WireGuard: jid loo maro peer ma jiro ka dib isbeddelka subnet — laba siyaabood
Isbeddelka subnet-ka wuxuu WireGuard ku jebiyaa laba meelood: AllowedIPs iyo jidka soo noqoshada. Isbarbardhig dib-u-nambaraynta goobta iyo dib-u-dhiska interface-ka.
Handshake-ku wuu cusub yahay wg show, barta ugu dambeysa waa sax, furayaashu weligood ma isbeddelin — haddana ping wuxuu leeyahay jid loo maro peer ma jiro. Waad beddeshay subnet-ka tunnel-ka saacad ka hor. Calaamaddaas waa sumadda isku-dhacsanaanta prefix ma aha mushkiladda furaha: WireGuard wuxuu dhammeeyay handshake-ka ka dibna wuu tuuray xogta sababtoo ah cinwaanka isha hadda lama mid yahay wixii peer-ka qaata uu aqbali doono. Waxaa jira laba siyaabood oo caqli-gal ah oo loo hirgeliyo isbeddelka subnet, oo ay ku guuldareystaan meelo kala duwan.
Laba siyaabood oo loo hirgeliyo isbeddelka, iyo qiimaha mid kasta
Xulashada A waa dib-u-nambarayn goobta: tafatir cinwaanka interface-ka, xaddiga peer-yada, jidadka iyo koob kasta oo config-ka ah, ka dibna dib u soo ror. Xulashada B waa in interface labaad laga dhiso prefix-ka cusub oo ku xiga kan hore, peer-yada loo raro, interface-kii hore la tirtiro marka taraafikadu runtii guurtay.
| A: renumber in place | B: parallel interface | |
|---|---|---|
| Downtime | The reload window, per host | None if peers are added to both |
| Rollback | Re-apply the previous files | Point peers back at the old interface |
| Risk | Half-applied change: new address, old ranges | Two live interfaces with overlapping intent |
| Effort | Small, if the deployment has one owner | Higher, and needs a cleanup step |
| Fits | Two or three peers you control | Many peers, remote sites, or no maintenance window |
Xaaladda nuska ah ee la hirgeliyay ayaa xulashada A khatar ka dhigta, sababtoo ah uma eka mid jaban. Interface-ku wuu soo baxaa, handshake-ku wuu guuleystaa, oo kaliya jidka xogta ayaa guuldareysta. Xulashada B waxay u baahan tahay shaqo badan laakiin waxay nooleynaysaa jid shaqeeya inta aad raadineyso tixraac kasta.
Maxaa dhinacaaga wada dhaqaaqi doona
Afar shay oo host-ka maxalliga ah ayaa sharraxaya isla subnet, oo mid beddeliddiisu waa dhammaan beddeliddood: cinwaanka interface-ka, AllowedIPs peer kasta, jidka nidaamku u isticmaalo meelahaas, iyo wax kasta oo maareeyaha magacaaga ku rakibo. wg-quick la socodsiinta labada ugu dambeeya waxaa laga soo saaraa config-ka mar kasta oo interface-ku soo baxo, sidaas darteed koob duugoobay ayaa si aamusnaan ah dib u rakibaya prefix-ka hore.
Isku barbardhig waxa la habaynayay iyo waxa nool halkii aad mid ka mid ah ku kalsoonaan lahayd:
wg show
wg showconf wg0
ip addr show wg0
ip route get 10.90.0.5Raadinta jidka waa tallaabada dadku ka boodaan. Waxay ka jawaabtaa waxa kernel-ku runtii u samayn lahaa meel loo socdo, oo ay ku jirto jid gaar ah oo maareeyaha ama deegaanka kontaynarada uu ka tagay. Haddii ay soo sheegto interface ka duwan tunnel-ka, config-ku maaha dhibaatada.
Interface shaqaynaya, codso faylka la tafatiray adigoon tunnel-ka dumiyin:
wg syncconf wg0 <(wg-quick strip wg0)Taasi waxay cusboonaysiisaa peer-yada iyo xaddiga goobta. Ma cusboonaysiiso cinwaanka interface-ka ama jidadka, sababtoo ah kuwaasi maaha habaynta WireGuard — sidaas darteed dib-u-nambarayntu weli waxay u baahan tahay dib-u-abuur interface-ka ama beddel cinwaanka ip, ka dibna dib u hubi jiheynta.
Maxaa dhanka fog wada dhaqaaqi doona
Halkan ayaa isbeddelka subnet-ku badanaa ku dhintaa. AllowedIPs maaha kaliya tilmaan jiheyn; waxay kaloo tahay liiska cinwaannada isha ee peer-ku soo bandhigi karo. Markaad dib-u-nambayso macaamiisha oo aad ka tagto AllowedIPs-ka server-ka prefix-ka hore, server-ku wuu aqbalaa handshake-ka, wuxuu helaa baakadaha sirta ah oo wuu tuuraa sababtoo ah isha gudaha kuma habboona xad kasta oo uu peer-kaas ku xiro. Khalad lama diiwaangeliyo, macmiilku wuxuu arkaa waqti-dhaaf.
