Ama-peer amabili e-WireGuard ahlanganyela ibanga: iyiphi ethola iphakethe
Amabanga ahambisanayo axazululwa nge-prefix eqondile kakhulu, hhayi ngokulandelana. Hlola umzila kuqala, bese uhlu lwama-peer, ngaphambi kokwandisa noma yini.
Ama-peer amabili abala amabanga athintana, futhi ithrafikhi ifinyelela kwelona elingalungile. Akukho okonakele: i-WireGuard ikhetha i-peer ngokufanisa indawo ekuyiwa kuyo namabanga alungisiwe, futhi ukufana okuqondile kakhulu kuyanqoba. Ngaphambi kokwandisa noma yini, nquma ukuthi iyiphi i-peer okufanele ibe nokuhambisana kwayo ne-prefix iphi.
I-prefix ende kakhulu iyanqoba ngaphakathi kwe-WireGuard
Yonke ingxenye ye-peer ithwala iqoqo lamaprefix endawo ekuyiwa kuyo. Lapho iphakethe lihanjiswa lingena ku-interface, ukusetshenziswa kufuna ingxenye eneprefix efanayo eqondile kakhulu — umthetho ofanayo osetinziswa ithebula lomzila. Ngakho-ke i-/24 inqoba i-/16 equkethwe yiyo, futhi i-peer encane ithola ithrafikhi.
Amasethingi e-road-warrior asebenzisa lokhu ngamabomu. I-peer eyodwa inebanga elibanzi lesiza, futhi amahosthi ngawodwana ahlukaniswa ngezingxenye ze-/32 ezingezinye izinto ze-peer. Iphethini iyasebenza ngoba ukuhlukaniswa kuqondile kakhulu, hhayi ngenxa yokulandelana.
Bhala ubunikazi njengothebula lwe-prefix ne-peer. Uma izingxenye ezimbili zichaza i-prefix efanayo, ukulungiswa akusavezi inhloso, kuveza umncintiswano.
Isistimu yokusebenza ikhetha i-interface kuqala
I-WireGuard ikhetha kuphela phakathi kwama-peer ase-interface eyodwa. I-interface iphi ethola iphakethe kunqunywa ngaphambilini, yithebula lomzila lomsingathi, futhi umzila wesibili ozenzakalelayo noma umzila ogugile ungathumela ithrafikhi endaweni lapho uhlu lwama-peer lungayiboni khona. Yingakho ukuxilongwa kwezinga le-peer kungase kube kuhle kodwa kungakuchazi ukwehluleka. Hlola umzila oya endaweni ekuyiwa kuyo ngaphambi kokufunda ukulungiswa kwe-peer, ngoba umzila okhombisa ku-interface yomzimba udlula umbuzo wonke.
Ithuluzi livamise ukufaka leyo mizila kusukela emabangeni ama-peer, okusho ukuthi ushintsho kuhlu lwe-peer eyodwa lungaqondisa kabusha ngokuthula ithrafikhi eyayiyeyesinye ngaphambilini. Ngakho-ke ukuhlela i-peer wushintsho lomzila olufihliwe. Buyekeza kokubili kanyekanye, kungenjalo uzolungisa okukodwa futhi wonakalise okunye.
Amaphakethe angenayo ahlolwa ngokomthombo
Uhlu lwamabanga lwenza imisebenzi emibili. Ethrafikhini ephumayo likhetha i-peer ngendawo ekuyiwa kuyo, futhi ethrafikhini engenayo ligunyaza ikheli lomthombo. Iphakethe elifika likheli elingaphandle kwamabanga aleyo peer liyaphonswa ngaphambi kokuba noma iyiphi i-firewall liyibone.
Lokhu kungalingani kulula ukukushiya lapho ufunda uhlangothi olulodwa lokulungiswa. I-peer ekwazi ukufinyelela i-subnet ayivunyelwa ngenxa yalokho ukuthumela kusukela kuleyo subnet, futhi izindlela ezimbili ziphoqelelwa izihlolo ezihlukene.
Ubunikazi bomthombo obuncane busiguqula lokhu bube inzuzo. Nika i-peer ngayinye i-/32 yekheli layo, futhi i-firewall engezansi inombombo othembekile wokuqhathanisa, esikhundleni sebanga leqembu lonke noma iyiphi ilungu engalifuna.
Amabanga aphindiwe awawona ama-failover
Ukwabela i-prefix efanayo kuma-peer amabili akudali i-load balancer noma indlela yokulinda. Akukho ukuhlolwa kwempilo futhi akukho ukuhambisana kweseshini: ingxenye enqobayo inqunywa ukulandelana kwangaphakathi kokusetshenziswa, futhi lokho akusona isivumelwano okufanele ukwakhe ngaso. Uma udinga ezinye izindawo zokuphuma, ziveze lapho ukukhetha kuchazwe khona. Inqubomgomo yomzila, isilinganiso, noma i-pair yamaprefix ahlukene anomnikazi obhaliwe ngalinye zikhiqiza ukuziphatha ongakubikezela futhi ukuhlole.
Ukwandisa ibanga ukuze kulungiswe ukwehluleka okungahlobene kungenye iphutha elivamile. Kususa ithrafikhi kude ne-peer eyayisebenza, futhi uphawu olusha lufika ngaphambi kokuba oludala luqondwe.
Qinisekisa ukukhetha ngaphambi kokuhlela
Imiyalo emithathu iphendula imibuzo emithathu ngokulandelana. Owokuqala ubala amabanga afunwa i-peer ngayinye. Owesibili ubonisa i-interface umsingathi angayisebenzisa endaweni ekuyiwa kuyo. Owesithathu ubonisa isimo esibukhoma sama-peer ngemva kokuba ithrafikhi ihambile.
wg show wg0 allowed-ips ip route get 10.66.8.20 wg show wg0 ip rule show
Yisebenzise ngaphambi nangemva koshintsho bese uqhathanisa. Uma umphumela womzila ushintshile kodwa ithrafikhi isafinyelela ku-peer engalungile, uhlu lwamaprefix luyahambisana ngendlela ongakayibhali. Uma umphumela womzila ungashintshanga, ukulungiswa kwe-peer kwakungesona isikhathi esihlolwayo.
Bhala kuthikithi indawo ekuyiwa kuyo, i-interface ekhethiwe ne-peer ekhethiwe. Yilowo mthathu owenza ukuhambisana kube nokubuyekezwa kamuva, futhi uwusizo kakhulu kunomfanekiso wesikrini wokulungiswa.