Uhlelo olulodwa nge-WireGuard: ukubopha akulona ukuqondisa

Isilungiselelo sibonakala njengokushintsha kwesicelo ngasinye, ngakho abantu babopha iklayenti kusixhumi esibonakalayo se-WireGuard futhi balindele ukuthi yilolo klayenti kuphela elizosebenzisa umhubhe. Lokho ukubopha okukwenzayo ngempela ukukhetha ikheli lomthombo. Ikherneli bese ithola umzila wendawo ekuyiwa kuyo, ithole umzila ojwayelekile ozenzakalelayo futhi ithumele iphakethe ngokuxhumana komzimba nekhasi lekholelo lomhubhe linanyathelisiwe. Umzila okhethwe lowo mthombo kuphela ogcwalisa inhloso.

Le ndlela inezingxenye ezimbili: ithebula lokuhambisa umzila okufanele lisetshenziswe ukugcwala komhubhe kuphela, kanye nomthetho odlulisela umthombo ohambisanayo lapho.

Ukubopha kumisa ikheli lomthombo, akukho okunye

I-Linux ikhetha isixhumi sokuphuma ngokufuna indawo ekuyiwa kuyo ethebuleni lokuhambisa umzila, ngemva kokuba imithetho yenqubomgomo ithole ithuba lokuqondisa lokho kufuna kwenye indawo. Imithetho ingakhetha ngekheli lomthombo, uphawu lwe-firewall, isixhumi esingenayo, i-UID noma ngisho imbobo; ngayinye iyindlela enye yokuthi lokhu kugcwala hhayi konke. Ukuhlelwa kweklayenti le-VPN kukhetha ithebula elinemizila yomhubhe; umthetho ukhetha ukuthi yikuphi ukugcwala okuvunyelwe ukubheka kulo. Ukubopha kuphela akunikezi kokubili.

Yingakho lokhu kwehluleka kubonakala kuxakile. Uhlelo lusebenzisa ikheli lomhubhe ngokuqinisekile, umhubhe uyasebenza ngokuqinisekile, futhi ukugcwala kuphuma ngesixhumi esingalungile ngokuqinisekile. Isitatimende ngasinye siyiqiniso, futhi ndawonye sichaza uhlelo lapho kungekho lutho oluxhumanisa ikheli nomzila.

Nikeza umhubhe ithebula lawo

I-wg-quick ifaka imizila lapho iphrofayili ikusho khona. Ukwengeza Table = 40 ngaphansi kwe-[Interface] kuyihambisa iye kuthebula 40 esikhundleni sethebula eliyinhloko. Phakamisa isixhumi bese uqinisekisa ukuthi zifike: ip -4 route ls table 40 kufanele ikhombise imizila yomhubhe, futhi ip -4 route get 10.66.127.142 ikhombisa indlela ikherneli exazulula ngayo enye yayo manje. Uma imizila isethebuleni layo, ithebula eliyinhloko liyaqhubeka lisebenza kukho konke okunye.

Yenza okufanayo nge-IPv6 esikhundleni sokufanisa isiqalo esibanzi. ip -6 rule add from fd00::2/128 lookup 40 ibophela ikheli elilodwa; fc00::/8 ingashayisana nezinye izixhumi kusibungu futhi ikhiqize umthetho ofana nokuningi kunalokho obekuhloswe.

Engeza umthetho womthombo bese ubheka izibali

Bese uxhuma izingxenye ezimbili: ip -4 rule add from 10.66.127.142/32 lookup 40, nekhasi elifanayo linanyathelisiwe kusixhumi se-WireGuard. Faka imithetho yomibili ku-PostUp ukuze ukuxhuma kabusha kubuyisele yona. Qinisekisa ngesicelo sangempela hhayi ngesilungiselelo: ip route get 1.1.1.1 from 10.66.127.142 kufanele isho idivayisi yomhubhe, futhi curl --interface wg0 ifconfig.me kufanele ibike ikheli lomhubhe hhayi elasekhaya.

Uma kusahluleka, funda i-ip -s rule. Umthetho okhona kodwa ongakaze ufanise ukhombisa izibali eziyiziro, futhi lokho kuhlukanisa umthetho ongalungile nokungabikho komthetho nhlobo. Lowo myalo owodwa wonga ukuqagela okuningi mayelana nokuthi uhlelo lwalunganaki isilungiselelo saso sesixhumi.

Icala eliphambene: gcina i-SSH ngaphandle komhubhe

Inkinga ephambene ivamile ngokufanayo: i-wg-quick ingumnikazi womzila ozenzakalelayo futhi iseshini ye-SSH eya kuseva iyafa phakathi nendawo. Imithetho yayo ihlezi kunombolo ephansi yokubaluleka, ngakho ukuhluka kufanele kuhlolwe ngaphambi kwayo. I-ip rule add dport 22 ipproto tcp table main priority 123 yenza lokho ku-iproute2 yakamuva; lapho isikhethi singatholakali, maka ukugeleza ku-nftables bese ufanisa uphawu.

Hlola nomzila wimpendulo. Iseshini ye-SSH esungulayo bese ithula ivamise ukuba nokuhambisa umzila okungalingani: uhlangothi olulodwa luphuma ngomhubhe olunye ngokusixhumi somzimba. I-ip route get yekheli leseva ikutshela ukuthi impendulo izakuya ngakuphi.

Bhala inombolo yethebula, umthetho womthombo nokuhluka kuphrofayili ngokwayo. Zontathu zingezokwakheka okukodwa futhi zizohlelwa ndawonye.