Indlela yokuqondisa iwebhusayithi eyodwa ngaphandle komhubhe wakho we-WireGuard

Umzila owodwa we-/32 odlula esangweni le-LAN ugcina isayithi eyodwa ekuxhumekeni kwakho okuvamile, inqobo nje uma i-firewall ikuvumela futhi i-DNS ivumelana ngekheli.

Ukukhipha igama lomsingathi yinto umhubhe ongakwazi ukuyenza. Kodwa umzila ungadlulisa ikheli elilodwa ngaphandle komhubhe futhi uphume ngosango lwasekhaya, futhi lokho ngokuvamile kwanele isayithi eyodwa. Inkinga ukuthi konke okuphansi komzila kufanele kuvumelane: i-firewall kufanele ivumele iphakethe liphume, i-DNS kufanele ibuyisele ikheli olwaluqondisa, futhi isayithi kufanele iqhubeke isebenzisa lelo kheli. Uma noma yikuphi kwalokhu kuthathu kuphambuka, okukhethekile kuyeka ukusebenza ngaphandle kokuzazisa.

Funda ikheli lendawo oya kuyo ngaphambi kokuthinta umhubhe

Layisha isayithi kanye lapho umhubhe uvuliwe, bese ubheka ikheli lozakwethu isiphequluli esixhumeke kulo ngempela. Ku-Linux, ss -tunp kubala ikheli elikude lesokhethi ngayinye evuliwe, futhi dig +short egameni elifanayo libonisa lokho isixazululi esikubuyisile. Gcina zombili izinombolo phambi kwakho.

Izimpendulo ezimbili zivame ukungavumelani, futhi lokho kungavumelani yiyo yonke inkinga. Amasayithi amakhulu abeka inethiwekhi yokuqukethwe phambi komthombo wawo, ngakho ikheli isixazululi sakho esilibuyisela manje kungenzeka ukuthi akulona lelo isiphequluli esalisebenzisa emzuzwini odlule. Qondisa lokho okubonile kusokhethi, hhayi lokho umhlahlandlela omdala okubalayo. Uma izimpendulo ziqhubeka zizungeza phakathi kwezifunda, okukhethekile kwekheli iyithuluzi elingalungile kuleyo sayithi ethile.

Gijima usesho okwesibili kusuka kwenye inethiwekhi, futhi ubhale impendulo ye-IPv6 kanye neye-IPv4. Umhubhe othwala imindeni yomibili udinga okukhethekile kukho kokubili, uma kungenjalo isiphequluli siwela buthule emuva emzileni we-IPv6 ongakaze uyithinte. Bhala amakheli nosuku endaweni ozophinde uyibheke.

Beka umzila womsingathi oyedwa kuklayenti

Ake sithi isixhumi sibizwa nge-home-wg futhi irutha ye-LAN ise-192.168.1.1. I-NetworkManager ithatha umzila osango lwawo kuyirutha leyo futhi ubude besiqalo bawo buhlanganisa wonke amabhithi angu-32, futhi i-kernel iyikhetha ngoba isiqalo eside kakhulu siyawina.

nmcli connection modify home-wg +ipv4.routes "198.51.100.20/32 192.168.1.1"
nmcli connection up home-wg
ip route get 198.51.100.20

Isango kufanele lifinyeleleke ngaphandle komhubhe; ukuqondisa ukugxuma okulandelayo ekhelini lomhubhe kuphazamisa inhloso, ngoba iphakethe lizophinde lingene esixhumini osihlukanisa naso. Uma ukuxhumana sekuphakamile futhi, ip route get okukhethekile kufanele kuphrinte isango le-LAN, futhi umyalo ofanayo wesixazululi somphakathi kufanele usaphrinta idivayisi yomhubhe.

Iphrofayela ye-wg-quick ayinalo inkambu yemizila, ngakho okukhethekile okufanayo kuhlala emugqeni PostUp owengeza umzila womsingathi kuthebula eliyinhloko ngokuthatha isixhumi se-LAN njengedivayisi yawo. Yehlisa bese uphakamisa isixhumi ngemuva kokuhlela, ngoba isixhumi esisebenzayo asikaze sifunde kabusha ifayela laso. Imithetho ye-fwmark efakwa yi-wg-quick iqondisa kuphela amaphakethe ayo ahlanganisiwe, ngakho ithrafikhi evamile yesiphequluli isalandela ithebula eliyinhloko futhi ithola i-/32 yakho.

