Ukuxhawulana kwe-WireGuard kuyasebenza, kodwa inethiwekhi encane yasehhovisi ayiphenduli

Ukuxhawulana kuyaqedwa, wg show kubika ukudluliswa kwakamuva, futhi ikheli lethubhu leseva liyaphendula ku-ping. Kodwa isibungu esiku-LAN yeseva asiphenduli. Izimo ezintathu kufanele zibe khona ngasikhathi sinye: umthengi kufanele aqondise isiqalo se-LAN ethubhini, iseva kufanele idlulise amaphakethe, futhi impendulo idinga indlela yokubuya. Uma enye kwezintathu ingekho, uphawu luyafana.

I-AllowedIPs iwuhlu lokufinyelela nethebula yemizila ngasikhathi sinye

Kumthengi, uhlu AllowedIPs lunquma kokubili okungathunyelwa kulowo mlingani kanye nemizila efakwa yi-WireGuard. Umugqa womlingani oklebhula kuphela ikheli lethubhu leseva ufaka umzila owodwa wesibungu, ngakho izindawo ze-LAN azingeneleli ethubhini. Ukwengeza isiqalo se-LAN yinto yokuqala okufanele iqinisekiswe, futhi ukushintsha okuvame ukushoda ngemva kokopiswa kwesetho. Umlingani okhuliswe waze wafinyelela umzila ozimele uyisakhiwo esihlukile, futhi uzosusa nokuhamba kwe-inthanethi komthengi.

Gcina umzila wesibungu nesiqalo se-LAN njengemigqa ehlukene. Uma ihhovisi linamaxhumano amabili amancane, womabili asohlwini, futhi isiqalo sesibili esingekho sidala ukwehluleka okubonakala kukhethekile kunokuba kuphelele.

[Peer]
PublicKey = <server public key>
Endpoint = vpn.example.net:51820
AllowedIPs = 10.66.0.1/32, 192.168.50.0/24

Ukudluliswa nokuhumusha kungokweseva

Iseva idinga ukudluliswa kwe-IP okuvuliwe, umthetho wokudlulisa owamukela ukuhamba okuvela ethubhini, nomthetho wokuhumusha obheke ku-interface yayo ye-LAN. Ukuhumusha yikho okwenza isakhiwo sisebenze ngaphandle kokuthinta isibungu ngasinye kunethiwekhi yasehhovisi. Khona-ke izimpendulo zibuyela esevini esikhundleni sekheli i-LAN engakaze ilizwe. Ngaphandle kwakho, isibungu ngasinye sidinga umzila oya kumaxhumano amancane ethubhu nomthetho we-firewall okuvumelayo, okuyinto engavamile ukwamukeleka kunethiwekhi ephethwe omunye umuntu.

sysctl -w net.ipv4.ip_forward=1
iptables -A FORWARD -i wg0 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Imithertho engezwe ngesandla iyanyamalala lapho kuqalwa kabusha, ngakho yibophela ku-interface ngemiyalo ye-hook kusetho seseva. Iqoqo lemithertho eliphila isikhathi eside kune-interface yalo yikho okwenza umshini ugcine ngokuhumusha ukuhamba kwethubhu engasekho.

Lapho i-LAN yathutha khona umthetho awuthathanga

Ukushintshwa kwerutha eliphinde linombola amaxhumano amancane asehhovisi kuyindlela yakudala yalokhu kwehluleka. Ithubhu lihlala livuliwe, ukuxhawulana kuhlala kusha, futhi akukho lutho ngemuva kweseva oluphendulayo, ngoba umthetho wokuhumusha usabiza ikheli elidala. Izikripthi zokufaka zivame ukufaka ikheli le-LAN leseva kumthetho we-POSTROUTING, futhi ngemva kokunombolwa kabusha lelo kheli alikho kunoma iyiphi i-interface. Amaphakethe abe esebhalwa kabusha aya endaweni engeke iphendule.

iptables -t nat -n -L POSTROUTING
ip -br addr show

Qhathanisa imiphumela emibili. Umkhombandlela wokuhumusha ongabonakali ohlwini lwama-interface yiwo iphutha, futhi ukulungisa kungukushintsha umugqa owodwa uma usubonile. Umthetho ungahlala ku-unit ekhiqiziwe hhayi kusetho se-WireGuard, ngakho layisha kabusha leyo unit ngemva kokuhlela futhi uqinisekise ukuthi ukuqala okulandelayo akubhali kabusha ushintsho lwakho.

Amasayithi amabili ngemuva kwe-NAT adinga indawo yokuhlangana

Uma kungekho uhlangothi olwamukela ukuxhumana okungena, impendulo esebenzayo iyisibungu esincane esinekheli lomphakathi nama-interface amabili e-WireGuard. Isayithi ngasinye sixhuma ngaphandle, isibungu esimaphakathi sibala i-LAN yomlingani ngamunye kuyo AllowedIPs, okuwuhlu lwayo, futhi ukudluliswa kuthwala amaphakethe phakathi kwemithombo emibili. Akukho lutho ku-firewall yanoma isiphi isayithi okufanele kushintshwe, yingakho lesi sakhiwo sisakazeka kalula.

Ukuhamba kwemizila phakathi kwamasayithi kugcina amakheli omsuka wangempela futhi ngaleyo ndlela kugcina ukulogwa kwesibungu ngasinye kunengqondo. Ukuhumusha esibungwini esimaphakathi kulula lapho ama-LAN amabili ehlangana khona, kodwa ngezindleko zokulahlekelwa ubunikazi bomsuka kumalogi. Nquma ukuthi iyiphi impawu ebalulekile ngaphambi kokukhetha.

Hlukanisa izingqimba ngokuhlola okune

Yenza ukuhlola okukodwa ngqimba ngalunye esikhundleni sokushintsha izinto ezintathu bese uthemba. Okokuqala kukhombisa ubudala bokuxhawulana nezibali zomlingani ngamunye. Okwesibili kukhombisa ukuthi umthengi uyayiqondisa yini leyo ndawo ethubhini ngempela. Okwesithathu nokwesine kukutshela ukuthi isicelo safika yini nokuthi ingabe umgomo othile wasilahla ngemva kokufika.

wg show
ip route get 192.168.50.20
tcpdump -ni wg0 icmp
iptables -vnL FORWARD --line-numbers

Isicelo esifika singalethi mpendulo sikhomba endleleni yempendulo noma esibungwini se-LAN. Isicelo esingakaze sifike sikhomba AllowedIPs noma emzileni womthengi. Le miphumela emibili idinga ukulungiswa okuhlukene, futhi ukubamba yikho okuhlukanisa.