Indlela yokusebenzisa inqubo eyodwa ye-Linux ngaphandle komhubhe we-WireGuard

Awukwazi ukukhulula uhlelo kumsingathi we-WireGuard onomhubhe ogcwele ngokuhlela imizila. Imizila ikhetha indlela ngokwendawo ekuyiwa kuyo, futhi into ofuna ukuyikhulula inqubo, ngakho ikhreneli ayinalutho lokuluqhathanisa. Indlela esebenzayo ukunikeza leyo nqubo umongo wayo wenethiwekhi: isikhala samagama esinefeksi yaso, amakheli kanye nomzila ozenzakalelayo, esixhunywe kumsingathi ngababhangqwana be-veth. Ngikwenzile lokhu ku-Ubuntu 24.04 nge-wireguard-tools 1.0.20210914, futhi isikhala samagama asizange sibe inkinga — inkinga kwakuyinqubokuchaza yokudlulisa yomsingathi kanye nemithetho yokumaka yomhubhe.

Qala ukhethe uhlobo lomongo oludingayo

Empeleni kuvela izinhlobo ezimbili. Uma umsingathi esebenzisa umhubhe ogcwele futhi uhlelo olulodwa kufanele luphume ngomzila we-ISP, wakha isikhala sesibili samagama, usixhuma kumsingathi futhi uvumele umsingathi ukuthi udlulise futhi uhumushe ithrafikhi yalo. Uma isikhala samagama sesivele sinesifaki se-VPN futhi udinga kuphela umyalo oqalwa ngaphakathi kwaso, lowo umjwayelo we-ip netns exec futhi iningi lomsebenzi womzila selwenziwe.

Azikho izinhlobo ezinikeza umthetho okhawulelwe ku-ID eyodwa yenqubo. I-Netfilter iqhathanisa amakheli, amachweba, izimpawu kanye nezifaki; awunayo ithebula lomzila ngenqubo ngayinye. Ukumaka kungaqondisa ithrafikhi, kodwa uphawu kufanele lubekwe kumaphakethe osuwakhombile, futhi leyo nkinga efanayo isezingeni elilodwa ngezansi. Isikhala samagama sihlukanisa isitaki sonke salowo muthi wezinqubo, yingakho liyimpendulo ejwayelekile.

Uma isidingo ngempela kungukuthi akukho okuhamba emhubheni, misa umhubhe esikhundleni salokho. Isikhala samagama sikhona ngenxa yendaba exubile: uhlelo olulodwa ngaphandle, konke okunye ngaphakathi, emshinini ofanayo, ngesikhathi esifanayo.

Yakha umongo wesibili futhi uxhume kumsingathi

Isakhiwo esiyisibonelo: umsingathi unesifaki se-WireGuard esithwala umzila ozenzakalelayo, futhi unesikhala samagama senethiwekhi esibizwa nge-clearnet esixhunywe kumsingathi ngababhangqwana be-veth. Amakheli angezansi ayizibonelo.

ip netns add clearnet
ip link add veth-clear-out type veth peer name veth-clear-in
ip addr add 192.168.100.1/24 dev veth-clear-out
ip link set veth-clear-out up
ip link set veth-clear-in netns clearnet
ip netns exec clearnet ip addr add 192.168.100.2/24 dev veth-clear-in
ip netns exec clearnet ip link set veth-clear-in up
ip netns exec clearnet ip route add default via 192.168.100.1

Lesi sikhala samagama manje singafinyelela kumsingathi futhi akukho okunye. Umsingathi kufanele adlulise ithrafikhi futhi abhale kabusha ikheli lomthombo, ngoba i-192.168.100.0/24 iyimfihlo futhi umzila womgwaqo ongenhla awunayo indlela yokubuyela kuwo:

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -o <wan-interface> -j MASQUERADE

Qinisekisa uhlangothi lwesikhala samagama ngaphambi kokuqhubeka.ip netns exec clearnet ip route kufanele kubonise umzila we-veth kanye nomzila ozenzakalelayo nge-192.168.100.1, futhi i-ping kulelo kheli kufanele iphendule. Uma i-ping ekhelini lomsingathi ihluleka, amakheli noma isimo sesixhumanisi asilungile futhi awukho umthetho we-firewall ozosiza.

