WireGuard isku dhegan: boodhka dhexe kama jawaabi karo portigiisa
Marka boodhka dhexe wax walba u diro hal tunnel, jawaabaha adeegga soo-gelinta waxay u baxaan waddo khaldan. Qaanuunka portiga isha ee interface-ka ayaa tan hagaajiya.
Saddex boodh oo WireGuard ah waxay gaaraan shabakad aan lahayn cinwaan dadweyne, ka dibna mashiinka dhexe wuu joojiyaa ka jawaabista portiga uu ku dhegaysan lahaa. Tunnelka hore weli wuu shaqeeyaa, martigeliyaha fog weli wuu jawaabaa, oo kaliya serverka dhexe ayaa dibadda ka aamusay. Isku-dhafkaas wuu wareeriyaa sababtoo ah isaga ayaa is keenay: boodhka dhexe wuxuu adeecaa shaxdiisa marinka, shaxduna jawaabihiisa waxay u dirtaa jihada khaldan.
Silsilad shaqaysa ilaa aad la hadasho sanduuqa dhexe
Qaado silsilad tusaale ah: macmiilka A wuxuu ku gaaraa serverka B UDP 500, B-na wuxuu u sii gudbaa serverka C UDP 500. C wuxuu kaliya ka aqbalaa taraafikada cinwaanka lammaanihiisa kaliya, taasoo ka dhigta blad oo dabeecaddiisa fudud ka dhigta. B ma aha blad, wax walba xiisaha leh ee ciladdan ku saabsan waxay ka dhacaan halkaas.
Farqigani waa muhiim sababtoo ah doorka bladka iyo kan dhexe waxay u jiitaan jihooyin iska soo horjeeda. Bladku wax walba wuu u diri karaa hal tunnel isagoo aan cawaaqib lahayn, maadaama aan wax kale ku tiirsanayn. Boodhka dhexe wuxuu isku mar yahay dhammaadka macaamiisha iyo macmiilka dhanka fog, labadaas shaqo waxay rabaan marinid kala duwan.
Sababta jawaabtu uga baxdo tunnelka
B dhexdiisa, interface-ka C u jeeda wuxuu qaataa AllowedIPs = 0.0.0.0/0 oo ay la socoto waddada caadiga ah ee u dhiganta. Sidaas darteed packet kasta oo B abuuro wuxuu galaa tunnelkaas, haddii aanay wax gaar ah mudnaan helin.
Packet ka yimid A oo B loo qoondeeyay wuu yimaadaa oo waa la aqbalaa, sababtoo ah B waa meesha loo socdo oo gaarsiinta gudaha ayaa marka hore dhacda. Jawaabtu waa packet cusub oo gabi ahaanba gudaha lagu abuuray oo loo jeediyay cinwaanka dadweynaha ee A, meeshaasna waxay la socotaa waddada caadiga ah ee tunnelka. C wuu helaa, ma hanto cinwaankaas, wuuna tuuraa.
Calaamaddu waxay u akhranaysaa sida dhibaato firewall ama isku-heli waaga fure, labadana run maaha halkan. Qabasho ku taal tunnelka C u jeeda waxay muujinaysaa in jawaabuhu u socdaan jihada khaldan. Hal observation taas waxay badbaadisaa waqti ka badan akhrinta configuration kasta, sidaas darteed qor ka hor intaadan bilaabin beddelka furaha. Qof kasta oo aan arkayn qabashada wuxuu u malayn doonaa in tunnelka laftiisu jaban yahay.
