Xeerarka dhammaan dekedaha u gudbiya waxay liqi karaan dhageystahaaga WireGuard
Xeer gudbin ballaaran ayaa liqi kara dhageystayaasha WireGuard iyo SSH ee gateway-ka laftiisa. Dooro xeerar cidhiidhi ah ama cinwaan guud oo gaar ah, kadibna tijaabi wadada xakamaynta.
Gateway guud ayaa horey ugu socda WireGuard UDP 51820, SSH 22, iyo hal barnaamij oo ay tahay in laga gaaro internetka. Xeerta soo jiidashada leh waxay u gudbisaa deked kasta peer-ka oo tidhaahda waa dhammaatay. Gateway WireGuard ah xeerkaas wuxuu qaban karaa gaadiidka tunnel-ka laftiisa oo kaa xidhi kara mishiinka soo afjaraya. Daabacaaddu waa go'aan marin oo leh ka-tagid lakabka xakamaynta, ma aha hal sadar DNAT.
Gelitaan guud ama gelitaan tunnel: mid dooro
Daabacaadda adeeg waxay abuurtaa barta cusub ee gelitaanka internetka. Lama mid ah in peer-ka la siiyo xubinimada VPN, sababtoo ah booqashadu marnaba ma gasho tunnel-ka oo gateway-ku wuxuu noqdaa wejiga guud ee backend-ka. Farqigaas ayaa go'aamiya dhageystayaasha xeerka iyo shahaadadiisa.
Interface-yada maamulka ayaa dhif ku habboon booskaas. Bogga maamulka ee ay gaaraan macaamiisha VPN ee loo oggolaaday wuxuu dusha weerarka ku hayaa tunnel-ka gudihiisa oo wuu ka fogaadaa in foomka gelitaanka la bandhigo baaritaan aan loo qorsheyn. Meelaha barnaamijka ee guud wali waxay u baahan yihiin shahaadadooda TLS, xaqiijin iyo xaddidaad xawaare; tallaabada WireGuard ee sirta ah ma ilaaliso qaybta booqashada ilaa gateway-ka.
Haddii adeeggu run ahaantii ay tahay inuu guud noqdo, qor magaca martigeliyaha, shahaadada daboolaysa iyo tirooyinka booqdayaasha ee ay tahay inay gaaraan. Saddexdaas xaqiiqo ayaa go'aaminaya qaabka xeerka iyo siyaasadda shaandhaynta gudaha. Wax kasta oo ka baxsan waa ballaarin baaxad leh oo ku saabsan dhageyste guud.
Hal deked gudaha, hal backend baxa
Isticmaal hal deked guud iyo hal adeeg backend. Tusaalahan eth0 waxay qaaddaa cinwaanka guud 198.51.100.20, cinwaanka tunnel-ka gateway-ku waa 10.200.0.1, peer-kuna wuxuu barnaamijka ku socodsiiyaa 10.200.0.7. TCP 9443 guud waxaa loo khariidayaa TCP 8443 ee peer-ka:
iptables -t nat -A PREROUTING -i eth0 -d 198.51.100.20 -p tcp --dport 9443 -j DNAT --to-destination 10.200.0.7:8443
iptables -t nat -A POSTROUTING -o wg0 -d 10.200.0.7 -p tcp --dport 8443 -m conntrack --ctorigdst 198.51.100.20 --ctorigdstport 9443 -j SNAT --to-source 10.200.0.1Xeerta SNAT waxay la mid tahay backend-ka la tarjumay iyo goobta guud ee asalka ah, sidaas darteed xiriir kale oo isla adeeggaas backend ah wuxuu ka baxsan yahay khariidaddan. Waxay kaloo qarinaysaa cinwaanka booqashada peer-ka, waana beddelka ka dhigaya soo-noqod marin oo ilka ilaaliya naqshad gaar ah. Tixraaca fidinnada iptables wuxuu sharraxayaa labada bartilmaameed iyo doorashooyinka is-waafajinta.
Gudbinta wali waa in la shido, silsiladda shaandhayntuna waxay u baahan tahay fasax goobta iyo dekedda la tarjumay iyo jawaabaha la aasaasay. Silsiladda FORWARD waxay aragtaa goobta la tarjumay ka dib DNAT, sidaas darteed xeer lagu qoray cinwaanka guud kuma habboona baakadda la gudbiyay. Qor fasaxa tuple-ka backend-ka, ma aha kan guud.
Peer-ku waa inuu aqbalo xiriirka adeegga cinwaanka tunnel-ka gateway-ka oo jawaabta dib ugu celiyo tunnel-ka. AllowedIPs-kiisu waa inuu oggolaadaa isha uu run ahaantii helo, taas oo tarjumaadda isha hooskeeda tahay cinwaanka tunnel-ka gateway-ka, oo gelitaan ballaaran 0.0.0.0/0 oo peer kasta ah looma baahna naqshaddan. Waxa dhiciya taraafikada soo-noqodka waa peer ay liistiisa ka maqan tahay cinwaankaas, ama naqshad ilka ilaaliya oo gudbisa cinwaanka booqashada laftiisa, sidaas darteed hubi isha uu peer-ku run ahaantii arko ee ma aha tan ku jirta xeerkaaga.
