Server VPN guri ama server daruuro: kee gaaraa NAS-kaaga?
Tunnel-ku wuu soo baxaa, laakiin NAS-ka gurigu wali lama gaari karo. Dooro goobta endpoint-ka iyadoo lagu saleynayo kheyraadka aad tahay inaad taabato, ka dibna hubi wadada.
Tunnel-ku wuu soo baxaa, macmiilku wuxuu muujinayaa dhibic cagaar ah, oo ssh 192.168.1.20 wali wuu lalmaanayaa ilaa waqtigu dhammaado. Si sax ah ayaan taas ula kulmay ka dib markii aan kireystay halista daruuro yar oo aan WireGuard ku rakibay: gacan-qaadid wanaagsan, DNS wanaagsan, iyo NAS-ka miiskayga saaran oo aan la gaari karin sida uu dayaxa ku yaal. Tunnel-ka wax qaldan kama jirin. Endpoint-ku wuxuu ku sugnaa shabakad aan waddo u lahayn gurigayga. Goobta endpoint-ka ayaa go'aamisa shabakadaha deriska ah, sidaas darteed ku dooro kheyraadka aad marka hore taabato oo barbar dhig martigelinta marka labaad.
Tunnel-ku wuxuu gaaraa oo kaliya shabakadaha endpoint-ku wado u mari karo
VPN waxay macmiilkaaga siisaa cinwaan ku dhex jira domain-ka wadista endpoint-ka laftiisa. Marka macmiilku packet u diro 192.168.1.20, endpoint-ku waa inuu ogaado halka uu tago. Shaxda VM daruuro waxay taqaan subnet-yada VPC ee bixiyaha; LAN-kaaga weligeed ma maqal. Ku xiran iyo la gaari karo waa laba xaqiiqo oo kala duwan, iyo inta badan jahawareerka guri iyo daruuro waxay ka timaadaa in tan hore loo qaato caddayn tan dambe.
Hal amar ayaa go'aamiya. Endpoint-ka ip route get 192.168.1.20 wuxuu magacaabaa interface LAN ama wuxuu tilmaamaa wadada caadiga ah. Mashiinka guriga jawaabtu waa dhinaca LAN. Halista daruuro packet-ku wuxuu u baxaa internet-ka oo wuu dhintaa. Daarista net.ipv4.ip_forward=1 iyo ku darista qaanuunka MASQUERADE ma beddelayso taas, sababtoo ah ma jirto meel loo sii gudbiyo ilaa wax dhinaca guriga ah uu xiriirka daruuro ku dhammeeyo.
Kiiska gurigu wuxuu leeyahay qayb labaad: wadada soo noqodka. Packet-yada LAN-ka ka baxa sanduuqa tunnel-ka waa la NAT-gayaa, ama LAN-ku wuxuu u baahan yahay waddo joogto ah oo ku noqota subnet-ka tunnel-ka. Marka hal jiho kaliya shaqeyso, hubi sysctl net.ipv4.conf.all.rp_filter. Shaandhaynta adag ee wadada rogan waxay tuuraan jawaabaha yimaada interface ka duwan kan wadadu saadaalisay, oo calaamaddu waxay u egtahay si sax ah qaanuunka darbiga dabka.
Akhri calaamadda ka hor intaadan taaban habeynta
Tunnel-ku ma sameysmo: furayaasha, cinwaanka endpoint-ka ama dekedda UDP oo xiran. Tunnel-ku kor ayuu yahay laakiin martigeliyayaasha LAN waa dhintaan: meelaynta iyo wadista. Tunnel-ku kor ayuu yahay laakiin baaritaanku waa dhintaan: gudbinta, NAT ama DNS. Kuwaasi waa saddex lakab iyo saddex hubin oo kala duwan, iyo dib u qorista habeyn hore u saxanayd waxay lumisaa hal habeen.
| Symptom | First suspect | Check |
|---|---|---|
| Handshake fails, no transfer | Keys, endpoint port, UDP blocked | wg show, then the port from outside |
| Peer pings, LAN host times out | No route to the LAN | ip route get on the endpoint |
| Tunnel up, name resolution fails | DNS options in the peer config | Resolve a name from the client |
| Large transfers reset the connection | MTU | Lower the tunnel MTU and retry |
Gaaritaanka soo gelaya guriga wuxuu mudan yahay hubin u gaar ah, sababtoo ah wuxuu go'aamiyaa in martigelinta guriga suurtagal tahay iyo in kale. Barbar dhig cinwaanka WAN ee router-kaagu soo sheegayo iyo cinwaanka martigeliyaha dibadda uu arko. Haddii uu ku dhaco 100.64.0.0/10, ama labaduba aanay is waafaqsaneyn, waxaad ku jirtaa gadaasha NAT carrier-grade oo ma jiro gudbin deked oo waligeed shaqeyn doonta. Xulashooyinka dhabta ah waa relay, xiriir daruuro oo guriga ka soo waca dibadda, ama in endpoint-ka la raro.
Maxaa martigelinta gurigu ku siinaysaa, maxse ku kacaysaa
Gurigu waa goobta kaliya ee sida caadiga ah ku dhex jirta LAN-ka, waana sababta oo dhan ee server halkaas loo dhigo. Aaladaha kaliya ka jawaaba qaybta maxalliga ah, sida daabacayaasha iyo bogagga maamulka NAS ee diida subnet-yada aan maxalli ahayn, waxay shaqeeyaan iyada oo aan loo baahnayn waddo dheeraad ah. Waxaad sidoo kale keligaa maamushaa mashiinka, router-ka iyo xiriirka sare.
