Ingabe iklayenti le-WireGuard alikwazi ukufinyelela iklayenti le-OpenVPN?

Womabili amathumbu ayaxhuma, iklayenti ngalinye lifinyelela isango, futhi ngesikhathi esisodwa lapho elinye lizama ikheli lenye, amaphakethe ayanyamalala. Akukho okungalungile ekuxhumaneni kwezandla kokubili, futhi ukukhipha kabusha okhiye akukushintshi lokho. Isango lithwala amaphakethe e-IP avamile angabhalwanga phakathi kwezindawo zalo ezimbili, ngakho izinqubo akudingeki ziqondane; ezikudingayo yizinto ezintathu okungekho kuxhumana kwezandla okuzinikezayo. Ukusibekela kwendawo kuklayenti lomthombo, ubunikazi bomthombo esangweni kanye nomzila wokubuya ohlangothini olukude. Isibonakaliso siyefana kuzo zontathu, ngakho zihlolwa ndawonye.

Isibonakaliso siswele ingxenye eyodwa ngesikhathi

Lo mklamo usebenzisa ichibi le-WireGuard 10.71.0.0/24 ku-wg1 nechibi le-OpenVPN 10.72.0.0/24 ku-tun1, kokubili kuphela esangweni elilodwa. Isicelo esihlolwayo sihamba sisuka ku-10.71.0.5 siye ku-HTTPS ku-10.72.0.30. Isinyathelo ngasinye esingezansi sikhuluma ngalowo mfudlana owodwa. Ukuhlola ngakunye kunophawu olwahlukile lokuhluleka nakuba umsebenzisi ekuthola ngendlela efanayo, futhi ngokuvamile kuswele okukodwa kwezintathu ngesikhathi.

Qala ngokuqinisekisa ukuthi womabili amachibi asesangweni sona lesi nokuthi ukudlulisa kuvuliwe endaweni yamagama lapho amathumbu akhona. Isango eliqeda zombili izinqubo ezindaweni zamagama ezihlukene akudlulisi lutho phakathi kwazo, futhi kufanele lokho kukhishwe ngaphambi kokufunda noma yikuphi ukuhlelwa kwe-peer.

Nweba ukusibekela kwendawo kwegatsha

Kuklayenti le-WireGuard, umugqa we-peer okhona kufanele ukhethe isango lendawo ye-OpenVPN, okusho ukuthi isiqalo sendawo kufanele sivele ohlwini oluvunyelwe lwaleyo peer. Ukunezela akudali ithumbu lesibili; kushintsha ukuthi iklayenti likhetha iyiphi peer lapho lifuna lelo kheli, futhi nge-wg-quick umzila ngokuvamile ulandela uhlu ngokuzenzakalela.

AllowedIPs = 10.71.0.0/24, 10.72.0.0/24

Shiya imigqa yangempela yokhiye neyendawo yokugcina ingathintwanga, futhi khumbula ukuthi umphathi osebenzisa i-Table = off akathathi noma yimuphi umzila kulolu hlu. Esimweni esinjalo isiqalo esifanayo kufanele sifakwe kuthebula lemizila yohlelo ngumnikazi waso, futhi umzila ongekho lapho ubukeka ufana ncamashi nesiqalo esivunyelwe esingekho.

Gcina ubunikazi bomthombo esangweni

Umugqa we-peer waleli klayenti esangweni kufanele uqhubeke unomnikazi wakho ikheli lomthombo lalelo klayenti. Amakheli avunyelwe ahlolwa nhlangothi zombili: akhetha i-peer yethrafikhi ephumayo futhi aqinisekise ukuthi umthombo wephakethe elingenayo ungowalowo peer eyilithumelile. Ukubeka ichibi le-OpenVPN kumugqa wegatsha ngoba igatsha lifuna ukulifinyelela yilona phutha elihambisa ithrafikhi kumhlanganyeli ongafanele.

AllowedIPs = 10.71.0.5/32

Funda lowo mugqa njengesimemezelo sobunikazi hhayi njengelula yomzila. Konke okunye iklayenti okufanele kufinyelele kukho kungokohlu lwezindawo zeklayenti, hhayi okomcabango wesango lokuthi le peer ivunyelwe ukuthumela ini.

Nika uhlangothi lwe-OpenVPN umzila wokubuya

Indawo manje idinga umzila obuyela emthonjeni we-WireGuard, futhi kumaklayenti echibi ngokuvamile ufika njengomzila ophushwayo ovela kuseva ye-OpenVPN. Yiphusha kuphela kumaklayenti okufanele abe nawo, futhi kuqinisekisa kuklayenti ukuthi yamukelwe esikhundleni sokucabanga ukuthi umyalo usetshenzisiwe.

push "route 10.71.0.0 255.255.255.0"

Ukusatshalaliswa kwemizila akulona igunya. Lapho indawo ingekho echibini kodwa ingemuva kwenye iklayenti le-OpenVPN, ubunikazi be-LAN balelo klayenti ngokwalo kanye nezimfuno zalo zokudlulisa kuyayingena idizayini, futhi umzila ophushwayo uyingxenye yokuqala kuphela. Phinda ubhale isidingo njengeshadi ngaphambi kokwengeza imiyalo: iyiphi indawo ephethe isiqalo sini, futhi iyiphi indawo edlulisela kuso.

Vumela kuphela loyo msebenzi owawuhlosile ukuwuvumela

Lapho ukudlulisa kuvuliwe futhi womabili amachibi enza imizila, umbuzo osele ngowenqubomgomo. Bhala umthetho womfudlana othile hhayi wababili bezindawo ngokujwayelekile, uwubone ngaphambi kokuwusebenzisa, futhi gcina umzila wokubuya onesimo ukuze izimpendulo zingavinjwa njengezixhumo ezintsha. Ukugijima okomile akubizi lutho futhi kukhombisa ngokunembile okuzokwengezwa.

sudo ufw --dry-run route allow in on wg1 out on tun1 proto tcp from 10.71.0.5 to 10.72.0.30 port 443

Lezi yimithertho yethrafikhi edlulisiwe, ehlukile emithethweni yokulalela yesango yezinsizakalo ezimbili ze-VPN. Ukuvula izimbobo ze-UDP zangaphandle akuvumeli isicelo sangaphakathi, futhi ukuvumela isicelo sangaphakathi akudingi i-SSH engenamkhawulo esangweni noma imvume yokuzenzakalela ekudluliseni. Ne-firewall yendawo ngokwayo nekheli lokulalela kufanele kuhambisane, ngoba insizakalo eboshelwe ku-loopback yenqaba ngisho iphakethe elenzelwe umzila ngokucophelela okukhulu. Inqubomgomo evala uhlangothi olulodwa kuphela lwengxoxo ivamise ukwehluleka ngesicelo esiphumelelayo nempendulo ethule, okuwumphumela odida kakhulu kwezintathu.

Imizila yomibili ngokuvamile isho ukuthi akudingeki ukuhunyushwa komthombo, okugcina ikheli le-WireGuard endaweni futhi kwenza amalog kulula ukuwafunda. Ungangezi i-masquerading ebanzi ngenxa yokuthi izinqubo ezimbili zihilelekile, futhi ungakususi umthetho wokuhumusha okhona ngaphandle kokwazi ukuthi yini encike kuwo. Bese uqinisekisa umfudlana owodwa kusukela ekuqaleni kuze kube sekugcineni, futhi uhlole nomthombo noma imbobo eyodwa engavunyelwe: ukuxhumana kwezandla okusebenza kuzo zombili izinhlangothi akufakazi umzila ophambanayo noma ukwehlukaniswa.