Iphrefikhi yomsingathi ku-WireGuard: kungani ikheli elilodwa lisebenza kanti amanye awasebenzi

Ithuneli livuliwe, i-handshake yenzeka njalo ngamaminithi amabili, futhi ikheli elilodwa ncamashi ngaphesheya liyaphendula. Ama-ping aya ekhelini lethuneli le-peer ayasebenza; akukho lutho ngemva kwalo olusebenzayo. Othile ufunda ukulungiselelwa kwesixhumi, ubona iphrefikhi yomsingathi futhi aphethe ngokuthi imaski ayilungile. Ukunweba iye ku-/24 kulungisa i-ping isikhashana bese kwephula enye into. Iphrefikhi yayingeyona imbangela nanini, futhi umzila owawungekho awuwona umzila olawulwa yimaski.

Yini iphrefikhi yesixhumi eyenza ngempela

Ku-Linux, ukwabela ikheli esixhumi kwakha umzila oxhunyiwe wale phrefikhi. Uma wabela iphrefikhi yomsingathi, umzila oxhunyiwe uhlanganisa ikheli elilodwa. Uma wabela i-/24, uhlanganisa angu-256, futhi ngayinye yawo manje ithathwa njengelifinyeleleka kulolo xhumano.

ip -4 addr show dev wg0
ip -4 route show dev wg0
ip route get 10.80.7.1

Iphrefikhi yomsingathi iyisinqumo esijwayelekile ngokuphelele kwithuneli le-point-to-point, ngoba kunep-peer eyodwa ncamashi kwelinye iphethe. Umyalo wesithathu yiwo ophendula umbuzo womsebenzisi: usho ukuthi yisiphi isixhumi i-kernel engayisebenzisa kuleyo ndawo, futhi ngeke ikhombise lutho olusizayo uma kungekho mzila ohambisanayo.

Yikho konke ukuchazwa kophawu. Ikheli elilodwa liyaphendula ngoba kukhona umzila oxhunyiwe walo, noma ngoba uhlu oluvunyelwe lwe-peer lulufaka ngengozi. Konke okunye akunawo umzila futhi kuyalahlwa ngaphambi kokuba i-WireGuard ihlanganyele. Ithuneli lihlala linempilo isikhathi sonke, yingakho isibali se-handshake siqhubeka sibonakala sithembisa.

I-AllowedIPs imithetho emibili ngaphansi kwegama elilodwa

Uhlu oluvunyelwe nge-peer ngayinye ku-WireGuard lwenza imisebenzi emibili ngesikhathi esisodwa, futhi isintaksi yokulungiselela iwenza abonakale njengowodwa. Ekungeneni, ivumela ukuthi yimaphi amakheli omsuka i-peer engawethula. Ekuphumeni, ikhetha ukuthi iyiphi i-peer okuthunyelwa kuyo iphakethe, ngokuthola ukufana okucacile kakhulu.

Akukho kule misebenzi emibili okuwukudlulisela imizila. I-kernel kusafanele inqume ukuthi iphakethe lingelesixhumi sethuneli ngaphambi kokuba i-WireGuard ilibheke, futhi leso sinqumo sivela kuthebula lemizila. Umbhalo we-peer onohlu oluvunyelwe olubanzi awulifaki umzila ngokwawo.

Yingakho ukulungiselelwa kungabonakala kuphelele futhi kuziphathe ngendlela engalingani. Iklayenti lithumela ngaphesheya ngoba umzila ukhona, futhi izimpendulo azifiki nanini ngoba uhlu oluvunyelwe lwangaphesheya aluvumeli umsuka weklayenti, noma ngoba uhlangothi olungaphesheya alunayo indlela yokubuya. Zombili izinhlangothi ziyizinqumo ezihlukene ezinendlela ezihlukene zokwehluleka. Ukubhala ukuthi iyiphi oyihlolayo ingxenye yokuxilonga.

