Maɓalli na sirri a nan, maɓalli na jama'a a can: maɓallan WireGuard
Maɓallinka na sirri yana zama a na'urarka; shigarwar abokin tarayya tana riƙe da maɓallin jama'a na ɗaya gefen. Raba rabin jama'a kawai, kuma ba kowace na'ura nata asalin.
Yawancin gazawar WireGuard da ake ginawa da hannu suna komawa ga wane maɓalli ya tafi ina. Sashen mu'amala yana ɗauke da maɓallin sirri na na'urar da kake daidaitawa, yayin da sashen abokin tarayya ke ɗauke da maɓallin jama'a na injin da ke wancan gefen. Musanyar waɗannan rabi, ko liƙa wanda bai dace ba, yana haifar da musafaha da ba ya ƙarewa da kuma tarihin da ba ya ambaton maɓalli. Yi waɗannan gwaje-gwaje huɗu da ke ƙasa bisa tsari kafin ka taɓa AllowedIPs ko DNS.
Maɓalli biyu, hanyoyi biyu
Maɓallin sirri na wata na'ura ɗaya ne kawai kuma yana zama a sashen mu'amalar wannan na'urar. Rabinsa na jama'a shine abin da kowane abokin tarayya ke buƙata don gane na'urar, kuma kayan aiki suna fitar da shi maimakon ƙirƙira shi. A kan uwar garke, maɓallin jama'a na na'urarka yana bayyana a matsayin shigarwar abokin tarayya; a na'urarka kuma, maɓallin jama'a na uwar garke ne ke riƙe wannan matsayi. Karanta tsarin da murya a cikin waɗannan kalmomi yana kama yawancin ruɗani kafin su isa musafaha.
Umurnin wg yana buga abin da mu'amalar gida ke amfani da shi a haƙiƙa, har da duka maɓallan jama'a biyu. Wannan ya sa ya zama hanya mafi sauri ta raba kuskuren daidaitawa da matsalar haɗi:
wg show
wg show interfacesFitowar farko tana lissafa kowane abokin tarayya da maɓallinsa na jama'a, ƙarshen wurin da ya yi amfani da shi na ƙarshe, da shekarun musafaharsa ta ƙarshe. Shekarun musafaha «taba» a gefe ɗaya da na kwanan nan a ɗayan suna nuni ga maɓallin da ƙarshen ɗaya kawai ya karɓa. Umurni na biyu yana ambaton mu'amalolin da za ka iya bincika ƙari.
Abin da za a raba da abin da ba za a taɓa rabawa ba
An yi maɓallin jama'a don a miƙa shi, ko da yake har yanzu yana nuna dangantakar na'ura, shi ya sa aika shi ga shugaban da ya nema ya bambanta da wallafa shi. Maɓallin sirri ba ya taɓa barin na'urar da ta ƙirƙira shi. Fayil ɗin da aka fitar ko lambar QR tana riƙe da dukan tsarin har da wannan maɓallin sirri, don haka babu ɗayansu da ke da aminci a wucewa da shi, kuma ɓoye rubutun a cikin hoto ba ya canza komai. Maɓallan da aka riga aka raba na zaɓi ne kuma asiri ɗaya, kuma dole ɓangarorin biyu su ɗauki ƙima ɗaya in ba haka ba musafahar tana tsayawa a wancan matakin.
Wani bambanci kuma ya kamata a faɗa a fili: ƙarshen wuri adireshi ne da tashar jiragen ruwa, ba maɓalli ba. Liƙa maɓallin jama'a a filin ƙarshen wuri, ko adireshi a filin maɓalli, yana haifar da fayil da ake nazari sannan ba ya yin komai. Kayan aiki ba za su kama shi ba, domin duka filayen kalmomi ne kawai. Farawar sauri ta WireGuard tana nuna hanyar ƙirƙira da fitarwa a layi ɗaya.
Na'ura ɗaya, shigarwar abokin tarayya ɗaya
Inda sabis ɗin ya yarda, kowace na'ura ya kamata ta ɗauki nata asalin abokin tarayya. Liƙa cikakken fayil ɗin kwamfutar tafi-da-gidanka a waya yana ɓata wace na'urar ke riƙe da wannan asalin a uwar garke kuma yana sa soke wayar da ta ɓace ya fi wahala. Idan maɓallin sirri ya yoyo, cire tsohuwar izinin abokin tarayya a uwar garke kuma ka samar da wanda zai maye gurbinsa. Share fayil ɗin gida ba ya cire shigarwar uwar garke, kuma sabon maɓallin abokin ciniki ba ya taimakon kowa har uwar garke ta san rabinsa na jama'a.
Ka riƙe taswirar na'ura zuwa maɓallin jama'a kusa da jerin adireshi. Wannan jerin ne ke mai da sokewa aiki na minti biyu maimakon dukan yammaci.
Abin da har yanzu ke gazawa bayan musafaha
Ma'auratan maɓalli suna gane abokan tarayya; ba sa yanke shawara kan halin cibiyar sadarwa. AllowedIPs yana haɗa jeri na adireshi da abokin tarayya, kuma hanyoyin da ke kewaye da shi abokin ciniki ko kayan aikin saitin ne ke kula da su. Alamar yawanci tana faɗin wane matakin ne za a buɗe gaba:
| What you see | Which key problem it usually means | Where to look first |
|---|---|---|
| Handshake age stays at never on both ends | Peer public key missing, or an endpoint pointing at nothing | wg show, then the endpoint value |
| Handshake completes on one side only | The two ends hold different public keys for each other | wg show on both hosts |
| Handshake works, then no traffic | AllowedIPs or routes rather than keys | wg show and the route table |
| Worked until a key was regenerated | The peer entry still holds the old public key | Compare both public keys, then update the peer |
DNS na iya gazawa bayan duka abokan tarayya sun tabbatar da kansu yadda ya kamata, kuma aikace-aikace na iya gazawa yayin da ramin da kansa yake lafiya, don haka musafahar da ke aiki ba ita ce ƙarshen binciken ba. Maɓalli kuma ba sa faɗin komai game da yadda mai aiki yake yin rikodi ko ko wani gidan yanar gizo ya gane asusunka, kuma waɗannan tambayoyin suna wani wuri. Matso zuwa matakan cibiyar sadarwa da zarar gwaje-gwajen huɗu sun wuce, domin maɓallin da ya ɓace ba matsalar hanya ba ce a ɓoye.