Indlela yokunikeza i-LAN eyodwa yokuhlola umgudu wayo wokuphuma we-WireGuard

Amadizayini amathathu axazulula inkinga efanayo yaselabhorethri: i-LAN encane kufanele iphume ngomlingani we-WireGuard ngenkathi isango ngokwalo ligcina ukuxhumana kwalo okujwayelekile okuphezulu. Indlela emfushane ekhangayo ukuhambisa umzila ojwayelekile womqondisi bangene emhubheni, kodwa lokho kwephula indlela yokuphatha yebhokisi ngokwalo nakho konke okunye elikudlulisayo. Inketho ethakazelisayo ukuhlinzeka ngomzila ngokwenqubomgomo okulinganiselwe ku-interface eyodwa nesiqalo esisodwa. Khetha phakathi kwazo ngokuphendula imibuzo emithathu mayelana nomshini onawo ngempela.

Nquma ukuthi umgudu wokuphuma uhlala kuphi

Umbuzo wokuqala: ingabe le ndawo yokusingatha idlulisela enye into? Isango laselabhorethri elizinikezelwe lingaphila ngenqubomgomo yokudlulisela elahla konke ngokuzenzakalelayo. Umqondisi onemisebenzi yokukhiqiza awukwazi, futhi ukubeka isethi yemithetho yezimbangi phezu kodonga lomlilo olawulwayo yiyo kanye indlela okuhlelwa ngayo ukuphazamiseka. Okwesibili: ingabe ungaba nezinto ezimbili zenqubomgomo nokuhleleka kwazo phakathi kokuqalisa kabusha? Okwesithathu: ingabe umlingani onawo ugunyaza ikheli lomthombo womhubhe wakho futhi unikeza umgudu wokuphuma kwi-inthanethi? Umlingani oveza kuphela inethiwekhi yangasese ungomunye umkhiqizo, futhi akukho shintsho lwasekhaya lomzila olulungisa lokho. Uma noma iyiphi impendulo ingu-cha, beka umgudu wokuphuma endaweni yamagama noma emshinini ongabonakali osebenziseka kanye.

Indawo yamagama noma i-VM idla imemori futhi ikunikeza indawo ehlanzekile yokuqhuma. Ukuhlinzeka ngomzila ngokwenqubomgomo kudla imithetho emibili futhi kukushiya nebhokisi elilodwa ozolilungisa.

Khetha umgudu wokuphuma ogunyaza umthombo wakho

Iningi lokwehluleka kule labhorethri kwenzeka ngaphambi kokuba kube khona ngisho umthetho owodwa wodonga lomlilo. Umqhubi womgudu wokuphuma kufanele amukele ikheli lomthombo elithwalwa amaphakethe akho ngemuva kokuhunyushwa, futhi kulo mdwebo lokho yikheli lomhubhe hhayi isiqalo se-LAN. Yingakho ukufihla kuyingxenye yomdwebo kusukela ekuqaleni hhayi isengezo sakamuva.

Qinisekisa izinto ezintathu nomqhubi: umlingani ugunyaza ikheli lomhubhe wakho, udlulisela i-IPv4 esikhundleni sokuqeda kuye, futhi usebenzisa i-NAT yokuphuma. Ngaphandle kokuqala amaphakethe akho ayafika abese enyamalala. Ngaphandle kwesithathu aphuma nomthombo wangasese futhi afe ekunyatheleni okulandelayo. Bese uhlola ukuthi i-wg-quick ayifaki umzila wayo ojwayelekile, okuvimbwa yi-Table = off; leso silungiselelo sicindezela ukwakhiwa kwemizila, hhayi izihlolo ze-AllowedIPs zomlingani noma ukuphatha kwayo i-DNS.

