Okumele i-VPS ikuvumele ngaphambi kokuba isingathe i-VPN yakho

I-instance iyaqala, ukufakwa kwamaphakethe kuyaphumelela, futhi insizakalo ibika isimo sokusebenza, kodwa akukho okuxhumayo. Leli phethini livamile kumaseva angasese abonakalayo, ngoba isivakashi esifinyelela ku-inthanethi ngokukhululekile sisengase singakwazi ukudala isixhumi esifunwa iphrothokholi yakho. Izivivinyo ezinhlanu zihlukanisa umsingathi ongakwazi ukukhonza ithumbu kusuka kulowo obonakala elungile kuphela, futhi isivivinyo sokuqala esihlulekayo ngokuvamile sichaza konke okulandela. Ngayinye ishibhile ukuyiqalisa futhi iphetha ngesinqumo hhayi ngenothi.

Qinisekisa isixhumi esidingwa iphrothokholi

OpenVPN phezu kwe-TUN kudinga idivayisi yezinhlamvu kanye nemojuli ye-kernel engemuva kwayo; i-WireGuard idinga ukusekelwa kwayo kwe-kernel noma ukusetshenziswa kwendawo yomsebenzisi okunezinto ezilindelekile ezihambisanayo. Amakhonteyina aphethwe angase abelane nge-kernel yomsingathi engayivezi neze idivayisi, futhi amanye amaplathifomu awakuvumeli ngokuphelele ukudala izixhumi zethumbu kungakhathaliseki ukuthi kufakwe ini.

Vivinya amandla esikhundleni sokufunda ikhasi lokusekelwa, ngoba amalebula okumaketha ashintsha ngokushesha kunemikhawulo engaphansi. Uhlu lwezici olubhalelwe uhlelo olulodwa lungase lungayichazi i-kernel isivakashi esisebenza kuyo ngempela. Imiyalo emibili emifushane iyaphendula umbuzo ngezinkinga ezisetshenziswa kakhulu, futhi yomibili iyazihlanza ngemuva kwayo. Imiyalo engezansi ayakhi lutho oluhlala njalo futhi isuswa ngokushesha.

sudo ip tuntap add dev tun9 mode tun
sudo ip tuntap del dev tun9 mode tun
sudo ip link add wgtest type wireguard && sudo ip link del wgtest

Ukunqatshwa kuqembu lokuqala kusho ukuthi i-TUN ayitholakali futhi imodi yokuzenzakalela ye-OpenVPN ayikwazi ukuqala; ukunqatshwa emugqeni wokugcina kusho ukuthi isixhumi se-kernel se-WireGuard asikho. Okwe-kernel incwadi ye-kernel mayelana ne-TUN/TAP ichaza idivayisi evivinywa isivivinyo sokuqala. Akukho kokubili lokhu kwehluleka okulungiswa ngokufaka kabusha iphakethe le-VPN.

Khumbula ukuthi indlela engenayo inabanikazi ababili

Imithetho yenethiwekhi yomhlinzeki kanye ne-firewall yesivakashi kuyizinhlelo ezihlukene, futhi ithrafikhi kufanele yeqe kokubili. Isilaleli esiboshelwe esivakashini asisho lutho uma iqembu lokuphepha lomhlinzeki lilahla imbobo, futhi umthetho ovulekile womhlinzeki awenzi lutho uma isivakashi senqaba iphakethe. Qinisekisa isilaleli, bese kuba yimithetho yesivakashi, bese kuba yiphaneli yomhlinzeki, ngalolo hlelo, futhi uqinisekise iphrothokholi kanye nenombolo yembobo. Ukugxuma ngqo kuphaneli yomhlinzeki iyona ndlela abantu abavula ngayo ububanzi ababengabudingi.

I-UDP iyisisulu esijwayelekile: amaplathifomu amaningi avumela i-TCP ngokuzenzakalela futhi abheka imithetho ye-UDP njengokufakwa okuhlukile. Uma i-instance ingemuva kwe-NAT yomhlinzeki esikhundleni sokuba nekheli lomphakathi, ukudlulisela izimbobo ohlangothini lomhlinzeki kuba ukuhlelwa kwesithathu okufanele kuvunyelwane ngakho.

