I-VPN yebhizinisi ngaphakathi kwe-WireGuard: yiliphi ungqimba oluza kuqala?

Kunezizathu ezimbili ezisemthethweni zokufaka imihubhe ngaphakathi komunye kukhompyutha yomthuthukisi. Kungaba ukuthi iklayenti lebhizinisi kufanele libonakale lifana nelivela ezweni elithile, noma amanethiwekhi amabili angasese kufanele afinyeleleke ngesikhathi esisodwa. Zombili lezi zimo zidinga ukuthi umhubhe wangaphandle uthwale ukuxhumana kwakhe iklayenti langaphakathi.

Ukuqalisa amaklayenti amabili nganoma yikuphi ukulandelana akukulethi lokho. Ukuhlelwa kwemizila kuyikho okukuletha.

Qhathanisa ukulandelana okubili okungenzeka

Khetha ungqimba lwangaphandle njengomhubhe okufinyeleleka kuwo iphoyinti lokugcina livela ku-inthanethi yomphakathi. Ungqimba lwangaphakathi umhubhe oseva yayo ephendula kuphela ngaleyo ndlela yokuphuma. Ku-Windows ukwehlukaniswa okusebenzayo yi-WireGuard ngaphandle neklayenti lebhizinisi ngaphakathi. Isici esinqumayo ukulawula.

Iklayenti le-WireGuard elisemthethweni lisebenzisa ifayela lokuhlela eliphelele, kufaka phakathi imizila ne-DNS. Amaklayenti ebhizinisi ezentengiselwano ngokuvamile afihla kokubili. Ukubeka iklayenti elifihliwe ngaphandle kukushiya uqagela indlela engaphansi kwalo.

Ukulandelana okuphambene akunakwenzeka. Kunzima nje ukucabanga ngakho, ngoba iklayenti langaphandle libhala kabusha imizila ngohlelo ongakaze ulubone.

Vumela i-AllowedIPs iqambe kuphela ibanga lebhizinisi

AllowedIPs ibala izindawo aziyisa kuzo i-WireGuard kumhubhe. Ukuze kufakwe ngaphakathi kudinga kuphela ikheli leseva yangaphakathi kanye neziqalo zebhizinisi. Konke okunye kuhlala kunethiwekhi yasendaweni, kufaka phakathi amaphrinta ne-hypervisor. Lona umhubhe ohlukanisiwe ngokomklamo, futhi ugwema ngokuphelele inkinga yokukhishwa.

Ungqimba lwangaphandle olunomhubhe ogcwele ludinga 0.0.0.0/0 susa amabanga asendaweni. Ifomethi ayikwazi ukuveza ukukhishwa, ngakho umphelelisi kufanele abalwe futhi anamatheliswe.

[Interface]
PrivateKey = ...
Address = 10.99.4.2/32

[Peer]
PublicKey = ...
Endpoint = 198.51.100.44:51820
AllowedIPs = 198.51.100.44/32, 10.20.0.0/16, 10.21.0.0/16

Lapho iklayenti langaphakathi lingayifaki imizila yalo, bala iziqalo zebhizinisi ngokwakho. Isiqalo esishiywe kuleyo mugqa siyindawo umhubhe wangaphandle ongakaze uyithwale. Ikhophi endala yohlu imbi kakhulu kunokungabi nalo, ngoba isabukeka ilungile.

Ukulandelana, amamethrikhi kanye ne-adaptha yesibili

Xhuma kuqala umhubhe wangaphandle, bese uqalisa iklayenti lebhizinisi. Khona-ke ukuxhumana kwalo nephoyinti lokugcina kuphuma nge-WireGuard esikhundleni sesango lendawo. Nikeza isixhumi esibonakalayo sebizinisi imethrikhi ephansi ukuze iziqalo zayo ziphumelele kumakheli eyawanikezwa.

# which interface currently claims the corporate prefix?
Find-NetRoute -RemoteIPAddress 10.20.10.5 | Select-Object -First 1

# prefer the corporate interface for its own prefixes
Set-NetIPInterface -InterfaceAlias 'Corp VPN' -InterfaceMetric 3
Set-NetIPInterface -InterfaceAlias 'wg-personal' -InterfaceMetric 40

wg show interfaces

Amamethrikhi yisinyathelo abantu abasishiyayo. Ngaphandle kokulandelana, umzila owafakwa ekugcineni uphumelela esiqalweni esigqagqene. Lokho kuyashintsha phakathi kokuqalisa, yingakho inkinga ibonakala iza ngezikhathi ezithile.

Amaklayenti akhiwe phezu kwe-OpenVPN 2.6 afaka ugibe lwawo. Lapho i-adaptha yokwehlisa isiteshi sedatha isivele isetshenziswa, isenzakalo sesibili senqaba ukuqalisa. Ukwengeza disable-dco kuphrofayela kubuyela emuva endleleni endala ye-TAP, bese kuthi zombili zisebenze ndawana yodwa.

Lapho indlela efakwe ngaphakathi iphuka khona

Ukunqamula umhubhe wangaphandle kubulala owangaphakathi. Ukuxhuma kabusha iklayenti langaphakathi kuphela kuvame ukulithumela ngqo ku-inthanethi futhi kususe ngokuthula ukufakwa ngaphakathi. Hlola ukulandelana kusukela ekuqaleni njalo, kuyilapho yomibili imihubhe imisiwe.

Linde i-MTU encane esebenzisekayo. Ungqimba ngalunye lwengeza izindleko ezengeziwe, ngakho ipheya yokuqala cishe ku-1420 kanye no-1400 iyindawo yokuqala. Ukudluliswa okumile kumaphakethe amakhulu ngenkathi izicelo ezincane ziphumelela wuphawu olujwayelekile. Inqubomgomo yebhizinisi ingomunye umkhawulo, ngoba iklayenti elifuna idivayisi elawulwayo lingabheka indlela efakwe ngaphakathi njengokwephula umthetho.

Lapho zombili iziphetho zingamanethiwekhi angashintshi, umhubhe wendawo-kuya-endaweni phakathi kwamasango ususa inkinga yokulandelana esikhundleni sokuyilawula. Kukhompyutha eyodwa, imihubhe emibili ihlala ndawana yodwa kuphela lapho ngayinye inesixhumi sayo esibonakalayo kanye nomthetho okhetha izindawo ngesiqalo.