WireGuard AllowedIPs: hanyar da NetworkManager bai taɓa ƙarawa ba

Ma’aunin musafaha yana sabuntawa, interface ɗin yana riƙe da adireshinsa, kuma ping zuwa ɗaya gefen ba ya isa ko’ina. Wannan haɗin yana rikitar da mutane domin musafaha mai aiki yana kama da hujja cewa ramin yana shirye. Ba haka ba: ramin na iya zama an yi shawarwari gaba ɗaya kuma har yanzu ba shi da wata hanya da ke tura zirga-zirga cikinsa, kuma waɗannan ayyuka biyu ne daban waɗanda ɓangarori biyu na yanayi daban suke yi. Gyaran ya dogara gaba ɗaya ga wanne daga cikin biyun ya ɓace, don haka mataki na farko shi ne gano hakan.

wg-quick yana yin duka biyu ba tare da an nemi shi ba. Tallafin WireGuard na ciki a cikin NetworkManager shi ma yana girka hanyoyin peer ta tsohuwa, wanda hakan ke taƙaita waɗanda ake zargi zuwa zaɓi da aka kashe, wata teburin tuƙi daban, ko saitin da aka shigo da shi ta wani abu dabam.

Tabbatar da ramin kafin bin hanyar

wg show yana buga interface ɗin, peer, ƙarshen wuri da shekarun musafaha na ƙarshe, kuma ip addr show yana tabbatar da adireshin yana nan. Musafaha na kwanan nan yana nufin maɓallan, ƙarshen wuri da hanyar UDP suna aiki. Duk abin da ya lalace yana zaune a ƙasa da su: tuƙi, tacewa ko warware sunaye.

Sa’an nan ka tambayi kernel abin da zai yi da wata manufa ta gaske maimakon ta hasashe: ip route get 10.42.7.9. Amsar tana ambaton interface ɗin fita da adireshin tushen da fakitin zai ɗauka. Idan ya ambaci adaftar jiki, fakitin ba ya shiga ramin ko kaɗan, duk yadda musafahar ta yi kyau.

AllowedIPs tace ne kuma jerin hanyoyi

Ƙwayoyin farko a cikin AllowedIPs suna yin ayyuka biyu. Suna zaɓar wane peer zai ɗauki manufar fita, kuma suna tabbatar da adireshin tushen fakiti masu shigowa, wanda shi ne iyakar tuƙin maɓallin sirri. A wg-quick suna kuma tafiyar da girka hanyoyi kai tsaye, kuma wannan ƙarin hali shi ne dalilin da ya sa wannan saitin ɗaya ke aiki daga terminal ba daga abokin ciniki na tebur ba.

A cikin lamarin da ke bayan wannan labarin, an shigo da bayanin ta hanyar plugin na ɓangare na uku maimakon ta tallafin ciki, kuma interface ɗin ya tashi ba tare da hanyar farkon ba. Jerin teburin yana nuna hakan nan take: ip route show yana ɗauke da hanyar da aka haɗa don adireshin interface ɗin kawai, ba komai game da watakila nisa.

Tambaya ko an kunna hanyoyin peer kwata-kwata

Karanta saitin kafin ka canza komai: nmcli -f wireguard.peer-routes,ipv4.route-table connection show work-wg. Lokacin da peer-routes ya nuna no, gyaran da aka tallafa shi ne nmcli connection modify work-wg wireguard.peer-routes yes, sannan sake haɗawa. Ƙara hanyar tsaye a maimakon hakan yana aiki har zuwa kunnawa na gaba sannan ya ɓace a hankali. Wannan ɓacewar ita ce alamar: hanyar da ke dawowa a matsayin asiri kowace safiya ba bayanin ne ke girka ta ba.

Idan an riga an kunna zaɓin, duba ko farkon yana zaune a wata tebur da ip route show table all | grep 10. Hanya a cikin tebur da ba babban tebur ba ba ta ɓace ba, kawai ba a ganuwa ga binciken da ke duba babban tebur kawai. Gyara tuƙin manufofi maimakon tara wani shigarwa mai kwafi a kai.

Ƙara farkon ga haɗin, ba ga tsarin da ke gudana ba

A cikin editan haɗi, shafin WireGuard yana riƙe peer da AllowedIPs ɗinsa, kuma shafin IPv4 yana riƙe ƙarin hanyoyi. Hanyar da aka ƙara a wurin tana wanzuwa bayan sake haɗawa domin ta bayanin ce. A layin umarni daidai shi ne ƙara hanya ga haɗin da sifar ƙofar fanko, sannan a saukar da haɗin a sake tayar da shi domin canjin ya yi aiki.

Zaɓi mafi ƙunci farkon da ke rufe rundunar da kake buƙata. Kwafin misalin /8 na mai bayarwa zai iya hadiye yankuna na gida da suka kasance a ciki, kuma gazawar da ke biyo baya tana kama da rami lalace ba hanya mai faɗi ba.

Rarraba ramin jerin farkon ne ke yanke shawara

Babu maɓalli na rabin rami; jerin farkon shi ne shawarar. Peer mai yanki ɗaya na LAN na ofis da ɗaya na cibiyar gwaji yana aika waɗannan manufofin daidai ta ramin kuma yana barin komai sauran a kwance. Mai masaukai ɗaya yana buƙatar /32, kuma yankunan da suka haɗu a wurare biyu suna buƙatar farkon masaukai har wani ya sake lambar reshen cibiyar.

Zaɓin kada a aika komai ta ramin yana kai wannan shawara zuwa ƙarfinta: jerin kaɗan yana barin hanyar a buɗe yayin da zirga-zirgar yau da kullum ke bin hanyarta ta yau da kullum. Rubuta niyyar, domin in ba haka ba mai karatu na gaba zai ɗauki ɗan jerin a matsayin sakaci ya kuma faɗaɗa shi da taimako.

Mai mallaka ɗaya ga teburin hanyoyi

wg-quick da NetworkManager duka suna ganin su ne suka mallaki hanyoyin interface ɗin. Shigo da saitin da aka rubuta wa wg-quick sannan ka kuma fara sabis ɗin wg-quick, za ka sami shigarwa masu kwafi ko masu cin karo da halinsu ya dogara da wanda ya gudana na ƙarshe. Zaɓi mai mallaka ɗaya ka cire ɗayan: idan NetworkManager ke kula da haɗin, kashe rukunin wg-quick na wannan interface ɗin, kuma kada ka taɓa ƙara bayani na biyu ga na’urar ɗaya.

Lokacin da rabuwar dole ta bi adaftar jiki maimakon manufa, ka koma tuƙin manufofi, kuma tuƙin manufofi shi ma yana buƙatar marubuci ɗaya. Tabbatar ta hanyar maimaita ip route get, sannan isa ga mai masaukai cikin farkon nesa da wani abu da ke buga adireshin tushen da ya zaɓa. Duba IPv6 da DNS daban idan bayanin yana ɗauke da ɗaya daga cikinsu.