Hlela indlela yokubuya, hhayi ukuphuma kuphela

Insizakalo yethumbu eligcwele idinga ukudlulisela okuvuliwe, uhlelo lokuhumusha noma lokuhlela ithrafikhi yamaklayenti, kanye nendlela yokubuya efinyelela iqoqo lamaklayenti. Ukuvula isilaleli akukunikezi lokhu. Ithumbu elisungulwayo kodwa elingathwali ithrafikhi ewusizo ngokuvamile lehluleka lapha hhayi ekugunyazweni. Thatha ukuxhawulana okuphumelelayo njengokuqala kokuxilonga, hhayi ukuphela kwayo.

Bhala uhlelo njengezinqumo ezintathu ezicacile: ukuthi amaklayenti athola luphi ububanzi bomthombo, ukuthi ithrafikhi yawo iphuma kanjani iye ku-inthanethi, nokuthi izimpendulo zithola kanjani indlela yokubuya. Bese uqinisekisa ukuthi i-kernel iyavumelana nohlelo ngaphambi kokuhlola iklayenti, ukuze ukungafani okuthulile kungathathwa njengokungahambi kahle ohlangothini lweklayenti.

sysctl -n net.ipv4.ip_forward
sudo nft list ruleset | head -n 40
ip -4 route show default

Nquma udaba lwe-IPv6 ngokusobala

I-IPv6 iza ngezindlela ezimbalwa eziziphatha ngendlela ehlukile esangweni: ikheli ku-instance, isiqalo esihleliwe, noma lutho. Isiqalo esihleliwe kuphela esivumela iseva ukuthi inikeze amakheli kumaklayenti ngendlela ejwayelekile. Ukucabanga ukuthi ikheli le-IPv6 elisebenzayo kumsingathi lisho isiqalo seklayenti esisebenzisekayo iyiphutha elivela kamuva njengokuxhumana okuphukile phakathi. Lolu uhlobo lwephutha oludlula zonke izivivinyo ezenziwa nge-IPv4 kuphela.

Uma umhlinzeki engahleli isiqalo, nquma ukuthi ithumbu lingele-IPv4 kuphela yini nokuthi amaklayenti kufanele atshelwe yini. Ukungabikho okubhaliwe kuphephile kunokuhlelwa okuyingxenye okujikijela ngokuthula izindawo ze-IPv6 emgodini omnyama kubasebenzisi abaxhunyiwe.

Kufakazela kusuka kuklayenti langaphandle

Isimo sensizakalo sasendaweni sichaza inqubo eyodwa kumsingathi oyedwa. Isivivinyo esiwusizo yiklayenti eligunyaziwe kunethiwekhi ehlukile, elixhuma ngephrofayela ohlose ukuyisabalalisa, bese lifinyelela uhlelo lokusebenza futhi lixazulule igama. Xhuma futhi kanye, ngoba ithumbu elisebenza kuphela emzamweni wokuqala alihlangabezani nemfuneko ebaluleke kakhulu empilweni.

sudo wg show wg0 latest-handshakes
ip -4 route get 203.0.113.44
sudo journalctl -u wg-quick@wg0 -n 15 --no-pager

Gcina izisekelo zokusebenza eceleni kwesivivinyo: indawo yezibuyekezo, amalogi anomkhawulo, ukufinyelela kokuphatha okungathembele kuthumbu, ikhonsoli yokubuyisela, kanye nenothi mayelana nokwenzeka kumaphrofayela amaklayenti lapho i-instance yakhiwa kabusha futhi ikheli layo lomphakathi lishintsha. Uma isixhumi noma imodeli yokudlulisela edingekayo ingekho nje, akukho shintsho ohlangothini lweklayenti oluzoyinikeza, futhi isinyathelo esilandelayo esethembekile uhlobo oluhlukile lwe-instance hhayi ukuhlelwa okwengeziwe.