Sida loo orod hal habsocod Linux ah meel ka baxsan tunnel-ka WireGuard

Ma siin kartid barnaamij ka madax-banaan martigeliyaha WireGuard ee tunnel buuxa leh adigoo tafatiranaya wadooyinka. Wadooyinku waxay doortaan jid iyagoo eegaya halka la aadayaa, waxaadna rabtaa inaad ka reebto waa habsocod, sidaas darteed kernel-ku ma hayo wax uu isbarbardhigo. Habka shaqayn kara waa in habsocodkaas la siiyo macluumaadkiisa shabakadeed: meel magac leh oo leh interface, cinwaanno iyo waddo caadi ah oo u gaar ah, oo lagu xiro martigeliyaha iyadoo la isticmaalayo lammaane veth. Waxaan tan ku orday Ubuntu 24.04 anigoo isticmaalaya wireguard-tools 1.0.20210914, meesha magacuna waligeed dhibaato ma ahayn — dhibaatadu waxay ahayd siyaasadda gudbinta martigeliyaha iyo xeerarka calaamadaynta tunnel-ka.

Marka hore dooro nooca macluumaadka aad u baahan tahay

Ficil ahaan laba qaab ayaa soo baxa. Haddii martigeliyuhu ordayo tunnel buuxa oo hal barnaamij uu uga baxayo waddada ISP, waxaad dhisaysaa meel magac labaad, ku xirtaa martigeliyaha oo u ogolaataa martigeliyaha inuu u gudbiyo oo u tarjumo taraafikada. Haddii meel magac horey u qaadatay interface VPN oo aad u baahan tahay oo kaliya amar lagu bilaabo gudaheeda, taasi waa kiiska caadiga ah ee ip netns exec iyo inta badan shaqada waddooyinka horey ayaa loo qabtay.

Midkoodna qaababka ma siiyo xeer ku xaddidan hal aqoonsi habsocod. Netfilter waxay isbarbardhigtaa cinwaanno, dekedo, calaamado iyo interface-yo; ma jiro shax waddo oo habsocod kasta leh. Calaamadayntu waxay hagaysaa taraafikada, laakiin calaamadda waa in lagu dhejiyaa baakadaha aad horey u aqoonsatay, taasna waa isla dhibaatada hal lakab hoos. Meesha magacu waxay kala soocdaa stack-ka oo dhan geedka habsocodkaas, sidaas darteed waa jawaabta caadiga ah.

Haddii shuruuddu dhab ahaan tahay in waxba ka bixin tunnel-ka, halkii jooji tunnel-ka. Meesha magacu waxay u jirtaa kiiska isku dhafan: hal barnaamij dibadda, wax kasta oo kale gudaha, isla mashiinka, isla waqtiga.

Dhis macluumaadka labaad oo ku xir martigeliyaha

Qaab tusaale ah: martigeliyuhu wuxuu leeyahay interface WireGuard oo qaada waddada caadiga ah, iyo meel magac shabakadeed oo la yiraahdo clearnet oo lagu xiro martigeliyaha lammaane veth. Cinwaannada hoose waa tusaale.

ip netns add clearnet
ip link add veth-clear-out type veth peer name veth-clear-in
ip addr add 192.168.100.1/24 dev veth-clear-out
ip link set veth-clear-out up
ip link set veth-clear-in netns clearnet
ip netns exec clearnet ip addr add 192.168.100.2/24 dev veth-clear-in
ip netns exec clearnet ip link set veth-clear-in up
ip netns exec clearnet ip route add default via 192.168.100.1

Meesha magacani hadda waxay gaari kartaa martigeliyaha oo wax kale ma gaarto. Martigeliyuhu waa inuu gudbiyo taraafikada oo dib u qoro cinwaanka isha, sababtoo ah 192.168.100.0/24 waa mid gaar ah oo router-ka sare ma laha waddo dib ugu noqota:

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -o <wan-interface> -j MASQUERADE

Ka hor inta aadan sii socon, xaqiiji dhinaca meesha magaca.ip netns exec clearnet ip route waa inuu muujiyaa waddada veth iyo waddada caadiga ah iyada oo loo marayo 192.168.100.1, ping-ka cinwaankaasna waa inuu jawaabo. Haddii ping-ka cinwaanka martigeliyaha ku guuldareysto, cinwaannada ama xaaladda xidhiidhka waa khalad oo ma jiro xeer firewall ah oo caawinaya.

