPs tura hanya ne, ba jerin izini ba

AllowedIPs shine tura hanyar maɓallin sirri na WireGuard. A fita, yana yanke shawarar wane peer zai karɓi fakiti bisa ga inda aka nufa. A shiga, yana yanke shawarar ko za a karɓi fakiti da ke zuwa daga wannan peer bisa ga tushensa. Filin ɗaya ne ke yin ayyukan biyu, shi ya sa ba jerin kula da shiga ba ne kuma ba jerin shafukan da aka yarda ba ne.

Ɗan ƙunci AllowedIPs a kan uwar garke ga abokin ciniki yana nufin uwar garken za ta karɓi fakiti da ke da'awar waɗannan tushe kawai, kuma za ta aika waɗannan wurare kawai ga wannan abokin ciniki. Faɗaɗa gefe ɗaya ba tare da faɗaɗa ɗayan ba, sai ka sami rami da ke tashi kuma ba ya wuce komai.

Abin da wg-quick yake ƙarawa a kewayen ka'idar

wg-quick yana karanta wannan fayil ɗin kuma yana yin matakan cibiyar sadarwa da ka'idar ta bar wa tsarin aiki. Yana ba da adireshin interface, yana ƙara hanyoyin da aka samu daga AllowedIPs, yana rubuta saitunan mai warwarewa kuma yana gudanar da umarnin ƙugiya bisa tsari.

Wannan layin yana bayyana rashin daidaito na gargajiya. Fayil da ke ɗauke da 0.0.0.0/0 da layin DNS yana ba abokin ciniki hanyar da ta dace da mai warwarewa, kuma ba ya yin komai kwata-kwata ga dokokin tura gaba ko NAT na uwar garke. Waɗannan na tsarin uwar garken kanta ne, kuma babu fayil ɗin abokin ciniki da zai iya samar da su.

Riƙe mai shi ɗaya ga fayil ɗin. Gyara shi da hannu yayin da SaveConfig ke kunne yana nufin gyaranka zai ɓace lokaci na gaba da interface zai sauka, kuma interface ba zai gaya maka cewa hakan ta faru ba.

Duba yanayin da aka yi amfani da shi, ba fayil ɗin ba

Fayil ɗin niyya ne. Yanayin da aka yi amfani da shi shine abin da kernel ke riƙe, kuma suna bambanta duk lokacin da wani mataimaki, drop-in ko ƙugiya ya gyara wani abu bayan kunnawa.

Karanta yanayin rayuwa da adireshi tare, sannan kwatanta duka biyu da abin da ka rubuta:

sudo wg show
ip -4 addr show dev wg0
ip -4 route show dev wg0
grep -v "^#" /etc/wireguard/wg0.conf

Idan jerin peer babu kome, an ƙirƙiri interface ba tare da an yi amfani da tsarinsa ba. Idan adireshi da hanyoyi suna nan amma ƙididdiga sun tsaya a sifili, an loda fayil ɗin kuma musafaha yana gazawa, wanda matsala ce ta maɓalli ko ƙarshe ba ta jerin sashe ba. Kwatanta ra'ayoyin biyu kafin gyara, domin tazarar da ke tsakaninsu ita ce ainihin laifin.