Ukuqala kokuqala: ukubhaliswa kweqembu lamadivayisi e-WireGuard

Ibhodhi iqala kusithombe esivamile, ithola isivumelwano se-DHCP, futhi umbhalo wokulungiselela uyasebenza ngaphambi kokuba noma ubani athinte idivayisi. Endaweni ethile kulo mbhalo kufanele ithole ubunikazi be-WireGuard obungobale bhodi kuphela hhayi obunye, igunyaze lobo bunkazi, futhi ibhale iphrofayili ezokwamukelwa yisango. Isithombe singathwala isofthiwe yeklayenti, ithempulethi ebuyekeziwe kanye nokhiye womphakathi wesango. Engakufanele neze ikuthwale ukhiye oyedwa wangasese owabiwe yiqembu lonke, ngoba lokho kwenza ibhodhi elilodwa elintshiwe libe yisigameko seqembu lonke. Ukulandelana ngezansi kugcina ubunikazi bungowasekhaya futhi ukugunyaza kucacile.

Isithombe sithwalani, futhi asithwali ini

Thumela iphakethe, ithempulethi enezikhala zokugcwalisa, ukhiye womphakathi wesango kanye neklayenti lokubhalisa. Ithempulethi iwukuma, akuyona imfihlo: kufanele ifundeke kumsebenzisi wokulungiselela futhi ingabi nayo impahla yokhiye.

Ukhiye wangasese udalwa kudivayisi ekuqaleni kokuqala futhi awuyi kuyishiye neze. Kuhamba ingxenye yomphakathi kuphela, ngaphakathi kwesicelo sokubhalisa esigunyazwa ngento engeyona isimangalo sedivayisi uqobo mayelana nokuthi ungubani. Lowo mehluko uwona ovimbela ibhodhi elintshiwe ukuba libe inkinga yeqembu lonke. Futhi iyona ngxenye amabhodi okubhala okuqala amaningi ayenza ngokungalungile.

Isinyathelo 1: dala ukhiye endaweni

Sebenzisa ukudalwa kusikhombisi esivikelwe ngemva kokuba ukuxhumana kwenethiwekhi okuyisisekelo kugunyaziwe futhi kusebenza. I-subshell igcina ushintsho lwe-umask luyindawo kulo msebenzi, futhi i-set -C iyenqaba ukubhala phezu kwefayela elikhona:

(
    umask 077
    set -C
    wg genkey > /etc/wireguard/device.key &&
        wg pubkey < /etc/wireguard/device.key > /etc/wireguard/device.pub
)

Ukuqala okusheshayo kwe-WireGuard kubhala ubudlelwano bokudalwa kokhiye okuncike kukho le mitheshwana emibili. Uma ukudalwa kuphazamiseka, shiya idivayisi ingabhalisiwe futhi uvumele ukugeleza komsebenzi ukuthi kuhlanganise amafayela. Ungasusi ubunikazi obukhona nje ukuze umbhalo usebenze uhlanzekile kusukela ekuqaleni.

Gcina ukhiye olindile phakathi kwemizamo emisha. Ukudala kabusha ubunikazi ngemva kokwehluleka kwenethiwekhi kwesikhashana ngakunye iyona ndlela iqembu eligcina ngayo ama-peer ayizintandane okungekho muntu ongawafanisa nedivayisi.

Isinyathelo 2: gunyaza irekhodi ledivayisi

Ake sithi uhlu lwempahla lubiza le bhodhi ngokuthi device-042 futhi lunikeza i-10.90.0.42/32. Insizakalo yokubhalisa kufanele iqinisekise ukuthi lona ofaka isicelo unelungelo lalelo rekhodi. Inombolo yokulandelana ebhalwe efomini ayibona ubufakazi, ngoba izinombolo zokulandelana zinyatheliswa ngaphandle kwebhokisi.

