WireGuard AllowedIPs: umzila ongakaze wengezwe yi-NetworkManager

Isibali sokuxhawulana kwezandla siyahlaziywa, i-interface igcina ikheli layo, futhi i-ping eya kolunye uhlangothi ayifinyeleli ndawo. Le nhlanganisela idida abantu, ngoba ukuxhawulana kwezandla okusebenzayo kubonakala njengobufakazi bokuthi ithaneli isilungile. Akunjalo: ithaneli lingase lixoxiswane ngokuphelele futhi lingabi nawo nowodwa umzila ohambisa ithrafikhi kuwo, futhi leyo imisebenzi emibili ehlukene eyenziwa izingxenye ezimbili ehlukene zesimo. Ukulungisa kuncike ngokuphelele ekutheni iyiphi kulezi ezimbili engekho, ngakho isinyathelo sokuqala ukuthola lokho.

I-wg-quick yenza kokubili ngaphandle kokucelwa. Ukusekelwa kwe-WireGuard okwakhelwe ngaphakathi ku-NetworkManager nakho kufaka imizila ye-peer ngokuzenzakalelayo, okunciphisa abasolwayo kunketho evaliwe, kwelinye ithebula lokuhambisa, noma kukho ukulungiselelwa okungeniswe ngenye into.

Qinisekisa ithaneli ngaphambi kokulandela umzila

wg show iphrinta i-interface, i-peer, iphoyinti lokugcina kanye nobudala bokuxhawulana kwezandla kokugcina, futhi i-ip addr show iqinisekisa ukuthi ikheli likhona. Ukuxhawulana kwezandla kwakamuva kusho ukuthi okhiye, iphoyinti lokugcina kanye nomzila we-UDP kuyasebenza. Konke okugawulile kuhlezi ngaphansi kwako: ukuhambisa, ukuhlunga noma ukuxazululwa kwamagama.

Bese ubuza i-kernel ukuthi izokwenzani ngendawo yokuphela yangempela esikhundleni yeyokucabanga: ip route get 10.42.7.9. Impendulo isho i-interface ephumayo kanye nekheli lomthombo ephakethe elizoluthwala. Lapho isho i-adaptha ebonakalayo, iphakethe aliweli neze ethanelini, kungakhathaliseki ukuthi ukuxhawulana kwezandla kubukeka kuphilile kangakanani.

I-AllowedIPs iyisihlungi kanye nohlu lwemizila

Amaqembu okuqala e-AllowedIPs enza imisebenzi emibili. Akhetha ukuthi iyiphi i-peer ethwala indawo yokuphela ephumayo, futhi aqinisekisa ikheli lomthombo lamaphakethe angenayo, okuwumngcele wokuhambisa ngokhiye wokubhala. Ku-wg-quick futhi aqhubela ukufakwa kwemizila okuzenzakalelayo, futhi yileyo ndlela eyengeziwe iyisizathu sokuthi ukulungiselelwa okufanayo kusebenze kusuka kutheminali hhayi kusuka kuklayenti yedeskithophu.

Esimweni esingemuva kwale ndatshana, iphrofayela yangeniswa ngeseluli yomuntu wesithathu hhayi ngokusekelwa okwakhelwe ngaphakathi, futhi i-interface yavuka ngaphandle komzila weqembu lokuqala. Ukufaka ithebula ohlwini kukhombisa lokho ngokushesha: i-ip route show iqukethe kuphela umzila oxhunyiwe wekheli le-interface, futhi akukho lutho lwebanga elikude.

Buza ukuthi imizila ye-peer ivuliwe nhlobo yini

Funda ukulungiselelwa ngaphambi kokushintsha noma yini: nmcli -f wireguard.peer-routes,ipv4.route-table connection show work-wg. Lapho i-peer-routes ibonisa i-no, ukulungiswa okusekelwayo yi-nmcli connection modify work-wg wireguard.peer-routes yes, kulandele ukuxhuma kabusha. Ukwengeza umzila ongaguquki esikhundleni salokho kusebenza kuze kube ukuqalisa okulandelayo bese kunyamalala buthule. Lokho kunyamalala yikho okuyisikhombisi: umzila obuya njengemfihlakalo njalo ekuseni awufakwanga yiphrofayela.

