Indlela yokwakha ukuhlolwa kwe-WireGuard yama-peer amabili okufakazela indlela eyodwa

Ukuhlolwa kwe-WireGuard okuthwala umzila ozenzakalelayo, isiqalo se-LAN, i-DNS kanye nokukhishwa kwe-firewall akukwazi ukukutshela ukuthi yikuphi kukho okwephukile. Kunciphise kuma-peer amabili, ipheya elilodwa lamakheli kanye nensiza eyodwa evunyelwe, futhi ukwehluleka akunandawo yokucasha. Isisekelo esiyisicefe siwukuhlola. Sakhe kuqala; kuthatha imizuzu eyishumi nanhlanu futhi konga intambama obuyayichitha ekuqageleni.

Lokho okufakazelwa isisekelo kuncane kunalokho iningi elikulindele. Kufakazela ukuthi ubunikazi obubili buyavumelana, ukuthi i-UDP ifinyelela embotsheni elalelayo nokuthi indawo eyodwa evunyelwe ithwala isicelo. Ukudlulisa, i-NAT, imizila ye-LAN kanye ne-DNS kuyizici ezihlukene ezingezwa kamuva, ngayinye ngayinye.

Okhiye, amakheli kanye ne-endpoint eyodwa

Dala ipheya lokhiye kusistimu ngayinye futhi uhambise phakathi kwabo izingxenye zomphakathi kuphela. wg genkey | tee privatekey | wg pubkey > publickey umyalo womugqa owodwa obhaliwe, futhi ushiya ukhiye wangasese kufayela ongayivikela kamuva. Khetha amakheli omhubhe ebangeni elingavela kunoma yikuphi okunye ukucushwa onawo, njenge-10.99.0.1/24 ne-10.99.0.2/24. Bhala ukuthi yiliphi ikheli elakumashini yiphi, ngoba konke ukuhlola okulandelayo kuncike kulokho kuhambisana.

Okhiye bangasese abahambi neze. Uma ukuhlolwa kudinga ukukopisha okukodwa kolunye uhlangothi, ukuhlolwa sekwenzile okungalungile. Uma izistimu ezimbili zingemva kwe-NAT, okukodwa kudinga imbobo ye-UDP efinyeleleka kuyilapho okunye kuthwele i-Endpoint ekhomba kuyo, futhi ikheli nembobo zomphakathi kufanele zibe kumanothi akho, hhayi emicabangweni yakho nge-51820.

Ukudluliswa kwembobo okwenza imephu yembobo yangaphandle ehlukile kusebenza kahle inqobo nje uma i-Endpoint ihambisana nayo. Ukungahambisani lapha kukhiqiza ukuthula esikhundleni samaphutha, yingakho kufanelekile ukuzihlola ephepheni ngaphambi kokuxazulula kuwaya.

Izinkambu ezingezika-wg nalezo ezingezona zayo

Iqoqo lezinkambu eziyisisekelo lincane: PrivateKey ne-ListenPort ngaphansi kwe-Interface, PublicKey, AllowedIPs ne-Endpoint ngaphansi kwe-Peer. I-Address ne-DNS ngezika-wg-quick hhayi ezika-wg uqobo, futhi umehluko lowo uyaluma ngesikhathi esifanayo ukucushwa kuhamba kuyisetshenziswa esinye.

[Interface]
PrivateKey = <peer-a-private>
Address = 10.99.0.1/24
ListenPort = 51820

[Peer]
PublicKey = <peer-b-public>
AllowedIPs = 10.99.0.2/32
Endpoint = 203.0.113.10:51820

I-AllowedIPs ithwala imisebenzi emibili ngesikhathi esisodwa. Ikhetha ukuthi yiziphi izindawo ezingena emhubheni, futhi igunyaza i-peer ukuthi isebenzise lawomakheli omthombo lapho ifika. Yingakho ukufakwa kwesibuko kolunye uhlangothi kufanele kubize ngokunemba ikheli lomhubhe wakho; i-/32 ye-peer engalungile ifundwa njengenkinga yomzila futhi iziphatha njengenkinga yokugunyazwa. Ukuqala okusheshayo kwe-WireGuard kubonisa isimo esifanayo sama-peer amabili ngamazwi ajwayelekile uma ufuna ukuqhathanisa amagama ezinkambu.