Uma amagama axazululwa kodwa akukho okubuya, funda i-FORWARD

Ukwehluleka kwakudala kubukeka njengephutha lomzila: isikhala samagama sixazulula igama, iphakethe liyaphuma futhi impendulo ayifiki neze. Kumsingathi onenqubokuchaza ye-FORWARD ethi DROP — ukusatshalaliswa okuningana kanye nezithombe eziqinisiwe eziningi kwenza lokho — iphakethe liyaphonswa endleleni, futhi iphutha elinyatheliswa uhlelo alisho lutho ngokuhlunga.

Funda iketango ngaphambi kokwengeza noma yini:

iptables -S FORWARD
nft list chain inet filter forward

Bese uvumela ithrafikhi ngezinhlangothi zombili, nezibali, ukuze wazi ukuthi umthetho wake wafanisa yini:

iptables -A FORWARD -i veth-clear-out -o <wan-interface> -j ACCEPT
iptables -A FORWARD -i <wan-interface> -o veth-clear-out -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
watch -n1 'iptables -L FORWARD -v -n'

Umthetho onesibali samaphakethe esingu-zero awukho emzileni. Ngokunye amagama ezifaki ahlukile kulokho obukucabanga, noma umthetho wangaphambili uketango wamukela, waphonsa noma wabuyisela iphakethe kuqala. Lungisa ukulandelana, hhayi umbhalo womthetho.

Ithrafikhi yempendulo iyingxenye abantu abayikhohlwayo. Umthetho wokubuyela udinga igama le-veth elifanayo kanye nokufanisa isimo sokuxhumana, noma ukwamukela isifaki okulula uma ugcina inqubokuchaza ivulekile. Engeza kuphela umthetho wokuphuma futhi uphawu lokuqala luyabuya, kuyilapho umthetho wakho omusha umile lapho futhi ubukeka ulungile.

Gcina imithetho yokumaka yomhubhe kude nomzila omusha

Lesi sinyathelo siguqula isikhala samagama esisebenzayo sibe esivuzayo. Izilungiselelo ze-WireGuard ngokuvamile zifaka inqubokuchaza yophawu lwe-firewall kanye nemithetho yazo yomzila nethebula elikhethekile, ngakho amaphakethe angenalo uphawu awela emuva kuthebula eliyinhloko kuyilapho anophawu esebenzisa ithebula lomhubhe. Ithrafikhi edluliswa isuka esikhaleni samagama ihlolwa ngokumelene nomzila wenqubokuchaza lapho iphuma, futhi kuye ngokuthi leyo mithetho yabhalwa kanjani, ingawela kuthebula lomhubhe.

Izingezo ezimbili zihlukanisa imizila. Buyela emuva kusenesikhathi kuketango ye-mangle yesubneti yesikhala samagama, futhi engeza umthetho osuselwa kumthombo obeka leyo subneti kuthebula eliyinhloko:

iptables -t mangle -I PREROUTING -s 192.168.100.0/24 -j RETURN
ip rule add from 192.168.100.0/24 lookup main priority 100

Ukubaluleka 100 kuhlelwa ngaphambi kwemithetho yomhubhe kumsingathi wami, ngakho ithebula elijwayelekile liyanquma ngalowo mthombo. Ungakopishi leyo nombolo ngokungaboni: ukubaluleka okufakwa wg-quick kuyahluka phakathi kwezinguqulo naphakathi kwezilungiselelo ze-IPv4 ne-IPv6, ngakho sebenzisa ip rule show bese ukhetha ukubaluleka okungena ngaphambi kwemithetho yomhubhe emshinini wakho.

Qinisekisa nge-sesha esikhethekile somthombo esikhundleni sokwethemba uhlu lwemithetho:

ip route get 1.1.1.1 from 192.168.100.2
ip netns exec clearnet ip route get 1.1.1.1

Uma umyalo wokuqala ubika isifaki se-WireGuard, umthetho omusha awukakabi phambi kwenqubokuchaza yomhubhe. Uma ubika isifaki se-WAN kuyilapho owesibili usabonisa umzila ozenzakalelayo we-veth, umsingathi nesikhala samagama akavumelani futhi kufanele ufunde kabusha zombili izithebula zomzila.

