IPIP ngaphakathi kwe-WireGuard: lawo ma-byte angu-20 engeziwe okungekho muntu owawafaka kwisabelomali

Ama-ping amancane anqamula i-tunnel usuku lonke, i-banner ye-SSH iyafika, bese kuthi iseshini ibambe ngesikhathi lapho ukudluliswa kwefayela kuqala. Leli phethini likhomba isabelomali sama-byte esibalwe esigabeni esingalungile, lapho i-tunnel yangaphandle yalinganiswa khona ngendleko yayo, futhi akekho owakhipha eyangaphakathi. Iphakethe le-IPIP elifakiwe lingelinye iphakethe le-IP kwi-WireGuard, yingakho lidla ama-byte ongakaze uwabeke eceleni. Ukulungiswa kuyizibalo, futhi kungena emiyalweni emithathu nethebula elilodwa.

Isibonakaliso esiveza lokho

Inkinga yokuhlukaniswa iziveza ngosayizi, hhayi ngezikhathi ngamakheli. I-peer yakho iphendula i-ping yama-byte angu-56 ihora lonke bese ithula kuma-byte angu-1400 ngenkathi i-tunnel isahamba futhi kungekho mzila oshintshile. I-handshake ingena, iwindi lokuqala eligcwele le-TCP alingeni, futhi ukudluliswa kuyama amasekhondi ngemuva kokubonakala kuphilile.

Linganisa uphahla ngaphambi kokuhlela noma yini, ngoba uphahla olungalinganiswanga yilolo ozolixosha kabili. Thumela i-probe eyodwa ngaphansi kosayizi okusolwayo nge-bit ye-do-not-fragment isethiwe, ping -M do -s 1000 10.9.0.2, bese uyiphinda ngosayizi owaziyo kakade ukuthi mkhulu kakhulu. Lapho ukuphenduka kulandela usayizi womthwalo ngenkathi indawo ekuyiwa kuyo ingashintshi, ukuhlela amamaki kwenza umsebenzi wako futhi kunekhanda elilodwa elingekho kwisabelomali.

Bala ikhanda ngalinye kanye, esigabeni esifanele

Qala kwi-MTU encane kakhulu emzileni hhayi ku-interface ye-tunnel, ngoba udonga lungaphezu kwazo zombili iziphetho. I-WireGuard isebenzisa ama-byte angu-60 ekuthuthweni kwangaphandle kwe-IPv4: angu-20 e-IP, angu-8 e-UDP nangu-32 ekhanda layo, nama-byte angu-80 lapho lokho kuthutha kuyi-IPv6. I-wg0 yama-byte angu-1420 igcina ama-byte angu-20 ensalela ngaphansi kwangu-1440 umzila wama-byte angu-1500 ongawaletha ngempela, yingakho inombolo ekopishwe ku-wiki isafaneleka lapha. Dweba yonke i-stack kumdwebo, ngoba ozoshintsha i-MTU ngokulandelayo uzokhetha inombolo entsha eyindilinga futhi izuze ifa iphutha lakho.

Umugqa wesihlanu yindawo lapho isabelomali sihamba kabi khona, ngoba ama-byte angu-1400 athwalwa i-interface efakiwe asevele ahlanganisa ama-byte angu-40 ekhanda lephakethe lokuqala. Ama-byte angu-1360 kuphela awo afinyelela kunqubo efunda ifayela. Thatha u-1400 njengomthwalo wohlelo lokusebenza, njengoba noma yimuphi umdwebo ongenalo ikholomu ukumema, futhi idivayisi yangaphakathi igcina ingu-40 ama-byte anomusa kakhulu phambi kodonga olungashukumi.

Setha ama-MTU amabili ngokwahlukana

Umthwali nedivayisi efakiwe kuyizinto ezihlukene, ngakho ngayinye idinga inani layo. Zisebenzise ngalolu hlelo, ngoba idivayisi efakiwe ayizuzi lutho kumthwali:

ip link set wg0 mtu 1420
ip tunnel add ipip0 mode ipip remote 203.0.113.9 local 198.51.100.4
ip link set ipip0 mtu 1400

