Yadda ake gudanar da tsarin Linux ɗaya a wajen ramin WireGuard

Ba za ka iya keɓe manhaja daga na'urar WireGuard mai cikakken rami ta hanyar gyara hanyoyi ba. Hanyoyi suna zaɓar hanya bisa ga inda aka nufa, kuma abin da kake son keɓewa tsari ne, don haka kernel ba shi da abin da zai daidaita. Hanyar da za ta yi aiki ita ce ba wa wannan tsari nata yanayin cibiyar sadarwa: sararin suna mai nata mu'amala, adireshi da tsohuwar hanya, wanda aka haɗa da na'urar ta hanyar veth biyu. Na gudanar da wannan a kan Ubuntu 24.04 tare da wireguard-tools 1.0.20210914, kuma sararin suna bai taɓa zama matsala ba — manufofin turawa na na'urar da ƙa'idojin yin alama na ramin ne suka kasance.

Da farko zaɓi irin yanayin da kake buƙata

A aikace ana samun siffofi biyu. Idan na'urar tana gudanar da cikakken rami kuma manhaja ɗaya za ta fita ta hanyar ISP, za ka gina wani sararin suna na biyu, ka haɗa shi da na'urar kuma ka bar na'urar ta tura da fassara zirga-zirga dominsa. Idan sararin suna yana ɗauke da mu'amalar VPN kuma kana buƙatar umarni da aka fara a cikinsa kawai, wannan shi ne na yau da kullum na ip netns exec kuma yawancin aikin hanya an riga an yi shi.

Babu ɗaya daga cikin siffofin biyu da zai ba ka ƙa'ida da aka iyakance ga ID ɗaya na tsari. Netfilter yana daidaita adireshi, tashoshi, alamomi da mu'amaloli; babu teburin hanya ga kowane tsari. Yin alama na iya jagorantar zirga-zirga, amma dole ne a sanya alamar a kan fakiti da ka riga ka gano, kuma wannan ita ce matsala ɗaya a wani mataki ƙasa. Sararin suna yana raba dukan tari ga wannan bishiyar tsari, kuma shi ya sa shi ne amsar da aka saba.

Idan buƙatar da gaske ita ce babu abin da zai fita daga ramin, to ka dakatar da ramin maimakon haka. Sararin suna yana nan don haɗaɗɗiyar yanayi: manhaja ɗaya waje, duk sauran ciki, a kan na'ura ɗaya, a lokaci ɗaya.

Gina yanayi na biyu kuma ka haɗa shi da na'urar

Tsari na misali: na'urar tana da mu'amalar WireGuard da ke ɗauke da tsohuwar hanya, da kuma sararin suna na cibiyar sadarwa mai suna clearnet wanda aka haɗa da na'urar ta hanyar veth biyu. Adireshin da ke ƙasa misalai ne.

ip netns add clearnet
ip link add veth-clear-out type veth peer name veth-clear-in
ip addr add 192.168.100.1/24 dev veth-clear-out
ip link set veth-clear-out up
ip link set veth-clear-in netns clearnet
ip netns exec clearnet ip addr add 192.168.100.2/24 dev veth-clear-in
ip netns exec clearnet ip link set veth-clear-in up
ip netns exec clearnet ip route add default via 192.168.100.1

Wannan sararin suna yanzu zai iya isa na'urar kuma babu wani abu. Dole na'urar ta tura zirga-zirga kuma ta sake rubuta adireshin tushe, domin 192.168.100.0/24 na sirri ne kuma na'urar hanya ta sama ba ta da hanyar komawa cikinsa:

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -o <wan-interface> -j MASQUERADE

Tabbatar da bangaren sararin suna kafin ka ci gaba.ip netns exec clearnet ip route ya kamata ya nuna hanyar veth da tsohuwar hanya ta 192.168.100.1, kuma ping zuwa wannan adireshin ya kamata ya amsa. Idan ping zuwa adireshin na'urar ya kasa, adireshin ko yanayin haɗin sun yi kuskure kuma babu ƙa'idar wuta da za ta taimaka.

