I-handshake iyasebenza, ikheli lilahlekile: izimo ezintathu ze-WireGuard
I-handshake entsha ikhombisa ukuthi i-peer iphendulile, hhayi ukuthi i-interface igcina ikheli layo noma ukuthi iphakethe elilandelayo lizothatha umzila ophezulu obekuhloswe.
I-WireGuard ingaba ne-handshake entsha futhi ingabi nekheli ngasikhathi sinye, futhi leso simo sihambisana, asiphikisani. I-handshake isigameko se-peer, ikheli lingele-interface, futhi umzila unquma ukuthi iphakethe liphuma ngowuphi umzila ophezulu. Izendlalelo ezintathu, abanikazi abathathu, futhi ngamunye angahluleka ngenkathi abanye ababili babonakala bephilile.
Ukuzifunda njengesimo esisodwa yikho okushintsha ukuxilongwa kwemizuzu emibili kube yintambama yonke yokuqalisa kabusha izinsizakalo.
I-handshake isigameko se-peer, hhayi isigameko sokunikeza ikheli
I-handshake ye-WireGuard ikhombisa ukuthi i-peer elungisiwe iphendule ngokhiye ovumelekile nokuthi okhiye besikhathi samanje basebenza. Ayisho lutho mayelana nekheli lendawo ku-interface, futhi ayisho nokuthi ngabe ukhona umzila okhomba lapho. Ikheli linikezwa isisizi noma umphathi wenethiwekhi, kanti ukulungiselelwa kweprotocol kumane kuqambe ama-peer nokhiye. Ukuhlanganisa lezi ezimbili yikho okwenza i-handshake ephilile ifundwe njengethimba elisebenzayo.
Yikho lokho okwenza i-wg show ikwazi ukubika i-handshake yamasekhondi ambalwa ku-interface engakwazi ukwamukela ngisho iphakethe elilodwa elivela kuhlelo.
Umphathi odala kabusha i-interface angalahla ikheli ngaphandle kokuthinta ukulungiselelwa kwe-peer, futhi i-handshake elandelayo iphumelela ngokushesha ngoba okhiye abakaze bashintshe. Umugqa wokubhalisa mayelana ne-handshake ephumelele uqondile futhi awuhlobene nokuhluleka.
| Observation | Which layer it belongs to | Wrong conclusion it invites |
|---|---|---|
| Handshake a few seconds old | Peer and keys | The tunnel is usable for application traffic |
Address present on wg0 | Interface configuration | Traffic actually egresses through it |
Route points at wg0 | Forwarding table | The outer packet uses the intended uplink |
Ikheli le-interface linomnini walo
Ikheli kudivayisi yethimba lingavela emugqeni we-Address wesisi, kusuka kuklayenti ye-DHCP esebenza ku-interface, noma kudemon yokuphatha eyidalayo ngesikhathi sokuxhuma. Noma yini eyiyo, leyo ngxenye ingumnini wekheli futhi izolibuyisela noma ingalibuyiseli ngokomqondo wayo. Ukufunda ikheli ngaphandle kokusho umnini walo kukushiya ngaphandle kwencazelo yokuthi kungani lanyamalala.
Abanikazi ababili ku-interface eyodwa yiphutha elijwayelekile. Ukuqalisa isisizi nomphathi wenethiwekhi wedeskithophu kudivayisi eyodwa kudala umncintiswano lapho omunye esusa lokho omunye asanda kukulungiselela, futhi iphoyinti lokugcina lilokhu liphendula ngaso sonke isikhathi.
Khetha umnikazi oyedwa bese uvumela elinye ithuluzi ukuthi libheke esikhundleni sokuphatha. Leso sinqumo sifanele sibhalwe phansi, ngoba uphawu luvela emasontweni kamuva futhi lubonakala njengokulahleka kwekheli okungahleliwe.
Umzila ukhetha umzila ophezulu, hhayi i-interface
Umzila wangaphakathi okhomba ku-wg0 unquma ukuthi ithrafikhi ingena ethimbeni. Isinqumo esihlukile sithumela amaphakethe angaphandle abethelwe ngokubhaliwe kuya ku-peer, futhi kusibambisi esinemizila ephezulu eminingi leso sinqumo sivela kuthebula lokudlulisa nemithetho yenqubomgomo. Ukuzulazula kwe-Wi-Fi kungashintsha indlela yangaphandle ngaphandle kokuthinta ikheli langaphakathi.
Ngakho-ke ithimba elisebenzayo ne-peer engafinyeleleki yizimo ezihambisanayo, kanjalo ne-peer elungile nomzila wangaphakathi ophukile. Ukubheka okuthathu kufanele kuthathwe ndawonye, ngasikhathi sinye, kungenjalo ukuqhathanisa akunantsingiselo.
Qhathanisa izimo ezintathu ngokuhamba okukodwa
Imiyalo emithathu yokufunda kuphela iphendula imibuzo emithathu ngokulandelana okuhlukanisa iphutha ngokushesha okukhulu. Yisebenzise ngaphandle kokushintsha lutho phakathi kwazo.
ip address show dev wg0
ip route get 10.80.0.1
wg show wg0 latest-handshakes transferEyokuqala ikhombisa ukuthi i-interface inekheli noma cha, eyesibili ikhombisa ukuthi iyiphi idivayisi indawo ethile engayisebenzisa manje. Eyesithathu ibika isikhathi se-handshake yokugcina nezibali zamabhayithi, futhi iyiyo kuphela kwezintathu echaza i-peer hhayi isibambisi sendawo.
Funda izibali kanye nesitembu sesikhathi. I-handshake evuselela njalo ngenkathi ukudlulisa kumile kusho ukuthi i-peer iyaphendula kodwa akukho okusizayo okudlulayo, lokhu kukhomba ekuhambiseni noma ku-ACL hhayi kokhiye. Isitembu sesikhathi esiyeka ukuqhubeka ngenkathi ikheli likhona sikhomba phezulu esikhundleni salokho. Kokubili ukufunda kuvela emugqeni ofanayo wokuphuma, futhi akukho okubonakalayo uma uhlola kuphela ukuthi i-handshake ikhona.
Lungisa isimo esithile esingalungile, bese uhlola kabusha uhlelo hhayi ithimba. I-handshake entsha iwubufakazi nge-peer, futhi ubufakazi nge-peer abusibufakazi bokuthi isicelo esilandelayo esivela kusiphequluli sakho sizothola ikheli, umzila nomzila ophezulu osebenzayo. incwadi ye-wg-quick isho ngokucacile ukuthi yikuphi kwalokhu okusethwa isisizi nokuthi yikuphi okungekweprotocol.