WireGuard: rabin hanyoyi biyu da 0.0.0.0/0 a cikin wg-quick

Prefix biyu na /1 suna rufe ainihin adiresoshin IPv4 da /0 ɗaya ke rufewa, kuma wannan daidaito tana aiki ne kawai a cikin jerin prefix ɗin da aka yarda da su na peer. Yana daina aiki a lokacin da kayan aikin saitin ya yanke shawara yadda za a yi tuƙi, domin Linux wg-quick yana ɗaukar tsohon prefix a matsayin yanayi na musamman ba a matsayin lissafi ba. Reshen na musamman yana girka tebur na musamman, ka’idojin manufa guda biyu, alamar soket da saitunan hanyar baya waɗanda rabin hanyoyi biyu ba sa samun su. Don haka lokacin da wakili ko burauza ya daina aiki bayan gyaran, prefix ɗin su ne mafi ƙarancin sha’awa a cikin canjin.

Jerin prefix ba shi ne dukan tsarin ba

AllowedIPs yana yin ayyuka biyu a lokaci ɗaya, kuma ɗaya ne kawai ke magana kan rufewa. Ga WireGuard kansa jerin shine tuƙin maɓallin sirri: yana yanke shawarar waɗanne wurare ake ɓoye zuwa peer da waɗanne adiresoshin tushe peer ɗin zai iya amfani da su. Ga wg-quick wannan jerin yana aiki kuma a matsayin ƙayyadaddun hanya, kuma hanyar da yake samarwa ya dogara da wane reshe jerin ya dace da shi. Don haka daidaitaccen rufewa a cikin siffofin jeri biyu daban-daban ba ya faɗin komai game da daidaitaccen yanayin host.

Tsarin tsoho yana ɗaukar wannan shawarar daga hannunka, domin Table a tsoho yana atomatik kuma kayan aikin yana zaɓar inda hanyoyin za su sauka. Wani mai sarrafa cibiyar sadarwa, marufi na rarrabawa ko ƙimar Table ta musamman suna sake canza sakamakon, shi ya sa shawara da aka rubuta wa host ɗaya na iya zama kuskure a na gaba.

Abin da reshen tsoho ke ƙarawa fiye da hanya

Shigarwar /0 tana aika wg-quick cikin hanyar tsoho: wani tebur na daban yana karɓar tsohon, ka’idar manufa ɗaya tana aika zirga-zirgar da ba ta da alama zuwa can, ka’ida ta biyu tana riƙe hanyoyin da suka fi takamaimai na babban tebur a matsayin masu iko, kuma interface ɗin yana samun alamar wutar bango a kan soket ɗinsa. Wannan alamar ita ce mai tsaron madauki. Datagram ɗin da aka ɓoye waɗanda ke ɗauke da zirga-zirgar tunnel suna fita da alamar a saita, don kada ka’idar da ke tura komai zuwa tunnel ta haɗiye fakitin jigilar tunnel ɗin kansa.

A maimakon haka, biyun shigarwar /1 suna bin hanyar al’ada. Hanyoyi biyu suna sauka a cikin tebur ɗin da aka saita, kuma babu ɗaya daga cikin injinan da ke kewaye da ya bayyana, ba domin ba shi da bukata ba, amma domin ba a taɓa shiga wannan hanyar lambar ba.

Inda tsare-tsaren biyu suka bambanta

Bambanci yana bayyana da farko a matsayin maimaitawa. Da rabin hanyoyin a cikin babban tebur, adireshin jigilar peer ɗin kansa yana faɗowa cikin prefix na tunnel, don haka fakitin da ya kamata ya ɗauki tunnel ɗin ya dace da hanyar da ke nuna cikin tunnel ɗin. Wani abu dole ya keɓe shi: hanyar host don ƙarshen wurin yanzu, alama da aka sanya da hannu, ko ka’ida ta musamman ga interface. Hanyar host tana aiki har sai adireshin ƙarshen wuri ya canza, abin da ke faruwa da ƙare-ƙare bisa DNS, abokan ciniki masu yawo da tsare-tsare masu peer da yawa.

Na biyu, duk abin da ke yin tunani kan alamomi yana canza ɗabi’a. Wakilin bayyane da ke juya hanyoyin sadarwa a cikin gida yana ƙirƙirar sabbin soket waɗanda alamominsu da tushensu suka bambanta da kwararar abokin ciniki ta asali, kuma ka’idojin manufa da reshen tsoho ya samar sun kasance ɓangare na abin da ya raba waɗannan kwararru. Karanta hanyar fita ta wakilin kansa wata motsa jiki ce daban da gwada ko ana iya isa wurin da aka nufa na asali.

Karanta ka’idoji da alamomi kafin gyara

Ɗauki yanayin yanzu yayin da tunnel ɗin ke cikin lafiya, sannan kuma bayan canjin, kuma kwatanta dumps ɗin biyu maimakon yin tunani daga fayil ɗin saiti. Haɗa ka’idojin manufa, kowane tebur, alamar interface da ƙarshen wuraren da aka rubuta.

ip rule show
ip -4 route show table all | grep -E 'default|wg1'
wg show wg1 fwmark
wg show wg1 endpoints

Idan layin farko na fitarwa ya rasa ka’idar zirga-zirgar da ba ta da alama kuma tebur ɗin na musamman ya zama fanko, reshen tsoho ba ya gudana kuma babu adadin lissafin prefix da zai dawo da tasirinsa. Alamar sifili a kan interface ɗin da a da ya ɗauki ɗaya ita ce alama ɗaya, ana iya ganinta a cikin ƙima ɗaya.

Gwada asarar tunnel kafin fitarwa

Idan shimfidar rabin hanya ita ce zaɓin da aka yi da gangan, dole ta samar da ɓangarorin da suka ɓace a bayyane: hanyar ƙarshen wuri da ke tsira daga canjin adireshi, ɗabi’ar da aka nufa lokacin da tunnel ɗin ya faɗi, da daidaitaccen kulawa ga IPv6. Rubuta waɗannan a matsayin buƙatu maimakon gano su a lokacin katsewa. Sannan gwada gazawar, domin cikakken tunnel da ke komawa a shiru zuwa hanyar jiki ya fi wanda ya daina aiki muni.

sudo ip -4 route add 198.51.100.20/32 via 192.0.2.1 dev eth0
ip -4 route get 198.51.100.20
sudo wg-quick down wg1

Neman hanya ya kamata ya warware ƙarshen wurin daga interface ɗin jiki ba tare da ratsa tunnel ɗin ba, kuma saukar da interface ɗin ya kamata ya bar host ɗin a yanayin da ƙirar ta yi alkawari. Wakilin da ke aiki bayan maye gurbin yana tabbatar da cewa yanayin host ɗin da aka haifar yana da muhimmanci; ba ya tabbatar da cewa hana madauki da ɗabi’a a yanayin kashe sun tsira daga gyaran.