Rarrabe tunel na WireGuard: daidaita ba tare da hanyar da aka saba ba

An bayyana rarrabe tunel da abin da kuke barin waje, kuma WireGuard yana yanke wannan shawara a fili ɗaya. AllowedIPs na gefen abokin ciniki yana zaɓar wuraren da za su bi ta tunel kuma yana tace waɗanne adiresoshin tushe na ciki ake karɓa, kuma wg-quick yana mai da wannan jeri zuwa hanyoyin uwar gida. Idan jeri ya yi kuskure, tunel ɗin ko ya haɗiye komai ko bai ɗauki komai ba.

Da farko a tantance jerin prefix

Rubuta wuraren da dole su yi amfani da tunel kafin ka taɓa fayil ɗin saiti. Ƙananan cibiyoyin ofis, yankin bayanan bayanai, hanyar sadarwar gudanarwa: kowanne prefix ne da dalili. Duk abin da ba ya cikin jeri yana kan hanyar zahiri, kuma wannan shi ne dukan manufar ƙirar.

Idan jeri ya ƙunshi 0.0.0.0/0 ko ::/0, ka gina cikakken tunel kuma ya kamata ka faɗa haka, domin hanyoyin gazawa da tsammanin DNS sun bambanta.

Ka riƙe jeri a takaice sosai domin mai bita ya iya kwatanta shi da teburin hanya daga baya.

Saitin abokin ciniki: peer, AllowedIPs, DNS

Bogin fuska na abokin ciniki yana riƙe da adireshin tunel ɗinsa da maɓallin sirri. Bogin peer yana riƙe da maɓallin jama'a na uwar garke, ƙarshen wuri da prefix ɗin mataki na farko:

[Interface]
Address = 10.9.0.2/32
PrivateKey = <client-private-key>
DNS = 10.20.0.53

[Peer]
PublicKey = <server-public-key>
Endpoint = vpn.example.net:51820
AllowedIPs = 10.20.0.0/16, 10.30.0.0/24
PersistentKeepalive = 25

AllowedIPs a gefen abokin ciniki shi ne jerin wuraren nesa, ba adireshin abokin ciniki kansa ba. Layin DNS yana aiki ne kawai ta hanyar haɗin mai warwarewa na wg-quick, don haka uwar gida da ba ta da goyon baya resolvconf ko systemd-resolved za ta yi watsi da shi. PersistentKeepalive yana kiyaye taswirar NAT a rai kuma ba ya buƙata a hanyar kai tsaye.

Ka yi sharhi a kan kowanne prefix da sabis ɗin da yake yi, in ba haka ba gyara na gaba zai zama hasashe.

Saitin uwar garke: kishiyar ra'ayi

A uwar garke, shigarwar peer tana wakiltar abokin ciniki, don haka AllowedIPs ɗinta adireshin tunel ɗin abokin ciniki ne, yawanci /32. Ba ƙaramin cibiyar ofis ba. Kwafin jerin abokin ciniki zuwa shigarwar uwar garke shine mafi yawan kuskuren rarrabe tunel, kuma ko yana faɗaɗa damar shiga ko yana karya binciken tushe na ciki a lokacin musafaha.

Adireshin fuskar uwar garke kanta, da hanyoyin da take buƙata zuwa ofis, sun bambanta da kowace shigarwar peer.

Fayiloli biyu, ra'ayoyi biyu, saitin prefix ɗaya da aka raba tsakaninsu.

Ka ɗaga shi ka karanta hanyoyin

Fara fuskar da mai sarrafawa da aka goyi baya, sannan ka duba abin da ya girka, ba abin da ka yi niyya ba. wg-quick yana fitar da hanyoyi daga AllowedIPs; idan bayanin ya saita Table = off, ba a girka kome ba kuma sarrafa hanya naka ne. Karanta hanyar kowanne prefix ka tabbatar tana nuna fuskar WireGuard. Jerin hanya mara komai yawanci yana nufin bayanin da aka yi amfani da shi ba shine wanda ka gyara ba.

Duba ma'aunin musafaha kuma, domin peer mara musafaha yana da matsalar maɓalli, ƙarshen wuri ko isa, ba matsalar hanya ba.

Rubuta ainihin umarnin da ka yi amfani da shi, domin mutum na gaba zai gudanar da shi cikin matsi.

Tabbatar da ɓangarorin biyu, sannan ka rubuta komawa baya

Gwada adireshin sirri, sunansa na ciki da wurin da dole ya kasance kai tsaye. Idan adireshin sirri yana aiki kuma na kai tsaye yanzu yana fita ta tunel, jerin prefix ya yi faɗi sosai. Idan sunan ya kasa yayin da adireshin ke aiki, layin DNS bai yi tasiri ba. Komawa baya umarni ɗaya ne, kuma yana cikin wannan rubutu.

Bayan sake haɗawa, tabbatar hanyoyin har yanzu suna nan, domin mai sarrafawa da ya sake amfani da bayanin zai iya maye gurbin hanyoyin hannu.

Ka riƙe mai saituna ɗaya, domin masu sarrafawa biyu da ke samar da fuska ɗaya za su sami sabani daga ƙarshe. Littafin jagora na wg-quick yana rubuta halayen hanya da DNS da yake bayarwa.