I-WireGuard peer iyanyamalala ngemuva kokuqalisa kabusha: thola ukuhlelwa kwangempela

I-peer oyifake nge-wg set iphendula ama-ping intambama yonke bese iyanyamalala ngemuva kokuqalisa kabusha. Akukho okonakele: i-kernel ayizange igcine ley peer ndawo ngaphandle kwe-interface ephilayo, futhi noma yini eyakha i-interface kabusha ngesikhathi sokuqalisa yayakha isuka efayeleni ongazange uyithinte. Ukulungisa akukho okunye wg set. Kungukuthola ukuthi iyiphi ingxenye engumnikazi we-interface, ukuhlela isimo yaleyo ngxenye, bese kufakazela ukuthi i-peer iyasinda kuso sona leso sigameko somjikelezo wokuphila esayisusa.

Kukhiqize kabusha kanye, ngamabomu

Ungayilungisi inkinga yokuqalisa kabusha ngaphambi kokuba uyibone ngamehlo akho. Uma ukufinyelela kwe-console noma kwangaphandle kukhona, bhala uhlu lwama-peer, qalisa kabusha ngesevisi engumnikazi we-interface, bese uqhathanisa. Uma i-peer isekhona, ushintsho lwakho selufinyelele esimweni esihlala njalo futhi uhlola isigameko esingalungile.

Bhala amaqiniso amathathu ngesikhathi wenza lokhu: igama le-interface, i-unit noma iphrofayela eyayiqalisa, nokuthi ingaba isibali sokuxhawulana kwi-peer esindile yaphindwa yasethwa yini. Isibali esiphindwe sasethwa sisho ukuthi i-interface yabhidlizwa futhi yakhiwa kabusha; isibali esingashintshanga ne-peer engekho sisho ukuthi okuthile kwahlela ukuhlelwa ngaphansi kwezinyawo zakho.

Ubani umnikazi we-interface?

I-WireGuard uqobo ayinayo i-daemon futhi ayinalo ifayela lokuhlela. Okuthile phezulu kwayo kubiza i-wg ngesikhathi sokuqalisa, futhi lokho okuthile kuwumthombo weqiniso. Abazongenela abajwayelekile yi-[email protected], iphrofayela yokuxhumana ye-NetworkManager, i-unit yenethiwekhi eqondene nokusabalalisa, noma iphaneli yokuphatha ebhala idathabhasi yayo.

Buza isistimu, hhayi imibhalo yokusabalalisa kwakho. I-systemctl status wg-quick@wg0 ne-nmcli connection show ngokuvamile ziyixazulula ngomyalo munye ngamunye. Uma zombili zifuna i-interface, usutholile ibhagu ngaphambi kokuhlela noma yini: abanikazi ababili babhala kabusha idivayisi efanayo ekuqaliseni ngakunye, futhi owokugcina ukugijima uyawina.

systemctl status wg-quick@wg0 --no-pager
grep -R "Address\|SaveConfig\|PostUp" /etc/wireguard/wg0.conf
nmcli -g NAME,TYPE connection show
wg show wg0 peers

Isimo sokusebenza nesimo sokuqalisa akuyona ifayela elilodwa

I-wg set isebenza ngedivayisi ephilayo nge-netlink. Ayibhaleli i-/etc/wireguard/wg0.conf, iphrofayela ye-NetworkManager noma idathabhasi yephaneli. I-wg show ephumelelayo ngemuva kwalokho ifakazela ukuthi i-kernel yamukele i-peer, hhayi ukuthi okuthile izoyibuyisela.

Kukhona ugibe lwesibili ohlangothini oluphambene. Inketho ye-SaveConfig ye-wg-quick ibhala isimo samanje se-interface ibuyisele efayeleni lokuhlela lapho i-interface yehliswa. Uma ivuliwe, ukuhlelwa okwenziwe efayeleni ngesikhathi i-interface iphezulu kungase kusitshalwe ukucisha okulandelayo, futhi uzofunga ukuthi lolo hlu lwalukhona. Uma i-peer ibuyela njalo, funda ifayela ngemuva kokumisa, hhayi ngaphambi.

I-NetworkManager iziphatha ngendlela ehlukile futhi: ingumnikazi wephrofayela futhi iyisebenzisa lapho ivula, ngakho i-.conf ehlelwe ngesandla eduze kokuxhumana kwe-NetworkManager okusebenzayo ingumhlobiso nje. Khetha umnikazi oyedwa we-interface bese uvumela omunye umphathi ukuthi angayithinti.

Qinisekisa ukuthi ushintsho lufika ezindaweni zombili

Hlela isimo esihlala njalo kuqala, bese uvumela umnikazi ukuthi asisebenzise, bese ugcina uqinisekisa isimo esiphilayo. Lokho kuhleleka kusho ukuthi ukwehluleka kunoma yisiphi isinyathelo kukhombisa into eyodwa esikhundleni sezintathu.

# 1. persistent state (wg-quick owner)
sudo vi /etc/wireguard/wg0.conf

# 2. apply through the owner, not by hand
sudo systemctl restart wg-quick@wg0

# 3. verify runtime matches the file
sudo wg show wg0
sudo wg showconf wg0

I-wg showconf iphrinta ukuhlelwa okuphilayo ngendlela efanayo ncamashi nefayela eliyisebenzisayo, okwenza kokubili kuqhathaniseke ngqo. Thatha lokho kuphuma njengemfihlo: kunezihluthulelo eziyimfihlo, ngakho ungakunamathiseli kutikithi noma esiteshini sengxoxo. Qhathanisa izihluthulelo zomphakathi zama-peer kanye nama-IP avunyelwe, futhi uhlole ukuthi i-peer oyisuse ngamabomu ayibuyanga.

Fakazela ukuthi iyasinda kusigameko somjikelezo wokuphila

Qalisa kabusha ngomnikazi okwesibili, bese uqinisekisa izinto ezintathu ezihlukene: i-peer ivela ku-wg show, isibali sokuxhawulana siyakhula ngemuva kwethrafikhi, futhi uhlelo oluncike kuthaneli luyaphendula ngempela. I-peer efakwe ohlwini nokuxhawulana okudala iyinkinga yomzila noma yokhiye, hhayi inkinga yokuqina, futhi lowo mehluko usindisa ukuhlela kokuhlelwa okungenamsebenzi.

Ekugcineni, hlola ukuthi ukuqalisa kabusha kubuyise ini. Ukuqalisa kabusha okuvusa i-peer oyisuse ngamabomu yibhagu efanayo ngophawu oluphambene, futhi ngokuvamile kusho ukuthi ikhophi endala yokuhlelwa isalayishwa kusuka kwenye indawo. Bhala umnikazi, indlela yefayela, isihluthulelo somphakathi se-peer kanye nemiyalo yokuqinisekisa eduze nokuhlelwa, ukuze umuntu olandelayo angaphindi akuthole lokhu ngokuqalisa kabusha ihosithi yokukhiqiza.