WireGuard: ayikho indlela eya ku-peer ngemva koshintsho lwe-subnet — izindlela ezimbili
Ushintsho lwe-subnet lwephula i-WireGuard ezindaweni ezimbili: AllowedIPs nendlela yokubuya. Qhathanisa ukubhalwa kabusha kwezinombolo endaweni nokwakhiwa kabusha kwe-interface.
I-handshake isha ku-wg show, i-endpoint ilungile, okhiye abakaze bashintshe — kepha i-ping isathi ayikho indlela eya ku-peer. Ushintshe i-subnet yetunnel ehoreni eledlule. Leso sibonakaliso siwuphawu lokungafani kwe-prefix hhayi inkinga yokhiye: i-WireGuard yaqeda i-handshake yabe isilahla idatha ngoba ikheli lomthombo alisahambisani nalokho i-peer eyamukelayo ezokwamukela. Kunezindlela ezimbili ezinengqondo zokuphatha ushintsho lwe-subnet, futhi zihluleka ezindaweni ezihlukene.
Izindlela ezimbili zokuphatha ushintsho, kanye nezindleko zazo
Ukukhetha A ukubhalwa kabusha kwezinombolo endaweni: hlela ikheli le-interface, izigaba zama-peer, izindlela kanye nayo yonke ikhophi yokucushwa, bese ulayisha kabusha. Ukukhetha B ukwakha i-interface yesibili ku-prefix entsha eceleni kweyakudala, ukuhambisa ama-peer, nokususa i-interface yakudala lapho ithrafikhi isihambile ngempela.
| A: renumber in place | B: parallel interface | |
|---|---|---|
| Downtime | The reload window, per host | None if peers are added to both |
| Rollback | Re-apply the previous files | Point peers back at the old interface |
| Risk | Half-applied change: new address, old ranges | Two live interfaces with overlapping intent |
| Effort | Small, if the deployment has one owner | Higher, and needs a cleanup step |
| Fits | Two or three peers you control | Many peers, remote sites, or no maintenance window |
Isimo esisetshenziswe ngesigamu yiso esenza ukukhetha A kube yingozi, ngoba asibonakali siphukile. I-interface iyaphakama, i-handshake iyaphumelela, futhi kuhluleka kuphela indlela yedatha. Ukukhetha B kudinga umsebenzi omningi kepha kugcina indlela esebenzayo iphilile ngesikhathi uthola zonke izikhombo.
Yini okufanele ihambe kanyekanye ohlangothini lwakho
Izinto ezine ku-host yendawo zichaza i-subnet efanayo, futhi ukushintsha okukodwa ukushintsha konke: ikheli le-interface, i-AllowedIPs ye-peer ngayinye, indlela esetshenziswa uhlelo kulezo zindawo, kanye nakho konke okufakwa umphathi egameni lakho. Nge-wg-quick, ezimbili zokugcina zikhiqizwa kusukela kukucushwa ngaso sonke isikhathi lapho i-interface iphakama, ngakho ikhophi endala ibuyisela i-prefix endala buthule.
Qhathanisa okucushwe nalokho okusebenzayo esikhundleni sokwethemba okukodwa kukho:
wg show
wg showconf wg0
ip addr show wg0
ip route get 10.90.0.5Ukusesha indlela yisinyathelo abantu abasidlulayo. Kuphendula ukuthi i-kernel ingenza ngempela ini endaweni ethile, kuhlanganise nendlela eqondile kakhulu eshiywe umphathi noma indawo yokusebenza yamakhontheyna. Uma ibika i-interface ehlukile kunetunnel, ukucushwa akusiyo inkinga.
Nge-interface esebenzayo, sebenzisa ifayela elihleliwe ngaphandle kokudiliza itunnel:
wg syncconf wg0 <(wg-quick strip wg0)Lokho kubuyekeza ama-peer nezigaba endaweni. Akubuyekezi ikheli le-interface noma izindlela, ngoba lezo akuzona izilungiselelo ze-WireGuard — ngakho ukubhalwa kabusha kusadinga ukwakhiwa kabusha kwe-interface noma ukushintshwa kwekheli nge-ip, bese kuqinisekiswa kabusha ukuhlelwa kwendlela.
Yini okufanele ihambe kanyekanye ekugcineni okukude
Yilapho ushintsho lwe-subnet ngokuvamile lufa khona. I-AllowedIPs ayisona iseluleko sokuhlelwa kwendlela kuphela; futhi iwuhlu lwamakheli omthombo i-peer evunyelwe ukuwethula. Lapho ubhala kabusha amaklayenti futhi ushiya i-AllowedIPs yesiphakamiso ku-prefix endala, isiphakamiso samukela i-handshake, sithola amaphakethe abethelwe bese siwalahla ngoba umthombo wangaphakathi awuhambisani nanoma yisiphi isigaba esisihlobanisa naleyo peer. Akukho phutha elibhalwayo, futhi iklayenti libona ukuphela kwesikhathi.
