Isethi ye-nftables ephakelwa yi-DNS iya ku-WireGuard: ukudluliswa kusebenza kanjani

Amagama axazululwa abe amakheli, futhi lawo makheli angangena kusethi yodonga lomlilo okuthi kamuva kube nomthelela ekuhambiseni, okwenza ukuqondisa okusekelwe egameni kwenzeke ngaphandle kwe-proxy. Inkinga ukuthi izingxenye ezine kufanele zidlulise kahle: isixazululi, isethi, isihlukanisi esimaka ukugeleza okusha, kanye nozakwabo okuthwala. Ukudluliswa ngakunye kwehluleka ngendlela ehlukile futhi ngakunye kugcina isikhathi sako.

Thatha umklamo njengeketanga hhayi njengokuhlelwa. Umbuzo esigabeni ngasinye ukuthi iyiphi ingxenye ephethe isinqumo nokuthi kwenzekani lapho okokufaka kwayo kungena.

Impendulo ye-DNS engakwenza nengenakukwenza

i-dnsmasq ingakopisha amakheli kusukela ezimpendulweni iye kusethi ye-nftables, lokhu kuwukuphakela hhayi isinqumo sokuhambisa. Leyo nketho, ebhaliwe encwadini ye-dnsmasq, isho umndeni, ithebula kanye nesethi, futhi u-4# wayo wokuqala ukhetha amarekhodi e-A kuphela, ngakho izindawo ze-v6 zidinga ilungiselelo lazo. Isethi kufanele isivele ikhona, ngoba isixazululi sengeza izici entweni eyenziwe umnikazi wodonga lomlilo. Akukho okukhetha isixhumanisi, ithebula noma uzakwabo kuleso sigaba.

Iklayenti kufanele futhi lisebenzise leso sixazululi egameni. Uhlelo olune-DNS yalo ebetshisiwe, noma impendulo egciniwe yasendulo ngaphambi kokuba umgomo ukhona, ixhumanisa ngaphandle kokudala noma yikuphi ukufakwa kusethi.

Isethi iwukufaka, hhayi indlela

Isici esisethini siyisimo sokufanisa. Kufanele kube nokuthile okubheka kuso, kunqume ukuthi leli phakethe liqala ukugeleza okusha, futhi kusebenzise umgomo othumela ukugeleza ngomhubhe. Ku-Linux lokhu ngokuvamile kusho indlela yokuphuma ekwazi ukuhambisa engabeka uphawu, umthetho othumela amaphakethe amakwe ukuya kwithebula elikhethekile, kanye nomzila kulelo thebula obheke kudivayisi ye-WireGuard. Ubulungu bodwa abukufaki lutho kulokhu.

nft add set inet vpn_select office_v4 { type ipv4_addr\; }
ip rule add fwmark 0x40 table 200
ip route add default dev wg0 table 200
wg show wg0 allowed-ips

Uzakwabo usebenzisa ukuhlolwa kwesibili kokumbesa abantu abakukhohlwa. I-WireGuard ibethela iphakethe kuphela kuzakwabo okukheli akhe avunyelwe ahlanganisa nakhona okuyiwa kuyo, ngakho umzila womgomo ongena kusixhumanisi awanele lapho uhlu lozakwabo lukhipha leso siqalo. Gcina uhlu ngaphansi kokulawula komnikazi wokuhambisa esikhundleni sokuthembela ekudaleni komzila okungase kwenziwe umphathi.

Izimpawu, amathebula nokumbesa kozakwabo

Izimpawu ziyingxenye yamagama eyabiwe, ngakho kokubili inani nesembozo kufanele kuvumelane nakho konke okunye okuzisebenzisayo. Umthetho othumela ithrafikhi emakwe ukuya kwithebula elikhethekile udinga umphumela ocacisiwe lapho lelo thebula lingenawo umzila ofanayo, ngoba ukusesha okungenayo impendulo kungaqhubeka kumthetho olandelayo futhi kukhiphe iphakethe ngaphandle kwesixhumanisi somzimba. Umzila ozenzakalelayo we-blackhole ngaphakathi kwethebula elikhethekile uguqula lokho kubaleka buthule kube ukulahla okubonakalayo. Into umklamo ongakwazi ukuyenza ukuthi uvale lapho kwehluleka kwindawo engakaze ingene kusethi.

Amaphakethe angaphandle omhubhe uqobo kufanele abalekele isihlukanisi. Amathuluzi e-WireGuard anikeza uphawu lwesokhethi ngenjongo yalokho, futhi ukulusebenzisa kuvimbela ukufakwa embozwe ukuthi kuhambiswe emuva kusixhumanisi esisakhiwayo.

Hlola impilo ngayinye ngokwehlukana

Izinqolobane ezintathu ziguga ngezinhlelo ezintathu: inqolobane yesixazululi, izici zesethi kanye nokuxhumana okulandelelwayo. Zihlole ngokulandelelana kanye futhi ubheke ukuthi ngayinye iyanyakaza lapho kufanele. Imiyalo engezansi ifunda isixazululi, isethi, ithebula lokuxhumana kanye nemithetho yomgomo ngaphandle kokushintsha lutho.

dig +short office.example
nft list set inet vpn_select office_v4
conntrack -L -d 10.60.8.15
ip rule show

Ukusesha okusha okwengeza isici kufakazela ukuthi ukuphakela kuyasebenza, kanti isici esidala esiphila isikhathi eside kunempendulo yaso ukungafani kwempilo okufanele kubhalwe phansi. Ukuxhumana okusha okuvela kwithebula lokuxhumana nophawu olulindelekile kubonisa ukuthi isihlukanisi sagijima, futhi ukuxhumana okudala okugcina uphawu lwako lokuqala kuyindlela elungile hhayi iphutha. Uhlu lwemithetho luphendula ukuthi ukusesha komgomo kukhona noma cha, okungumbuzo ohlukile kulo wokuthi kufanile. Funda okukhiphayo okune ngokulandelelana kanye futhi ukudluliswa okuhlulekile kuyozidalula.

Lapho isidingo sikhona sokuthi igama elithile lihlale lisebenzisa indlela eyodwa, isethi ephakelwa yi-DNS ayikwazi ukukufakazela, ngoba amakheli abiwe nawo athwala amanye amagama. I-proxy noma indlela esezingeni lohlelo iyithuluzi laleso siqinisekiso.