Uma inketho isivele ivuliwe, hlola ukuthi iqembu lokuqala lihlala kwelinye ithebula nge-ip route show table all | grep 10. Umzila osethebuleni okungewona oluyinhloko awukashoda, awubonakali nje ekusesheni okubheka ithebula eliyinhloko kuphela. Lungisa ukuhambisa kwengqubomgomo esikhundleni sokunqwabelanisa umbhalo ophindwe kabili phezulu.

Engeza iqembu lokuqala kuxhumano, hhayi kusistimu esebenzayo

Kuhleli lokuxhumanisa, ikhasi le-WireGuard ligcina i-peer ne-AllowedIPs yayo, kanti ikhasi le-IPv4 ligcina imizila eyengeziwe. Umzila owengezwe lapho uhlala ukhona ngemva kokuxhuma kabusha ngoba ungowuphrofayela. Emgqeni womyalo okulingana nakho ukunamathisela umzila kuxhumano ngendlela yesango elingenalutho, bese wehlisa futhi ukhuphula uxhumano ukuze ushintsho lusebenze.

Khetha iqembu lokuqala elincane kakhulu elihlanganisa amahosthu owadingayo. Ukukopisha isibonelo sika-/8 somhlinzeki kungagwinya izigaba zasendaweni ezingena ngaphakathi kwaso ngengozi, futhi ukwehluleka okuvelayo kubonakala njengethaneli ephukile hhayi umzila obanzi kakhulu.

Ithaneli elihlukanisiwe linqunywa uhlu lwamaqembu okuqala

Asikho iswishi yethaneli elihlukanisiwe; uhlu lwamaqembu okuqala yisinqumo. I-peer enesigaba esisodwa se-LAN yasehhovisi nesinye senethiwekhi yaselabhorethri ithumela lezo zindawo zokuphela ngqo ethanelini futhi ishiya konke okunye. Ihosthu eyodwa idinga u-/32, futhi izigaba ezihlangana ezindaweni ezimbili zidinga amaqembu okuqala ehosthu kuze kube umuntu uphinda inamba yesubnethi.

Ukukhetha ukungathumeli lutho ethanelini kuhambisa leso sinqumo emngceleni waso: uhlu oluncane lugcina isixhumanisi siphezulu kuyilapho ithrafikhi evamile ilandela indlela yayo evamile. Bhala inhloso phansi, ngoba uma kungenjalo umfundi olandelayo uzothatha uhlu olufushane njengokunganaki futhi alwandise ngomusa.

Umnikazi oyedwa wethebula lemizila

I-wg-quick ne-NetworkManager zombili zikholelwa ukuthi zingabanikazi bemizila ye-interface. Ngenisa ukulungiselelwa okwalungiselelwe i-wg-quick bese uqalisa futhi insizakalo ye-wg-quick, futhi uzothola imibhalo ephindwe kabili noma engqubuzanayo okuziphatha kwayo kuncike ekutheni iyiphi egcine ukusebenza. Khetha umnikazi oyedwa bese ususa omunye: uma i-NetworkManager ilawula uxhumano, khubaza iyunithi ye-wg-quick yaleyo interface, futhi ungaze wengeze iphrofayela yesibili kudivayisi efanayo.

Lapho ukuhlukanisa kufanele kulandele i-adaptha ebonakalayo hhayi indawo yokuphela, usuwedlulele ekuhambiseni kwengqubomgomo, futhi ukuhambisa kwengqubomgomo nakho kudinga umbhali oyedwa. Qinisekisa ngokuphinda i-ip route get, bese ufinyelela ihosthu engaphakathi kweqembu lokuqala elikude ngento ephrinta ikheli lomthombo elikhethile. Hlola i-IPv6 ne-DNS ngokwehlukana uma iphrofayela ithwala enye yazo.