Handshake-ka WireGuard waa shaqeeyaa laakiin internet ma jiro: raad raac baakadda
Handshake-ku wuxuu caddeeyaa oo keliya furayaasha iyo gaaritaanka. Raad raac hal baakad laga bilaabo AllowedIPs iyada oo maraysa gudbinta, NAT iyo waddada soo noqodka si aad u aragto halka ay joogsato.
Tunnel-ka waa furan yahay, wg show wuxuu soo sheegayaa handshake dhowaan, waxaad ping kartaa ciwaanka tunnel-ka server-ka, waxna ka shisheeya ma jawaabo. Fikradda ugu horreysa waa in furayaasha dib loo abuuro ama configuration-ka dib loo wadaago. Taasi waxay beddelaysaa qaybta waddada ee horey loo caddeeyay inay shaqeyso.
Handshake dhammaadka wuxuu sheegayaa in labada dhinac ay ku heshiiyeen furayaasha, in UDP uu gaaro barta ugu dambaysa, iyo in crypto routing-ku uu aqbalo baakadda. Ma sheegayo wax ku saabsan haddii baakaddu ka bixi karto server-ka intaas ka dib.
Marka raad raac hal baakad halkii aad qiyaasi lahayd. Waxaa jira afar meelood oo ay ku dhiman karto, mid kastaana wuxuu ka tagaa calaamad kala duwan.
Waxa handshake-ku dhab ahaan caddeeyo
WireGuard waa protocol UDP oo sameeya session handshake Noise ah ka dibna encryption ku sameeya baakadaha saaxiib. Marka wg show uu muujiyo handshake daqiiqado yar jira iyo counter-ka wareejinta oo kordhaya, barta ugu dambaysa, furayaasha iyo furaha guud ee saaxiibka dhammaantood waa sax.
Waxa aanu caddayn karin: in macmiilkaagu uu gudbiyo traffic-ka internet-ka u jeedda interface-ka, in server-ku diyaar u yahay inuu gudbiyo, ama in jawaabtu ay heli karto waddada soo noqodka. Kuwaani waa go'aanno routing kernel iyo firewall ah, waxaana lagu qaataa tunnel-ka dibadiisa.
Taasi waa sababta ping-ka ciwaanka tunnel-ka server-ku u yahay imtixaan sidaas u khiyaano leh. Baakaddaas loogu jeediyay server-ka laftiisa, sidaas darteed waxay ku dhammaataa gudaha. Marnaba uma baahna gudbin, marnaba turjumaad, marnaba waddo soo noqod internet-ka.
AllowedIPs waa go'aan routing ah
Macmiilka, AllowedIPs wuxuu qabtaa laba shaqo. Waa shaxda routing-ka furaha crypto oo go'aamisa ciwaannada meesha loo socdo ee la geliyo tunnel-ka saaxiibkan, waana liiska ciwaannada isha ee saaxiibku kaa aqbali doono. Haddii configuration-ka macmiilku uu taxo oo keliya 10.8.0.0/24, meelaha guud marnaba ma galaan interface-ka waddada caadiga ah ee default-ka ayaa ka qaada tunnel-ka dibadiisa. Markaas tunnel-ku si fiican ayuu u shaqeeyaa waxna kama qabto wixii aad rabtay.
Eeg waxa macmiilku dhab ahaan rakibay halkii aad eegi lahayd waxa faylka configuration-ku sheegayo:
wg show wg0 allowed-ipsip route get 1.1.1.1
Amarka labaad waa kan go'aanka leh. Haddii jawaabtu sheegto interface-kaaga jirka iyo gateway-ga caadiga, baakaddu tunnel-ka ma marayso waxna isbeddel ah oo dhinaca server-ka ah ma hagaajin doono. Ku dar 0.0.0.0/0 IPv4 iyo ::/0 IPv6 si gooni ah; qaanuunka qabta wax walba ee hal qoys ka tagayaa kan kale waddadiisa asalka ah, waana sababta caadiga ah ee tunnel IPv4 shaqeeya iyo raadinta IPv6 xanniban.
Halka baakaddu ku dhimato gateway-ga
Haddii waddadu sax tahay oo baakaddu weli meelna aadaynin, waxay gaartaa server-ka oo halkaas ayay joogsataa. Afar baaritaan ayaa daboolaya inta badan gateway-yada.
Gudbin. sysctl net.ipv4.ip_forward oo soo celiya 0 waa jawaabta caadiga ah, qaybo badan ayaa weli default ku ah 0. Waa inuu noqdaa 1, oo si joogto ah loogu dhigaa fayl sysctl halkii amarka ku libdhaya marka dib loo bilaabo. Gudbinta IPv6 waa switch gooni ah.
