Izindawo ezimbili zamaselula ezingenazo izimbobo zokungena: yakha isikhungo esisebenzayo

Lapho kungekho siza esamukela ukuxhumana kwe-IPv4 okungena, vumela zombili ukuthi ziqale ukuya esikhungweni esifinyeleleka. Sebenzisa izinyathelo zomzila, ukudlulisa kanye nendlela yokuphuma ngokulandelana.

Izindawo ezimbili ezisezixhumanisweni zamaselula zibhekana nenkinga efanayo kuzo zombili izinhlangothi: akukho noyedwa ongamukela ukuxhumana kwe-IPv4 okungacelwanga, ngakho akukho noyedwa ongadlala indawo yeseva kuthubhu eqondile. Isakhiwo esisebenzayo sibeka umuntu wesithathu ofinyelelekayo phakathi: isizinda ngasinye sishayela ngaphandle futhi isikhungo sidlulisela kuphela ithrafikhi oyivumayo. Leso sikhungo kungaba isikhombi somzila osisebenzisayo noma umkhiqizo owethula ontanga, futhi lezi azifani. Izinyathelo ezingezansi zihlelwe ukuze ngasinye sinikeze ubufakazi ngaphambi kokuthi esilandelayo sincike kuso.

Awekho isizinda okungashayelwa kuso, ngakho zombili kufanele zishayele ngaphandle

Qinisekisa umkhawulo ngaphambi kokuklama nxazonke zawo. Uma umhlinzeki enikeza i-WAN interface ikheli langasese, akukho kudluliswa kwembobo kusikhombi somzila sesizinda uqobo okuzokwenza lifinyeleleke, ngoba ukuhumusha kwenzeka phezulu. Ikheli lomphakathi le-IPv6 lingaba khona kusixhumanisi esifanayo futhi lishintshe ukuklama ngokuphelele, yingakho ukuhlola kuhlanganisa imindeni yomibili. Bhala impendulo yisizinda ngasinye, ngoba lezi zimbili akuvamile ukuba nemikhawulo efanayo ngisho noma zabelana ngomhlinzeki oyedwa.

Icala elivamile lamaselula libukeka njengekheli elivela ebangeni elihunyushiwe lomhlinzeki kanye nomzila ozenzakalelayo odlula kuwo. Lokhu akulona iphutha okufanele lilungiswe; lesi yisizathu sokuthi isikhungo sikhona. Lokho okufunayo yinoma yiliphi ikheli umuntu wesithathu angafinyelela kulo ngaphandle kokuthi isizinda sikhulume kuqala.

Imiyalo emibili iphendula umbuzo wekheli wesizinda esiphambi kwakho. Yisebenzise kusikhombi somzila sesizinda, hhayi kukhompyutha ephathekayo engemuva kwaso:

ip -4 addr show scope global
ip -6 addr show scope global

Ubani wethula ontanga, futhi ubani uthwala amaphakethe

Ukwethula nokuthutha kuyimisebenzi ehlukene umkhiqizo ojwayele ukuzihlanganisa ngaphandle kokwenza umngcele ubonakale. Indlela yokuhlangana isiza ontanga ababili ukuthola umzila ongaba khona; i-relay ithwala amaphakethe abo lapho kungekho mzila oqondile. Ukuthenga isevisi eyethula ontanga akukunikezi isikhombi somzila, futhi lowo mehluko unquma ukuthi ukuklama kudinga isikhungo noma cha.

Ukuwela kunomagama wakho, futhi amagama achaza izindima, hhayi iziqinisekiso. Isicaciso se-ICE sichaza abazongenela ukhetho nokuhlolwa kokuxhumana, i-STUN ichaza indlela eyodwa yokufunda ngokuhunyushwa kwamakheli, kanti i-TURN ichaza ukuthuthwa nge-relay kwezinhlelo ezikwenzayo. Akukho kulawa mikhakathi evela esangweni elijwayelekile ngoba uyiqondisile ekhelini lokuthola. Qinisekisa ukuwela njengekhono lomkhiqizo, futhi ucatshange ukuthi kukhona i-relay kuze kube ukuhlolwa kukhombisa okunye.

