AllowedIPs lissafin tuƙi ne, ba ƙa'idar bangon wuta ba

Yawancin mutane suna karanta AllowedIPs a matsayin lissafin izini, jerin adiresoshin da za su iya haɗawa da abokin haɗi, kamar ƙa'idar bangon wuta da aka rubuta don rami. Ba haka ba ne. Filin teburin tuƙi ne da ke aiki a duka kwatance biyu: yana zaɓar abokin haɗi don fakitin fita kuma yana tabbatar da tushen fakitin shigowa. Karanta shi a matsayin lissafin izini yana haifar da saitunan da suke tuƙa zirga-zirgar da babu wanda ya nema.

Fili ɗaya, masu karatu biyu: zaɓin fita da duba tushe

A wajen abokin ciniki, fifikon yana ƙayyade waɗanne wurare ke tafiya zuwa wannan abokin haɗi kuma waɗanne ke zama a kan talakawan hanyar sadarwa. Don haka shigarwa don 0.0.0.0/0 tana kama kowane wurin IPv4, kuma shi ya sa shigo da bayanin cikakken rami ke tura talakawan bincike ta na'urar nesa. Ƙananan shigarwa suna yin akasin haka: suna tuƙa hanyoyin sadarwar da ka lissafa kawai kuma suna barin sauran duka a inda suke. Sashen tuƙin maɓallin sirri a cikin takardun WireGuard ya bayyana ayyukan biyu a wuri ɗaya: zaɓin abokin haɗin fita da tabbatar da tushen shigowa.

A wajen sabari, wannan filin yana bayyana waɗanne adiresoshin tushe kowane abokin haɗi zai iya amfani. Wannan duba ce ta sirri ba tacewar fakiti ba: fakitin da tushensa na ciki bai dace da lissafin abokin haɗi ba ana jefar da shi cikin WireGuard kafin kowane bangon wuta na mai masauki ya gan shi. Ayyukan biyu suna raba lissafi ɗaya, kuma shi ya sa lissafin da aka kwafa daga wani wuri ke yin kuskure a wurin da ba ka yi la'akari da shi ba.

Bilokin abokin ciniki shi ne inda yawancin wannan ruɗani ke farawa. Tagwayen rami yana ambaton hanyoyin sadarwar nesa, kuma cikakken rami shi ne wannan filin da fifikon da aka saba:

[Peer]
# split tunnel: only these networks
AllowedIPs = 10.77.0.0/24, 192.168.30.0/24

[Peer]
# full tunnel: everything, both families
AllowedIPs = 0.0.0.0/0, ::/0

Duk siffofin biyu cikakke ne da kansu, kuma zaɓi ne maimakon matakai. Na farko yana aika waɗannan hanyoyin sadarwa biyu kawai ta ramin; na biyu yana aika kowane wuri, inda shigarwar ::/0 ke ƙara IPv6 ga tsohon IPv4. Duk wanda ka zaɓa, waɗannan fifikon sune dukan shawarar tuƙi ga wannan abokin haɗi da zarar wg-quick ya fara shigar da hanyoyi.

Cibiyar tana buƙatar wani lissafi

Cibiya tana lissafa adireshin rami na kowane abokin ciniki a matsayin fifikon mai masauki, tare da duk wata hanyar sadarwa da ke bayan wannan abokin ciniki. Kwafin lissafin fadi na abokin ciniki zuwa kowane abokin haɗin cibiya yana gaya wa cibiya cewa abokan haɗi da yawa na iya amfani da adiresoshi ɗaya a matsayin tushe, kuma wannan ba shirin adireshi ba ne. Filin Endpoint na wani Layer ne gaba ɗaya: yana ambaton adireshin waje da tashar abokin haɗi, ba wani wuri cikin rami ba.

[Peer]
# laptop: tunnel address 10.77.0.2, office LAN behind it
AllowedIPs = 10.77.0.2/32, 192.168.30.0/24

Fifikon mai masauki yana ɗauke da adireshin rami kuma fifikon hanyar sadarwa yana ɗauke da abin da ke bayan abokin ciniki, kuma duka biyu ana buƙata. Ba tare da fifikon mai masauki ba cibiya ba za ta iya mayar da zirga-zirgar abokin ciniki kanta ba, kuma ba tare da fifikon hanyar sadarwa ba LAN ɗin da ke bayansa ya kasance ba a iya isa ba; abokin haɗin da babu komai a bayansa yana samun fifikon mai masauki kawai.

Tsallake shigar da hanyoyi yana barin gibi

wg-quick, mai taimakawa da ke ɗaga mu'amala daga fayil ɗin saiti, yana shigar da adiresoshin mu'amala da hanyoyi a matsayin ɓangaren wannan aiki. Saitin Table = off yana gaya wa mai taimakawa ya tsallake aikin hanyoyi, wanda ba ya shigar da maye gurbi kuma ba ya sa hanyar sadarwa ta sirri a iya isa. Lokacin da hanyoyin atomatik suka riga sun yi aikin, ambaton fifikon da kake buƙata shine mafi bayyanan saiti. Kashe sarrafa hanyoyi da barin maye gurbin ba a rubuta ba ba tsari ba ne, ajiyar kai ne.

Babban kayan aikin wg yana yin wata hali: yana saita mu'amala kuma ba ya taɓa hanyoyi, don haka tsarin da aka gina kai tsaye akansa yana buƙatar umarnin hanyoyinsa. Umarnin da aka rubuta don kayan aiki ɗaya na iya zama kamar ba daidai ba idan aka bi su da ɗayan. Ping mai nasara ma shaida ce mai rauni, domin yana gwada hanya ɗaya maimakon kowace hanyar aikace-aikacen da kake buƙata.

DNS da IPv6 ana yanke shawara daban

Duba adireshin sabarin DNS da ramin ke sanarwa, kuma tabbatar da cewa akwai hanya zuwa wannan adireshin ta fifikon da ka zaɓa. Saitin mai warwarewa ba ya sa mai warwarewa a iya isa, kuma ƙunsantar da rami na iya cire hanyar da ta kasance tana isa gare shi a hankali. Bincika IPv6 kuma da kansa, domin daidaitaccen rabon IPv4 ba ya faɗin komai game da hanyar da aka saba ta IPv6 da har yanzu take nuni ga haɗin jiki. Shawarwari uku daban-daban na iya canzawa lokaci ɗaya idan ka gyara bilokin abokin haɗi ɗaya.

Sannan buɗe wata hanya ta sirri da wani gidan yanar gizo na yau da kullum daga sanannen saitin farawa. Idan hanyar ta amsa kuma bincike har yanzu yana fita ta hanyar sadarwar gida, rabon yana yin abin da ka nema. Idan bincike ya lalace a lokaci ɗaya, ramin ya ɗauki hanyar da aka saba kuma lissafin fifiko shine wurin da za a duba.