I-kill switch iyinto elandelayo eyivimbayo

Inqubomgomo ye-firewall evumela ithrafikhi kuphela kusixhumi somhubhe izokhipha okukhethekile ngisho nalapho umzila uqonde ngokuphelele. Funda imithetho engemuva kweswishi esikhundleni sokuthemba iswishi, ngoba leyo eqalisa i-kill switch ivame ukukhawulelwa egameni lesixhumi.

Okufunayo imvume emincane yesixhumi somzimba kanye naleyo ndawo eyodwa, ibekwe ngaphambi kokukhipha, kuyilapho inqubomgomo ezenzakalelayo ihlezi ingathintwanga. Ukumisa i-kill switch ngokuphelele kubonisa iphuzu, kodwa futhi kushiya umshini uvezekile isikhathi sonke uma ukhohlwa ukuwuvula futhi.

Hlola izinhlangothi zombili ngokwehlukana. Isicelo esiya ekhelini lokukhethekile kufanele siphumelele kuyilapho isicelo esiya kusayithi engahlobene sisaphuma ngomhubhe. Uma zombili ziphumelela kodwa eyesibili ibika ikheli lasekhaya, ukulandelana kwemithetho ye-firewall kungalungile, hhayi umzila.

I-DNS inquma ukuthi isiphequluli sishayela kuluphi ikheli

Lapho igama lixazululwa ngaphakathi komhubhe, isixazululi somhlinzeki singaphendula ngekheli elihlukile kunalelo elinikezwe elesifunda. Umzila wakho khona-ke usebenza ekhelini isiphequluli esingasoze sixhumane nalo, futhi ikhasi lilayishwa ngomhubhe sengathi akukho okushintshile. Lokhu kwehluleka kubonakala njengokukhethekile okuphukile ngisho nalapho ithebula lokuhamba lilungile.

Thumela imibuzo yalelo gama ngesixazululi sendawo futhi, noma weqa amagama ngokuphelele futhi uhlole ikheli ngqo. Ukuhlukanisa ikheli kuyilapho i-DNS isahlezi ngaphakathi komhubhe iwuhlelo oluseduze kodwa olungaphelele olujwayelekile kakhulu lwalolu lungiselelo, futhi futhi yilona olunzima kakhulu ukuqaphela, ngoba isayithi iyaqhubeka isebenza, hhayi ngendlela obuqonde ngayo.

Okukhethekile okufanayo kurutha, kanye, kudivayisi ngayinye

Uma umhubhe ugijima kurutha, umzila womsingathi ungaphansi kwethebula lokuhamba ngenqubomgomo lerutha futhi ukhomba esangweni le-WAN esikhundleni saleso se-LAN. Yonke idivayisi engemuva kwayo izuza okukhethekile, okuyinto ebalulekile kubhokisi lokusakaza noma ikhompyutha yomsebenzi ongeke ukwazi ukushintsha izilungiselelo zayo zenethiwekhi.

Shiya umhubhe njengomgwaqo wokuphuma ozenzakalelayo kuyo yonke enye iklayenti, bese uqinisekisa kusuka kumshini weklayenti hhayi kusuka kukhonsoli yerutha. Layisha isayithi yokukhethekile kanye nesayithi yesibili kuseshini efanayo yesiphequluli bese uqhathanisa amakheli okuphuma; uma eyesibili isabonisa umhubhe, ithebula lenqubomgomo lenza lokho okukucelile.

Bhala ikheli, usuku nesizathu emibhalweni yerutha. Okukhethekile okwakhiwe eduze kwekheli elizothutha kamuva kuba yiphutha okungekho muntu ongalichaza ngemuva konyaka, futhi ukulungisa kuhlala kubonakala njengempicabadala kuze kube umuntu uthola umbhalo omdala.

Izihloko ezihlobene