Kungani i-wg-quick ibhala kabusha i-wg0.conf lapho umisa isixhumi

Ufaka i-peer ku-/etc/wireguard/wg0.conf, usebenzisa i-systemctl restart wg-quick@wg0, futhi i-peer isinyamalele efayeleni uma uphinde ubheka. Akukho okonakalise lutho. Ukuqala kabusha ukuma okulandelwa ukuqala, futhi isinyathelo sokuma singabhalela phezulu isimo samanje sokusebenza efayeleni osanda kulihlela. Isilungiselelo esinesibopho sihlala efayeleni elifanayo obulihlela, futhi yikho okwenza umjikelezo ube nzima kangaka okokuqala lapho uhlangabezana nawo.

Izimo ezimbili, ifayela elilodwa nokugcinwa ngesikhathi sokuvala

Isimo sokusebenza se-WireGuard nefayela lokuhlela le-wg-quick kuxhumene kodwa kwehlukile. Ifayela lingukufaka: i-wg-quick iyalifunda, idala isixhumi, ibeka amakheli nemizila futhi ihlela ama-peer. Idivayisi ye-kernel iyinto ephilayo, futhi izinguquko ezisezingeni eliphansi ezenziwe nge-wg azizibhali ngokwazo emuva.

Ngaphandle kwendlela eyodwa. Lapho i-SaveConfig = true ivela esigabeni sesixhumi, i-wg-quick igcina ukuhlela okukhona efayeleni njengengxenye yokwehlisa isixhumi. Incwadi ye-wg-quick ixwayisa ngakho lokhu ngqo: izinguquko ezenziwe efayeleni ngesikhathi isixhumi sisebenza zingabhalwa phezulu lapho sisuswa. Lokhu kuwukugcinwa ngesikhathi sokuvala, hhayi isikhathi sangemuva, ngakho kusebenza kuphela lapho okuthile kumisa isixhumi.

Funda ithebula njengesixwayiso mayelana nokulandelana. Konke ukulahleka okungazelelwe kulesi sigaba kuvela ekuhlelweni okwenzeka ngaphambi kokugcinwa hhayi ngemuva kwako.

Misa kuqala, hlela okwesibili, qala ekugcineni

Uma ifayela liwumthombo wakho weqiniso, yenza ifayela libe negunya ngokwakhiwa hhayi ngethemba. Wehlisa isixhumi, qinisekisa ukuthi lihambile, bese uhlela, bese uliphakamisa futhi. Umthetho ulula: akukho kuhlela okukhona ngesikhathi ukugcinwa kusengasebenza.

sudo cp -a /etc/wireguard/wg0.conf /root/wg0.conf.$(date +%F-%H%M)
sudo wg-quick down wg0
ls /sys/class/net/wg0 2>/dev/null || echo "interface is gone"
sudoedit /etc/wireguard/wg0.conf
sudo wg-quick up wg0

Umugqa wesipele awusona isiko. Uma ithumbu liyindlela yakho yokufinyelela lo mshini, isinyathelo sokwehlisa singaqeda isikhathi sakho, futhi ikhophi kudiski kanye nekhostolo noma indlela engaphandle kwebhande iwukuphela kokubuyisela okusebenzayo. Hlola lowo mugqa wesibili ngaphambi kokuwethemba: igama lesixhumi esidala kuskripthi esihluleka buthule iyona ndlela abantu abahlela ngayo ifayela elisaphila.

Ukusetha i-SaveConfig = false ngaphambi kokwehlisa okuvamile kungenye indlela eyamukelekayo, futhi kufanele kwenziwe efayeleni i-wg-quick elilifunda ngempela. Lokhu kuvimbela lokho kugcinwa okuzenzakalelayo okukodwa. Akwenzi iphrofayela ehlukile ye-NetworkManager, ukukhishwa kwerawutha noma indawo yokungena yekhontheyna ilayishe kabusha izinguquko zakho, ngoba labo baphathi abalifundi nhlobo leli fayela.

