Amasayithi amabili, isubneti eyodwa, ihabhu elilodwa le-WireGuard: yenza isebenze

Womabili amasayithi asebenzisa ibanga le-LAN elifanayo, futhi ukuxabana akuyona into ephula umklamo ngempela. Ihabhu kufanele likhethe isayithi ngokusebenzisa ikheli lendawo eya kuyo kuphela, futhi izindawo ezimbili ezifanayo aziliniki lutho lokukhetha ngalo. Ukubuyisela izinombolo ehhovisi elisebenzayo ukuze kwenelise umhubhe ngokuvamile kuwukushintshana okubi kakhulu kunokunikeza wonke umsebenzi oshicilelwe ikheli elihlukile umhubhe ongakwazi ukulithwala. Umklamo ongezansi ushicilela umsebenzi owodwa we-HTTPS isayithi ngalinye futhi akukho okunye.

Kungani ukuxabana kungeyona inkinga yangempela

I-WireGuard idlulisa ngokwendawo eya kuyo: ama-AllowedIPs e-peer anquma ukuthi iyiphi i-peer ethola iphakethe. Ama-peer amabili awakwazi ukumemezela kokubili i-10.10.7.0/24 ngaphandle kokuthi elinye lazo liwine konke ukusesha. Lokho kuyisici sethebula lama-peer hhayi somhubhe, yingakho isixazululo lapha siwuhlelo lwamakheli hhayi iqhinga lokuhlela izindlela.

Uhlelo ukuthi kuyekwe ukumemezela i-LAN ngokuphelele. Kunalokho memezela i-alias yomsebenzi ngamunye, ikheli elilodwa isayithi ngalinye, futhi inggele yesayithi ngasinye iguqulele leyo alias kuhlelo lwayo lwangempela.

Umsebenzisi uhlela amakheli amabili ahlukile, akaze abone isiqalo esingacacile, futhi akukho okushintshayo kuwo womabili amahhovisi. Lokhu futhi kusho umngcele ngobuqotho: ushicilela umsebenzi owodwa we-HTTPS kusuka esayithini ngayinye, awuhlanganisi amanethiwekhi amabili. Imithetho elandelayo ihlala incane ngoba isitatimende sincane. Isitatimende esibanzi sizodinga imithetho ebanzi, futhi yileyo ndlela le miklamo iba yinkimbinkimbi ngayo.

Nikeza isayithi ngasinye i-alias umsebenzisi angayihlela

Khetha amakheli ebangeni elingashayisani nanoma yini emshinini womsebenzisi, ihabhu noma i-LAN eyodwa kulezi ezimbili. Lapha ihabhu ngu-10.66.0.1, umsebenzisi ngu-10.66.0.10, izinggele ngu-10.66.0.21 no-10.66.0.22, futhi ama-alias amabili ngu-10.77.1.20 no-10.77.2.20. Ihabhu lishicilela i-alias ngayinye nge-peer elinayo, ngakho iphakethe eliphumayo elibhekiswe ku-alias eyodwa lingaphuma kuphela ngesayithi elifanayo:

[Interface]
Address = 10.66.0.1/32
ListenPort = 51820
PrivateKey = HUB_KEY

[Peer]
PublicKey = USER_PUBLIC_KEY
AllowedIPs = 10.66.0.10/32

[Peer]
PublicKey = SITE_A_PUBLIC_KEY
AllowedIPs = 10.66.0.21/32, 10.77.1.20/32

[Peer]
PublicKey = SITE_B_PUBLIC_KEY
AllowedIPs = 10.66.0.22/32, 10.77.2.20/32

Uhlangothi lomsebenzisi ludinga ama-alias amabili kuphela, lokho kugcina ukucushwa kwekhasimende kungenalo womabili amasiqalo e-LAN. Akukho lutho kulokho kucushwa okusho noma iyiphi i-LAN yangempela:

[Interface]
Address = 10.66.0.10/32
PrivateKey = USER_KEY

[Peer]
PublicKey = HUB_PUBLIC_KEY
Endpoint = hub.example.net:51820
AllowedIPs = 10.77.1.20/32, 10.77.2.20/32
PersistentKeepalive = 25

Inggele ngayinye imemezela ihabhu nomthombo womsebenzisi, akukho okunye, ngakho isayithi alikaze lifunde i-LAN yesinye. I-Keepalive igcina ukumapeka kwe-NAT kumkhakha ophezulu wesayithi; ayikuvumeli ukuthunyelwa, futhi udonga lomlilo lusaquma ukuthi yini eyamukelwayo. Ukukopisha ukucushwa kwenggele eyodwa kwenye kuhle uma nje ukhiye oyimfihlo, ikheli lesikhombisi kanye ne-alias konke kushintsha.

Ihabhu kufanele livumele ini phakathi kwama-peer alo amabili

Ihabhu lidlulisa amaphakethe phakathi kwama-peer alo amabili, lokho kuyisinqumo kuchungechunge lwe-forward hhayi isinqumo sokufaka. Nika amandla ukudluliswa kwe-IPv4 ngendlela evamile yepulatifomu, bese uvumela ngqo izimbili ezidingwa umklamo.

