Funda ukulungiselelwa kwe-WireGuard umugqa ngomugqa, kusukela ku-Interface kuye ku-Peer

Iningi lezilungiselelo ze-WireGuard eziphukile ayenzi iphutha enanini; zibeka inani elifanele ohlangothini olungalungile. Ukhiye oyimfihlo ungowalo mshini, i-peer ithwala ukhiye osesidlangalaleni womunye umshini, futhi ikheli lihlala kubhlokhi ye-interface nakuba lichaza lapho umhubhe uhlala khona. Funda ifayela njengezindlela ezimbili ezihlangana, bese uhlola ukuthi iskripthi sosizo sengeze ini phezulu. Iphrothokholi ngokwayo inezinkambu ezimbalwa kunefayela, futhi ezengeziwe kufanele zaziwe ngokwehlukana.

Izinkinobho ze-interface zichaza lo mshini

Ibhlokhi ye-interface igcina ubunikazi baleli cihla uqobo. PrivateKey ingubona ubunikazi futhi ayilokothe ishiye umsingathi; ukhiye osesidlangalaleni ohambisanayo ukhishwa kuyo futhi yikho okuklelisiwe amanye ama-peer. ListenPort iyindawo lapho lolu hlangothi lwamukela khona ukuxhawulana, ngakho amaklayenti amabili ngemuva kwekheli elilodwa adinga amachweba ahlukene.

Address yikheli lomhubhe umsingathi ophendula kulo, ebhalwe ngobude besiqalo ngoba futhi ungumthombo ozosebenzisa. Iphutha lesiqalo lapha lishintsha ukuthi yiziphi izindawo umsingathi acabanga ukuthi zixhunywe ngqo, futhi lokho kukhiqiza ukwehluleka okubonakala njengokuhambisa indlela hhayi ukulungiselelwa.

Konke okunye ku-[Interface] bhlokhi eneklayenti langempela ngokuvamile kwengezwa yi-wg-quick: DNS, MTU, Table, nemigqa yokugxuma. Lezi akuzona izinkambu zephrothokholi, futhi wg ukulungiselelwa okungenalutho kuzishaya indiva ngokuphelele.

Ingxenye ngayinye ye-peer ichaza olunye uhlangothi

[Peer] ibhlokhi iwuhlangothi olukude. PublicKey ukhiye okhishiwe walolo hlangothi, akusilo ukhiye wabo oyimfihlo, futhi PresharedKey iyimfihlo eyengeziwe yokuzikhethela okufanele yomibili imikhakha iyigcine ifana. Endpoint yilapho kuthunyelwa khona, futhi PersistentKeepalive icela lo msingathi ukuthi athumele iphakethe ngemuva kwesikhawu lapho kungekho okunye okuphumayo.

Amaphutha amabili achaza iningi lokudideka lapha. Ukukopisha ukhiye wakho oyimfihlo kubhlokhi ye-peer kwenza iziphetho ezimbili zabelane ngobunikazi obubodwa, futhi ukuxhawulana kwehluleka ngendlela ebhalwa kabi kumarekhodi. Endpoint ukushiya ngaphandle kuklayenti ngokuvamile kwenziwa ngamabomu, ngoba iseva ifunda ikheli ekuxhawulaneni okungena; ukushiya ngaphandle kuseva okufanele iqale akusikho lokho. Khumbula futhi ukuthi i-keepalive igcina imephu ye-NAT ivulekile, futhi ayithuthukisi ukudluliswa noma yehlise ukubambezeleka, ngakho imizuzwana engamashumi amathathu yamaphakethe engeziwe ayithengi lutho lapho ithrafikhi isivele ihamba.

I-AllowedIPs iwukuhambisa indlela, hhayi uhlu lwezimvume

AllowedIPs iwukuhambisa indlela ngokhiye wokubethela we-WireGuard. Ngaphandle, inquma ukuthi iyiphi i-peer ethola iphakethe ngokusekelwe endaweni eya kuyo. Ngaphakathi, inquma ukuthi iphakethe elivela kuleyo peer lamukelwa yini ngokusekelwe emthonjeni walo. Inkambu efanayo yenza imisebenzi yomibili, yingakho kungeyona uhlu lokulawula ukufinyelela futhi kungeyona uhlu lwamawebhusayithi avunyelwe.

Encane AllowedIPs kuseva yeklayenti isho ukuthi iseva izamukela kuphela amaphakethe afaka isimangalo sale mithombo, futhi izothumela kuphela lezo zindawo kulelo klayenti. Khulisa uhlangothi olulodwa ngaphandle kokukhulisa olunye, futhi uthola umhubhe ophakamayo ongadlulisi lutho.

Yini i-wg-quick eyengeza ezungeze iphrothokholi

wg-quick ifunda ifayela elifanayo futhi yenza izinyathelo zenethiwekhi iphrothokholi ezishiya kusistimu yokusebenza. Yabela ikheli le-interface, yengeza imizila ekhishwe ku-AllowedIPs, ibhala izilungiselelo zesixazululi futhi isebenzisa imiyalo yokugxuma ngokulandelana.

Leso sendlalelo sichaza ukungafani kwendabuko. Ifayela eline-0.0.0.0/0 kanye nomugqa we-DNS linika iklayenti umzila wokuzenzakalela nesixazululi, futhi ayenzi lutho nhlobo emithethweni yokudlulisa noma ye-NAT yeseva. Leyo ingeyokulungiselelwa kweseva uqobo, futhi alikho ifayela leklayenti elinganikeza lokho.

Gcina umnikazi oyedwa wefayela. Ukulihlela ngesandla ngenkathi SaveConfig kunikwe amandla kusho ukuthi ukuhlela kwakho kuyanyamalala ngokulandelayo lapho i-interface yehla, futhi i-interface ngeke ikutshele ukuthi lokho kwenzekile.

Hlola isimo esisetshenzisiwe, hhayi ifayela

Ifayela liyinhloso. Isimo esisetshenzisiwe yikho okugcinwa yi-kernel, futhi kuyahlukana njalo lapho isisizi, i-drop-in noma igxuma kuhlele okuthile ngemuva kokuvula.

Funda isimo esibukhoma kanye nokwabiwa kwamakheli ndawonye, bese uqhathanisa kokubili nalokho okubhalile:

sudo wg show
ip -4 addr show dev wg0
ip -4 route show dev wg0
grep -v "^#" /etc/wireguard/wg0.conf

Uma uhlu lwama-peer lungenalutho, i-interface yadalwa ngaphandle kokusetshenziswa kokulungiselelwa kwayo. Uma amakheli nemizila ekhona kodwa izibali zihlala zingu-zero, ifayela lalayishwa futhi ukuxhawulana kwehluleka, okuyinkinga yokhiye noma yecibha hhayi yokulandelana kwezigaba. Qhathanisa izimo ezimbili ngaphambi kokuhlela, ngoba igebe phakathi kwazo ngokuvamile liyisiphambeko sangempela.