Fure gaar ah halkan, fure dadweyne halkaas: furayaasha WireGuard
Furahaaga gaarka ah wuxuu ku sii jiraa qalabkaaga; gelinta lammaanaha waxay haysataa furaha dadweynaha dhinaca kale. La wadaag oo kaliya qaybta dadweynaha, oo qalab kastaa ha yeesho aqoonsigiisa gaar ah.
Inta badan cilladaha WireGuard ee gacan lagu dhisay waxay ku soo ururaan furaha kee baa meesha kee tegey. Qaybta is-dhexgalka waxay qaaddaa furaha gaarka ah ee qalabka aad habaynayso, halka qaybta lammaanuhu ay qaaddo furaha dadweynaha ee mashiinka dhinaca kale. Beddelidda qaybahaas, ama dhejinta midka qaldan, waxay soo saartaa gacan-qaad aan waligiis dhammaan iyo diiwaan aan waligiis fure magacaabin. Samee afarta hubin ee hoos ku qoran si taxane ah ka hor intaadan taaban AllowedIPs ama DNS.
Laba fure, laba jiho
Fure gaar ah wuxuu ka tirsan yahay hal qalab oo keliya wuxuuna ku sii jiraa qaybta is-dhexgalka qalabkaas. Qaybtiisa dadweynuhu waa waxa lammaane kasta oo kale uga baahan yahay inuu qalabka garto, qalabkuna way soo saaraan halka ay ka abuuraan. Serverka, furaha dadweynaha ee qalabkaaga wuxuu u muuqdaa sidii gelin lammaane; qalabkaaga, furaha dadweynaha ee serverku wuxuu qabtaa doorkaas. In habaynta cod sare loo akhriyo erayadan waxay qabataa inta badan jahwareerka ka hor intaysan gaarin gacan-qaad.
Amarka wg wuxuu daabacaa waxa is-dhexgalka maxalliga ahi dhab ahaan isticmaalo, oo ay ku jiraan labada fure ee dadweynaha. Taas ayaa ka dhigaysa habka ugu dhaqsiyaha badan ee lagu kala saaro khaladka habaynta iyo dhibaatada xidhiidhka:
wg show
wg show interfacesSoo-saarista kowaad waxay taxdaa lammaane kasta oo wata furahiisa dadweynaha, barta ugu dambeysay ee uu isticmaalay iyo da'da gacan-qaadkiisii ugu dambeeyay. Da'da gacan-qaad «waligaa» dhinac iyo mid dhowaan ah dhinaca kale waxay tilmaamaysaa fure ay qaateen hal gees oo keliya. Amarka labaad wuxuu magacaabaa is-dhexgallada aad si dheeraad ah u baari karto.
Waxa la wadaago iyo waxa aan waligaa la wadaagin
Fure dadweyne waxaa loogu talagalay in la gudbiyo, in kasta oo uu weli aqoonsado xidhiidhka qalabka, taas ayaa ka dhigaysa in maamulaha codsaday loo diro mid ka duwan daabacaaddiisa. Fure gaar ah waligiis kama tago qalabkii abuuray. Borofayl la dhoofiyay ama koodhka QR waxay hayaan habaynta oo dhan oo ay ku jirto furahaas gaarka ah, sidaas darteed midkoodna ma aha mid ammaan ah in la isu gudbiyo, oo qarinta qoraalka sawirka dhexdiisa waxba ma beddesho. Furayaasha hore loo wadaagay waa ikhtiyaari oo isla qarsoodi ah, labada geesna waa inay qaadaan isla qiimaha, haddii kale gacan-qaadku wuu istaagaa marxaladdaas.
Mid kale oo farqi ah waa in si cad loo yiraahdo: barta ugu dambeysa waa cinwaan iyo deked, waligeed ma aha fure. Dhejinta fure dadweyne goobta barta ugu dambeysa, ama cinwaan goobta fure, waxay soo saartaa borofayl la falanqeeyo oo markaas waxba sameyn. Qalabku ma qaban doonaan taas, maxaa yeelay labada goobood waa uun xarfo. Bilowga degdega ah ee WireGuard wuxuu hal saf ku muujinayaa silsiladda abuurista iyo soo saarista.
Hal qalab, hal gelin lammaane
Meesha adeeggu u oggolaado, qalab kastaa waa inuu qaataa aqoonsigiisa lammaane. Dhejinta borofaylka buuxa ee kombiyuutar gaadhan taleefan waxay mugdi gelisaa qalabka kee baa aqoonsigaas ku haysta serverka oo ka dhigaa mid adag in la baajiyo hal taleefan oo lumay. Haddii fure gaar ah soo baxo, ka saar oggolaanshaha lammaanaha hore serverka oo diyaari beddel. Tirtirista faylka maxalliga ah ma tirtirto gelinta serverka, fure macmiil cusubna qofna ma caawiyo ilaa serverku ogaado qaybtiisa dadweynaha.
Hay isku-xidhka qalabka ilaa furaha dadweynaha agta liiska cinwaannada. Liiskaas ayaa baajinta ka dhigaya hawl laba daqiiqo ah halkii duhur dhan.
Waxa weli guuldarraysta gacan-qaadka ka dib
Lammaanayaasha furaha waxay aqoonsadaan lammaanayaasha; ma go'aamiyaan habdhaqanka shabakadda. AllowedIPs wuxuu xidhiidhiyaa ballacyada cinwaannada lammaane, oo dariiqyada ku wareegsan waxaa maamula macmiilka ama qalabka habaynta. Calaamaddu waxay inta badan tidhaa lakabka kee baa la furayaa xigga:
| What you see | Which key problem it usually means | Where to look first |
|---|---|---|
| Handshake age stays at never on both ends | Peer public key missing, or an endpoint pointing at nothing | wg show, then the endpoint value |
| Handshake completes on one side only | The two ends hold different public keys for each other | wg show on both hosts |
| Handshake works, then no traffic | AllowedIPs or routes rather than keys | wg show and the route table |
| Worked until a key was regenerated | The peer entry still holds the old public key | Compare both public keys, then update the peer |
DNS wuu guuldarrayaa ka dib marka labada lammaane si sax ah isu xaqiijiyaan, oo barnaamijku wuu guuldarrayaa iyada oo tunnelka laftiisu caafimaad qabo, sidaas darteed gacan-qaad shaqeeya ma aha dhammaadka baaritaanka. Furayaashu waxba kama sheegaan dhaqanka diiwaangelinta ee hawlwadeenka ama in goob web ay aqoonsato akoonkaaga, su'aalahaasna meel kale ayay ka tirsan yihiin. U gudub lakabyada shabakadda marka afarta hubin ay gudbaan, maxaa yeelay fure maqan ma aha dhibaato dariiq oo is-qarinaysa.