Umzila uvela kuphi

Uma usebenzisa i-wg-quick, imizila yenziwa yakho isuka ohlwini oluvunyelwe lwe-peer ngayinye, ngaphandle uma usethe i-Table = off futhi wathatha ukulawula ngokwakho. Lokho kuwukuziphatha okubhalwe yithuluzi, futhi yisizathu sokuthi ukulungiselelwa okungenazo iziqondiso ezicacile zomzila kusasebenza.

sudo wg show wg0 allowed-ips
ip route show | grep wg0
sudo wg-quick strip wg0

Qhathanisa uhlu oluvunyelwe nemizila ekhona ngempela. I-peer evumela isubneti yonke kodwa eyakha umzila womsingathi kuphela isho ukuthi umsizi akazange asebenze, noma ukuthi ulawula isixhumi ngqo nge-wg ne-ip, futhi lapho akukho lutho olwakha imizila kuwe.

Uma uwulawula ngesandla, umzila uwumugqa owodwa futhi ukuma kwawo kucacile: indawo ngokusebenzisa isixhumi, ngaphandle kwesango ngoba uxhumano luyi-point-to-point. Ukwengeza kwawo akusona isisombululo sedlulayo sephrefikhi embi; kuyingxenye engekho yomklamo owakhetha ukuphatha umzila ngokwawo.

Iphrefikhi ebanzi ayifaki umbhalo we-peer

Isixazululo esilingayo ukushintsha ikheli libe i-/24 ukuze umzila oxhunyiwe uhlanganise i-LAN yeseva. Kubonakala kusebenza, futhi isizathu sokuthi kubonakale kusebenza ukuthi umzila oxhunyiwe manje uhambisana, hhayi ukuthi i-WireGuard ifunde okusha.

Okunye okwenzile ukufuna lonke ibanga njengelifinyeleleka ngqo kulolo xhumano, kuhlanganise namakheli ezingezinye i-peer noma e-LAN ngempela engemva kweseva. Ithrafikhi eya kulawo makheli manje ingena ethunelini, futhi ukuthi iyophuma yini ngaphesheya kuncike ekuhambiseni imizila nasezintweni ezivunyelwe zeseva ngokwalo.

Uhlangothi lwe-crypto aluthinteki nganoma yisiphi isimo. I-WireGuard isadinga umbhalo ohlwini oluvunyelwe ohlanganisa indawo ukuze ikhethe i-peer, futhi uhlangothi olungaphesheya lusadinga umbhalo ohlanganisa umsuka wakho ukuze luwamukele. Iphrefikhi yesixhumi ebanzi ayikwazi ukuhlinzeka nakokukodwa kwalokhu.

Qinisekisa izinhlangothi zombili ngaphambi kokushintsha noma yini

Sebenza neziphetho zombili ngokwehlukana futhi ubhale okusho yikuphi. Kuklayenti umzila nombhalo we-peer; kuseva isithombe esiyisibuko kanye nendlela yaso yokubuya:

ip route get 192.168.70.20
sudo wg show wg0 allowed-ips
sudo wg show wg0 latest-handshakes
sudo tcpdump -ni wg0 -c 10

Ukuthwebula yikho okuqeda izingxabano mayelana nendlela. Uma amaphakethe aphumayo evela esixhumi sethuneli futhi iseva ingabhalile lutho, isiphetho esikude siyawalahla, ngokuvamile ngoba umsuka wakho ungaphandle kohlu lwayo oluvunyelwe. Uma kungekho lutho oluvelayo nhlobo, umzila awukho noma ukhomba kwenye indawo.

Bese ulungisa isiphetho esincane. Umbhalo ohlwini oluvunyelwe ohlangothini lweseva wekheli leklayenti lakho nombhalo ohlangothini lweklayenti wesubneti yendawo yikuma okuvamile, futhi kushiya iphrefikhi yesixhumi ingathintekile. Nweba iphrefikhi kuphela uma uhlelo lwamakheli lufuna ngempela isubneti eyabiwe kulolo xhumano, futhi kwenze njengoshintsho lohlelo hhayi njengesinyathelo sokulungisa amaphutha.