I-WireGuard ayibonisi ukuxhawulana kwakamuva: yini okufanele uyihlole kuqala

Inkambu yokuxhawulana kwakamuva engenalutho ngokuvamile isho ukuthi isixhumi esibonakalayo asikakagcwalisi ukuxhawulana selokhu saphakama, okusho okuncane mayelana nokucushwa kunalokho okubonakala. I-WireGuard ithula kuze kube yilapho iphakethe lidinga ukuphuma ngesixhumi, ngakho i-peer engasebenzi engenalutho engaluthumelayo ibika khona kanye lokho. Qinisekisa ukuthi ngempela kwahlongozwa okuthile ngaphambi kokuhlola okhiye.

Ukuhlolwa yiphakethe elivunyelwe elibheke endaweni okufanele i-peer iyithwale. Konke okunye esikrinini sesimo kuchaza inhloso, hhayi umsebenzi.

Isixhumi esingasebenzi asinalutho oluzobikwa

I-WireGuard yenza ukuxhawulana ngobuvila: iphakethe lokuqala elidinga umhubhe liqala ukushintshana, futhi isixhumi sihlala sithule kuze kube yilapho. I-peer eyacushwa futhi engakaze isetshenziswe ibonisa ukuxhawulana okungenalutho, amabhayithi angenalutho atholiwe kanye negebe elikhulayo kusukela kokugcina. Leso simo siphilile kuklayenti engasebenzi futhi siyakhathaza kuphela uma ubukulindele ukuthi ithrafikhi isivele yahamba. Hlola futhi izibali zokudlulisa, ngoba zihlukanisa akukho-okuthunyelwe kokuzanyiwe-kwahluleka.

Uma izibali zifunda uziro ezinhlangothini zombili, inkinga ingaphezu komhubhe. Akukho okufinyelele isixhumi ukuze kuqale okuthile.

Vuselela ithrafikhi i-peer evunyelwe ukuyithwala

Khetha ikheli elingaphakathi kweziqalo ezivunyelwe ze-peer, kumshini wasendaweni, futhi uqinisekise ukuthi ithebula lomzila lingayithumela ngesixhumi. Indawo engaphandle kwalezo ziqalo ikhiqiza isicelo esijwayelekile esihamba ngomzila ngaphandle kokuhileleka kwe-WireGuard. Sebenzisa isevisi ephendula ngokushesha, njenge-ping noma uxhumano olufushane lwe-TCP, ukuze umzamo ube nokuqala nokuphela okubonakalayo. Bese ufunda umugqa wokuxhawulana futhi esikhundleni sokugqolozela isikrini futhi ulinde.

ip route get 10.60.9.5
ping -c 3 -W 2 10.60.9.5
wg show wg0 latest-handshakes
wg show wg0 transfer

Umbuzo womzila ubaluleke kakhulu kune-ping. Uma ubalula isixhumi esibonakalayo, iphakethe alizange lingene emhubheni futhi ukuxhawulana okungenalutho kuyimpendulo yomzila, hhayi eyombhalo oyimfihlo. Lungisa umzila ngaphambi kokulungisa i-peer.

Qhathanisa ipheya lokhiye nendawo yokugcina

Lapho ithrafikhi inikezwa ngempela, ukuhlolwa okulandelayo ubunikazi. Ukhiye oyimfihlo wasendaweni kufanele uhambisane nokhiye osesidlangalaleni ogunyazwa uhlangothi olulandelayo, ukhiye osesidlangalaleni okude ocushiwe kufanele ukhombe i-peer ehlosiwe, futhi noma yimuphi ukhiye owabiwe ngaphambilini kufanele uhambisane ezinhlangothini zombili. Umehluko wohlamvu olulodwa kukhiye we-base64 ukhiqiza i-peer ebonakala icushiwe futhi engakaze iqedele ukushintshana. Qhathanisa nerekhodi lokuhlinzeka esikhundleni sokuphinda ukhiqize okhiye, ngoba ukhiye omusha wenza kungasebenzi yonke i-peer eyayithemba okudala.

Indawo yokugcina idinga ukuhlolwa okufanayo: igama lomsingathi, ikheli, imbobo ye-UDP kanye nomndeni osetshenziselwa ukufinyelela kuyo. Ikheli elidala noma imbobo engalungile kuletha ukuthula esikhundleni somyalezo.

Bheka umzila we-UDP wangaphandle

Ukuxhawulana kuhamba njenge-UDP kuyo indawo yokugcina, ngakho umzila wangaphandle kufanele uwuthwale. Imiyalo engezansi ihlola ukuthi ukhona yini umlaleli, ukuthi isitaki sasendaweni sikhiphile idathagramu, nokuthi iyiphi indawo yokugcina ecushiwe. Gijimisa ukuthwebula ngenkathi uvuselela ithrafikhi, hhayi ngaphambili.

ss -lunp | grep 51820
sudo tcpdump -ni eth0 udp port 51820
wg show wg0 endpoints
conntrack -L -p udp | grep 51820

Ukuthwebula okubonisa ukuqala ngaphandle kwempendulo kukhombisa ngaphandle komshini, ngoba uhlangothi olukude alilaleli, lihlungiwe, noma likheliwe ngokungalungile. Ukuthwebula okungabonisi lutho kusho ukuthi iphakethe alizange liphume, okukubuyisela emzileni kanye nanoma yikuphi uphawu lwesokhethi olusebenzayo. Uma uphatha izinhlangothi zombili, hlanganisa umzamo ngesigxivizo sesikhathi nokuthwebula okuncane kuseva esikhundleni sokujwayelekile. Ukuhlolwa kwembobo ye-TCP akufakazi lutho lapha, ngoba iphrothokholi yi-UDP kuphela.

Lapho ukuxhawulana kuvela, hlola uhlelo lokusebenza ngomhubhe, ngoba ukushintshana okuqediwe kufakazela ubunikazi nokufinyeleleka, hhayi umthamo osebenzisekayo noma i-DNS elungile. Gcina umphumela wesimo ngaphambi nangemva koshintsho, futhi umehluko uyoba ubufakazi bakho.