I-handshake ye-WireGuard iyasebenza kodwa akukho i-internet: landela iphakethe
I-handshake ifakazela kuphela okhiye nokufinyeleleka. Landela iphakethe elilodwa lisuka ku-AllowedIPs lidlula ekudluliseni, i-NAT kanye nomzila wokubuyela ukuze ubone lapho lima khona.
Umhubhe uyasebenza, i-wg show ibika i-handshake yakamuva, ungakwazi ukupinga ikheli lomhubhe leseva, futhi akukho okunye ngale kwayo okuphendulayo. Umcabango wokuqala ukukhiqiza kabusha okhiye noma ukwaba kabusha ukulungiselelwa. Lokho kushintsha leyo ngxenye yomzila osekuvele kufakazelwe ukuthi iyasebenza.
I-handshake eqediwe ithi izinhlangothi zombili zivumelana ngokhiye, i-UDP ifinyelela endaweni yokugcina, futhi ukuhlela umzila kwe-crypto kwamukela iphakethe. Ayisho lutho mayelana nokuthi iphakethe lingashiya iseva ngemuva kwalokho.
Ngakho landela iphakethe elilodwa esikhundleni sokuqagela. Zine izindawo lapho lingafa khona, futhi ngayinye ishiya umkhondo ohlukile.
I-handshake ifakazela ini ngempela
I-WireGuard iyiphrothokholi ye-UDP eyakha iseshini nge-handshake ye-Noise bese ibethela amaphakethe kumlingani. Uma i-wg show ikhombisa i-handshake yemizuzwana embalwa kanye nesibali sokudlulisa esikhulayo, indawo yokugcina, okhiye kanye nokhiye womphakathi womlingani konke kulungile.
Engakufakazeli khona ukuthi iklayenti lakho lithumela ithrafikhi ebheke ku-internet kusixhumi noma cha, ukuthi iseva ikulungele ukukudlulisa, noma ukuthi impendulo ingathola indlela yokubuya. Lezo izinqumo zokuhlela umzila kwe-kernel kanye ne-firewall, futhi zithathwa ngaphandle komhubhe.
Yingakho ukupinga ikheli lomhubhe leseva kuwukuhlolwa okudukisayo kangaka. Lelo phakethe liqondiswe kuseva uqobo, ngakho liphela endaweni. Alidingi ukudluliswa nakanye, alidingi ukuhunyushwa nakanye, futhi alidingi umzila wokubuya osuka ku-internet nakanye.
I-AllowedIPs isinqumo sokuhlela umzila
Kuklayenti, i-AllowedIPs yenza imisebenzi emibili. Ithebula lokuhlela umzila ngokhiye we-crypto elinquma ukuthi yimaphi amakheli okufika angena emhubheni walo mlingani, futhi uhlu lwamakheli omsuka umlingani azowamukela kuwe. Uma ukulungiselelwa kweklayenti kufaka kuphela i-10.8.0.0/24, izindawo zomphakathi azingeni esixhumi futhi umzila wakho ojwayelekile we-default uzikhipha ngaphandle komhubhe. Ngaleso sikhathi umhubhe usebenza ngokuphelele futhi awenzi lutho kulokho obukufuna.
Bheka lokho iklayenti elikufakile ngempela, hhayi lokho okusho ifayela lokulungiselela:
wg show wg0 allowed-ipsip route get 1.1.1.1
Umyalo wesibili unquma. Uma impendulo isho isixhumi sakho somzimba kanye nesango elijwayelekile, iphakethe alidluliswa emhubheni futhi akukho shintsho ohlangothini lweseva oluzolungisa lokho. Engeza i-0.0.0.0/0 ye-IPv4 kanye ne-::/0 ye-IPv6 ngokwehlukana; umthetho obamba konke kumndeni owodwa ushiya omunye emzileni wawo wokuqala, futhi lesi yisizathu esivamile somhubhe we-IPv4 osebenzayo nokusesha kwe-IPv6 okumile.
Iphakethe lifa kuphi esangweni
Uma umzila ulungile futhi iphakethe lisaqhubeka lingayi ndawo, lifinyelela esevani futhi lima lapho. Izahluko ezine zihlanganisa amasango amaningi.
Ukudlulisa. I-sysctl net.ipv4.ip_forward ebuyisela u-0 iyimpendulo yakudala, futhi izabelo eziningi zisasebenza ngo-0 ngokuzenzakalela. Kufanele ibe ngu-1, futhi isethwe unomphela efayeleni le-sysctl hhayi ngomyalo onyamalalayo lapho kuqalwa kabusha. Ukudlulisa kwe-IPv6 kuyiswishi ehlukile.