Marka magacyadu xalliyaan laakiin waxba soo noqon, akhri FORWARD

Guuldarada caadiga ah waxay u egtahay khalad waddo: meesha magacu waxay xallinaysaa magac, baakaddu way baxdaa, jawaabna waligeed ma timaaddo. Martigeliyayaasha leh siyaasadda FORWARD ee DROP — dhowr qaybin iyo inta badan sawirada adag ayaa sidaas sameeya — baakadda waa la tuuraa inta lagu jiro, khaladka barnaamijku daabacona waxba kama sheego shaandhaynta.

Akhri silsiladda ka hor inta aadan wax ku darin:

iptables -S FORWARD
nft list chain inet filter forward

Kadib u oggolow taraafikada labada jiho, iyadoo leh tiriyeyaal, si aad u ogaato haddii xeerku waligiis is waafajiyay:

iptables -A FORWARD -i veth-clear-out -o <wan-interface> -j ACCEPT
iptables -A FORWARD -i <wan-interface> -o veth-clear-out -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
watch -n1 'iptables -L FORWARD -v -n'

Xeerka tiriyaha baakadaha eber ma ku jiro waddada. Ama magacyada interface-yadu way ka duwan yihiin waxaad u qaadatay, ama xeer hore oo silsiladda ku jira ayaa baakadda marka hore aqbalay, tuuray ama soo celiyay. Hagaaji nidaamka, ma aha qoraalka xeerka.

Taraafikada jawaabtu waa qaybta dadku illoobaan. Xeerka soo noqodku wuxuu u baahan yahay isla magaca veth iyo iswaafajinta xaaladda xidhiidhka, ama aqbalid interface caadi ah haddii aad siyaasadda furan ka dhigto. Ku dar oo kaliya xeerka bixitaanka oo calaamadii asalka ah way soo noqotaa, xeerkaaga cusubna halkaas ayuu taagan yahay oo sax u eg yahay.

Ka fogee xeerarka calaamadaynta tunnel-ka waddada cusub

Tallaabadani waxay meel magac shaqaynaysa ka dhigtaa mid qulqulaya. Rakibaadda WireGuard waxay inta badan rakibaan siyaasadda calaamadda firewall oo ay la socdaan xeerarkooda waddo iyo shax gaar ah, sidaas darteed baakadaha aan calaamad lahayn waxay ku soo laabtaan shaxda weyn halka kuwa calaamad leh ay isticmaalaan shaxda tunnel-ka. Taraafikada laga gudbiyay meesha magaca waxaa lagu qiimeeyaa marka uu baxayo marka la eego waddada siyaasadda, iyo iyadoo ku xiran sida xeerarkaas loo qoray waxay ku dhici kartaa shaxda tunnel-ka.

Laba kordhin ayaa kala sooca wadooyinka. Ku soo noqo goor hore silsiladda mangle ee subnet-ka meesha magaca, oo ku dar xeer ku salaysan isha oo subnet-kaas dhigaya shaxda weyn:

iptables -t mangle -I PREROUTING -s 192.168.100.0/24 -j RETURN
ip rule add from 192.168.100.0/24 lookup main priority 100

Mudnaanta 100 ayaa martigeliyahayga ka hor timaadda xeerarka tunnel-ka, sidaas darteed shaxda caadiga ah ayaa go'aamisa ishaas. Ha koobiyn lambarka indho la'aan: mudnaanta ay wg-quick rakibto way ku kala duwan tahay noocyada iyo rakibaadda IPv4 iyo IPv6, sidaas darteed orod ip rule show oo dooro mudnaan ka hor dhacda xeerarka tunnel-ka mashiinkaaga.