Umzila owodwa isizinda ngasinye, ophethwe untanga

Isikhungo sidinga ithubhu eyodwa isizinda ngasinye, isiqalo se-LAN esihlukile ngemuva kwesinye, kanye nomzila wesiqalo ngasinye osho umnikazi waso. Esibonelweni isikhungo ngu-10.61.0.1, isizinda A ngu-10.61.0.11 esine-LAN 10.60.10.0/24, futhi isizinda B ngu-10.61.0.12 esine-LAN 10.60.20.0/24. Wonke umzila ongezansi ukhomba untanga ophethe isiqalo, hhayi i-interface yethubhu:

ip route add 10.60.10.0/24 via 10.61.0.11 dev wg0
ip route add 10.60.20.0/24 via 10.61.0.12 dev wg0
sysctl net.ipv4.ip_forward
ip route get 10.60.20.55 from 10.60.10.77

Ukudlulisa kufanele kuvuliwe, ngaphandle kwalokho amaphakethe ayama esikhungweni ngaphandle kwephutha elikhomba imbangela. Umyalo wokugcina uphendula umbuzo wangempela, ngoba ubuza ukuthi iphakethe lizothatha muphi umzila lisuka ku-LAN yesizinda A liya ku-LAN yesizinda B ngenkathi umthombo ufakiwe ekusesheni. Thatha ukusesha okusho i-interface yethubhu njengobufakazi, futhi lokho okuwela kumzila ozenzakalelayo njengomzila ongekho, hhayi njengemfihlakalo. Bese unqamula ukudlula ngamabomu, ngoba isikhungo esidlulisela phakathi kwabo bonke ontanga senza izindawo ezimbili zibe inethiwekhi eyisicaba futhi inqubomgomo yokufinyelela obucabanga ukuthi unayo ayisasebenzi.

Nquma futhi ukuthi ukubethela kuphela kuphi. Lapho isikhungo sibamba zombili iziphetho zethubhu, umqhubi walowo mshini nomthwalo wakhe womsebenzi bangena kumodeli yokuthembana nokutholakala, futhi umkhawulokudonsa wakhe uba yingxenye yomzila.

Gcina imephu ngayinye iphilile ngomhlinzeki

Isizinda ngasinye siqala ithubhu yaso, futhi ngasinye kufanele sigcine imephu yokuhumusha iphilile ngaphandle kwalokho umhlinzeki uyoyikhohlwa. Umlayezo wokugcina uphila ohlangothini oluqalayo ugcina leyo mephu phakathi kokuxhawulana. Nqamula iziqalo ezivunyelwe ekhelini lesikhungo kanye ne-LAN ekude, ukuze untanga ohlaseleke ungeke afune isiqalo okungezona esakhe:

[Peer]
PublicKey = <hub public key>
Endpoint = 192.0.2.10:51820
AllowedIPs = 10.61.0.1/32, 10.60.20.0/24
PersistentKeepalive = 25

Khombisa ibhulokhi kwesinye isizinda ngesiqalo saso esikude, futhi umelane nesifiso sokuvumela lonke ibanga lethubhu. Ukuxhawulana okuma bese kuqala futhi kusuka embotsheni yomthombo entsha wusayino wemephu ephelelwe yisikhathi, futhi izigxivizo zesikhathi zokuxhawulana ziwubufakazi bokuthi kwenzekile. Isikhala esifushane kunesikhathi sokulinda somhlinzeki sivimbela ukuphela esikhundleni sokulungisa kamuva. Uma umhlinzeki eshintsha ukuziphatha kwakhe kokuhumusha, lindela ukuthi lezo zikhathi zishintshe naye.

Fakazela izinhlangothi zombili, bese ufakazela ukululama

Ukuqinisekisa kunendlela, ngakho i-ping esuka ku-A iya ku-B ifakazela uhhafu wokuklama futhi ayisho lutho ngomzila wokubuya. Hlola umzila wempendulo ngaleso sifanekiso sosesho esiqaphela umthombo esikhungweni, bese uphinda ukuhlolwa kusuka kolunye uhlangothi. Ukuxhawulana okusha nakho kuyingxenye yobufakazi, ngoba ithubhu elihleli lingase lihlola imephu endala:

wg show wg0 latest-handshakes
ping -c 3 10.60.20.55
traceroute -n 10.60.20.55

Bese uhlola ukwehluleka okukulindele, hhayi impumelelo oyifunayo. Qala kabusha uxhumano lwesizinda esisodwa futhi uqinisekise ukuthi ithubhu liyabuya ngaphandle kokuthi umuntu athinte noma yimuphi umkhawulo, ngoba ukuklama okudinga umqhubi ngemuva kwakho konke ukushintsha kumhlinzeki akukapheleli. Bhala umzila oyinhloko, enye indlela ye-IPv6 uma ikhona, kanye nokuziphatha uma isikhungo singatholakali. Isikhungo manje siyingxenye yemodeli yakho yokutholakala, ngakho bhala lokho esikhundleni sokukuthola ngesikhathi sokuphazamiseka.

Izihloko ezihlobene