Ukufunda i-handshake esikhundleni sesithonjana

Khuphula i-interface ngokusebenzisa noma yini enayo, bese ufunda isimo hhayi isibani sesimo. wg show iphrinta i-handshake yakamuva nge-peer ngayinye kanye nezibali zamabhayithi, futhi i-handshake emizuzwini embalwa edlule isho ukuthi okhiye, i-endpoint kanye nomzila we-UDP konke kuyasebenza. Isibali esikhuphuka ngendlela eyodwa kuphela siyimpendulo yaso, futhi akusona isephutha elifanayo ne-handshake engakaze yenzeke.

Amaphutha amabili asikisela uphenyo oluhlukile. Ukungabikho neze kwe-handshake kukhombisa ukungahambisani kokhiye, i-Endpoint engalungile, i-UDP evinjiwe noma i-firewall elahla i-handshake uqobo. I-handshake ephumelelayo kuyilapho idatha ingayi ndawo ikhombisa i-AllowedIPs, insiza engalaleli ekhelini lomhubhe, noma i-firewall yomsingathi eyamukela imbobo ye-LAN kodwa hhayi ye-interface yomhubhe. Lezi zingxenye ezihlukene zesistimu, futhi isisekelo sizihlukanisa ngaphambi kokuthi uqale ukushintsha imithetho.

Ukufakazela insiza eyodwa evunyelwe, bese kuba ngakolunye uhlangothi

Thumela isicelo ekhelini lomhubhe lwelinye i-peer ensizeni okufanele iphendule, futhi khetha into engcono kune-ping. Impendulo ye-ICMP engekho ingaba ukuhlungwa komsingathi hhayi iphutha lomhubhe, ngakho i-ping ethule ayifakazeli uhlangothi nolunye. Ukuxhumana kwe-TCP embotsheni oyaziyo ukuthi ivulekile, noma isicelo esibuyisela idatha, kukunikeza impendulo ongayihumusha.

Gijima uhlangothi oluphambene njengokuhlola okuhlukile okunomphumela wakho, ngoba izinhlangothi ezimbili zinezinto ezihlukile ze-firewall ne-AllowedIPs futhi zingahluleka ngokuzimela. Uma i-handshake isebenza kodwa isicelo singasebenzi, inkinga isendleleni yedatha hhayi emhubheni: i-AllowedIPs, insiza elalelayo noma i-firewall yomsingathi. Lungisa lokho ngaphambi kokwengeza ukudlulisa, i-NAT noma i-DNS, ngaphandle kwalokho uzochitha intambama ukuxazulula isici esingakaze sibe necala.

Ukugcina isisekelo njengereferensi

Gcina i-topology esebenzayo kanye nomthombo wephrofayela endaweni ongakwazi ukubuyisela kuyo, futhi uwagcine ngaphandle kwanoma yimuphi umkhakha ovumelanisa nensiza yomphakathi. Bese wengeza isici esisodwa ngesikhathi, uphinda isicelo sokuqala ngemuva kwesinye ngasinye: ukudlulisa, i-NAT, umzila we-LAN bese kuba yi-DNS kuphela. Konke ukwengezwa okwephula ukuhlolwa manje sekukhonakala ukukuthola, ngoba akukho okunye okunyakazile.

Isisekelo esenza isithonjana sibe luhlaza kuphela asikutshelanga lutho mayelana nokuthi yikuphi ukwengezwa okwabangela ukwehluleka okulandelayo. Gcina indlela eyodwa evunyelwe isebenza njengereferensi, futhi zonke izinguquko ezilandelayo zikalwa ngokuyihlola.