Ngakho buyekeza uhlangothi olwamukelayo ngenhloso: umbhalo we-peer kusiphakamiso kufanele ubhale i-prefix entsha yeklayenti, indlela yokubuya yesiphakamiso uqobo kufanele ikhombe itunnel yaleyo prefix, futhi noma iyiphi inethiwekhi engaphansi ngemuva kwesiphakamiso kufanele ifunde indlela entsha. Inqubomgomo ye-firewall ebisho isigaba esidala nayo idinga ukwelashwa okufanayo, kanjalo nakho konke okwenza ukukhetha okusekelwe kumthombo.
Ukuxilonga okuhlukanisa lokhu kwehluleka okubili kushibhile. I-handshake entsha kodwa ingekho idatha kusho ukuthi itunnel iphakeme futhi ukukhethwa kwamakheli angaphakathi akuhambisani. Ukungabikho neze kwe-handshake kusho ukuthi ubheka ukufinyeleleka noma okhiye. Ungaguquli okhiye ngenkinga ye-prefix; lokho kubuyisela emuva into eyodwa eyayisebenza.
Amakhophi amadala aphila isikhathi eside kunokuhlela kwakho
Ukuhlela ifayela akufani nokushintsha uhlelo olusebenzayo, futhi amakhophi maningi kunalokho abantu abakulindele: iyunithi noma umphathi ongumnikazi we-interface, iphrofayili yesibili enegama elifanayo kwisikhombisi esinye, ikhontheyna enokucushwa okubhakwe kusithombe, i-interface yerutha enenguqulo yayo ehleliwe, kanye nohlelo lweklayenti olungenisa kabusha itunnel egciniwe lapho luqala. Ngayinye yazo ingabuyisela i-prefix endala ngemva kokuba ushintsho lwakho lubonakala luphelile.
Amagama nawo ayahamba. Uma indlela yezinombolo isebenza kodwa igama le-host lihluleka, irekhodi le-DNS langaphakathi noma ukucushwa kwensizakalo kusakhomba ekhelini elidala letunnel. Lungisa isikhombo esikhundleni sokwandisa isigaba ngasinye se-peer, ngoba lokho bekungafihla inkinga yangempela futhi kukhulise i-ACL yomthombo ngesikhathi esifanayo.
Gcina indlela eyodwa yokubuyisela ivuliwe ngesikhathi usebenza: enye indlela yokungena ku-host, ikhonsoli yochungechunge, noma ukubuyiselwa emuva okuhleliwe kwamafayela okucushwa. Ushintsho lwetunnel olukuvalela ngaphandle kumshini owushintshayo yiyo indlela evamile kakhulu yokwenza lo msebenzi ube ubusuku.
Ukukhetha phakathi kokubili, nokuqinisekisa ukusika
Khetha A lapho ungumnikazi wawo wonke ama-peer, inani lincane, futhi ukuphazamiseka okufushane kwamukelekile. Khetha B lapho ama-peer ayizandla ezikude ongazilawuliyo, lapho isixhumanisi saphakathi kwezindawo kufanele sihlale siphakeme, noma lapho ungakwazi ukuqinisekisa ukuthi ikhophi ngayinye izobuyekezwa ngokuhamba okukodwa. Kuleso simo engeza i-prefix entsha kuzo zombili izindawo zokuxhumana, hambisa ama-peer ngamunye, bheka ithrafikhi kwentsha, bese kusuka lapho ususa i-interface endala nezindlela zayo.
Kukho kokubili ukukhetha, ushintsho luphelile lapho izivivinyo ezine zidlula: i-handshake intsha, ukusesha indlela yendawo ene-prefix entsha kubiza itunnel, umthwalo wamakhulu ambalwa wamabhayithi udlula kuzo zombili izinhlangothi, futhi okufanayo kuyasebenza ngemva kokuqala kabusha kwe-host noma umphathi. Ukuze incwadi ye-wg(8) iyisikhombo salokho i-AllowedIPs ekushoyo ohlangothini ngalunye, futhi kufanele ifundwe futhi ngaphambi kokuba wandise isigaba ukuze uphawu lunyamalale.
- I-handshake entsha futhi akukho datha: bheka i-AllowedIPs kumamukeli ngaphambi kokuthinta okhiye.
- Ukusesha indlela kukhomba i-interface engalungile: umphathi noma ikhontheyna ingumnikazi wendlela, hhayi ifayela lakho.
- Ikheli lezinombolo lilungile futhi igama le-host liphukile: isikhombo esidala, hhayi umjikelezo wokuhlelwa kwendlela.
- Ushintsho luphela kuphela lapho ngemva kokuqala kabusha kusasetshenziswa i-prefix entsha.