Izinto ezimbili zenqubomgomo zenza ukuqondisa

Ukuqondisa kudinga ithebula nomthetho. Ithebula ligcina imizila emibili: isiqalo se-LAN esiphuma ku-interface ye-LAN nomzila ojwayelekile ophuma emhubheni. Umthetho uthumela ithrafikhi efika ku-interface ye-LAN futhi ethwala leso siqalo iye ethebuleni. Sebenzisa isikhethi se-iif kanye nokufana komthombo, ngoba amaphakethe e-WireGuard esango ngokwalo avela endaweni futhi awasoze afane ne-interface engenayo.

Unogada uza ngaphambi kokusesha, hhayi ngemuva. Lokho kuhleleka yiyo yonke impahla yokuphepha yomdwebo.

Unogada uwumthetho wesibili kuleso sikhethi okusizwa yiwona ukuthi unreachable. Mnikeze ukubaluleka kwenombolo ephezulu ukuze ukusesha kunqobe ngenkathi umhubhe uphakeme. Lapho umzila womhubhe unyamalala, ukusesha akubuyiseli lutho futhi unogada umisa ukusesha esikhundleni sokukuyeka kwehlule kuya kumzila ojwayelekile we-WAN ethebuleni eliyinhloko.

ip rule add from 192.168.50.0/24 iif lan0 lookup 51861 pref 1000
ip rule add from 192.168.50.0/24 iif lan0 unreachable pref 1001
ip route add table 51861 default dev wg0

Vala igebe lokuhlehla ngaphambi kokulivula

Faka unogada kuqala bese kuba ukusesha. Ukwenza lokho ngokuphambene kushiya iwindi lemizuzwana lapho ithrafikhi yeklayenti lokuhlola ingafinyelela khona ekuxhumaneni okuphezulu.

Isihlungi siqedela isithombe. Ku-hook ye-forward yamukela uhlangothi olusuka ku-LAN luye emhubheni lwesiqalo sokuhlola kanye nohlangothi lokubuya olusunguliwe, bese ulahla konke okunye; i-NAT yaleso siqalo ku-interface yomhubhe ingena ku-postrouting. Ukushiya i-policy drop ochungechungeni lokudlulisela yikho okuguqula umzila ongekho kube ukuthula esikhundleni sokuvuza. Ukuhlunga komzila ophambene kudinga imodi exegayo ku-interface yomhubhe, ngoba umthombo womphakathi ofika usuvuliwe unomzila wawo ophambene ongcono kakhulu ohlangothini lwe-WAN. I-Linux ithatha eliphakeme phakathi kwenani le-all nelokwe-interface ngayinye, ngakho ukusetha i-interface yomhubhe akufani nokwenza buthaka ukuqinisekisa yonke indawo.

Kufakazele ngesimo sokwehluleka

Buza i-kernel umbuzo onembile ngokusho ikheli lomthombo weklayenti kanye ne-interface elingena kuyo. Ukusesha ngaphandle kwakho kokubili kuphendula omunye umbuzo futhi kuzobonakala kulungile kuzo zombili izimo. Bese ubheka izibali zodonga lomlilo, isimo sokudlulisela somlingani kanye nensiza yeklayenti ngokwalo.

Hlola ukususwa ngendlela efanele. Misa umhubhe ushiya umthetho nesihlungi endaweni yazo: iklayenti kufanele lime futhi ithrafikhi yesango ngokwalo kufanele iqhubeke isebenza. Bese umisa umlingani ngaphandle kokuthinta i-interface yasendaweni, futhi yiso leso simo esibamba imidwebo encike kuphela ekubeni khona komzila. Ekugcineni qalisa kabusha futhi uhlole ukuhleleka kwemithetho futhi, ngoba i-hook yokuhlakaza esusa unogada ibuyisela wonke umdwebo ethebuleni eliyinhloko. Bhala inombolo yethebula, ukubaluleka namagama e-interface kutikithi yoshintsho, ngoba umuntu olandelayo ozofaka umthetho uyena ozokwephula lokhu.