Rukunai biyu, subnet ɗaya, cibiyar WireGuard ɗaya: sa ya yi aiki

Dukan rukunin yanar gizo biyu suna amfani da kewayon LAN ɗaya, kuma haɗuwar ba ita ce ainihin abin da ke karya ƙirar. Dole ne cibiyar ta zaɓi rukunin yanar gizo da adireshin manufa kaɗai, kuma manufa guda biyu iri ɗaya ba su ba ta abin zaɓi. Sake lambobi ofis ɗin da ke aiki don biyan bukatar rami yawanci mummunar ciniki ce fiye da ba kowane sabis ɗin da aka buga adireshin dabam da ramin zai iya ɗauka. Ƙirar da ke ƙasa tana buga sabis ɗin HTTPS ɗaya a kowane rukunin yanar gizo kuma ba wani abu ba.

Me ya sa haɗuwar ba ita ce ainihin matsalar

WireGuard yana turawa bisa ga manufa: AllowedIPs na peer ne ke yanke shawarar wane peer zai karɓi fakiti. Peers biyu ba za su iya shelar 10.10.7.0/24 duka ba tare da ɗaya daga cikinsu ya ci kowane bincike ba. Wannan dabi'a ce ta teburin peer, ba ta rami ba, shi ya sa maganin a nan shirin adireshi ne, ba dabarar turawa ba.

Shirin shi ne a daina shelar LAN gaba ɗaya. A maimakon haka, shelar alias ga kowane sabis, adireshi ɗaya a kowane rukunin yanar gizo, kuma bari ƙofar kowane rukunin ta fassara wannan alias zuwa ainihin aikace-aikacensa.

Mai amfani yana tura adireshi biyu na musamman, bai taɓa ganin prefix ɗin da ba shi da tabbas ba, kuma babu abin da ke canzawa a kowane ɗayan ofisoshin biyu. Wannan yana faɗin iyakar da gaskiya: kana buga sabis ɗin HTTPS ɗaya daga kowane rukunin yanar gizo, ba haɗa cibiyoyin sadarwa biyu ba. Dokokin da ke biyo baya suna zama ƙanana domin bayanin ɗan ƙunci ne. Faɗin bayani zai buƙaci faɗin dokoki, kuma haka waɗannan ƙirorin suke rikitarwa.

Ba kowane rukunin yanar gizo alias da mai amfani zai iya turawa

Zaɓi adireshi daga kewayon da ba ya cin karo da kome a na'urar mai amfani, cibiyar ko ɗaya daga cikin LAN ɗin biyu. A nan cibiyar ita ce 10.66.0.1, mai amfani shi ne 10.66.0.10, ƙofofin su ne 10.66.0.21 da 10.66.0.22, kuma aliases ɗin biyu su ne 10.77.1.20 da 10.77.2.20. Cibiyar tana buga kowane alias ta peer ɗin da ya mallake shi, don haka fakiti mai fita da aka aika zuwa alias ɗaya zai iya fita ne kawai ta rukunin da ya dace:

[Interface]
Address = 10.66.0.1/32
ListenPort = 51820
PrivateKey = HUB_KEY

[Peer]
PublicKey = USER_PUBLIC_KEY
AllowedIPs = 10.66.0.10/32

[Peer]
PublicKey = SITE_A_PUBLIC_KEY
AllowedIPs = 10.66.0.21/32, 10.77.1.20/32

[Peer]
PublicKey = SITE_B_PUBLIC_KEY
AllowedIPs = 10.66.0.22/32, 10.77.2.20/32

Bangaren mai amfani yana buƙatar aliases ɗin biyu kawai, wanda ke kiyaye saitin abokin ciniki daga duka prefixes ɗin LAN biyu. Babu abin da ke cikin wannan saitin da ya ambaci kowane ainihin LAN:

[Interface]
Address = 10.66.0.10/32
PrivateKey = USER_KEY

[Peer]
PublicKey = HUB_PUBLIC_KEY
Endpoint = hub.example.net:51820
AllowedIPs = 10.77.1.20/32, 10.77.2.20/32
PersistentKeepalive = 25

Kowace ƙofa tana shelar cibiyar da tushen mai amfani, ba wani abu ba, don haka rukuni ba ya taɓa koyon LAN na ɗayan. Keepalive yana kiyaye taswirar NAT a kan hanyar sama ta rukunin; ba ya ba da izinin zirga-zirga, kuma bangon wuta har yanzu yana yanke shawarar abin da ake karɓa. Kwafin saitin ƙofa ɗaya zuwa wata ba laifi ba ne muddin maɓallin sirri, adireshin mu'amala da alias duk sun canza.

Abin da cibiyar dole ta yarda tsakanin peers ɗinta biyu

Cibiyar tana tura fakiti tsakanin peers ɗinta biyu, wanda shawara ce a cikin sarkar forward ba shawara ta shigarwa ba. Kunna turawar IPv4 ta hanyar da ta saba ta dandamali, sannan ka yarda da ma'auratan da ƙirar ke buƙata daidai.