Lokacin da sunaye suka warware amma babu abin da ya dawo, karanta FORWARD

Kuskuren da aka saba yana kama da kuskuren hanya: sararin suna yana warware suna, fakitin yana fita, kuma babu amsa da ta taɓa zuwa. A kan na'urorin da manufar FORWARD ta zama DROP — wasu rarrabawa da yawancin hotuna masu ƙarfi suna yin haka — ana jefar da fakitin a hanya, kuma kuskuren da manhajar ke bugawa ba ya faɗin komai game da tacewa.

Karanta sarkar kafin ka ƙara wani abu:

iptables -S FORWARD
nft list chain inet filter forward

Sa'an nan ka ba da izinin zirga-zirga a dukkan kwatance biyu, da ƙididdiga, don ka san ko ƙa'idar ta taɓa daidaitawa:

iptables -A FORWARD -i veth-clear-out -o <wan-interface> -j ACCEPT
iptables -A FORWARD -i <wan-interface> -o veth-clear-out -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
watch -n1 'iptables -L FORWARD -v -n'

Ƙa'idar da ƙididdigar fakiti ta zama sifili ba ta cikin hanya. Ko sunayen mu'amala sun bambanta da abin da ka yi tsammani, ko wata ƙa'ida ta farko a sarkar ta karɓi, ta jefar ko ta mayar da fakitin da farko. Gyara tsari, ba rubutun ƙa'idar ba.

Zirga-zirgar amsa ita ce rabin da mutane ke mantawa. Ƙa'idar dawowa tana buƙatar sunan veth ɗaya da kuma daidaiton yanayin haɗi, ko karɓar mu'amala kawai idan kana ajiye manufar buɗe. Ƙara ƙa'idar fita kawai sai ainihin alamar ta dawo, yayin da sabuwar ƙa'idarka tana nan tana kama da daidai.

Ka nisantar da ƙa'idojin yin alama na ramin daga sabuwar hanya

Wannan mataki yana mai da sararin suna mai aiki zuwa wanda ke yoyo. Saitunan WireGuard yawanci suna girka manufar alamar wuta tare da nasu ƙa'idojin hanya da keɓaɓɓen teburi, don haka fakiti marasa alama suna komawa teburin babba yayin da fakiti masu alama ke amfani da teburin ramin. Zirga-zirgar da aka tura daga sararin suna ana auna ta da tsarin hanya a lokacin fita, kuma dangane da yadda aka rubuta waɗannan ƙa'idoji tana iya faɗawa cikin teburin ramin.

Ƙari biyu ne ke raba hanyoyin. Ka dawo da wuri a cikin sarkar mangle don ƙaramin cibiyar sararin suna, kuma ka ƙara ƙa'ida bisa tushe da ke sanya wannan ƙaramin cibiyar a teburin babba:

iptables -t mangle -I PREROUTING -s 192.168.100.0/24 -j RETURN
ip rule add from 192.168.100.0/24 lookup main priority 100

Babban fifiko 100 yana zuwa gaban ƙa'idojin ramin a na'urata, don haka teburin talakawa ne ke yanke hukunci ga wannan tushe. Kada ka kwafa lambar a makance: manyan fifikon da wg-quick ke girka sun bambanta tsakanin nau'o'i da tsakanin saitunan IPv4 da IPv6, don haka gudanar da ip rule show kuma ka zaɓi fifiko da zai zo gaban ƙa'idojin ramin a na'urarka.

