Amaqembu ontanga e-WireGuard esiteshini: ubunikazi bomthombo kanye nenqubomgomo

Isiteshi esisebenzisa i-WireGuard singahlukanisa amaqembu ontanga ngaphandle kwesixhumi noma ithebula lomzila elihlukile seqembu ngalinye. Izindlela ezimbili zenza lo msebenzi, futhi ukuzihlanganisa yisizathu esivamile sokuthi inqubomgomo ibonakale ilungile kodwa ingenzi lutho. Isigaba esisodwa sinquma ukuthi ubani angafuna ikheli lomthombo. Esinye sinquma ukuthi leyo phakethe ivunyelwe ukuya kuphi.

Imisebenzi emibili, ehlukanisiwe

Isigaba se-tunnel siphendula umbuzo omncane: ingabe ukhiye wale ntanga ugunyaze leli kheli lomthombo langaphakathi. Isigaba sokudlulisa siphendula umbuzo obanzi: ingabe le phakethe ingaphuma ibheke kuleyo ndawo. Akukho okuphendula umbuzo wesinye, futhi akukho okukodwa okuyinqubomgomo yokufinyelela ephelele.

Lokho kwehlukanisa yisizathu sokuthi intanga ingaqinisekiswa, inikwe ikheli elifanele, futhi nokho ingakwazi ukufinyelela isiphathi okungafanele sifinyelele kuso. Kuchaza futhi okuphambene: umthetho wothango lomlilo ovumela konke awufakazi lutho mayelana nokuthi ubani angafuna likuphi ikheli.

Dweba izigaba zombili ndawonye, bese uhlola zombili. Ukuhlelwa okulungile kwesigaba esisodwa futhi okungahloliwe kwesinye kwehluleka ngokuvulekile noma ngokuvalekile kuye ngenani elizenzakalelayo.

Nika intanga ngayinye ikheli layo kuphela

Izintanga ezinamaphathi amaningi zikuyenga ukuthi unikeze lonke ibanga leqembu ohlangothini lweseva. Leyo mvume iyisicelo sekheli lomthombo, ngakho iklayenti elihlaselwe noma elihlelwe kabi lingethula noma yiliphi ikheli elikulelo banga futhi i-tunnel izolamukela. Yabela i-/32 ontanga ngayinye ngekheli layo langaphakathi. Setha amabanga amaqembu kumaklayenti kuphela, lapho echaza khona ukuthi yiziphi izindawo lelo klayenti elingazifinyelela hhayi ukuthi yimiphi imithombo engayisebenzisa.

Uthango lomlilo lube seluqhathanisa umthombo olungamethemba. Umthetho obhalelwe ibanga leqembu usalokhu uwukuhlukanisa okuwusizo, futhi uba nencazelo kuphela lapho kungekho ntanga eyodwa engafuna ikheli elingelomunye ilungu.

Bhala inqubomgomo yokudlulisa ehlukanisa amaqembu

Ithrafikhi enentshisekelo lapha ingena futhi iphuma ngesixhumi se-tunnel esifanayo, ngakho idlula indlela yokudlulisa hhayi indlela yokufaka yesiphathi. Imithetho ingeyeketanga yokudlulisa ekhona yanoma yimuphi umphathi wothango lomlilo ongumnikazi wesiphathi, futhi iyizicucu hhayi isethi yemithetho ephelele.

iifname "wg0" oifname "wg0" ip saddr 10.66.10.0/24 ip daddr 10.66.10.0/24 accept
iifname "wg0" oifname "wg0" ip saddr 10.66.20.0/24 ip daddr 10.66.20.0/24 accept
iifname "wg0" oifname "wg0" drop

Imithetho emibili yokuqala ivumela ithrafikhi ngaphakathi kweqembu ngalinye. Eyokugcina ivimba konke okunye okudlula kuleso sixhumi, futhi yikho okudala ukuhlukaniswa phakathi kwamaqembu. Engeza imithetho ecacile yomunye umndeni wamakheli uma uyidinga, ngoba i-drop ebhalelwe i-IPv4 ayigunyazi futhi ayichazi ukuziphatha kwe-IPv6.

Ukulandelana kunquma ukuthi inqubomgomo iyasebenza yini

Ukulandelana kwemithetho kubaluleke ukudlula isicucu uqobo. Umthetho ojwayelekile owamukela ukuxhumana okusunguliwe futhi obekwe ngaphambi kwalezi zingeniso uvumela ukugeleza kwakudala phakathi kwamaqembu ukuba kuqhubeke, ngakho ukuhlukaniswa kusebenza kuphela ekuxhumaneni okusha. Nquma ukuthi iyiphi kulezi ziphumo ezimbili oyifunayo ngaphambi kokulayisha kabusha.

Isinqumo sokwamukela naso asisolokhu siphelele phakathi kwamaketanga ku-hook efanayo. Uma elinye iketanga lesisekelo lisebenza kamuva, inqubomgomo esebenzayo iyinhlanganisela, ngakho hlola izibali hhayi ifayela olilihlele. Izibali ziwubufakazi obushibhile obutholakalayo. Umthetho ongenakho ukubalwa kwamaphakethe awuhambisani, futhi umthetho ohambisanayo ngesikhathi iketanga elilandelayo lamukela ukutshela ukuthi i-drop isendaweni engafanele.

Hlola i-matrix, hhayi inani lamafayela

Akha i-matrix encane yemiphumela elindelekile bese uhlola iseli ngalinye. Iqembu A kuye eqembu A kufanele kusebenze, iqembu B kuye eqembu B kufanele kusebenze, futhi A kuye ku-B akufanele, kuzo zombili izinhlangothi futhi kuyo yomibili imindeni yamakheli uma uyisekela.

nft list ruleset
wg show wg0 allowed-ips
ping -c 2 10.66.10.5
conntrack -L -s 10.66.20.7 2>/dev/null | head

Ezimbili zokuqala zikhombisa ukuthi yini esethiwe. I-ping evela elungwini leqembu elingalungile ikhombisa ukuthi kwenzeka ngani ngempela. Uhlu lwe-conntrack lukhombisa ukuthi ukugeleza okudala kusamukelwa yini, futhi yileyo ndlela ukushintsha kokuhlukaniswa okwehluleka ngokuthule ukusebenza.

Izinsizakalo zesiphathi esiteshini kanye nokufinyelela kwi-LAN engemuva kwaso kuyizindlela ezihlukile ezinqubomgomo ehlukile. Bhala ukuthi iyiphi yazo i-matrix eyimbozayo, ngoba ukuhlolwa okuhlola kuphela ithrafikhi yontanga-nontanga akusho lutho nganoma yikuphi kukho kokubili.