Qala inqubo evula ukuxhumana

Ukuqala umyalo kuwumugqa owodwa, kodwa qala inqubo eyakha ngempela isokhethi.ip netns exec clearnet curl -s https://ifconfig.me ukuhlolwa okuthembekile okuncane: kubonisa ikheli isikhala samagama esikwethula emhlabeni, hhayi lelo umsingathi angalisebenzisa.

Kusevisi, xhuma isikhala samagama ngomzila ukuze inqubo ihlale kuso impilo yayo yonke:

[Service]
NetworkNamespacePath=/run/netns/clearnet

Izinhlelo zokudweba yindawo lapho indlela yomugqa owodwa yehluleka khona buthule. Isiphequluli esiqalwa kusuka kumenyu ngokuvamile sidlulisela isicelo ku-instance esivele isebenza ngaphandle kwesikhala samagama, ngakho iwindi elisha liyavela futhi ithrafikhi isaphuma ngomhubhe. Yinike iphrofayela ehlukile ukuze i-instance entsha yakheke ngempela, bese uhlola umongo wenqubo esikhundleni sokuqagela:

readlink /proc/$(pgrep -f clearnet-profile | head -1)/ns/net
readlink /run/netns/clearnet

Imiphumela emibili kufanele ifanise. Ukuhlolwa okufanayo kuyasebenza kunoma yiluphi uhlelo olusebenza isikhathi eside, futhi kufanelekile ukukwenza kanye kuhlelo ngalunye esikhundleni sokucabanga ukuthi isiqalisi senze okubukucabanga.

Ukuxazululwa kwamagama kudinga isinqumo saso. Ukwakha isikhala samagama akusinikezi ukulungiselelwa kwesixazululi; amafayela esikhala samagama ngasinye asekelwa nge-/etc/netns/<name>/resolv.conf, futhi ngaphandle kwaso uzuzwa ifa lokuziphatha okulula ukukufunda ngokungalungile. I-IPv6 idinga ukuphathwa okufanayo: uma isikhala samagama singenawo umzila ozenzakalelayo we-v6 kuyilapho uhlelo lukhetha i-v6, izicelo zingamisa ngaphambi kokuhlehla, okubukeka njengomhubhe ophukile.

Hlola uhlaka, hhayi ikheli lokuphuma kuphela

Ikheli lomphakathi elisebenzayo lifakazela umzila, hhayi isidingo sonke. Dlula okunye ngalokhu kulandelana:

• ip netns exec clearnet ip route get 1.1.1.1 kubonisa umzila ozenzakalelayo we-veth, hhayi isifaki se-WireGuard.
• Izibali ze-FORWARD kuyo yomibili imithetho ziyakhula ngesikhathi isicelo siqhubeka.
• Inqubo yohlelo ibika i-inode yesikhala samagama oyilindele.
• Ngemva kokuqalisa kabusha isikhala samagama sikhona ngaphambi kokuthi isevisi iqale; i-unit esebenza ngaphambili iyehluleka noma, okubi kakhulu, isebenza ngaphandle kwesikhala samagama.

Bese unquma ukuthi kufanele kwenzeke ini uma umhubhe uwile. Isikhala samagama siyaqhubeka sisebenza, futhi lokho kuyinhloso yalo msebenzi kanye nengozi: uhlelo olukhululiwe luhlala luxhunyiwe kuyilapho konke okunye kuma. Bhala lokho njengokukhetha kwenqubokuchaza futhi ube ocacile mayelana nokuthi ukukhululwa akukubandakanyi ini — ubunikazi be-akhawunti, isimo sesiphequluli esigciniwe kanye nomhlinzeki wakho we-DNS konke kungaphandle kobubanzi besikhala samagama senethiwekhi, futhi ukuthatha ukukhululwa njengokungaziwa kuyiphutha eliphila isikhathi eside kunokulungiselelwa.