Ubuqiniso bokuqala bedivayisi ngayinye, ukugunyazwa komsebenzi, noma ubufakazi obusekelwa yi-hardware kungasungula isimangalo. Vikela ubuqotho besicelo kanye nobuqiniso bempendulo, futhi ungafaki ubufakazi bendawonye bokwenziwa esikhundleni semfihlo eyodwa yabiwe ye-VPN.

Irekhodi eligciniwe libopha idivayisi, ukhiye wayo womphakathi, ikheli eliyabelwe kanye nendima yokuphatha evunyelwe. I-WireGuard uqobo ayichazi i-API yokubhalisa, ngakho leyo nsizakalo iyinto oyakhayo futhi oyisebenzisayo ngamabomu.

Isinyathelo 3: bhala izilungiselelo ezimbili ezihambisanayo

Idivayisi idinga iphrofayili ehambisa iziqalo zokuphatha kungene ku-tunnel, futhi isango lidinga irekhodi le-peer elivumela kuphela ikheli lomthombo lale divayisi uqobo. Uma isango liku-10.90.0.1 futhi inethiwekhi yokuphatha iyi-10.60.0.0/16, uhlangothi lwedivayisi lubukeka kanje:

[Interface]
PrivateKey = <device-042 private key>
Address = 10.90.0.42/32

[Peer]
PublicKey = <trusted gateway public key>
Endpoint = vpn.example.com:51820
AllowedIPs = 10.90.0.1/32, 10.60.0.0/16
PersistentKeepalive = 25

Amanani angaphakathi kwabakaki ayizikhala zokugcwalisa, akuwona okhiye. I-keepalive ibalulekile uma ibhodhi lingemuva kwe-NAT futhi kufanele lihlale lifinyeleleka; ayidingeki kuyo yonke indawo, futhi ukuyengeza ngomkhuba kugcina umsakazo uphaphathekile ngaphandle kwesizathu.

Esangweni, irekhodi le-peer lincane ngamabomu:

[Peer]
PublicKey = <device-042 public key>
AllowedIPs = 10.90.0.42/32

Ungakopishi uhlu lwezindawo zedivayisi ku-peer yesango. Kudivayisi lolo hlu lusho ukuthi yini okufanele ihambiswe ku-tunnel; esangweni lusho ukuthi yimaphi amakheli omthombo le peer engawasebenzisa, futhi lezo ziyizitatimende ezihlukene.

Ukudlulisela, imithetho yodonga lomlilo kanye nendlela yokubuyela kunethiwekhi yokuphatha kusamele kuvumele ukufinyelela okugunyaziwe. I-peer ebhalisiwe akuyona imvume yayo yonke inhlelo ezungezile.

Isinyathelo 4: qinisekisa ukubhaliswa njengesimo somjikelezo wempilo

Sebenzisa irekhodi lesango kanye nephrofayili yedivayisi ngalowo ongumnikazi wesilungiselelo ngasinye, bese umaka ukubhaliswa njengokuqediwe kuphela lapho ubunikazi nekheli okuhlosiwe kwamukelwa. Imizamo emisha kufanele ihambisane nalelo rekhodi elilodwa esikhundleni sokwaba i-peer yesibili noma ikheli lesibili.

Gcina indlela yokubuyisela yokulungiselela okuphazamisiwe, kufaka phakathi isimo lapho isango lamukele ukhiye futhi idivayisi yayingakaze ibhale iphrofayili yayo.

Uma ibhodhi lishintshwa noma lihoxiswa, susa ukhiye walo womphakathi kanye nokugunyazwa kwalo ndawonye. Ukhiye omusha uyisigameko sokubhalisa kabusha ngamabomu, akusona umphumela we-reimage. Ukulandelana komsebenzi: dala endaweni, gunyaza ngokuhambisana nohlu lwempahla, bhala izinhlangothi zombili, qinisekisa isimo, bese uhlola isicelo esisodwa sokuphatha nge-tunnel.