WireGuard ma abuuri karo isdhexgalkiisa: kernel mise rukhsad?
Abuurista isdhexgalka way guuldareysataa ka hor inta aan lammaane is-gacan qaban. Akhri khaladka si aad u kala garato moduul maqan iyo xad rukhsad ama mulkiile isdhexgal hore u jiray.
WireGuard wuu ku guuldareystaa abuurista isdhexgalkiisa, sidaas darteed ma jiro qalab la habayn karo, ma jiro fure la isweydaarsan karo oo ma jiro is-gacan-qaad la baadhi karo. Guuldarradu waxay si buuxda ugu hadha mishiinka gudaha, oo qoraalka khaladka wuxuu sheegayaa qaybta stack-ga gudaha ee diiday. Si sax ah u akhrintiisu way ka dhaqso badan tahay dib-u-rakibidda habaynta lammaanaha. Lakabyada waa la kala saari karaa, oo fariintu waxay magacaabaysaa tan diiday.
Khaladku wuxuu dhacaa ka hor inta aan lammaane kasta hadlin
Abuurista isdhexgal waa hal codsi netlink oo kernel-ka loo diro qalab nooca wireguard ah. Kernel-ku wuxuu leeyahay darawal fahma noocaas ama ma leh, jawaabtuna isla markiiba soo noqotaa. Tallaabadan wax baakad ah kama baxo mishiinka, sidaas darteed cinwaannada dhammaadka iyo furayaasha server-ka ma noqon karaan sababta.
Nidaamkani wuxuu muhiim u yahay ogaanshaha. Haddii amarku waligiis aanu abuurin qalab, dhibaatadu ma noqon karto fure guud oo khaldan ama deked UDP oo xiran. Marka hore hagaaji waddada abuurista gudaha kadibna eeg bannaanka.
Goorma hirgelinta ay tahay inay maamusho qalabka
Laba hirgelin ayaa ka jawaabi kara codsigaas. Moduulka kernel-ka dhexdiisa wuxuu diiwaangeliyaa nooca qalabka wireguard, hirgelin ku taal meelaha isticmaalaha sida wireguard-go waxay bixisaa isla isdhexgalka hab kale. Haddii moduulku maqan yahay, kernel-ku wuxuu diidaa codsiga khalad qalab aan la taageerin, xalkuna waa in moduulka la raro ama agabka loo jeediyo hirgelinta meelaha isticmaalaha.
Hubi waxa run ahaantii jira ka hor inta aad ka doorato labada. Amarka koowaad wuxuu muujinayaa haddii moduulku raran yahay, tan labaadna kernel-ka si toos ah ayay wax ka weyddiinaysaa:
lsmod | grep wireguard
ip link add wgtest0 type wireguardAmarka labaad waa soo-saarista ugu yar ee suurtagal ah: wuxuu codsadaa qalab oo wax kale ma codsado. Haddii uu ku guuldareysto fariin nooc aan la taageerin, qaybta maqan waa hirgelinta, ma aha faylkaaga habaynta.
| Error text | What refused | Next step |
|---|---|---|
| Unknown device type or operation not supported | The kernel has no wireguard driver | Load the module or use the userspace implementation |
| Operation not permitted | Missing privilege | Use the service context or grant the capability |
| File exists | The name is already in use | Inspect the owner before touching it |
| No such device in a container | No tunnel device or capability | Add the device and NET_ADMIN to the container |
Rukhsadaha iyo xadka weelka
Abuurista iyo habaynta qalabka shabakada waxay u baahan tahay rukhsad, ama root ahaan ama awoodda maamulka shabakada. Fadhi isticmaale caadi ah ma samayn karo, xaddidaadduna waa nashqadda laftiisa, ma aha caqabad in laga gudbo iyadoo la ordayo rakibye aanad eegin.
Weelka gudihiisa xadku wuu labanlaabmaa. Weelku wuxuu u baahan yahay gelitaan qalabka tunnel-ka iyo awoodda lagu habaynayo, calaamadaha taas bixiyaana waa isla kuwa uu isticmaalo weelka VPN ee Linux. Marti xaddidan oo caadiyan baari kara webka weli ma abuuri karo isdhexgal, sababtoo ah baaritaanku uma baahna awooddaas. Awoodda sii adeegga u baahan, ma aha fadhi kasta oo host-ka ah.
Xalliso khilaafka magaca, kadibna isku day mar kale
Isdhexgal hore u jiray si otomaatig ah ma aha hadhaag. Maamule kale ayaa laga yaabaa inuu iska leeyahay magaca oo hadda isticmaalayo, sidaas darteed baadh ka hor inta aad wax tirtirto:
ip link show wg0
sudo wg show wg0Haddii mulkiiluhu yahay adeeg firfircoon, habee adeeggaas halkii aad abuuri lahayd qalab labaad. Haddii run ahaantii uu duugoobay, ka saar qalabkii abuuray, kadibna kor u qaad isdhexgalka macmiilka ama cutubka la diiwaangeliyay si habaynta iyo qalabku isku waafaqaan.
Marka abuuristu guulaysato, guuldarrada xigta waxay ka tirsan tahay marxalad dambe, cutubka soo sheega guuldarro ka dib jiritaanka qalabka waa dhibaato ka duwan qalab aan waligiis la abuurin. Kala sooc labada ka hor inta aad mar kale beddesho rukhsadaha.