Xaqiiji iyadoo la isticmaalayo raadin gaar u ah isha halkii aad ku kalsoonaan lahayd liiska xeerarka:

ip route get 1.1.1.1 from 192.168.100.2
ip netns exec clearnet ip route get 1.1.1.1

Haddii amarkii ugu horreeyay sheegto interface WireGuard, xeerka cusubi wali ka hor ma aha siyaasadda tunnel-ka. Haddii uu sheegto interface WAN halka kan labaad wali muujinayo waddada caadiga ah ee veth, martigeliyaha iyo meesha magacu isku raacsana, waa inaad labada shax waddo dib u akhridaa.

Bilow habsocodka fura xidhiidhka

Amarka bilaabistiisu waa hal sadar, laakiin bilow habsocodka dhab ahaan abuura socket-ka.ip netns exec clearnet curl -s https://ifconfig.me waa tijaabada daacadda ah ee ugu yar: waxay muujinaysaa cinwaanka meesha magacu adduunka u soo bandhigto, ma aha kan martigeliyuhu isticmaali lahaa.

Adeeg, ku xir meesha magaca iyadoo la marayo waddada si habsocodku ugu sii jiro inta uu nool yahay:

[Service]
NetworkNamespacePath=/run/netns/clearnet

Barnaamijyada garaafiga ah waa halka habka hal-sadar si aamusan ugu guuldareysto. Browser-ka laga bilaabo menu-ga wuxuu inta badan codsiga u dhiibaa nuqul horey dibadda uga socda meesha magaca, sidaas darteed daaqadda cusub way soo baxdaa taraafikaduna wali tunnel-ka ayuu ka baxaa. Sii profile gaar ah si nuqul cusub dhab ahaan loo abuuro, kadib hubi macluumaadka habsocodka halkii aad qiyaasi lahayd:

readlink /proc/$(pgrep -f clearnet-profile | head -1)/ns/net
readlink /run/netns/clearnet

Laba wax soo saar waa inay is waafaqaan. Isla hubintaas waxay u shaqaysaa barnaamij kasta oo muddo dheer socda, waana mudan in hal mar loo sameeyo barnaamij kasta halkii la qaadan lahaa in bilaabuhu sameeyay waxaad ula jeeday.

Xallinta magacyadu waxay u baahan tahay go'aan u gaar ah. Abuurista meel magac ma siiso habaynta xalliyaha; faylalka meel kasta oo magac leh waxaa lagu taageeraa iyadoo la marayo /etc/netns/<name>/resolv.conf la'aanteedna waxaad dhaxashaa dabeecad si fudud loo akhriyi karo si khaldan. IPv6 wuxuu u baahan yahay isla daaweynta: haddii meesha magacu aanay lahayn waddo caadi ah oo v6 ah halka barnaamijku doorbido v6, codsiyadu way istaagi karaan ka hor inta aysan dib u noqon, taas oo u eg tunnel jaban.

Hubi qaab-dhismeedka, ma aha oo kaliya cinwaanka bixitaanka

Cinwaan dadweyne oo shaqeeya wuxuu caddeeyaa waddada, ma aha shuruudda oo dhan. Mara inta kale nidaamkan:

• ip netns exec clearnet ip route get 1.1.1.1 wuxuu muujiyaa waddada caadiga ah ee veth, ma aha interface WireGuard.
• Tiriyeyaasha FORWARD ee labada xeer way kordhaan inta codsi socdo.
• Habsocodka barnaamijku wuxuu sheegaa inode meesha magaca aad filayso.
• Dib u bilaabid ka dib meesha magacu waxay jirtaa ka hor inta adeeggu bilaabmo; unit goor hore socda wuu guuldareystaa ama, ka sii xun, wuxuu ka socdaa meesha magaca dibaddeeda.

Kadib go'aanso waxa dhacaya marka tunnel-ku dhaco. Meesha magacu way sii shaqaynaysaa, taas oo ah ujeeddada layliskan iyo sidoo kale khatarta: barnaamijka laga reebay wuu xidhiidhsan yahay halka wax kasta oo kale istaagaan. U qor tan doorasho siyaasadeed oo caddee waxa ka-reebidda aanay daboolin — aqoonsiga akoonka, xaaladda browser-ka ee la kaydiyay iyo bixiyahaaga DNS dhammaantood waxay ka baxsan yihiin baaxadda meel magac shabakadeed, oo ka-reebidda u qaadashada qarsoodi waa khaladka ka cimri dheer habaynta.