Sidaas darteed si ula kac ah u cusboonaysii dhinaca qaata: diiwaanka peer-ka server-ka waa inuu taxaa prefix-ka cusub ee macmiilka, jidka soo noqoshada server-ka waa inuu u jeedaa tunnel-ka prefix-kaas, iyo shabakad kasta oo hoose oo server-ka ka dambeysa waa inay bartaa jidka cusub. Siyaasadda dab-demiska ee magacaysay xaddigii hore waxay u baahan tahay isla daawaynta, iyo wax kasta oo doorasho ku saleysan isha sameeya.
Baaritaanka kala soocaya labada guuldareysi waa jaban. Handshake cusub oo xog la'aan macnaheedu waa tunnel-ku wuu taagan yahay oo cinwaanaynta gudaha isku raacsan tahay. Handshake gabi ahaan la'aan macnaheedu waa waxaad eegaysaa gaaritaan ama furayaal. Ha rogin furayaasha dhibaatada prefix; taasi waxay dib u dejisaa waxa kaliya ee shaqaynayay.
Koobab duugoobay oo ka sii noolaada tafatirkaaga
Tafatirka fayl maaha isla beddelka nidaamka shaqaynaya, koobabkuna way ka badan yihiin waxa dadku filaan: unugga ama maareeyaha leh interface-ka, profile labaad oo isla magac ah oo ku yaal galka kale, kontaynar config-kiisu ku duuban yahay sawir, interface router oo haysta nuqtediisa la tafatiray, iyo abka macmiilka oo bilowga dib u soo dejiya tunnel la kaydiyay. Mid kasta oo iyaga ka mid ah wuxuu soo celin karaa prefix-ka hore ka dib marka isbeddelkaagu uu u muuqdo mid dhammaaday.
Magacyaduna way safraan. Haddii jidka tirooyinku shaqeeyo laakiin magaca host-ku guuldareysto, diiwaan DNS gudaha ama habaynta adeeg ayaa weli u jeedda cinwaanka tunnel-ka hore. Hagaaji tixraaca halkii aad ballaarin lahayd xad kasta oo peer, taas oo qarin lahayd dhibaatada dhabta ah oo isla waqti isku ah weynayn lahayd ACL-ka isha.
Inta aad shaqaynayso fur hal jid oo soo kabasho: siyaabad labaad oo host-ka loo galo, konsol taxane ah, ama dib-u-noqosho la qorsheeyay oo faylasha config-ka. Isbeddelka tunnel-ka ee kaa xira mashiinka aad beddelayso ayaa ah habka ugu caansan ee hawshan u noqoto fiid.
Doorashada labada, iyo xaqiijinta goynta
Dooro A markaad leedahay peer kasta, tirada yar tahay, oo hakad gaaban la aqbali karo. Dooro B marka peer-yadu ay yihiin gacmo fog oo aadan xakameynin, marka isku xirka goob-ilaa-goob ay tahay inuu kor joogo, ama marka aadan dammaanad qaadi karin in koob kastaa hal mar lagu cusboonaysiin doono. Xaaladdaas ku dar prefix-ka cusub labada interface, u rar peer-yada mid mid, fiiri taraafikada kan cusub, oo markaas ka dib tirtir interface-kii hore iyo jidadkiisa.
Xulasho kasta, isbeddelku wuu dhammaaday marka afar baaritaan ay gudbaan: handshake-ku wuu cusub yahay, raadinta jidka ee meel leh prefix-ka cusub waxay magacaysaa tunnel-ka, xamuul dhowr boqol oo byte ah ayaa labada jihoo dhex mara, oo isla sidaas ayaa ah ka dib dib-u-bilowga host-ka ama maareeyaha. Taas buugga wg(8) wuxuu tixraac u yahay waxa AllowedIPs ka dhigan tahay jiho kasta, waana mudan in dib loo akhriyo ka hor inta aadan ballaarin xad si calaamad u baabto.
- Handshake cusub oo xog ma jirto: fiiri AllowedIPs-ka qaataha ka hor inta aadan taaban furayaasha.
- Raadinta jidku waxay u jeeddaa interface khaldan: jidka waxaa leh maareeye ama kontaynar, maaha faylkaaga.
- Cinwaanka tirooyinku wuu fiican yahay magaca host-ka jaban yahay: tixraac hore, maaha wareeg jiheyn.
- Isbeddelku wuxuu dhammaanayaa oo kaliya marka dib-u-bilow ka dib weli la isticmaalo prefix-ka cusub.