Hay dhageystayaasha gateway-ka laftiisa xeerka ka baxsan
Tarjumaadda goobta waxay dhacdaa ka hor inta uusan mishiinku go'aansan in baakaddu tahay mid maxalli ah, sidaas darteed UDP 51820 wuxuu ku dhammaan karaa peer-ka halkii uu ku dhammaan lahaa habka haya xiriir kasta peer. Xeerku si guul leh ayuu u rarayaa tunnel-kuna wuu dhintaa, taas oo ah guuldarro adag in laga akhriyo dhinaca peer-ka.
SSH, wakiillada kormeerka iyo adeeg kasta oo kale oo gateway-ka ku martigeliyay waxay leeyihiin isla soo-gaadhistaas. Xeer gudbiya wax kasta ma kala sooco lakabka xakamaynta iyo barnaamijka la daabacay, oo dib-u-bilowga ugu horreeya ee isbeddelka ka dib waa marka xidhitaanku caddaan noqdo. Xeerta wax walba daboola ma digniiso adeegga ay aamusnaan ku qaadato. Waxaad ogaataa marka xiriirka xiga uu guuldareysto.
Haddii gudbin ballaaran run ahaantii loo baahan yahay, deji dekedaha xakamaynta ka hor xeerta wax walba daboola ama isticmaal cinwaan guud oo gaar ah daabacaadda. Doorashada labaad waa ka nadiifsan sababtoo ah cinwaanka xakamaynta wuxuu hayaa siyaasaddiisa, laakiin bixiyuhu waa inuu bixiyaa cinwaankaas; diiwaanka DNS ku darid ma qoondeeyo mid.
Gudbinta ballaaran ee TCP iyo UDP sidoo kale ma aha borotokool kasta. ICMP, IPv6, jawaab-celinta MTU ee wadada iyo gaadiidka dibadda ee VPN waxay u baahan yihiin siyaasadooda, oo xeerka daboola TCP iyo UDP wuxuu kiisaskan uga tagaa silsiladda caadiga ah.
Dooro qaabka ka hor qorista xeerarka
Afar qaab ayaa daboola inta badan daabacaadaha gateway-ka, doorashaduna waxay ku xiran tahay inta adeeg aad maamusho iyo inta khatar ee lakabka xakamaynta aad u dulqaadan karto. Shaxda hoose waxay u kala hormariaysaa laga bilaabo tan ugu cidhiidhisan ilaa tan ugu ballaaran.
| Model | What it protects | Cost | Use when |
|---|---|---|---|
| Narrow port forward | Every other listener, including the VPN | One rule per service | Few services, stable ports |
| Catch-all with reserved ports | Ports named in the exception list | Rule order becomes critical | Many services and disciplined review |
| Separate public address | Control address fully isolated | Provider must supply the address | High-value publication |
| VPN-only access | No public entry at all | Visitors need the tunnel | Admin interfaces and internal tools |
Ku bilow qaabka cidhiidhiga ah xitaa haddii aad filayso adeegyo badan gudaha. Waa tan ugu fudud in la baaro, oo xeerar cidhiidhi ah oo la beddelo hal xeer oo la dib-u-eegay oo wax walba daboola ayaa ka fudud in la ogaado dhageyste kee uu qabtay xeer ballaaran. Qaab kasta oo aad doorato, xeerarka ku hay milkiilaha firewall-ka. Ku dabaqidda sadarrada iptables agagaarka habaynta UFW ama nftables oo isla silsiladaha maamusha waxay soo saartaa siyaasad ku beddelata nidaamka kicinta.
Caddee daabacaadda iyo wadada xakamaynta labadaba
Ka tijaabi macmiil dibadeed oo loo oggolaaday isticmaalka magaca martigeliyaha la ansixiyay iyo shahaado u qalma. Xaqiiji backend kee jawaabay, kadib hubi in dekedaha guud ee aan xiriirka lahayn ay wali diidan yihiin. Hubinta shahaadada la damiyay ma aha tijaabo HTTPS oo gudubtay, oo xiriirka gaara backend khaldan wuu ka xun yahay mid guuldareystay.
Intaas ka dib xaqiiji gateway-ka laftiisa: ku xir peer WireGuard, fur fadhi SSH oo xaqiiji in kormeerku wali soo sheegayo. Adeegga la daabacay wuu shaqeyn karaa iyadoo lakabka xakamaynta jaban yahay, sidaas darteed labada hubin waa inay ku jiraan isla daaqadda isbeddelka. Hal mar dib u bilow si aad u caddeyso in xeerarku dib loogu dabaqo nidaamka la filayo, kadib ka saar daabacaadda oo xaqiiji in ka-saariddu run ahaantii la mid tahay ku-daridda. Ku-darid badan oo bilow ah iyo nadiifin aan dhamaystirnayn ayaa ah sida tijaabo ku meel gaar ah ay u noqoto furid joogto ah.