Inqubomgomo yokuhlunga. Uchungechunge lwe-FORWARD olunomgomo we-drop ozenzakalelayo luzolahla ithrafikhi yomhubhe kodwa luvumele ithrafikhi eya kumtshini uqobo, futhi lokho kuhambisana ncamashi nezimpawu. Funda isethi yemithetho esebenzayo, hhayi ifayela eligciniwe: i-nft list ruleset noma i-iptables -S.
Ukuhumusha noma ukuhlela umzila. Amaklayenti asebenzisa amakheli omhubhe ayimfihlo adinga i-NAT yomsuka esixhumini sokuphuma seseva, noma isiqalo esihlelwe umzila isixhumi esingaphezulu esikwaziyo ukusibuyisela. Ukukhetha phakathi kwakho kokubili kulandela uhlelo lwamakheli. Ukwengeza i-MASQUERADE kunethiwekhi esivele ihlela umzila wesiqalo sakho sibuyele emuva akulimazi kodwa akunamsindo, futhi ukusishiya lapho kungekho umzila kushiya izimpendulo ziqondiswe kububanzi obuyimfihlo obungenakuhlelwa umzila.
Umzila wokubuya. Emiklamweni ehlelwe umzila, irutha engaphezulu idinga umzila okhomba esevani yakho. Inethiwekhi yomhlinzeki nayo ingakuvimba: amafu amaningana avula ukuhlolwa komsuka nendawo yokugcina ku-instance, okulahla buthule amaphakethe omsuka wawo okungewona ikheli le-instance uqobo, kuze kube yilapho lokho kuhlolwa kucishwa.
I-DNS yehluleka ngendlela ehlukile ekuhleleni umzila
Iphakethe eliya ekhelini elaziwayo nokusesha igama kuyizinto ezimbili ezihlukile zokwehluleka, futhi imilayezo yephutha idukisa ngezinhlangothi eziphambene. Uma i-ping 1.1.1.1 isebenza futhi isiphequluli singakwazi ukulayisha lutho, umzila ulungile futhi ukuxazululwa kwamagama akulungile. Uma i-ping uqobo yehluleka, i-DNS ayinamsebenzi futhi usubuyele esigabeni esedlule.
I-wg-quick ingasetha i-resolver kusuka emugqeni we-DNS = kokulungiselelwa, futhi i-systemd-resolved inokuziphatha kwayo isixhumi ngasinye. I-VPN eshintsha i-resolver ngekheli elifinyeleleka ngaphakathi komhubhe kuphela izokwehluleka zonke izinto zokusesha ngesikhathi umhubhe uwa, futhi lokho kubonakala sengathi umhubhe uwonakalisa i-internet.
| Symptom | Layer to inspect |
|---|---|
| Tunnel address pings, nothing else does | Client route, then gateway forwarding |
| Public IP pings, hostnames fail | Resolver selection and reachability |
| Handshake completes, no reply ever | FORWARD policy or missing NAT on the server |
| Small requests work, large transfers stall | MTU and TCP MSS clamping |
Ukulandelana okukhiqiza ubufakazi
Qala ngokuhlolwa ohlangothini lweklayenti, ngoba umyalo owodwa futhi ususa uhhafu wamathuba. Bese uqinisekisa ukuthi iseva yayenzelwe ukuba yindawo yokuphuma ku-internet ngempela; isango elakhelwe ukufinyelela okuyimfihlo aliphuli uma izindawo zomphakathi zehluleka.
Esevani, bheka isixhumi ngesikhathi uthumela i-ping kusuka kuklayenti: i-tcpdump -ni wg0 icmp kufanele ikhombise isicelo, futhi i-tcpdump -ni eth0 icmp kufanele ikhombise ukuthi liyaphuma, lihunyushiwe noma cha. Uma livela kwelokuqala futhi lingaveli nakanye kwelesibili, ukuma kungokwaseva uqobo. Uma liphuma futhi kungekho mpendulo ebuyayo, inkinga ingaphezulu, futhi lokho kungolunye udaba.
Ekugcineni yenza ukulungiswa kuhlale ngisho ngemuva kokuqalwa kabusha. Ukudlulisa kungokwasefayeleni le-sysctl, imithetho ye-firewall ingeyansizakalo eyifakayo, futhi imizila yeklayenti ingeyokulungiselelwa okuvusa isixhumi hhayi i-shell ozoyikhohlwa. Xhuma futhi, phinda lezo zivivinyo ezimbili, futhi uqinisekise ukuthi izibali ziyahamba.