Umthetho ongezansi uvumela umsebenzisi ukufinyelela i-alias eyodwa nembobo eyodwa, futhi uvumela ukuthunyelwa okubuyayo ngokulandelela ukuxhumana. Kuye kulahla konke okunye endleleni ye-forward, futhi lokho yiphuzu:

nft add table inet hub_transit
nft add chain inet hub_transit forward '{ type filter hook forward priority 0 ; policy drop ; }'
nft add rule inet hub_transit forward ct state established,related accept
nft add rule inet hub_transit forward iifname wg0 oifname wg0 tcp dport 443 ip saddr 10.66.0.10 ip daddr 10.77.1.20 accept

Imininingwane emibili ifanele ishiwo ngoba ibangela ukwehluleka okuthule. I-accept kuchungechunge olulodwa lwesisekelo ayikweqi i-drop kwelinye, ngakho hlanganisa lokhu nomgomo okhona esikhundleni sokuweletha eceleni. Futhi ikheli lomthombo likhomba idivayisi, hhayi umuntu; gcina ukuqinisekiswa kohlelo kuhlukile ekwamukelweni kwenethiwekhi.

Lapho i-alias iba ikheli langempela

Isayithi A lamukela isicelo esiya ku-10.77.1.20, libhala kabusha indawo eya kuyo ibe uhlelo lwangempela, futhi libhala kabusha umthombo ube ikheli laso le-LAN ukuze impendulo ibuye ngaphandle kwendlela eya kumhubhe. Ukwenza ukuhumusha kokubili endaweni eyodwa kugcina inethiwekhi yonke ingazi nge-alias. Imithetho engezansi iyisimiso sonke:

nft add table ip site_a_nat
nft add chain ip site_a_nat pre '{ type nat hook prerouting priority -100 ; policy accept ; }'
nft add chain ip site_a_nat post '{ type nat hook postrouting priority 100 ; policy accept ; }'
nft add rule ip site_a_nat pre iifname wg0 tcp dport 443 ip saddr 10.66.0.10 ip daddr 10.77.1.20 dnat to 10.10.7.20:443
nft add rule ip site_a_nat post iifname wg0 oifname lan0 tcp dport 443 ip saddr 10.66.0.10 ip daddr 10.10.7.20 snat to 10.10.7.2

Ngemva kwalokho umgomo we-forward wesayithi A kufanele uvumele ukugeleza okuhunyushiwe kusuka kusikhombisi somhubhe kuya kusikhombisi se-LAN, kanye nendlela yokubuya. I-hook ye-forward ibona indawo eya kuyo ngemva kokuhumusha indawo eya kuyo nangaphambi kokubhala kabusha umthombo, yingakho umthetho usho ikheli lohlelo lwangempela. Funda lawo ma-hook amabili ngalolo hlelo noma nini lapho umthetho ubonakala ungangqamani nalutho. Umthetho we-forward obhalwe ngokumelene ne-alias awukwazi ukungqamana nakancane, ngoba i-alias ayisekho kuleyo hook.

Isayithi B liphinda lokhu nge-alias yalo nokhiye walo. Akufanele liphinde lisebenzise ukhiye oyimfihlo wesayithi A, ngoba ama-peer amabili abelana ngobunikazi bunye iphutha lokucushwa okunzima ukulibona futhi okulula ukulenza ngokukopisha ifayela. Gcina imibhalo yamagate womabili ifana ngaphandle kwamavelu okufanele ahluke, ukuze umehluko ugqame ekubuyekezweni. Ifayela elikopishiwe lingumsuka ojwayelekile walelo phutha.

Ukubhala kabusha umthombo kunesibopho. Uhlelo lubona inggele njengekhasimende layo, ngakho amarekhodi ayo awasabonisi ukuthi yimuphi umsebenzisi oxhumile. Gcina umkhondo wokucwaninga wenggele, futhi ungabuthakathisi ukungena kohlelo ukuze unxephezele ubunikazi benethiwekhi obususwe ukuhumusha.

Indlela yokufakazela ukuthi womabili amagama ashicilelwe ayaphendula

Nikeza i-alias ngayinye igama le-DNS futhi ucuse uhlelo nesitifiketi salelo gama, ngoba ukuhumusha akubhali kabusha iziqondiso noma ama-URL aphelele afakiwe. Sebenzisa igama elilodwa isayithi ngalinye ukuze ukungafani kwesitifiketi kungaze kuthathwe njengephutha lokuhlela izindlela.

Hlola kusuka kukhasimende langempela, qinisekisa ukuthi iyiphi isayithi ephendulile, futhi uhlole nembobo engavunyelwe. Sebenzisa ukuxhumana okusha ngemva kwanoma yiluphi ushintsho lwe-NAT, ngoba isimo esisunguliwe sigcina ukumapeka okudala:

wg show wg0 allowed-ips
sudo nft list ruleset
curl -sS -o /dev/null -w "%{http_code}\n" https://site-a.example.net/

I-alias engenalutho noma engalindelekile emyalweni wokuqala isho ukuthi ukukhethwa kwe-peer akulungile ngaphambi kokuthi noma yimuphi umthetho wodonga lomlilo ube nomthelela. Uma i-alias ilungile futhi igama lisahluleka, inkinga isisuke yaya ku-DNS nezitifiketi. Lapho womabili amagama ephendula futhi imbobo yesithathu ihlala ivaliwe, umklamo wenza lokho okushoyo: imisebenzi emibili eshicilelwe ngobuncane, hhayi ama-LAN amabili ahlanganisiwe.