Ukucisha okuphuthumayo noma ukufinyelela ku-LAN? Izimpendulo ezimbili ze-WireGuard

Ukuxhawana kuqedwa, ukuphequlula kuyasebenza, kodwa iphrinta, i-NAS namahost e-SSH endawo ayanyamalala. Kuklayenti le-Windows lokhu ngokuvamile akusona neze ukwehluleka kokuhambisa: i-peer okufakwe kuyo iziqalo ezivunyelwe eziqukethe okuzenzakalelayo ngokwezwi nezwi ivula Vimbela ithrafikhi engaphandle komhubhe, futhi leyo nketho isetshenziswa njengemithetho yodonga lomlilo elahla amaphakethe aphuma kunoma iyiphi enye i-interface. Ithebula lemizila lisabala isubneti yendawo njengoxhumano oluqondile, yingakho uphawu lubonakala luyiphutha. Izimo ezintathu zinquma okumele kwenziwe, futhi kuzo kuyisimo esisodwa kuphela esiphathelene nokuhambisa.

Ukwehluleka okubili kunophawu olulodwa

Ukwehluleka kokuqala imodi ye-fail-closed yeklayenti, futhi uphawu lwayo ukuthi konke okungaphandle komhubhe kuyama kuyilapho umhubhe uqobo usebenza ngokuphelele. Okwesibili inkinga yangempela yokufinyeleleka: umzila ongekho, umugqa ongekho kuseva wesubneti engemuva kweklayenti, noma amanethiwekhi amabili abelana ngebanga elifanayo lamakheli. Kokubili kukhiqiza umshini ongaphequlula kodwa ongakwazi ukuphrinta, futhi izixazululo zawo ziphambene, ngakho ukuxilongwa kufanele kuze ngaphambi kokumiswa.

Ukwelusa okuhlukanisayo ukuthi ngabe isubneti yendawo isekhona yini ethebuleni lemizila ngenkathi ithrafikhi eya kuyo ilahliwe.

Izimo ezintathu zinquma impendulo

Okokuqala, ingabe lo mshini udinga i-fail-closed? Uma impendulo ingu-yebo, umhubhe owelayo kufanele umise ithrafikhi esikhundleni sokuyeka ibuyele ku-interface yomzimba, futhi leso sidingo sibaluleke ngaphezu kwesihlelo sasendaweni. Okwesibili, ingabe amadivayisi endawo kufanele ahlale efinyeleleka ngenkathi umhubhe uvuliwe? Ukuphrinta, isitoreji senethiwekhi namakhonsoli okuphatha endawo yizizathu ezijwayelekile, futhi lezi ziyizimfuno ezisemthethweni, hhayi okuhlukile okufanele uxolise ngakho. Okwesithathu, ingabe iphrofayela iveza okuzenzakalelayo njengo-0.0.0.0/0 wangempela? Yikho kanye lokhu okucushiwe okwenza imithetho yeklayenti isebenze, futhi kungalungiswa.

Phendula lezi zintathu ngokubhaliwe ngaphambi kokuthinta iphrofayela, ngoba impendulo ngayinye ikhomba ekumisweni okwehlukile.

Khetha i-fail-closed bese ushiya i-LAN

Uma ukuvuza kubaluleke ngaphezu kokufinyeleleka kwendawo, gcina okuzenzakalelayo wangempela futhi ushiye Vimbela ithrafikhi engaphandle komhubhe kuvuliwe. Lesi yisimo esingaguquki: umshini uthathwa njengedivayisi engaphakathi komhubhe noma engaxhunyiwe, futhi izinsiza zendawo zifinyelelwa kusuka kwelinye idivayisi noma ngomhubhe uma iseva ibahambisa. Izindleko zingokoqobo futhi kufanele zishiwo kumanothi okusetshenziswa, esikhundleni sokuthi umuntu odinga ukuphrinta akuthole yena.

Lokhu ukukhetha okulungile emishinini eyenza umsebenzi okungafanele uvele kunethiwekhi yekhefi lapho umhubhe uwela. Kungukwehluleka okubi kwelaptop yasekhaya edinga futhi isithwebuli.

Khetha ukufinyelela ku-LAN bese uveza okuzenzakalelayo ngenye indlela

Uma amadivayisi endawo kufanele ahlale efinyeleleka, veza ukumboza okufanayo ngaphandle kwesiqalo sokuzenzakalelayo sangempela. Iziqalo ezimbili eziyingxenye zihlanganisa wonke amakheli e-IPv4, ipheya elilinganayo lihlanganisa i-IPv6, futhi iklayenti ayisakufaki imithetho evimbayo ngoba intambo eyifunayo ayikho.

[Peer]
AllowedIPs = 0.0.0.0/1
AllowedIPs = 128.0.0.0/1
AllowedIPs = ::/1
AllowedIPs = 8000::/1
Endpoint = vpn.example.net:51820

Ukususa lokho kubha kubangela ukuthi iklayenti libhale lawo mapheya amabili kuyiphrofayela, ngakho ukuqhathanisa ifayela elikhiqiziwe neblokhi elingenhla kuyindlela esheshayo yokuqinisekisa umshini esikhundleni sokuwuqagela. Imiphumela emibili iyalandela. Ukumboza kuyafana, ngakho akukho okunye okushintshayo emhubheni. Ukuvikelwa akufani: lapho imithetho ingasekho, umhubhe owelayo ushiya umshini kwi-interface yawo yomzimba, futhi yikho kanye okwakuvinjwa i-fail-closed.

Hlola nabanye abasolwa ababili

Lapho impikiswano yodonga lomlilo isixazululiwe, qinisekisa ukuthi isubneti yendawo ihambiswa ngempela nokuthi uhlangothi olukude lwazi konke okungemuva kwale klayenti. Iseva okufanele ifinyelele i-LAN engemuva kweklayenti idinga leso siqalo ohlwini oluvunyelwe lweklayenti kuhabhu; uma usishiya, ihubhu ayikwazi ukukhetha i-peer yalawa makheli, futhi akukho kumiswa kweklayenti okukhiqiza okukodwa.

Get-NetConnectionProfile | Select-Object Name, InterfaceAlias, NetworkCategory
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultOutboundAction
route print 0.0.0.0

Isigaba senethiwekhi sibaluleke ngaphezu kwalokho abantu abakulindele: i-adaptha yomhubhe esanda kwenziwa ehlukaniswa njengeyomphakathi ishintsha imithetho esebenza kuyo, futhi umphumela ungabonakala njengokuvinjelwa kodonga lomlilo ohlangothini olukude. Ukuphrinta kwemizila kukhombisa ukuthi ngabe kukhona okuzenzakalelayo noma cha, okuhlukanisa inkinga yenqubomgomo nomzila ongekho.

Bese uhlola izinto ezintathu esikhathini esisodwa: i-inthanethi, i-host yendawo eyodwa ngokwekheli, kanye ne-host eyodwa ngomhubhe. Ukuxhawana kufakazela kuphela ukuthi okhiye bayavumelana, ngakho izivivinyo ezintathu yizo ezikhombisa inqubomgomo. Uma i-host yendawo isala ngisho lapho inketho isusiwe, abasolwa abasele umzila, uhlu oluvunyelwe lohlangothi olukude kanye nesubneti ephindiwe, ngalolo hlelo.