Laba goob, hal subnet, hal xarun WireGuard: ka dhig mid shaqeeya

Labada goobood waxay isticmaalaan isla baaxadda LAN, iskuna-dhaca ma aha waxa dhab ahaan jebiya naqshadda. Xaruntu waa in ay goob ku doorato ciwaanka bartilmaameedka oo keliya, laba bartilmaameed oo isku mid ahna wax ay ku doorato ma siiyaan. In xafiil shaqeeya dib loo nambareeyo si tunnel loo qanciyo ayaa inta badan ganacsi ka xun in adeeg kasta oo la daabacay la siiyo ciwaan gaar ah oo tunnelku qaadi karo. Naqshadda hoose waxay daabacdaa hal adeeg HTTPS goob kasta iyo wax kale ma leh.

Sababta isku-dhacu aanu ahayn dhibaatada dhabta ah

WireGuard waxay u gudbisaa bartilmaameedka: AllowedIPs peer-ka ayaa go'aamiya peer-ka helaya baakadda. Laba peer ma wada sheegi karaan 10.10.7.0/24 iyada oo aan midkood ku guulaysan raadin kasta. Taasi waa sifo shaxda peer-ka, ma aha tunnel-ka, sidaas darteed xalku halkan waa qorshe ciwaan, ma aha khiyaano waddo-raacis.

Qorshuhu waa in si buuxda loo joojiyo sheegista LAN. Taa beddelkeeda ku dhawaaq alias adeeg kasta, hal ciwaan goob kasta, oo ha u tarjunto albaabka goob kastaa aliaskaas barnaamijkiisa dhabta ah.

Isticmaalahu wuxuu waddo-raaciyaa laba ciwaan oo gaar ah, waligiis ma arko horgalaha mugdiga ah, waxnana ma is beddelo labada xafiis midkoodna. Tani waxay kaloo si daacad ah u sheegtaa xadka: waxaad daabacaysaa hal adeeg HTTPS goob kasta, ma aha inaad midoobayso laba shabakadood. Sharciyada soo socdaa way yaraadaan sababtoo ah hadalku waa cidhiidhi. Hadal ballaaran wuxuu u baahan lahaa sharciyo ballaaran, sidaas oo kalena naqshadahaani way adkaadaan.

Sii goob kasta alias ay isticmaalahu waddo-raaci karo

Ka dooro ciwaanno baaxad aan waxna ku dhicin mishiinka isticmaalaha, xarunta ama mid ka mid ah labada LAN. Halkan xaruntu waa 10.66.0.1, isticmaalahu waa 10.66.0.10, albaabbadu waa 10.66.0.21 iyo 10.66.0.22, labada aliasna waa 10.77.1.20 iyo 10.77.2.20. Xaruntu waxay daabacdaa alias kasta iyada oo u maraysa peer-ka hantida leh, sidaas darteed baakad baxaysa oo loo diraa hal alias waxay ka bixi kartaa oo kaliya goobta u dhiganta:

[Interface]
Address = 10.66.0.1/32
ListenPort = 51820
PrivateKey = HUB_KEY

[Peer]
PublicKey = USER_PUBLIC_KEY
AllowedIPs = 10.66.0.10/32

[Peer]
PublicKey = SITE_A_PUBLIC_KEY
AllowedIPs = 10.66.0.21/32, 10.77.1.20/32

[Peer]
PublicKey = SITE_B_PUBLIC_KEY
AllowedIPs = 10.66.0.22/32, 10.77.2.20/32

Dhinaca isticmaalaha wuxuu u baahan yahay oo kaliya labada alias, taas oo ka dhigaysa habaynta macmiilka mid ka madhan labada horgale ee LAN. Waxna kama hadlo habayntaas mid ka mid ah LAN-ka dhabta ah:

[Interface]
Address = 10.66.0.10/32
PrivateKey = USER_KEY

[Peer]
PublicKey = HUB_PUBLIC_KEY
Endpoint = hub.example.net:51820
AllowedIPs = 10.77.1.20/32, 10.77.2.20/32
PersistentKeepalive = 25

Albaab kastaa wuxuu ku dhawaaqaa xarunta iyo isha isticmaalaha, wax kale ma leh, sidaas darteed goob waligeed ma barato LAN-ka goobta kale. Keepalive waxay ilaalisaa khariidad NAT ku taal xiriirka sare ee goobta; ma fasaxdo taraafikada, oo dab-damiska ayaa weli go'aamiya waxa la aqbali karo. Nuqul ka mid ah habaynta hal albaab mid kale waa hagaagsan yahay haddii furaha gaarka ah, ciwaanka interface-ka iyo alias-ku dhammaantood is beddelaan.

Waxa xaruntu tahay in ay fasaxdo inta u dhaxaysa laba peer oo ay leedahay

Xaruntu waxay u gudbisaa baakado inta u dhaxaysa laba peer oo ay leedahay, taas oo ah go'aan ku jira silsiladda forward ma aha go'aan gelitaan. Daar gudbinta IPv4 iyada oo la adeegsanayo habka caadiga ah ee madal, ka dibna fasax oo kaliya lammaanaha naqshaddu u baahan tahay.