Kharashyadu waa jireed. Soo gelinta gurigu waa xadka dhammaan macaamiisha isku mar, sidaas darteed wicitaan fiidiyow iyo kayd ayaa u tartamaya hal tuubo. Koronto, daalka disk-ka, balastarrada, cinwaan firfircoon oo u baahan DDNS, router-ka waa inuu UDP gudaha u gudbiyo, iyo laga yaabee NAT labanlaab ah — dhammaantood adigay kugu soo dhacaan. Waxa dadku seegaan waa soo kabashada: haddii sanduuqu dhinto adigoo maqan, wadadaada kaliya ee guriga way la dhimataa. Hayso aalad labaad oo isla furayaal ah, ama ugu yaraan qorshe gelitaan jireed.
Haddii aad rabto gelitaan LAN oo aan sanduuq guriga ku jirin, dhis xiriir halkii aad iska dhigi lahayd. Endpoint-ka daruuru wuxuu noqdaa router: tunnel ka imanaya dhinaca guriga oo AllowedIPs = 192.168.1.0/24 leh peer-ka daruuraha, oo lagu daray gudbin iyo NAT sanduuqa daruuraha. Hagaha gudbinta strongSwan wuxuu dhex maraa qaybta soo noqodka ee habeyntaas, oo halkaasay ku guuldareystaan inta badan isku dayadaan. Peer-ka gurigu hadda waa inuu kor ahaadaa si wax u shaqeeyaan, marka waxaad beddeshay hal ku-tiirsanaan mid kale oo waa inaad taas qortaa.
Endpoint daruuro maxaa dhab ahaan loogu talagalay
Endpoint daruuro wuxuu beddelaa bixitaankaaga dadweynaha. Taraafikku wuxuu ka baxaa kala duwanaanta cinwaannada bixiyaha, oo goobaha waxay arkaan cinwaankaas halkii cinwaanka gurigaaga. Taasi waa qiimaha, oo taas ayaa sababta VPN daruuro uusan ku siin NAS-ka: waxaad rartay bixitaanka, ma aha LAN-ka.
Waxaad wali maamushaa nidaamka martida, adeegga VPN iyo aqoonsiga diiwaanka, halka bixiyuhu maamulo hypervisor-ka iyo shabakadda jireed, oo kala qaybintan ayaa muhiim ah marka wax xumaado 2-duhurnimo habeennimo. Endpoint dadweyne waa la baarayaa si joogto ah, sidaas darteed dekedda maamulka xir, u oggolow oo kaliya dekedda VPN, oo balastar qorshe ahaan. Kooxaha amni iyo darbiyada dabka ee bixiyaha waa inay oggolaadaan dekeddaas, oo daruuro qaar waxay tuuraan taraafik gudban haddii aadan hagaajin hubinta isha iyo goobta halista.
Halista yar waxay daboolaysaa sacab macaamiil ah, laakiin sirta xogta waa shaqo CPU, oo halista burstable ee kreditkeeda dhammaaday waxay u dhaqantaa si aan isleeg ahayn marka culays joogto ah jiro. Fiiri wadada aad dhab ahaan isticmaasho, ma aha warqadda tilmaamaha.
Go'aan aad qori karto
Hawsha ayaa go'aamisa meelaynta, ma aha calaamada sanduuqa. Haddii aad u baahan tahay aalad ku taal LAN-ka gurigaaga, jawaabta saxda ah ee ugu jaban waa endpoint guriga; sanduuqa daruuru wuxuu shaqeeyaa oo kaliya ka dib markaad dhisto xiriirka soo noqodka. Haddii aad u baahan tahay bixitaan dadweyne oo kale, jawaabtu waa daruuro oo su'aasha LAN weligeed ma soo baxdo. Inaad labadaba rabto waa sharci, laakiin waxay la macno tahay laba endpoint, laba key set iyo laba waddo oo diiwaan gashan.
| What you need | Endpoint location | What else must exist |
|---|---|---|
| Reach a NAS or printer on the home LAN | A box on that LAN | Port forward or relay, DDNS, recovery plan |
| Browse from an exit unrelated to home | Cloud instance | Firewall and egress rules, patching |
| Both, reliably | Two endpoints, or cloud plus a link home | Separate keys, routes, documented failure modes |
Ka hubi macmiilka si taxane ah: gacan-qaadid, cinwaanka peer, martigeliye LAN, ka dib IP bixitaanka. curl -s https://ifconfig.me wuxuu muujinayaa waxa internet-ku arko, oo ip route get 192.168.1.20 wuxuu muujinayaa waxa endpoint-ku aaminsan yahay. Marka hubinta bixitaanku gudubto oo hubinta NAS-ku lalmaanato, jawaabta meelaynta horeba waad haysataa; hagaajinta AllowedIPs ee macmiilka ma abuuri doonto waddo. Sadar qaybsan sida 10.8.0.0/24, 192.168.1.0/24 waxay taraafika LAN-ka ku hayaa tunnel-ka oo kaliya marka waddadaas dhab ahaan jirto.