I-WireGuard enezelwe: igxathu eliphakathi nendawo alikwazi ukuphendula imbobo yalo
Lapho igxathu eliphakathi lithumela konke kumhubhe owodwa, izimpendulo enkonzweni yalo engenayo ziphuma ngendlela engalungile. Umthetho wombobo womthombo kusixhumi uyalungisa lokho.
Amagxathu amathathu e-WireGuard afinyelela kunethiwekhi engenakho ikheli lomphakathi, bese umshini ophakathi uyeka ukuphendula embotsheni obekufanele ulalele kuyo. Umhubhe wokuqhubeka usasebenza, isibungu esikude sisaphendula, futhi yiseva ephakathi yodwa ethule ngaphandle. Leyo nhlanganisela iyadida ngoba izibangelile yona: igxathu eliphakathi lilandela ithebula layo yomzila, futhi ithebula ithumela izimpendulo zayo ngendlela engalungile.
Iketanga elisebenza kuze kube yilapho ukhuluma nebhokisi eliphakathi
Thatha iketanga eliyisibonelo: iklayenti A lifinyelela kuseva B ku-UDP 500, futhi u-B uqhubeka kuya kuseva C ku-UDP 500. U-C wamukela ithrafikhi kuphela ekhelini lomlingani wakhe oyedwa, okumenza abe iqabunga futhi kugcine ukuziphatha kwakhe kulula. U-B akalona iqabunga, futhi konke okuthakazelisayo ngalolu kuphazamiseka kwenzeka lapho.
Lo mehluko ubalulekile ngoba izindima zeqabunga neziphakathi zidonsela ezinhlangothini eziphambene. Iqabunga lingathumela konke kumhubhe owodwa ngaphandle komphumela, ngoba akukho okunye okuncike kulo. Igxathu eliphakathi liyisiphetho sabaklayenti futhi liyiklayenti elibheke ohlangothini olukude ngasikhathi sinye, futhi leyo misebenzi emibili ifuna umzila ohlukile.
Kungani impendulo iphuma ngomhubhe
Ku-B, isixhumi esibheke ku-C siphethe AllowedIPs = 0.0.0.0/0 kanye nomzila ojwayelekile ohambisanayo. Ngakho-ke iphakethe ngalinye elenzelwe u-B lingena kulowo mhubhe, ngaphandle uma okuthile okuqondile kuthola ukubaluleka.
Iphakethe elivela ku-A elibhekiswe ku-B liyafika futhi lamukelwe, ngoba u-B uyindawo ekuyiwa kuyo futhi ukuhanjiswa kwasekhaya kwenzeka kuqala. Impendulo iyiphakethe elisha sha elenzelwe kulelo khaya futhi libhekiswe ekhelini lomphakathi lika-A, futhi leyo ndawo ihambisana nomzila ojwayelekile ongena kumhubhe. U-C uyalithola, akanalo lelo kheli, futhi uyalilahla.
Isibonakaliso sifundeka njengenkinga yodonga lomlilo noma ukungafani kokhiye, futhi akukho noma yikuphi okuyiqiniso lapha. Ukuthwebula kumhubhe obheke ku-C kubonisa ukuthi izimpendulo ziya endleleni engalungile. Lowo mbono owodwa ugcina isikhathi esiningi kunanoma yikuphi ukufunda kokucushwa, ngakho-ke kubhale phansi ngaphambi kokuthi uqale ukushintsha okhiye. Noma ngubani ongakubonanga ukuthwebula uzocabanga ukuthi umhubhe ngokwawo uphukile.
