WireGuard 5G reshe: bari reshe ya kira hub ɗin

Nuna reshe zuwa hub shine rabin sauƙi na wannan ƙira lokacin da reshe ke bayan adireshin wayar hannu mai canzawa kuma hub ɗin yana da suna mai tsayawa. Sa’an nan hub ɗin yana koyon reshe daga zirga-zirgar da aka tabbatar, maimakon daga rikodin da dole ka ci gaba da sabunta shi. Yarjejeniyar mai sauƙi ce: reshe ne koyaushe yake farawa.

Saita shi da gangan, sannan ka tabbatar da ɓangaren da mutane suke tsammanin yana aiki. Duk matakan biyu suna ɗaukar mintuna, kuma a na biyu ne waɗannan ƙira sukan gaza.

Wane ɓangare ke riƙe da ƙarshen wuri mai tsayawa

Saitin reshe yana ambaton ƙarshen wurin hub ɗin da maɓallin jama’a. Saitin hub ɗin yana ambaton maɓallin jama’ar reshe da ƙayyadaddun prefixes na ciki da aka yarda da su, kuma yana iya zama ba shi da kowane ƙarshen wuri, domin asali yana zuwa daga maɓalli ba daga adireshin tushen fakiti na ƙarshe ba. Wannan rashin daidaito shine duk injin, kuma yana kawar da aji ɗaya na matsalolin ganowa daga ɓangaren hub ɗin.

Lokacin da reshe ya aika fakiti da aka tabbatar, hub ɗin yana rubuta tushen da ya fito, kuma yana amfani da wannan taswirar don amsoshi. Sake lambobi na hanyar wayar hannu ba ya kashewa komai bayan musayar hannu ta gaba, kuma kowane ɓangaren da ba ka buƙatar shi kuma shine wanda ba zai iya gaza yayin sauyawa ba. Wannan dabi’a ta cancanci a gwada lokacin sauyi da aka tsara ba lokacin wani lamari ba. Yi shi yayin da wani zai iya kallon ƙarshen biyu a lokaci ɗaya.

Ba reshe saitinsa da zai jure sake lambobi

Riƙe ƙarshen wuri da keepalive a reshe, kuma riƙe shigarwar peer na hub ɗin ba tare da adireshin da aka hard-code ba. Keepalive yana riƙe taswirar da aka fassara a buɗe tsawon isa don hub ɗin ya aika zirga-zirgar da ba a nema ba bayan lokacin rashin aiki.

[Peer]
PublicKey = HUB_PUBLIC_KEY_BASE64
Endpoint = hub.example.net:51820
AllowedIPs = 10.60.0.0/24, 10.60.10.0/24
PersistentKeepalive = 25

Dakika ashirin da biyar shine misalin da ake yawan ambata don riƙe taswirar NAT da rai, ba wajibi ba ga kowane peer. Saita shi bisa ga lokacin ƙarewar taswirar da kake gani a zahiri, kuma ka tuna yana haifar da zirga-zirga a kan hanyar da ke da iyakar bayanai muddin interface ɗin yana aiki.

A hub ɗin, prefixes da aka yarda da su na peer ɗin reshe dole su rufe duk abin da reshe zai aika. Prefix da ya ɓace yana ɗaukar hali kamar gazawar tafiyar da hanya a ƙarshen nesa kuma ba ya haifar da kowane gargaɗi a kowane ɓangare, don haka ya cancanci bita kafin ainihin fakiti na farko. Kwatanta prefixes da aka yarda da su na hub ɗin da adireshin interface na reshe kafin haɗin farko.

Tabbatar da taswirar da jujjuyawar gazawa

Tabbatar cewa musayar hannu tana cika, hub ɗin yana lissafa ƙarshen wurin reshe na yanzu, kuma ana iya isa adireshin ciki na reshe ta hanyar tunnel ɗin. Wannan shine tushen layi, kuma ya kamata a rubuta shi kafin wani ya taɓa hanyar wayar hannu. Layi biyu na fitarwa sun isa. Ajiye su a tikit ɗin tare da tambarin lokaci.

wg show wg0
wg show wg0 latest-handshakes
ip route show default
ping -c 3 10.60.10.1

Sannan gwada gazawar da ƙirar ta kasance dominta. Cire WAN na farko kuma ka tabbatar cewa tushen hanyar reshe zuwa hub ɗin yanzu yana fita ta interface ɗin wayar hannu. Tunnel ba zai iya gyara hanyar jiki da ta karye ba, don haka hanyar waje da har yanzu ke nuni ga hanyar sama da ta mutu tana haifar da ƙarewar lokacin musayar hannu wanda yake kama da matsalar hub ɗin kai tsaye.

Idan an ɗaure hanyar waje a fili ko an tafiyar da ita bisa manufa, jujjuyawar gazawa dole ta haɗa da ita. Wannan gibin tsakanin ƙirar da ake karantawa daidai da wadda ta jure rashin aiki shine yawanci abu ɗaya da ya ɓace.

Abin da wannan ƙira ba ta warwarewa

Babu wani abu a nan da ke ba da izinin haɗi mai shigowa zuwa reshe. Idan wani abu a babban ofis dole ya buga waya zuwa wurin wayar hannu, alkiblar tunnel ɗin ba daidai ba ce ga wannan buƙata, kuma DNS mai canzawa yana sabunta suna kawai. Fassarar mai bayarwa, manufar shigowa da sabunta ƙarshen wuri daga abokin ciniki duk suna kan hanya, kuma rikodin da ya canza ba zai iya buɗe NAT na matakin mai aiki ba.

Riƙe prefix ɗin reshe dabam da kowane wuri, kuma ka iyakance abin da ƙofarsa za ta tura. Ƙarshen wurin hub mai tsayawa yana sauƙaƙa ganowa kuma ba ya yin komai ga ƙirar tafiyar da hanya, tsara adireshi ko tambayar waɗanne hanyoyin aikace-aikace suka jure jujjuyawa.

Rubuta abubuwa huɗu a cikin runbook: wa ya fara, waɗanne prefixes aka yarda da su, tsawon keepalive, da abin da ke faruwa idan babbar hanyar ta faɗi. Waɗannan layukan sune abin da ma’aikacin gaba zai buƙata da gaske da ƙarfe uku na safe.