Abokin ciniki na WireGuard ba ya iya isa abokin ciniki na OpenVPN?

Duk ramukan biyu suna haɗuwa, kowane abokin ciniki yana isa ƙofar, kuma a lokacin da ɗaya ya gwada adireshin ɗayan sai fakiti su bace. Babu abin da ba daidai ba a kowace musafaha, kuma sake fitar da maɓallai ba ya canza hakan. Ƙofar tana ɗaukar fakiti na IP na yau da kullum marasa ɓoyewa tsakanin biyu daga cikin muƙamanta, don haka ka'idojin ba sa buƙatar fahimtar juna; abin da suke buƙata shi ne abubuwa uku da babu musafaha da ke bayarwa. Rufin inda ake nufi a abokin ciniki na asali, mallakar tushe a ƙofar, da hanyar dawowa a gefen nesa. Alamar cutar ɗaya ce ga dukan ukun, shi ya sa ake gano su tare.

Alamar cutar tana rasa sashe ɗaya a lokaci ɗaya

Wannan ƙira tana amfani da tafkin WireGuard 10.71.0.0/24 a kan wg1 da tafkin OpenVPN 10.72.0.0/24 a kan tun1, dukansu suna ƙarewa a ƙofa ɗaya. Buƙatar da ake gwadawa tana tafiya daga 10.71.0.5 zuwa HTTPS a kan 10.72.0.30. Kowane mataki da ke ƙasa game da wannan kogin guda ɗaya ne. Kowane bincike yana da sa hannun gazawa daban ko da yake mai amfani yana fuskantar su ɗaya, kuma yawanci ɗaya ne kawai daga cikin ukun ke ɓacewa a lokaci ɗaya.

Fara da tabbatar da cewa duk tafkunan biyu suna kan wannan ƙofar kuma an kunna turawa a cikin sararin suna da ramukan ke ciki. Ƙofar da ke ƙare ka'idojin biyu a cikin sararun suna daban ba ta tura kome tsakaninsu, kuma ya dace a kawar da hakan kafin karanta kowace ƙirar abokin tarayya.

Faɗaɗa rufin inda ake nufi na reshen

A kan abokin ciniki na WireGuard, shigarwar abokin tarayya da ke akwai dole ta zaɓi ƙofar don inda ake nufi na OpenVPN, wato dole jigon inda ake nufi ya bayyana a cikin jerin da aka yarda na wannan abokin tarayya. Ƙara shi ba ya ƙirƙirar rami na biyu; yana canza wanda abokin ciniki zai zaɓa sa'ad da yake neman wannan adireshin, kuma da wg-quick hanya tana bin jerin kai tsaye.

AllowedIPs = 10.71.0.0/24, 10.72.0.0/24

Bar ainihin layukan maɓalli da matsayin ƙarshe ba tare da an taɓa su ba, kuma ka tuna cewa mai sarrafawa da ke amfani da Table = off ba ya ɗaukar kowace hanya daga wannan jeri kwata-kwata. A irin wannan yanayi dole wanda ya mallaki wannan jigon ya sanya shi a cikin teburin hanyoyin na'urar, kuma hanyar da ta ɓace a wurin tana kama da jigon da aka yarda wanda ya ɓace.

Ka riƙe mallakar tushe a ƙofar

Shigarwar abokin tarayya na wannan abokin ciniki a ƙofar ya kamata ta ci gaba da mallakar ainihin adireshin tushe na wannan abokin ciniki. Ana bincika adireshin da aka yarda a duka kwance biyu: suna zaɓar abokin tarayya don zirga-zirgar fita kuma suna tabbatar da cewa tushen fakiti mai shigowa na abokin tarayyarsa ne da ya aika shi. Sanya tafkin OpenVPN cikin shigarwar reshe saboda reshe yana son isa gare shi shi ne kuskuren da ke tura zirga-zirga zuwa wurin mahalarta mara kyau.

AllowedIPs = 10.71.0.5/32

Karanta wannan shigarwa a matsayin sanarwar mallaka ba sauƙin hanya ba. Duk wani abu da abokin ciniki zai isa gare shi yana cikin jerin inda abokin ciniki zai nufa, ba cikin tunanin ƙofar game da abin da aka yarda wannan abokin tarayya ya aika ba.

Ba gefen OpenVPN hanyar dawowa

Yanzu inda ake nufi yana buƙatar hanya ta komawa zuwa tushen WireGuard, kuma ga abokan ciniki na tafki yawanci tana zuwa a matsayin hanyar da aka tura daga uwar garken OpenVPN. Tura ta zuwa ga abokan ciniki da ya kamata su kasance da ita kawai, kuma tabbatar a kan abokin ciniki cewa an karɓa ta maimakon ɗauka cewa an yi amfani da umarnin.

push "route 10.71.0.0 255.255.255.0"

Rarraba hanyoyi ba izini ba ne. Sa'ad da inda ake nufi yake bayan wani abokin ciniki na OpenVPN maimakon a cikin tafki, mallakar LAN na wannan abokin ciniki da buƙatunsa na turawa suna shiga cikin ƙirar, kuma hanyar da aka tura rabin farko ne kawai. Sake bayyana buƙatar a matsayin zane kafin ƙara umarni: wane kulli ya mallaki wane jigo, kuma wane kulli ke turawa zuwa gare shi.

Ka yarda da sabis ɗin da kake so ka yarda da shi kawai

Da an kunna turawa kuma duk tafkunan biyu suna iya tafiya, tambayar da ta rage ita ce manufa. Rubuta ƙa'idar don takamaiman kogi maimakon ga ma'auratan muƙamai gaba ɗaya, duba ta kafin amfani da ita, kuma ka riƙe hanyar dawowa mai yanayi domin kada a toshe amsoshi a matsayin sabbin haɗi. Gwajin bushe ba ya kashe kome kuma yana nuna ainihin abin da za a ƙara.

sudo ufw --dry-run route allow in on wg1 out on tun1 proto tcp from 10.71.0.5 to 10.72.0.30 port 443

Waɗannan ƙa'idoji ne na zirga-zirgar da aka tura, dabam da ƙa'idojin sauraren ƙofar na sabis ɗin VPN biyu. Buɗe tashoshin UDP na waje ba ya ba da izinin buƙatar ciki, kuma ba da izinin buƙatar ciki ba ya buƙatar SSH marar iyaka zuwa ƙofar ko izini na asali a kan turawa. Hakanan dole bangon wutar inda ake nufi da adireshin saurara su jitu, domin sabis ɗin da aka ɗaure da loopback yana ƙin fakiti mafi tsanani da aka yi masa hanya. Manufar da ke rufe gefe ɗaya kawai na tattaunawar tana gazawa da buƙata mai nasara da amsa shiru, wanda shi ne sakamako mafi rikitarwa daga cikin ukun.

Hanyoyin juna yawanci suna nufin ba a buƙatar fassarar tushe, wanda ke adana adireshin WireGuard a inda ake nufi kuma yana sa rajistan ayyuka a iya karantawa. Kada ka ƙara masquerading gaba ɗaya saboda ka'idoji biyu suna ciki, kuma kada ka cire ƙa'idar fassara da take akwai ba tare da sanin abin da ya dogara da ita ba. Sa'an nan ka tabbatar da kogin guda ɗaya daga farko zuwa ƙarshe, kuma ka gwada tushe ko tasha ɗaya da aka hana: musafaha da ke aiki a kowane gefe ba ya tabbatar da hanyar tsallakewa ko keɓewa.