Siyaasadda filter-ka. Silsilad FORWARD oo leh siyaasad drop default ah ayaa tuuraya traffic-ka tunnel-ka halka ay u oggolaanayso traffic-ka host-ka laftiisa, taas oo si sax ah u dhigma calaamadaha. Akhri xeerarka nool, ma aha fayl la kaydiyay: nft list ruleset ama iptables -S.
Turjumaad ama routing. Macmiillada isticmaala ciwaannada tunnel-ka gaarka ah waxay u baahan yihiin NAT isha interface-ka bixista server-ka, ama prefix la route-gareeyay oo shabakadda sare ay taqaan sida loo celiyo. Doorashada labadooda waxay raacdaa qorshaha ciwaannada. Ku darista MASQUERADE shabakad horey u route-gareysa prefix-kaaga dib loo soo celiyo waa wax aan waxyeello lahayn laakiin macno malahan, ka tagista meel aan waddo ka jirin waxay jawaabaha uga tagtaa ciwaan loo jeediyay xad gaar ah oo aan la route-gareyn karin.
Waddada soo noqodka. Naqshadaha la route-gareeyay, router-ka sare wuxuu u baahan yahay waddo u jeedda server-kaaga. Shabakadda bixiyaha ayaa sidoo kale xannibi karta: dhowr cloud ayaa daara kiciya baaritaanka isha iyo meesha loo socdo instance-ka, taas oo si aamusnaan ah u tuurta baakadaha ishuna aanay ahayn ciwaanka instance-ka laftiisa, ilaa baaritaankaas la damiyo.
DNS si ka duwan routing ayuu u guuldareystaa
Baakad u socota ciwaan la yaqaan iyo raadinta magac waa laba guuldarro oo gooni ah, fariimaha khaladaadkuna waxay ku khiyaaneeyaan jihooyin iska soo horjeeda. Haddii ping 1.1.1.1 shaqeeyo oo browser-ku waxba soo dejisan karin, waddadu waa sax tahay xallinta magacyaduna ma aha. Haddii ping-ka laftiisu guuldareysto, DNS waa wax aan khusayn oo waxaad ku noqotay qaybta hore.
wg-quick wuxuu dejin karaa resolver line-ka DNS = ee configuration-ka, systemd-resolved-na wuxuu leeyahay dabeecad u gaar ah xiriir kasta. VPN beddela resolver-ka ciwaan lagu gaari karo oo keliya tunnel-ka gudihiisa ayaa guuldareyn doona raadin kasta isla marka tunnel-ku dhaco, taas oo u ekaanaysa sida tunnel-ku u burburinayo internet-ka.
| Symptom | Layer to inspect |
|---|---|
| Tunnel address pings, nothing else does | Client route, then gateway forwarding |
| Public IP pings, hostnames fail | Resolver selection and reachability |
| Handshake completes, no reply ever | FORWARD policy or missing NAT on the server |
| Small requests work, large transfers stall | MTU and TCP MSS clamping |
Nidaam soo saara caddayn
Marka hore samee baaritaanka dhinaca macmiilka, maxaa yeelay waa hal amar oo meesha ka saaraya kala bar suurtagalnimada. Kadib xaqiiji haddii server-ku loogu talagalay inuu noqdo bixista internet-ka; gateway loo dhisay gelitaan gaar ah ma burburo marka meelaha guud guuldareystaan.
Server-ka, fiiri interface-ka inta aad ping ka dirayso macmiilka: tcpdump -ni wg0 icmp waa inuu muujiyaa codsiga, tcpdump -ni eth0 icmp na waa inuu muujiyaa inuu baxayo, turjuman ama aan turjuman. Haddii uu ku muuqdo kan hore oo aanu waligiis ku muuqan kan labaad, joogsigu waa mid gudaha server-ka. Haddii uu baxo oo jawaab soo noqonin, dhibaatadu waa kor, taasna waa hadal kale.
Ugu dambeyn ka dhig wax ka beddelka mid ka badbaada dib u bilaabista. Gudbintu waxay ku deel qaadanaysaa fayl sysctl, xeerarka firewall-ka waxay ku deel qaadanaysaa adeegga soo raraya, waddooyinka macmiilkana waxay ku deel qaadanaysaa configuration-ka kor u qaada interface-ka, ma aha shell aad illoobi doonto. Dib u xiriir, ku celi labada imtixaan ee isku mid ah, oo xaqiiji in tirooyinku dhaqaaqaan.