Umthetho okufanele ukhunjulwe: i-MTU yangaphakathi = i-MTU yangaphandle - 20 lapho iphakethe elithwalwa i-tunnel ye-IPIP liyi-IPv4, futhi - 40 ngokushesha lapho noma yiluphi uhlangothi lwephakethe langaphakathi luyi-IPv6, ngoba ikhanda elifakiwe likhula lisuka kuma-byte angu-20 liye kwangu-40. Akukho okunye okungena kulokho kukhipha. Izindleko ze-WireGuard zase zisetshenzisiwe ngesikhathi ukhetha u-1420, futhi ukuzikhokhisa kabili kwenza i-tunnel esebenza kahle futhi ehlala inensayo uma nje kungekho odlingiwe. Ukusetshenziswa lapho womabili amadivayisi athwala u-1400 oyindilinga yisigxivizo somunwe salelo phutha.

I-IPv6 kunoma yiluphi uhlangothi lwephakethe elifakiwe yenza wonke amanani angenhla angasebenzi, ngakho bala kabusha esikhundleni sokukopisha inombolo kusayithi elifanayo. Amakhanda akhishiwe angama-byte angu-40 ngalinye ngokushesha lapho i-IPv6 ivela emzileni wangaphandle noma kudathagramu lokuqala, futhi inombolo yomthwalo yehla ncamashi ngalokho.

Umthetho we-firewall okungenzeka awuwudingi

Phakathi kwama-peer amabili e-WireGuard into kuphela esemgqeni yi-UDP, ngakho umthetho wokungena wephrothokholi 4, inombolo i-RFC 2003 eyinikeza ukufakwa kwe-IPv4-ngaphakathi-kwe-IPv4, awukhi umzila ofakiwe futhi awuwugcini uphila. Ikhanda le-IPIP lihlala ngaphakathi komthwalo obethelwe, lapho ingekho i-firewall yomkhawulo eyilibonayo. Ukuvula iphrothokholi 4 noma kunjalo akuthengi lutho ngaphandle komunye umzila ovunyelwe wokungena kusibungu.

Inqubomgomo ekhuluma ngemithombo neziqondiso zephakethe lokuqala ingeyangemva kokukhishwa, kuma-interface e-tunnel nasekuthebuleni kokuhlela. Yibeke lapho futhi umthetho womkhawulo ungahlala uvaliwe.

Lokho i-WireGuard eqinisekisa ngempela

AllowedIPs ihlulela umthombo wephakethe elithwalwa i-WireGuard, futhi lokho elikuthwalayo iphakethe elifakwe nge-IPIP. Umthombo we-IPIP ovunyelwe wamukelwa ngisho lapho ikhanda langaphakathi lisho isibungu ongathandi ukulihlela. Ngakho umthombo wokuqala akusilo lokho i-peer ekuhlolele khona, futhi lelo pheshana lamakheli angaphakathi lidinga ukuphoqelelwa kwalo ngemva kokukhishwa.

Isembozo sinikeza isakhiwo sokuhlela, hhayi ungqimba lwesibili lwe-cryptography. Ukubiza i-IPIP ngokuthi ukuvikelwa okwengeziwe ngaphakathi kwe-WireGuard kuchaza umklamo ohlukile.

Qinisekisa ngesitebhisi, hhayi nge-ping eyodwa

Hlola osayizi abazungeza umngcele owubalile, bese uqinisekisa ukuthi i-kernel icabangani ngamadivayisi womabili. Lapho ama-byte angu-1360 omthwalo kanye nama-byte angu-40 ekhanda enza u-1400, i-echo yokuqala engezansi ingena futhi eyesibili ihla nge-byte eyodwa ngaphesheya kophahla:

ping -M do -s 1372 10.9.0.2
ping -M do -s 1373 10.9.0.2
wg show wg0
ip -d link show ipip0

Ukudlula okuhlanzekile ngaphansi kophahla nokwehluleka kosayizi wokuqala ongaphezulu kusho ukuthi izibalo ziyabamba kusukela ekuqaleni kuze kube sekugcineni. Bese uphinda ugijime ukudluliswa okwama ekuqaleni, ngoba i-probe yokwenziwa iqinisekisa isabelomali futhi ayisho lutho ngosayizi wokubhala wombhali ngokwakhe. Uma umzila ofakiwe usaphuka kosayizi okuqinisekise ukuthi uyangena, hlola ukukhishwa nokuhlela kweziphetho ezikude ngaphambi kokusika amanye ama-byte ayishumi ku-MTU.