Sebenzisa izinguquko ze-peer ngaphandle kokudabula isixhumi

Akukho kuhlela okudinga ukuphazamiseka. Izinguquko ezisezingeni le-peer zingasetshenziswa kusixhumi esisebenzayo ngokuguqula ifayela libe ukuhlela nokukuvumelanisa, lokhu okugwema ngokuphelele isinyathelo sokwehlisa futhi ngakho kugwema ukugcinwa:

sudo wg syncconf wg0 <(sudo wg-quick strip wg0)
sudo wg show wg0 peers
sudo wg show wg0 latest-handshakes

Isinyathelo se-strip sibalulekile. Siphrinta ifayela ngokukhipha okhiye abangaba-ka-wg-quick kuphela, ukuze amakheli, i-DNS nemiyalelo yomzila kungayi ethuluzini engayiqondi. Bese ukuvumelanisa kusebenzisa ama-peer nokhiye kudivayisi ephilayo ngaphandle kokwakha kabusha isixhumi, ngakho izikhathi nemizila ekhona ziyasinda.

Yiba nembe ngemikhawulo. Ukuvumelanisa ama-peer akushintshi ikheli lesixhumi, imizila eyengezwe yi-wg-quick noma ukuhlela kwesixazululi, ngoba akukho kwalokho okungeye-divayisi ye-WireGuard. Ukwengeza i-subnet ku-AllowedIPs nokulindela ukuthi i-kernel iyihambise kuwukufunda okungalungile okuvamile; umzila kufanele wengezwe yi-wg-quick ngesikhathi sokuphakamisa noma nguwe.

Hlola ukuthi isixhumi ngesikabani ngaphambi kokuhlela noma yini

Kudeskithophu noma kuseva ephethwe uhlelo lokuhlela, ifayela lingaba umphumela hhayi ukufaka. Ukuxhumana kwe-NetworkManager, iphrofayela eyenziwe yiravutha noma iskripthi sokuqala sekhontheyna konke kungaba ngumnikazi wegama elifanayo lesixhumi, futhi kuleso simo ukulandelana kwe-wg-quick okungenaphutha kusengahlela into engalungile.

systemctl status wg-quick@wg0 --no-pager
nmcli connection show | grep -i wireguard
sudo wg showconf wg0 | head -n 5

Umyalo wesithathu uphrinta ukuhlela okukhona ngendlela efanayo nefayela, kuhlanganise nokhiye oyimfihlo, lokhu okusiza ekuqhathaniseni futhi kuyingozi kuthikithi. Kufihle ngaphambi kokunamathisela; ukhiye oyimfihlo emseleni wosekelo ukuphulwa okungapheli, hhayi iphutha lokuthayipha.

Uma iyunithi yesevisi ingasebenzi kodwa isixhumi sikhona, okunye okuthile kwasidala futhi ifayela alinagunya. Lowo mbono owodwa wonga ihora lokuhlela ifayela okungekho okulifundayo.

Qinisekisa ukuqala kabusha okulandelayo, bese ugcina ukubuyisela

Isivivinyo esibonisa ngempela ukulungiswa ukuqala kabusha kwesibili, ngoba yilokho kulandelana okwahluleka okokuqala. Qinisekisa ukuthi i-peer iyasinda futhi ukuhlela okukhona kusafana nalokho okukudiski:

sudo systemctl restart wg-quick@wg0
sudo wg show wg0 latest-handshakes
sudo grep -c '^\[Peer\]' /etc/wireguard/wg0.conf

Gijima ukuqala kabusha kabili. Ukudlula okuhlanzekile kanye kungaba inhlanhla: ukuqala kabusha kokuqala kungase kusebenzise ushintsho lwesikhathi sokusebenza olwalungakagcinwa, ngakho okwesibili yikho okutshela ukuthi ifayela nokusebenza kwavumelana ekupheleni kokokuqala.

Gcina isipele kusukela ekuqaleni kwenqubo kuze kube usuqedile ukuqala kabusha okukabili, bese usisusa noma usihambisa ngaphandle kwedijithali yokuhlela. I-wg0.conf.bak elahlekile eduze kwefayela langempela ayinangozi ku-wg-quick futhi iyadida umuntu olandelayo, ozohlela okungalungile ekugcineni.