Hal WireGuard peer lama gaadhi karo inta tan kale shaqaynayso: liiska hubinta

Hal WireGuard peer ayaa gudbiyaa taraafikada, tan labaadna dhammaysataa is-gacan-qaadka laakiin waligeed ma gaadho wax ka dambeeya tunnel-ka. Peerkii shaqaynayay wuxuu kuu sheegayaa in interface-ka, port-ka UDP iyo furaha server-ka ay u badan tahay inay wanaagsan yihiin. Wax kama sheegayo AllowedIPs-ka peerkii labaad, cinwaanka isha gudaha ama xeerarka gudbinta ee u dhexeeya. Liiska si taxane ah u mar oo ku joog tallaabada ugu horreysa ee shuruuddeeda fashilanto.

Tallaabada 1: Qor waddada ay packet-ku qaadan doonto

Laba macmiil oo isku hub ah si toos ah midba midka kale ma gaadho. Naqshadda hub iyo fallaadhaha, server-ku wuxuu packet-ka ku qaataa wg0 wuuna ku gudbinayaa dibadda wg0 una gudbinayaa peerkii kale, taas oo u baahan gudbinta IP iyo xeer gudbin. Naqshadda tooska ah ee peer-ka-peer, dhinac kastaa wuxuu u baahan yahay endpoint-ka dhinaca kale iyo cinwaanka tunnel-kiisa gudaha AllowedIPs. Go'aanso naqshadda aad sixinayso ka hor inta aadan akhrin wax qaabayn ah.

Waddada la filayo waxay sidoo kale kuu sheegtaa halka aad ka eegto. Haddii packet-ku u baahan yahay inuu ka gudbo hub-ka, boodhka fashilma waa AllowedIPs-ka diraya, gudbinta hub-ka, ama AllowedIPs-ka qaata. Haddii uu si toos ah u socdo, hub-ku macne ma leh oo beeraha endpoint-ka labada peer ayaa muhiim ah.

Tallaabada 2: Isbarbar dhig AllowedIPs labada dhinac, ma aha hal dhinac oo keliya

WireGuard wuxuu AllowedIPs u isticmaalaa sida shaxda marinka iyo sidoo kale liiska gelitaanka. Marka la dirayo, cinwaanka loo socdo waxaa laga raadiyaa AllowedIPs-ka peer-ka si loo doorto tunnel-ka; marka la qaadanayo, cinwaanka isha gudaha waa inuu gudaha ka noqdaa AllowedIPs-ka peer-ka diraya haddii kale packet-ka waa la tuurayaa. Baaxad maqan oo ku taal dhinac kasta waxay keentaa calaamad isku mid ah: gaadiidku wuu shaqeeyaa, xamuulka wuu libdhayaa.

Akhri xaaladda nool halkii aad ka akhrin lahayd faylka, waayo dib-u-soo-dejintu waxaa laga yaabaa inay si aamusan u fashilantay: sudo wg show wg0 allowed-ips. Server-ka, gelitaanka peerkii fashilmay waa inuu ku daro cinwaanka tunnel-kiisa, tusaale ahaan 10.90.0.3/32. Macmiilka, gelitaanka peerkii server-ka waa inuu ku daro halka aad tijaabinayso, hadday tahay cinwaanka tunnel-ka hub-ka ama subnet-ka fog. Baaxadaha is-dul-saaran waxay ka dhigaan raadinta mugdi oo waxay dooran karaan peer aadan ujeedin, sidaas darteed kala sooc.

Tallaabada 3: Hubi cinwaanka isha gudaha

Macmiilka 10.90.0.3 ku mara wg0 laakiin packet-yada ka dira cinwaankiisa Wi-Fi waa uu diidi doonaa qaataha, waayo isha kuma habboona AllowedIPs-ka peer-ka. Xaqiiji waxa kernel-ku dhab ahaan doorto ip route get 10.90.0.3 from 10.90.0.2, oo xaqiiji cinwaanka loo qoondeeyay interface-ka tunnel-ka ip -brief addr show wg0.

Host-ka Linux ee qaata, shaandhaynta waddada gadaal waa albaabka labaad. rp_filter adag oo ku yaal interface-ka leh marinka gadaal ayaa laga yaabaa inuu tuuro taraafikada tunnel-ka ee waddada gadaal aysan ka habboonayn interface-ka uu ka yimid. Hubi qiimaha dhabta ah ka hor inta aadan damin; topoloojiyada badan sixitaanka saxda ah waa marin, ma aha shaandhayn dabacsan.

Tallaabada 4: Dib u eeg gudbinta hub-ka iyo waddada gadaal

Haddii hub-ku u baahan yahay inuu ka gudbiyo peer-yada, kernel-ku wuxuu u baahan yahay net.ipv4.ip_forward=1, oo dab-damiska waa inuu aqbalaa qulqulka la gudbiyay: gelid wg0, bixid wg0, laga bilaabo cinwaanka tunnel-ka diraya ilaa kan qaata. Cillad caadi ah waa xeer gelid oo aqbala UDP 51820 laakiin aan lahayn xeer gudbin], sidaas darteed is-gacan-qaadku wuu guulaystaa xamuulkuna wuu dhintaa. Liis xeerarka dhabta ah sudo nft list ruleset ama wax u dhigma maareeyaha dab-damiskaaga.

Kadib hubi jawaabta. Host-ka loo socdo waa inuu lahaadaa marin dib ugu noqota diraya, ha ahaado hub-ka ama gateway-ga u gaar ah. Haddii hub-ku sidoo kale NAT ku sameeyo subnet-ka tunnel-ka, xaqiiji in turjumaaddu khuseeyso qulqulka la gudbiyay iyo in jawaabtu gaadho hub-ka ka hor inta uusan xaaladdu dhamaan. Fashil hal-jiho ah oo u eg mushkiladda furaha ayaa inta badan ah waddadan gadaal.

Ugu dambayn, kala sooc is-gacan-qaadka iyo xogta. Peer-ka dhammaystira is-gacan-qaadka laakiin ku hakada wareejinta waaweyn wuxuu inta badan qabaa dhibaato MTU ama MSS oo ku taal waddadaas gaar ah, ma aha dhibaato AllowedIPs. Marka hore ku tijaabi ping yar, kadib mid cabbir buuxa leh, oo isbarbar dhig labada peer.

Tallaabada 5: Beddel hal shay oo peer-ka shaqaynaya ka dhig mid aan dhaawac soo gaarin

Ku samee hal isbeddel oo keliya waddada fashilan oo labada peer dib u tijaabi. Ku beddelka AllowedIPs-ka peer kasta 0.0.0.0/0 waa habka ugu dhaqsiyaha badan ee loo jebiyo peerkii hore u shaqaynayay, waayo waxay beddelaa go'aanka marinka dhammaan taraafikada interface-kaas. Tafatir gelitaankaas keliya, dib u soo rar, oo dib u akhri xaaladda nool.

Qor waddada guulaysatay, tan fashilantay, iyo soo-saarka amarka saxda ah mid kasta. Isbarbardhiggaas ayaa ka qiimo badan warbixin guud oo sheegta in VPN-ku jaban yahay, waana waxa ugu horreeya ee qofka xiga weyddiin doono.