I-AllowedIPs iwuhlu lokuhambisa, akusona isimiso se-firewall

Iningi labantu lifunda i-AllowedIPs njengohlu lwezimvume, okungukuthi amakheli angaxhuma ku-peer, cishe njengomthetho we-firewall obhalelwe ithumelo. Akusona leso. Le nkambu iyithebula lokuhambisa elisebenza kuzo zombili izinhlangothi: ikhetha i-peer yephakethe eliphumayo futhi iqinisekisa umthombo wephakethe elingenayo. Ukuyifunda njengohlu lokufinyelela kukhiqiza izilungiselelo ezihambisa ithrafikhi okungekho muntu oyicelile.

Inkambu eyodwa, abafundi ababili: ukukhetha okuphumayo nokuhlola umthombo

Kuklayenti, iziqalo zinquma ukuthi yiziphi izindawo eziya kuleyo peer futhi yiziphi ezihlala kunethiwekhi evamile. Ngakho-ke ingeno ka-0.0.0.0/0 ibamba yonke indawo ye-IPv4, futhi yingakho ukungenisa iphrofayela yethumelo eliphelele kuthumela ukuphequluka okuvamile ngomshini okude. Izingeno ezincane zenza okuphambene: zihambisa kuphela amanethiwekhi owabhalile futhi zishiya konke okunye lapho bekukhona. Isigaba sokuhambisa kokhiye bokushoqa emibhalweni ye-WireGuard sisho imisebenzi yomibili endaweni eyodwa: ukukhetha i-peer ephumayo nokuqinisekisa umthombo ongenayo.

Kuseva, leyo nkambu ifanayo ichaza ukuthi yimaphi amakheli omthombo i-peer ngayinye engawasebenzisa. Lokhu ukuhlola kwe-cryptographic hhayi isihlungi samaphakethe: iphakethe elinomthombo wangaphakathi ongahambisani nohlu lwe-peer liyaphonswa ngaphakathi kwe-WireGuard ngaphambi kokuba noma iyiphi i-firewall ye-host ilibone. Imisebenzi yomibili yabelana ngohlu olulodwa, futhi yingakho uhlu olukotshwe kwenye indawo luziphatha kabi endaweni ongayicabangile.

Ibhlokhi yeklayenti iyindawo lapho iningi lalokhu kudideka liqala khona. Ithumelo elihlukanisiwe lisho amanethiwekhi akude, futhi ithumelo eliphelele iyona nkambu efanayo enesiqalo esizenzakalelayo:

[Peer]
# split tunnel: only these networks
AllowedIPs = 10.77.0.0/24, 192.168.30.0/24

[Peer]
# full tunnel: everything, both families
AllowedIPs = 0.0.0.0/0, ::/0

Zombili izinhlobo ziphelele ngokwazo, futhi ziyizindlela ezehlukene hhayi izinyathelo. Eyokuqala ithumela kuphela lawo manethiwekhi amabili ngethumelo; eyesibili ithumela yonke indawo, futhi ingeno ye-::/0 yengeza i-IPv6 kusiqalo esizenzakalelayo se-IPv4. Noma yikuphi okukhethayo, lezo ziqalo ziyisinqumo sonke sokuhambisa sale peer uma i-wg-quick isiqala ukufaka imizila.

I-hub idinga uhlu oluhlukile

I-hub ibala ikheli lethumelo leklayenti ngalinye njengesiqalo se-host, kanye nanoma iyiphi inethiwekhi emile ngempela ngemuva kwalelo klayenti. Ukukopa uhlu olubanzi lweklayenti kuwo wonke ama-peer e-hub kutshela i-hub ukuthi ama-peer amaningi angasebenzisa amakheli afanayo njengomthombo, futhi lokho akulona uhlelo lwamakheli. Inkambu ye-Endpoint ingeyelinye ngokuphelele igxathu: isho ikheli langaphandle neport ye-peer, ayisho neze indawo ngaphakathi kwethumelo.

[Peer]
# laptop: tunnel address 10.77.0.2, office LAN behind it
AllowedIPs = 10.77.0.2/32, 192.168.30.0/24

Isiqalo se-host sithwala ikheli lethumelo futhi isiqalo senethiwekhi sithwala lokho okungemuva kweklayenti, futhi kokubili kuyadingeka. Ngaphandle kwesiqalo se-host i-hub ayikwazi ukubuyisela ithrafikhi yeklayenti uqobo, futhi ngaphandle kwesiqalo senethiwekhi i-LAN engemuva ihlala ingafinyeleleki; i-peer engenalutho ngemuva kwayo ithola kuphela isiqalo se-host.

Ukweqa ukufakwa kwemizila kushiya isikhala

I-wg-quick, umsizi ophakamisa i-interface kusuka kufayela lokucwangciswa, ifaka amakheli e-interface nemizila njengengxenye yalowo msebenzi. Ukusetha i-Table = off kutshela umsizi ukweqa umsebenzi wemizila, lokho okungafaki okunye esikhundleni futhi okungenzi inethiwekhi yangasese ifinyeleleke. Uma imizila ezenzakalelayo isivele yenza umsebenzi, ukusho iziqalo ozidingayo kuwukucwangciswa okucacile. Ukucisha ukuphathwa kwemizila nokushiya okunye esikhundleni kungabhalwanga akusona isakhiwo, kuwukweqiwa.

Ithuluzi eliyisisekelo i-wg lenza okuhlukile: licwangcisa i-interface futhi alithinti imizila neze, ngakho-ke ukusethwa okwakhiwe kulo ngqo kudinga imiyalo yalo yemizila. Imiyalelo ebhalelwe ithuluzi elilodwa ingabonakala ingalungile uma ilandelwa kwelinye. I-ping ephumelelayo nayo ingubufakazi obuthaka, ngoba ihlola umzila owodwa hhayi wonke umzila wohlelo lokusebenza owudingayo.

I-DNS ne-IPv6 kunqunywa ngokwehlukana

Hlola ikheli leseva ye-DNS elimenywa ithumelo, futhi uqinisekise ukuthi umzila oya kulelo kheli ukhona ngeziqalo ozikhethile. Ukusetha isixazululi akwenzi isixazululi sifinyeleleke, futhi ukunciphisa ithumelo kungase kususe buthule umzila owawuhola lapho. Hlola ne-IPv6 ngokwayo, ngoba ukwehlukaniswa okulungile kwe-IPv4 akusho lutho ngomzila osizenzakalelayo we-IPv6 osakhomba kuxhumano lomzimba. Izinqumo ezintathu ezihlukene zingashintsha ngesikhathi esisodwa uma uhlela ibhlokhi eyodwa ye-peer.

Bese uvula insiza yangasese eyodwa newebhusayithi evamile eyodwa kusuka kucwangciso lokuqala olwaziwayo. Uma insiza iphendula futhi ukuphequluka kusaphuma ngoxhumano lwasendaweni, ukwehlukaniswa kwenza lokho obukucelile. Uma ukuphequluka kuphuka ngaso leso sikhathi, ithumelo lithathe umzila osizenzakalelayo futhi uhlu lweziqalo yindawo okufanele ibhekwe.