Ithumela le-WireGuard lasekhaya lidinga indlela yokubuya evela ku-LAN

Ukufinyelela ekhaya kuyisevisi eyodwa yangasese, hhayi umnyango wesibili we-inthanethi. I-WireGuard iphelela kumshini we-Linux ngemuva kweroutha, iroutha igcina umsebenzi wayo wamanje, futhi i-laptop ithumela kuphela isiqalo sasekhaya ngethumela. Iyiphi idivayisi edluliselayo futhi iyiphi ephelayo yisinqumo okulandela kuso wonke umthetho olandelayo. Uma wehluleka lokhu kwaba, uzobe ulungisa i-NAT obungazimisele ukuyengeza.

Nquma ukuthi ubani odluliselayo nokuthi ubani ophelayo

Iroutha inomngeci womphakathi: yamukela iphakethe le-UDP bese ilinikeza umsingathi we-Linux. Lowo msingathi unomsilaleli we-WireGuard nesinqumo sokudlulisela ku-LAN. Empeleni ukumephu kuthumela i-UDP 51820 ku-192.168.50.10, futhi imbobo yohlelo ngokwalo ihlala ivaliwe. Ukwehlukanisa izindima kugcina i-firewall imfishane.

Bhala uhlelo lwamakheli ngaphambi kokwakha i-interface. Iroutha 192.168.50.1, igethiweyi 192.168.50.10, isevisi 192.168.50.20, ithumela 10.77.0.0/24 ne-gethiweyi .1 ne-laptop .2. Ibanga lethumela akumele lihlangane nenethiwekhi i-laptop eseyifinyelela, ngaphandle kwalokho izindawo ziba nokungaqondakali. I-NAT yezinga lomhlinzeki noma iroutha ephezulu ingavimba ukufinyelela okungenayo, futhi akukho ukudluliswa kwembobo yasendaweni okukulungisayo.

Shintshanisa okhiye, bese ulinganisa i-AllowedIPs

Yakha ipheya lokhiye elihlukile ekugcineni ngakunye futhi hambisa kuphela okhiye bomphakathi ngomzila oqinisekisiwe. Umugqa we-peer kugethiweyi uvumela kuphela umthombo wethumela we-laptop, ngoba i-LAN yasekhaya ingemuva kwegethiweyi hhayi ngemuva kwe-laptop. Ukufaka i-LAN kulo mugqa kuchaza isakhiwo ongazange usakhe.

[Interface]
Address = 10.77.0.2/32
PrivateKey = LAPTOP_PRIVATE_KEY_BASE64

[Peer]
PublicKey = HOME_PUBLIC_KEY_BASE64
Endpoint = home-vpn.example.com:51820
AllowedIPs = 192.168.50.0/24, 10.77.0.1/32

I-AllowedIPs iyiqalo lasekhaya kanye nekheli lethumela legethiweyi, hhayi nhlobo i-0.0.0.0/0, ukuze ukuphequlula okuvamile kugcine indlela yasendaweni. Gcina umnikazi oyedwa wokuhlela, futhi ungaxhumanisi i-interface efanayo nomphathi wesibili wenethiwekhi.

Indlela yokubuya iyingxenye abantu abayeqayo

Lo mklamo ugcina umthombo we-10.77.0.2 we-laptop esikhundleni sokuwufihla njengegethiweyi, ngakho amadivayisi asekhaya kumele azi ukuthi aphendula kanjani. Engeza indlela emile kuroutha yasekhaya ye-10.77.0.0/24 ne-192.168.50.10 njengesinyathelo esilandelayo, futhi ufunde ukuthi i-wg-quick ikhipha ini ku-AllowedIPs esicelweni. Ngaphandle kwaleyo ndlela, ukuxhawulana okuqediwe kuhlangana nezimpendulo zohlelo ezingafiki.

Uma iroutha ingakwazi ukuthwala leyo ndlela, khetha umklamo wokubuya obhaliwe. Ukwengeza i-NAT buthule kushintsha umfuziselo womthombo owusanda kubhala.

Vumela isevisi eyodwa, hhayi i-subnet

Vula ukudluliswa kwe-IPv4 kugethiweyi futhi ugcine imisebenzi emithathu ye-firewall yehlukile: vumela umsilaleli we-WireGuard, dlulisela umthombo we-laptop ku-192.168.50.20 kuphela, futhi ushiye ingxenye esele yenethiwekhi yasekhaya ivaliwe kuleyo peer. Hlanganisa imithetho nomphathi we-firewall osevele usetshenziswa esikhundleni sokuwasusa. Indlela yeqalo lonke lasekhaya akuyona imvume yokusebenzisa yonke idivayisi engaphakathi.

Ukuqinisekiswa kohlelo ngokwalo ne-firewall yomsingathi kungumnyango ohlukile. Shono isevisi evunyelwa yiqoqo lemithetho, ukuze umbuyekezi olandelayo ayiqhathanise nomsebenzi ohlosiwe.

Hlola ngaphandle, bese ukhipha ngokuhlanzekile

Khuphula amaphrofayili ngomnikazi wawo, qinisekisa ukuxhawulana, bese usebenzisa uhlelo oluhloselwe kusukela kunethiwekhi yangaphandle evunyiwe futhi uhlole impendulo. Zama isevisi yasekhaya okumele ihlale yenqatshwa, ngoba umthetho ovumelayo awubonakali kuze kube khona okusebenzisayo. Nge-HTTPS sebenzisa igama elisencwadini yobufakazi futhi uvumele ukuqinisekiswa kusebenze; ukuthayipha ikheli elingacwebile nokudlula isexwayiso akufakazi lutho ngendlela. I-PersistentKeepalive iyazikhethela: isiza i-peer eboshwe ku-NAT ngemuva kwesikhathi sokungenzi, kodwa akuyona indlela engekho noma ukulungisa imvume.

Ikheli lomphakathi eliguqukayo lidinga izibuyekezo ze-DNS, futhi i-laptop kumele ixazulule kabusha iphoyinti layo lokugcina ngemuva koshintsho; amarekhodi amasha e-DNS awasusi iphoyinti lokugcela elilungisiwe. Khipha i-laptop ngokususa i-peer yayo kukho kokubili ukuhlela okugciniwe nokokusebenzayo; ukususa iphrofayili ye-laptop kuphela akuhoxisi ugunyazo lwegethiweyi.