Dayactirka cidhiidhiga ah: qawaaniinta siyaasadda ee la socda portiga isha
Jawaabaha ka imanaya socket-ka dhegeysanaya ee B waxay ku baxaan portiga isha 500. Qaanuunka siyaasadda ayaa la socon kara taas oo packetkaas dib ugu celin karaa shaxda caadiga ah:
ip rule add sport 500 table main priority 100
ip rule add sport 8080 table main priority 101Qawaaniinta siyaasadda waxaa lagu eegaa sida mudnaanta, shaxda ugu weynna waxay ku taal 32766, sidaas darteed qaanuunka 100 waxaa la weydiiyaa ka hor inta aan waddada caadiga ah ee tunnelku wax odhan. Ku dar hal gelis port kasta oo ay tahay inuu dibadda ka gaari karo oo wax dheeraad ah ma jiro, si taraafikada la gudbiyo ay sii waddo isticmaalka tunnelka loo dhisay.
Ogsoonow xadka xeeladdan. Xulashada sport waxay la socotaa packet-yada gudaha lagu abuuray, taasoo si sax ah u qarinaysa kiiska jawaabta oo si ula kac ah aanay u qarinayn taraafikada B kaliya u gudbiyo qof kale. Adeeg lagu martigeliyay B gadaashiisa weli wuxuu u baahan yahay jawaabtiisa, sheegashada liddi ku ahna waxay soo saartaa hagaajin u shaqeeya adeegga koowaad kuna guuldarraysta kan labaad.
Qaanuunka sii mulkiile
Qaanuun lagu qoray prompt wuu luntaa marka xigta ee interface-ka dib loo dhiso. Dejinta WireGuard, dhig meesha interface-ka lagu abuuro laguna tirtiro:
PostUp = ip rule add sport 500 table main priority 100
PostDown = ip rule del sport 500 table main priority 100Haddii interface-ka uu leeyahay NetworkManager, jillaab qaybin ama barta gelitaanka konteenar, lammaanuhu waxay u leeyihiin mulkiilahaas halkii ay u lahaan lahaayeen fayl gacan lagu tafatiray. Hubi qawaaniinta waxtarka leh kadib dib u xidhka, ma aha oo kaliya kadib bilowga koowaad, sababtoo ah bilowga koowaad waa kiiska had iyo jeer shaqeeya.
Si daacad ah isbarbar dhig xulashooyinka
Qaanuunka portiga isha waa mid ka mid ah afarta bixitaan, waana kan ugu cidhiidhi ah. Wuxuu leeyahay faa’iidada ah inuusan siyaasadda tunnelka taaban gabi ahaanba, taas ayaa sababta uu inta badan ka badbaado isbeddelada dambe. Hagaajinta cidhiidhiga ah sidoo kale cod dheer bay ku guuldarraystaan marka ay joojiyaan khuseeya, halka ka-tagista ballaaran ay si aamusan u sii shaqeyso muddo dheer ka dib markii sababta ay lumo. Farqigaas wuxuu ka muhiimsan yahay quruxda marka laba sano kadib qof kale uu sanduuqa leeyahay.
| Approach | What it costs | Where it breaks |
|---|---|---|
| Source-port policy rule | One rule per exposed port | Anything B forwards rather than originates |
| Destination exception route | A route pinned to specific client addresses | Clients whose address changes |
| Stop full-tunnelling on B | Loses the catch-all path toward C | Designs that depend on it |
| Split into two tunnels | More interfaces and more policy | Nothing, at the cost of complexity |
Hubi labada gees kadib markaad dooratid. A ka, bilow xiriirka portiga B oo muddo ku hay mashquul. B dhexdiisa, ka dhig kernel-ka inuu caddeeyo waddada jawaabta wax la mid ah ip route get <address-of-A> sport 500, oo xaqiiji inuu sheego interface-ka WAN ee aanu ahayn tunnelka. Intaas kadib, hubi in wax B ka dambeeya C weli ku jawaabo silsiladda, taasoo caddaynaysa in ka-tagista ay cidhiidhi ku hadhay halkii ay ka noqon lahayd waddo dhaaf. Ugu dambayn, ku qor portiyada qoraallada naqshadeynta, haddii kale hawlwadeenka xiga wuxuu tan dib ugu ogaan doonaa adeeg kale.