Dokar da ke ƙasa tana ba mai amfani izinin alias ɗaya da tashar jiragen ruwa ɗaya, kuma tana ba da izinin zirga-zirgar dawowa ta hanyar bin diddigin haɗi. Tana watsar da duk sauran a hanyar forward, kuma wannan shine ma'anar:

nft add table inet hub_transit
nft add chain inet hub_transit forward '{ type filter hook forward priority 0 ; policy drop ; }'
nft add rule inet hub_transit forward ct state established,related accept
nft add rule inet hub_transit forward iifname wg0 oifname wg0 tcp dport 443 ip saddr 10.66.0.10 ip daddr 10.77.1.20 accept

Abubuwa biyu sun cancanci ambata domin suna haifar da gazawa cikin shiru. Accept a cikin sarkar tushe ɗaya ba ya wuce drop a wata, don haka haɗa wannan da manufar da ke akwai maimakon loda shi gefe da gefe. Kuma adireshin tushe yana gane na'urar, ba mutum ba; ka raba tantancewar aikace-aikace da karɓar cibiyar sadarwa.

Inda alias ya zama ainihin adireshi

Rukunin A yana karɓar buƙata zuwa 10.77.1.20, yana sake rubuta manufar zuwa ainihin aikace-aikacen, kuma yana sake rubuta tushen zuwa adireshin LAN ɗinsa don amsar ta iya dawowa ba tare da hanyar zuwa ramin ba. Yin fassarorin biyu a wuri ɗaya yana kiyaye sauran cibiyar sadarwa cikin rashin sani game da alias. Dokokin da ke ƙasa su ne dukan injin:

nft add table ip site_a_nat
nft add chain ip site_a_nat pre '{ type nat hook prerouting priority -100 ; policy accept ; }'
nft add chain ip site_a_nat post '{ type nat hook postrouting priority 100 ; policy accept ; }'
nft add rule ip site_a_nat pre iifname wg0 tcp dport 443 ip saddr 10.66.0.10 ip daddr 10.77.1.20 dnat to 10.10.7.20:443
nft add rule ip site_a_nat post iifname wg0 oifname lan0 tcp dport 443 ip saddr 10.66.0.10 ip daddr 10.10.7.20 snat to 10.10.7.2

Sannan manufar forward ta rukunin A dole ta yarda da kwararar da aka fassara daga mu'amalar rami zuwa mu'amalar LAN, da kuma alkiblar dawowa. Hook ɗin forward yana ganin manufar bayan fassarar manufa da kuma kafin sake rubuta tushe, shi ya sa dokar ke ambaton adireshin ainihin aikace-aikacen. Karanta waɗannan hooks biyu a wannan tsari duk lokacin da doka ta yi kama da ba ta dace da kome ba. Dokar forward da aka rubuta a kan alias ba za ta taɓa dacewa ba, domin alias ɗin ba ya wanzu a wannan hook.

Rukunin B yana maimaita wannan da alias ɗinsa da maɓallinsa. Bai kamata ya sake amfani da maɓallin sirri na rukunin A ba, domin peers biyu da ke raba ainihi ɗaya kuskure ne na saiti wanda ke da wuya a gani kuma mai sauƙin ƙirƙira ta kwafin fayil. Ka riƙe takardun ƙofofin biyu iri ɗaya sai dai ƙimar da dole su bambanta, don bambancin ya bayyana a bita. Fayil ɗin da aka kwafa shine asalin wannan kuskuren.

Sake rubuta tushen yana da farashi. Aikace-aikacen yana ganin ƙofar a matsayin abokin cinikinsa, don haka rajistarsa ba ta ƙara nuna wane mai amfani ya haɗa ba. Ka riƙe sawun binciken ƙofar, kuma kada ka raunana shiga aikace-aikacen don ramawa ga ainihin cibiyar sadarwa da fassarar ta cire.

Yadda za a tabbatar da cewa duka sunayen da aka buga suna amsawa

Ba kowane alias sunan DNS kuma saita aikace-aikacen da takardar shaida ga wannan sunan, domin fassara ba ta sake rubuta turawa ko URL cikakke da aka saka ba. Yi amfani da suna ɗaya a kowane rukunin yanar gizo don rashin daidaituwar takardar shaida ba za a taɓa ɗaukarsa a matsayin gazawar turawa ba.

Gwada daga ainihin abokin ciniki, tabbatar da wane rukuni ya amsa, kuma gwada tashar da ba a ba da izini ba. Yi amfani da sabbin haɗi bayan kowane canjin NAT, domin yanayin da aka kafa yana riƙe tsohuwar taswira:

wg show wg0 allowed-ips
sudo nft list ruleset
curl -sS -o /dev/null -w "%{http_code}\n" https://site-a.example.net/

Alias mara komai ko wanda ba a tsammani a umarni na farko yana nufin zaɓin peer ɗin ba daidai ba ne kafin kowace dokar bangon wuta ta yi muhimmanci. Idan alias ɗin daidai ne kuma sunan har yanzu yana kasawa, matsalar ta ƙaura zuwa DNS da takardun shaida. Da zarar duka sunayen sun amsa kuma tashar ta uku ta kasance a rufe, ƙirar tana yin abin da ta faɗa: sabis biyu da aka buga a ƙunci, ba LAN biyu da aka haɗa ba.