WireGuard ba ya nuna sabon musafaha: abin da za a fara dubawa

Filin sabon musafaha mara komai yawanci yana nufin mu’amala ba ta kammala musafaha ba tun lokacin da ta taso, wanda ke faɗin ƙasa game da saitin fiye da yadda yake gani. WireGuard yana yin shiru har sai fakiti ya buƙaci fita ta mu’amala, don haka peer mara aiki wanda ba shi da abin aikawa yana ba da rahoton haka. Tabbatar ko an ba da wani abu da gaske kafin ka duba maɓallan.

Gwajin shi ne fakiti da aka yarda da shi zuwa inda peer ya kamata ya ɗauka. Duk sauran a wannan allon matsayi suna bayyana niyya ne ba aiki ba.

Mu’amala marar aiki ba ta da abin da za ta bayar da rahoto

WireGuard yana yin musafaha cikin kasala: fakiti na farko da ke buƙatar rami yana fara musayar, kuma mu’amala tana yin shiru har sai lokacin. Peer da aka saita kuma ba a taɓa amfani da shi ba yana nuna musafaha mara komai, sifili bytes da aka karɓa da tazara mai girma tun na ƙarshe. Wannan yanayin yana da lafiya ga abokin ciniki marar aiki kuma yana da damuwa kawai idan kana tsammanin zirga-zirga ya riga ya gudana. Duba ma’aunin canja wuri kuma, domin suna raba babu-abin-da-aka-aika daga an-gwada-kuma-ya-kasa.

Idan ma’aunai sun tsaya a sifili a ɓangarorin biyu, matsalar tana sama da rami. Babu abin da ya isa mu’amala don fara wani abu.

Kunna zirga-zirgar da aka yarda peer ya ɗauka

Zaɓi adireshi cikin ƙayyadaddun da aka yarda na peer, a kan na’urar gida, kuma tabbatar cewa teburin hanya zai aika shi ta mu’amala. Wurin da ke wajen waɗannan ƙayyadaddun yana haifar da buƙatar da aka saba ta hanya ba tare da wani hannu na WireGuard ba. Yi amfani da sabis da ke amsa da sauri, kamar ping ko ɗan gajeren haɗin TCP, domin ƙoƙarin ya sami bayyanannen farawa da ƙarshe. Sannan sake karanta layin musafaha maimakon kallon allo da jira.

ip route get 10.60.9.5
ping -c 3 -W 2 10.60.9.5
wg show wg0 latest-handshakes
wg show wg0 transfer

Tambayar hanya ta fi ping muhimmanci. Idan ta ambaci mu’amalar zahiri, fakiti bai taɓa shiga rami ba kuma musafaha mara komai amsar hanya ne ba ta sirri ba. Gyara hanyar kafin ka gyara kuskuren peer.

Kwatanta maɓallan biyu da ƙarshen wuri

Da zarar an ba da zirga-zirga da gaske, tantancewa shi ne dubawa na gaba. Maɓallin sirri na gida dole ya dace da maɓallin jama’a da wancan ɓangaren ke ba da izini, maɓallin jama’a na nesa da aka saita dole ya gane peer ɗin da ake so, kuma duk wani maɓallin da aka riga aka raba dole ya dace a ɓangarorin biyu. Bambancin harafi ɗaya a cikin maɓallin base64 yana haifar da peer da ke kama da an saita shi kuma ba ya taɓa kammala musayar. Kwatanta da rikodin samarwa maimakon sake ƙirƙirar maɓallai, domin sabon maɓalli yana lalata kowane peer da ya amince da tsohon.

Ƙarshen wuri yana buƙatar wannan binciken: sunan mai masauki, adireshi, tashar UDP da dangin da ake amfani da shi don isa gare shi. Tsohon adireshi ko tashar da ba daidai ba yana haifar da shiru maimakon saƙo.

Kula da hanyar UDP ta waje

Musafaha yana tafiya a matsayin UDP zuwa ƙarshen wuri, don haka hanyar waje dole ta ɗauke shi. Umarnin da ke ƙasa suna duba ko akwai mai sauraro, ko tarin gida ya aika datagram, da kuma wane ƙarshen wuri aka saita. Gudanar da ɗaukar hoto yayin kunna zirga-zirga, ba kafin haka ba.

ss -lunp | grep 51820
sudo tcpdump -ni eth0 udp port 51820
wg show wg0 endpoints
conntrack -L -p udp | grep 51820

Ɗaukar hoto da ke nuna farawa ba tare da amsa ba yana nuna wajen na’urar, domin wancan gefen ko baya sauraro, an tace shi, ko an yi masa adireshi ba daidai ba. Ɗaukar hoto da ba ya nuna komai yana nufin fakiti bai taɓa fita ba, wanda zai mayar da kai ga hanya da duk wata alamar socket da ke cikin wasa. Idan kana kula da ɓangarorin biyu, haɗa ƙoƙarin bisa ga hatimin lokaci tare da ɗan ƙaramin ɗaukar hoto a kan uwar garke maimakon babban. Gwajin tashar TCP ba ya tabbatar da komai a nan, domin ka’idar UDP ce kawai.

Da zarar musafaha ya bayyana, gwada aikace-aikace ta cikin rami, domin kammalallen musayar yana tabbatar da tantancewa da isarsu, ba yawan kwarara da za a iya amfani da shi ko DNS daidai ba. Ajiye fitarwar matsayi kafin da bayan canjin, kuma bambancin zai zama shaidarka.