Tunnel-ka WireGuard ee gurigu wuxuu u baahan yahay waddo ku noqosho LAN-ka

Helitaanka guriga waa hal adeeg gaar ah, ma aha iridda labaad ee internet-ka. WireGuard wuxuu ku dhamaadaa mishiin Linux ah oo ka dambeeya router-ka, router-ku wuxuu hayaa shaqadiisa hadda, laptop-kuna wuxuu maraa tunnel-ka oo kaliya prefix-ka guriga. Qalabka kee ayaa gudbiya iyo kee ayaa dhammeeya waa go'aanka qaanuun kasta oo dambe uu ka yimaado. Haddii aad qaybtan khalad ku sameyso, waxaad hagaajin doontaa NAT aadan waligaa dooneyn inaad ku darto.

Go'aanso cidda gudbisa iyo cidda dhammeeya

Router-ku wuxuu leeyahay iridda dadweynaha: wuxuu qaataa xirmada UDP oo u gudbiyaa martigeliyaha Linux. Martigeliyahaas wuxuu leeyahay dhageystaha WireGuard iyo go'aanka gudbinta LAN-ka. Ficill ahaan mapping-ku wuxuu UDP 51820 u diraa 192.168.50.10, iyo dekedda abka laftiisa way xiran tahay. Kala soocidda doorarka waxay firewall-ka ka dhigtaa mid gaaban.

Qor qorshaha cinwaannada ka hor inta aadan abuurin interface-ka. Router 192.168.50.1, gateway 192.168.50.10, adeeg 192.168.50.20, tunnel 10.77.0.0/24 oo leh gateway .1 iyo laptop .2. Baaxadda tunnel-ku waa in aysan kukin shabakad uu laptop-ku mar hore gaaro, haddii kale meelaha loo socdo way mugdi noqdaan. NAT heer shirkadeed ama router ka sarreeya ayaa xannibi kara gelitaanka, mana jiro gudbin deked maxalli ah oo taas hagaajisa.

Isku beddel furayaasha, ka dibna qiyaas cabbirka AllowedIPs

Abuur lammaane fure oo gaar ah dhammaad kasta, oo kaliya furayaasha dadweynaha ku wareeji kanaalka la xaqiijiyay. Diiwaanka peer-ka gateway-ga wuxuu oggolaanayaa kaliya isha tunnel-ka laptop-ka, sababtoo ah LAN-ka gurigu wuxuu ka dambeeyaa gateway-ga ee ma aha laptop-ka. LAN-ka gelinta diiwaankaas waxay qeexaysaa topology aadan dhisin.

[Interface]
Address = 10.77.0.2/32
PrivateKey = LAPTOP_PRIVATE_KEY_BASE64

[Peer]
PublicKey = HOME_PUBLIC_KEY_BASE64
Endpoint = home-vpn.example.com:51820
AllowedIPs = 192.168.50.0/24, 10.77.0.1/32

AllowedIPs waa prefix-ka guriga oo lagu daray cinwaanka tunnel-ka gateway-ga, weligaa ma aha 0.0.0.0/0, sidaas darteed baaritaanka caadiga ah wuxuu hayaa waddadiisa maxalliga ah. Hayso hal milkiile configuration, oo weligaa ha ku xidhin isla interface-ka maareeyaha shabakadda labaad.

Waddada ku noqoshada waa qaybta dadku dhaafaan

Naqshaddan waxay hayaan isha 10.77.0.2 ee laptop-ka halkii ay ka qarin lahayd sidii gateway, sidaas darteed qalabka gurigu waa inay ogaadaan sida looga jawaabo. Ku dar waddo static ah router-ka guriga 10.77.0.0/24 oo leh 192.168.50.10 boodhka xiga, oo akhri waxa wg-quick ka soo saaro AllowedIPs tixraaciisa. La'aanteed waddadaas, gacan-qabsi dhammaaday wuxuu la jiraa jawaabaha abka ee waligood iman.

Haddii router-ku uusan qaadi karin waddadaas, dooro naqshad ku-noqosho la diiwaangeliyay. Ku darista NAT si aamusnaan ah waxay beddeshaa moodeelka isha ee aad hadda qortay.

Oggolow hal adeeg, ma aha subnet-ka

Daar gudbinta IPv4 gateway-ga oo hay saddex waajibaadka firewall gooni ah: oggolow dhageystaha WireGuard, u gudbi isha laptop-ka kaliya 192.168.50.20, oo ka tag shabakadda guriga inta ka hartay mid xiran peer-kaas. Ku biir xeerarka maareeyaha firewall-ka hore loo isticmaalo halkii aad ka nadiin lahayd. Waddo loogu talagalay dhammaan prefix-ka guriga ma aha oggolaansho in la isticmaalo qalab kasta oo ku dhex jira.

Xaqiijinta abka laftiisa iyo firewall-ka martigeliyaha waa irid gooni ah. Magacow adeegga ay xeerarka oggolaadaan, si dib-u-eegaha xiga uu ula barbardhigo shaqada loogu talagalay.

Ka tijaabi dibadda, ka dibna si nadiif ah uga bax

Kor u qaad profiles-ka iyada oo loo marayo milkiilahooda, xaqiiji gacan-qabsiga, ka dibna ku celi abka loogu talagalay shabakad dibadeed la ansixiyay oo hubi jawaabta. Isku day adeeg guri oo ay tahay inuu diidan sii ahaado, sababtoo ah xeerka fasaxa ah waa mid aan muuqan ilaa wax isticmaalo. HTTPS, isticmaal magaca shahaadada oo u daa xaqiijinta inay socoto; qorista cinwaanka ceeriin iyo dhaafista digniinta waxba kama caddeyso waddada. PersistentKeepalive waa ikhtiyaari: wuxuu caawiyaa peer ku xiran NAT wakhti fadhiid ka dib, laakiin ma aha waddo maqan ama hagaajin fasax.

Cinwaan dadweyne firfircoon wuxuu u baahan yahay cusboonaysiinta DNS, laptop-kuna waa inuu dib u xalliyaa barttiisa dhammaadka isbeddel ka dib; diiwaannada DNS cusub ma dhaqaajiyaan bartta dhammaadka ee la habeeyay. Ka bixi laptop-ka adigoo ka saaraya peer-kiisa configuration-ka la kaydiyay iyo kan firfircoon; tirtirista profile-ka laptop-ka oo keliya ma buriso oggolaanshaha gateway-ga.