Tabbatar da bincike na musamman ga tushe maimakon dogaro da jerin ƙa'idoji:

ip route get 1.1.1.1 from 192.168.100.2
ip netns exec clearnet ip route get 1.1.1.1

Idan umarni na farko ya bayar da rahoton mu'amalar WireGuard, sabuwar ƙa'idar ba ta gaban manufar ramin ba tukuna. Idan ya bayar da rahoton mu'amalar WAN yayin da na biyu ke nuna tsohuwar hanyar veth, na'urar da sararin suna ba su da jituwa kuma ya kamata ka sake karanta dukkan teburorin hanya biyu.

Fara tsarin da ke buɗe haɗin

Fara umarnin layi ɗaya ne, amma fara tsarin da ke ƙirƙirar soket ɗin da gaske.ip netns exec clearnet curl -s https://ifconfig.me shi ne mafi ƙarancin gwaji na gaskiya: yana nuna adireshin da sararin suna ke gabatarwa ga duniya, ba wanda na'urar za ta yi amfani da shi ba.

Don sabis, haɗa sararin suna ta hanya don tsarin ya kasance a cikinsa dukan rayuwarsa:

[Service]
NetworkNamespacePath=/run/netns/clearnet

Manhajoji na hoto su ne inda hanyar layi ɗaya ke gazawa a hankali. Mai bincike da aka fara daga menu yakan ba da buƙatar ga wani misali da ke gudana a wajen sararin suna tuni, don haka sabuwar taga tana bayyana kuma zirga-zirga har yanzu tana fita ta ramin. Ba shi keɓaɓɓen bayanin martaba don a haɗa sabon misali da gaske, sannan ka duba yanayin tsarin maimakon yin hasashe:

readlink /proc/$(pgrep -f clearnet-profile | head -1)/ns/net
readlink /run/netns/clearnet

Dole ficewar biyu su yi daidai. Wannan gwajin yana aiki ga kowane manhaja mai tsawo, kuma ya cancanci yin shi sau ɗaya ga kowace manhaja maimakon ɗauka cewa mai farawa ya yi abin da kake nufi.

Warware sunaye yana buƙatar nata shawarar. Ƙirƙirar sararin suna ba ya ba shi tsarin mai warwarewa; ana tallafa wa fayiloli na kowane sararin suna ta hanyar /etc/netns/<name>/resolv.conf kuma ba tare da ɗaya ba za ka gaji halin da ake sauƙin karantawa ba daidai. IPv6 yana buƙatar irin wannan kulawa: idan sararin suna ba shi da tsohuwar hanyar v6 yayin da manhajar ta fi son v6, buƙatun na iya tsayawa kafin su koma baya, wanda ke kama da karyayyen rami.

Duba tsarin, ba adireshin fita kawai ba

Adireshin jama'a mai aiki yana tabbatar da hanya, ba dukan buƙatar ba. Bi sauran a wannan tsari:

• ip netns exec clearnet ip route get 1.1.1.1 yana nuna tsohuwar hanyar veth, ba mu'amalar WireGuard ba.
• Ƙididdigar FORWARD a kan ƙa'idojin biyu suna ƙaruwa yayin da buƙata ke gudana.
• Tsarin manhajar yana bayar da rahoton inode na sararin suna da kake tsammani.
• Bayan sake kunnawa sararin suna yana nan kafin sabis ya fara; unit da ke gudana a baya ya kasa, ko mafi muni, yana gudana a wajen sararin suna.

Sa'an nan ka yanke shawarar abin da ya kamata ya faru idan ramin ya faɗi. Sararin suna yana ci gaba da aiki, wanda shi ne manufar wannan aiki kuma har ila yau haɗarin: manhajar da aka keɓe tana ci gaba da haɗi yayin da duk sauran suka tsaya. Rubuta hakan a matsayin zaɓin manufa kuma ka kasance a fili game da abin da keɓewar ba ta rufewa — asalin asusu, yanayin mai bincike da aka adana da mai ba da DNS naka duk suna wajen iyakar sararin suna na cibiyar sadarwa, kuma ɗaukar keɓewar a matsayin ɓoye asali ita ce kuskuren da ya fi tsarin tsawon rai.