Sharciga hoose wuxuu isticmaalaha u oggolaanayaa hal alias iyo hal deked, wuxuuna fasaxaa taraafikada soo noqota iyada oo loo marayo la-socodka xiriirada. Wuxuu tuurayaa wax kasta oo kale oo ku jira waddada forward, taasina waa ujeeddada:

nft add table inet hub_transit
nft add chain inet hub_transit forward '{ type filter hook forward priority 0 ; policy drop ; }'
nft add rule inet hub_transit forward ct state established,related accept
nft add rule inet hub_transit forward iifname wg0 oifname wg0 tcp dport 443 ip saddr 10.66.0.10 ip daddr 10.77.1.20 accept

Laba faahfaahin ayaa mudan in la sheego sababtoo ah waxay keenaan guuldarrooyin aamusan. Accept ku jira hal silsilad sal ah ma ka sarreeyo drop ku jira mid kale, sidaas darteed tan ku dar siyaasadda jirta halkii aad barbar dhiggi la dhig lahayd. Iyo ciwaanka isha wuxuu aqoonsadaa qalabka, ma aha qofka; ka fogee xaqiijinta barnaamijka oggolaanshaha shabakadda.

Halka alias uu noqdo ciwaan dhab ah

Goobta A waxay heshaa codsi loo diray 10.77.1.20, waxay dib u qortaa bartilmaameedka barnaamijka dhabta ah, waxayna dib u qortaa isha ciwaanka LAN-keeda si jawaabtu ugu soo noqon karto iyada oo aan waddo u lahayn tunnel-ka. In labada turjumaadood hal meel lagu sameeyo waxay shabakadda intiisa kale ka dhigaysaa mid aan wax ka ogeyn aliaska. Sharciyada hoose waa habka oo dhan:

nft add table ip site_a_nat
nft add chain ip site_a_nat pre '{ type nat hook prerouting priority -100 ; policy accept ; }'
nft add chain ip site_a_nat post '{ type nat hook postrouting priority 100 ; policy accept ; }'
nft add rule ip site_a_nat pre iifname wg0 tcp dport 443 ip saddr 10.66.0.10 ip daddr 10.77.1.20 dnat to 10.10.7.20:443
nft add rule ip site_a_nat post iifname wg0 oifname lan0 tcp dport 443 ip saddr 10.66.0.10 ip daddr 10.10.7.20 snat to 10.10.7.2

Kadib siyaasadda forward ee goobta A waa in ay fasaxdo qulqulka la turjumay ee ka yimaada interface-ka tunnel-ka una gudbaya interface-ka LAN, iyo sidoo kale jihada soo noqodka. Hook-ga forward wuxuu arkaa bartilmaameedka ka dib turjumaadda bartilmaameedka iyo ka hor dib-u-qoraalka isha, sidaas darteed sharcigu wuxuu magacaabaa ciwaanka barnaamijka dhabta ah. Akhri labadaas hook markaas isla sidaas mar kasta oo sharci uu u muuqdo mid aan waxba ku habboonayn. Sharci forward oo ka soo horjeeda aliaska waligiis ma habboon karo, sababtoo ah aliasku hookgaas kama jiro.

Goobta B waxay tan ku celisaa aliaskeeda iyo furaheeda. Waa in aanay dib u isticmaalin furaha gaarka ah ee goobta A, sababtoo ah laba peer oo wadaaga hal aqoonsi waa khalad habayn oo adag in la arko oo sahlan in la abuuro iyada oo fayl la koobiyeeyo. Hayso labada dukumeenti albaab isku mid ah marka laga reebo qiyamka ay qasab tahay inay kala duwanaadaan, si farqigu u soo baxo marka dib loo eegayo. Fayl la koobiyeeyay waa isha caadiga ah ee cilladaas.

Dib-u-qoraalka isha wuxuu leeyahay qiimo. Barnaamijku wuxuu u arkaa albaabka macmiilkiisa, sidaas darteed diiwaannadiisu ma muujiyaan cidda isticmaale ee xiriirtay. Hayso raadka hanti-dhawrka albaabka, oo ha daciifin gelitaanka barnaamijka si aad u magdhabto aqoonsiga shabakadeed ee turjumaaddu ka saartay.

Sida loo caddeeyo in labada magac ee la daabacay ay jawaabaan

Sii alias kasta magac DNS oo habee barnaamijka iyo shahaadada magacaas, sababtoo ah turjumaadku dib uma qorto dib-u-dirista ama URL buuxa oo lagu daray. Isticmaal hal magac goob kasta si aan kala-duwanaanta shahaadadu waligeed loo qaldin khalad waddo-raacis.

Ka tijaabi macmiilka dhabta ah, xaqiiji goobta jawaabtay, oo tijaabi sidoo kale deked aan la oggolayn. Isticmaal xiriiro cusub ka dib isbeddel kasta oo NAT ah, sababtoo ah xaaladda la dhisay waxay hayaan khariidadda hore:

wg show wg0 allowed-ips
sudo nft list ruleset
curl -sS -o /dev/null -w "%{http_code}\n" https://site-a.example.net/

Alias madhan ama aan la filayn amarka koowaad waxay ka dhigan tahay in doorashada peer-ku khaldan tahay ka hor inta aan sharci dab-damis ah muhiim noqon. Haddii aliasku sax yahay oo magacu wali guuldarraysto, dhibaatadu waxay u guurtay DNS iyo shahaadooyin. Marka labada magacba jawaabaan oo dekedda saddexaad xiran tahay, naqshaddu waxay samaysaa waxa ay sheegatay: laba adeeg oo si cidhiidhi ah loo daabacay, ma aha laba LAN oo la miday.