I-WireGuard kusikhala segama lenethiwekhi: kungani isokhethi yasala ngemuva

I-interface ibalwe endaweni yegama oyifunayo, uhlelo luxhumene nayo, kodwa akukho thrafikhi yethaneli evelayo. Lolu wuphawu lwedivayisi ye-WireGuard ku-kernel ye-Linux eyadalwa endaweni eyodwa yegama yabe isihanjiswa kwenye: i-interface yahamba kodwa isokhethi yayo ye-UDP ebhalisiwe ayihambanga. Kokubili kufanele kube sendaweni efanele ngaphambi kokuba ukuthrafikhi kwangaphakathi kube nencazelo. Ukuhlola kuyashesha uma usazi ukuthi kufanele ubheke izimo ezimbili hhayi eyodwa.

Uphawu: indawo yegama efanele, kodwa awekho amaphakethe

Ngaphakathi kwendawo yegama ithaneli libonakala liphilile. Idivayisi ikhona, amakheli abekiwe, futhi ukucushwa kozakwethu kukhona. Ngaphandle, ukushintshana kwe-UDP obekulindelekile akukaze kubonakale ku-interface obekuyibuka, futhi uhlangothi olunye lubika ukuthi akubanga nokuxhawana izandla.

Isizathu ukuthi amaphakethe angaphakathi wohlelo afinyelela idivayisi eshanjisiwe, futhi idivayisi izama ukuwathumela ngesokhethi engaphansi kwesinye isimo senethiwekhi. Umzila ongaphansi ewusebenzisayo, kanye nawo wonke umthetho we-firewall osebenza kuwo, ungowendawo yegama lapho idivayisi yadalwa khona.

Lokhu akusona isiphambeko ekuhambiseni futhi akusona ukucushwa okungalungile kozakwethu. Ukuqaliswa kwe-kernel kwenza kanjalo, futhi imibhalo yendawo yegama ye-WireGuard ichaza ngqo umthetho wokudala.

Kungani isokhethi inendawo yokuzalwa

Idivayisi ye-WireGuard inesokhethi eyodwa ye-UDP yokuthutha kwayo okubhalisiwe, futhi leyo sokhethi ivulwa endaweni yegama lapho idivayisi idalwa khona. Ukuhambisa i-interface ngomyalo woxhumo kuhambisa idivayisi ebonakalayo kodwa kushiya ukuthutha lapho kwaqala khona. Ngaleso sikhathi izinto ezimbili zinabanikazi abehlukene.

Umphumela kulula ukuwushiya ngoba izingxenye ezimbili zihlolwa ezindaweni ezahlukene. Umzila wangaphakathi unqunywa endaweni yegama lapho uhlelo lusebenza khona, futhi umzila wangaphandle unqunywa lapho kuhlala khona isokhethi. Ukuhlola eyodwa kuphela kunikeza isiphetho esiqinisekile kodwa esingalungile. Ukuhlola kokubili ngokuvamile kuqeda uphenyo ngohambo olulodwa.

Yidale lapho ufuna khona isokhethi

Isixazululo siwukudala idivayisi ngaphakathi kwendawo yegama okuyiwa kuyo esikhundleni sokuyidala ngaphandle nokuyihambisa. Ngokucabanga ukuthi indawo yegama evunyelwe isivele ikhona futhi igama alisetshenziswanga:

ip netns exec vpn-apps ip link add wg-demo type wireguard
ip netns exec vpn-apps wg show

Manje kokubili i-interface nesokhethi yayo kungokwesimo, ngakho umzila ongaphansi kanye nemithetho yokuhlunga esebenzayo yileyo ecushwe lapho. Uma umklamo udinga uhlangothi olucacile kwenye indawo, qala ubeke i-interface eyisisekelo endaweni yegama bese udala ithaneli. Ukulandelana kuyingxenye yomklamo, akusona incazelo yokuqaliswa.

Zithathe njengemiyalo yokuphatha inethiwekhi, hhayi njengeresiphi. Zidala idivayisi futhi zibonisa isimo; okhiye, ozakwethu, amakheli nemizila kusafanele kuvele ekucushweni okuvunyelwe, futhi i-interface yokukhiqiza ekhona akufanele neze ishintshwe esibonelweni.

Funda izinhlangothi zombili zomzila

Uma idivayisi isendaweni efanele, qinisekisa izinqumo ezimbili ngokwehlukana. Qala ngokusesha kwangaphakathi kusimo sohlelo, bese uhlola umzila wangaphandle kusimo esiphethe isokhethi:

ip netns exec vpn-apps ip route get 10.30.0.9
ip netns exec vpn-apps wg show
tcpdump -ni any udp port 51820

Uma ukusesha kwangaphakathi kuxazululwa ngethaneli futhi ukuthwebula kwangaphandle kubonisa ukushintshana okubhalisiwe, izingxenye ezimbili ziyavumelana. Uma ukuthwebula kungenalutho, isokhethi isekwenye indawo, noma umzila ongaphansi endaweni yayo yegama awufinyeleli ekupheleni.

Olunye uhlolo kufanele lube semibhalweni: indivayisi idalwa kanjani ngemuva kokuqalisa kabusha. Umphathi odala kabusha i-interface ngesimo sokudala esihlukile ushintsha indawo yokuzalwa yesokhethi. Ukuhambisa ngesandla okwaphumelela kanye akusona ubufakazi mayelana nomzila ophethwe.