Ukulungisa okuncane: imithetho yenqubomgomo ehambisana nombobo womthombo
Izimpendulo ezivela kusokhethi elalele lika-B ziphuma ngombobo womthombo 500. Umthetho wenqubomgomo ungahambisana nalokho futhi ubuyisele lawo maphakethe kuithebula elijwayelekile:
ip rule add sport 500 table main priority 100
ip rule add sport 8080 table main priority 101Imithetho yenqubomgomo ibhekwa ngokulandelana kokubaluleka, futhi ithebula eliyinhloko lise-32766, ngakho-ke umthetho ku-100 uyabuzwa ngaphambi kokuba umzila ojwayelekile womhubhe ube nokuthi usho. Engeza okufakiwe okukodwa kumbobo ngamunye okufanele uhlale ufinyeleleka ngaphandle futhi akukho okunye, ukuze ithrafikhi edluliswayo iqhubeke isebenzisa umhubhe eyakhelwe wona.
Yazi umkhawulo wale qhinga. Isikhethi sport sihambisana namaphakethe enzelwe kulelo khaya, okuhlanganisa ngqo icala lempendulo futhi ngamabomu akuhlanganisi ithrafikhi u-B ayidlulisela komunye umuntu. Insizakalo esingathwe ngemuva kuka-B isadinga impendulo yayo, futhi ukwenza sengathi kungenjalo kukhiqiza ukulungisa okusebenza ensizakalweni yokuqala futhi kwehluleke kweyesibili.
Nika umthetho umnikazi
Umthetho othayiphiwe kusikhuthazo uyanyamalala ngokuzayo lapho isixhumi sakhiwa kabusha. Kusetho se-WireGuard, wubeke lapho isixhumi sikhiqizwa futhi sisuswa khona:
PostUp = ip rule add sport 500 table main priority 100
PostDown = ip rule del sport 500 table main priority 100Uma isixhumi siphethwe yi-NetworkManager, igwegwe lokusabalalisa noma indawo yokungena yesitsha, lezi zimbili zezomnikazi lowo hhayi zefayela elihlelwe ngesandla. Hlola imithetho esebenzayo ngemuva kokuxhuma kabusha, hhayi kuphela ngemuva kokuqala kokuqala, ngoba ukuqala kokuqala yicala elisebenza njalo.
Qhathanisa ezinye izindlela ngobuqotho
Umthetho wombobo womthombo ungenye yezindlela ezine zokuphuma, futhi uwona omncane kunazo zonke. Unezinzuzo zokungathinti inqubomgomo yomhubhe nhlobo, yingakho uvame ukusinda ezinguqukweni zakamuva. Ukulungisa okuncane nakho kwehluleka ngomsindo lapho kuyeka ukusebenza, kuyilapho ukukhishwa okubanzi kuqhubeka kusebenza buthule isikhathi eside ngemuva kokunyamalala kwesizathu sako. Lowo mehluko ubaluleke kakhulu kunobuhle lapho omunye umuntu engumnikazi webhokisi eminyakeni emibili.
| Approach | What it costs | Where it breaks |
|---|---|---|
| Source-port policy rule | One rule per exposed port | Anything B forwards rather than originates |
| Destination exception route | A route pinned to specific client addresses | Clients whose address changes |
| Stop full-tunnelling on B | Loses the catch-all path toward C | Designs that depend on it |
| Split into two tunnels | More interfaces and more policy | Nothing, at the cost of complexity |
Qinisekisa kuzo zombili iziphetho uma usukhethile. Kusuka ku-A, qala ukuxhumana nombobo ka-B futhi uyigcine imatasa isikhashana. Ku-B, yenza i-kernel ithethelele umzila wempendulo ngento efana ne-ip route get <address-of-A> sport 500, futhi uqinisekise ukuthi isho isixhumi se-WAN hhayi umhubhe. Ngemuva kwalokho, hlola ukuthi okuthile ngemuva kuka-C kusaphendula ngokwetanga, okufakazela ukuthi ukukhishwa kwahlala kukuncane esikhundleni sokuba indlela yokudlula. Ekugcineni, bhala imibobo kumanothi wokuklama, uma kungenjalo umsebenzi olandelayo uzokuthola lokhu futhi kwenye insizakalo.