I-peer ye-WireGuard ayifinyeleleki kuyilapho enye isebenza: uhlu lokuhlola

I-peer eyodwa ye-WireGuard idlulisa ithrafikhi kanti eyesibili iqeda ukuxhawulana kodwa ayikaze ifinyelele noma yini ngemuva komhubhe. I-peer esebenzayo ikutshela ukuthi i-interface, imbobo ye-UDP kanye nokhiye weseva kungenzeka zilungile. Ayisho lutho mayelana ne-AllowedIPs ye-peer yesibili, ikheli lomthombo wangaphakathi noma imithetho yokudlulisela phakathi kwabo. Landela uhlu ngokulandelana futhi ume esinyathelweni sokuqala isimo saso esihlulekayo.

Isinyathelo 1: Bhala indlela okufanele iphakethe ihambe ngayo

Amaklayenti amabili ku-hub eyodwa awafinyeleli komunye nomunye ngokuzenzakalela. Kumklamo we-hub nemisebe, iseva ithola iphakethe ku-wg0 futhi kufanele ilidlulisele futhi liphume ku-wg0 liye kwenye i-peer, okudinga ukudluliselwa kwe-IP kanye nomthetho wokudlulisela. Kumklamo oqondile we-peer-kuya-peer, uhlangothi ngalunye ludinga iphuzu lokugcina lalolunye kanye nekheli lomhubhe walolunye ngaphakathi kwe-AllowedIPs. Nquma ukuthi yimuphi umklamo owulungisayo ngaphambi kokufunda noma yikuphi ukulungiselelwa.

Indlela elindelekile futhi ikutshela lapho ubheka khona. Uma iphakethe kufanele lidlule i-hub, isinyathelo esihlulekayo kungaba i-AllowedIPs yomthumeli, ukudlulisela kwe-hub noma i-AllowedIPs yomamukeli. Uma kufanele liqonde ngqo, i-hub ayibalulekile futhi izinkambu zephuzu lokugcina kuwo womabili ama-peer zibalulekile.

Isinyathelo 2: Qhathanisa i-AllowedIPs kuzo zombili izinhlangothi, hhayi ohlangothini olulodwa

I-WireGuard isebenzisa i-AllowedIPs njengothebula lokuhambisa kanye nohlu lokufinyelela. Lapho ithumela, ikheli lendawo ekuyiwa kuyo liyaseshwa ku-AllowedIPs ye-peer ukuze kukhethwe umhubhe; lapho yamukela, ikheli lomthombo wangaphakathi kufanele liwele ngaphakathi kwe-AllowedIPs ye-peer ethumayo, ngaphandle kwalokho iphakethe liyalahlwa. Ibanga elingekho kunoma yiluphi uhlangothi linikeza uphawu olufanayo: ukuthutha kuyasebenza, umthwalo uyanyamalala.

Funda isimo esibukhoma esikhundleni sefayela, ngoba ukulayisha kabusha kungenzeka kwehlulekile ngokuthula: sudo wg show wg0 allowed-ips. Kuseva, umbhalo we-peer ehlulekile kufanele uhlanganise ikheli lomhubhe wayo, isibonelo 10.90.0.3/32. Kuklayenti, umbhalo we-peer yeseva kufanele uhlanganise indawo okuyiwa kuyo oyihlolayo, kungaba ikheli lomhubhe we-hub noma isubneti ekude. Amabanga ahambisana ayenza imfuno ingacaci futhi angakhetha i-peer obungayihlosile, ngakho wahlukanise.

Isinyathelo 3: Hlola ikheli lomthombo wangaphakathi

Iklayenti elihambisa i-10.90.0.3 nge-wg0 kodwa lithumela amaphakethe lisuka ekhelini lalo le-Wi-Fi lizokwenqatshwa umamukeli, ngoba umthombo awuhambisani ne-AllowedIPs ye-peer. Qinisekisa ukuthi i-kernel ikhetha ini ngempela nge-ip route get 10.90.0.3 from 10.90.0.2, futhi uqinisekise ikheli elinikezwe i-interface yomhubhe nge-ip -brief addr show wg0.

Kumphathi we-Linux owamukelayo, ukuhlunga kwendlela ebuyayo kuyisango lesibili. I-rp_filter eqinile ku-interface ephethe indlela ebuyayo ingalahla ithrafikhi yomhubhe indlela yayo ebuyayo engahambisani ne-interface eyangena ngayo. Hlola inani elisebenzayo ngaphambi kokuyicisha; emiklamweni eminingi ukulungiswa okufanele yindlela, hhayi isihlungi esikhululekile.

Isinyathelo 4: Buyekeza ukudlulisela kwe-hub nendlela ebuyayo

Uma i-hub kufanele idlulisele phakathi kwama-peer, i-kernel idinga i-net.ipv4.ip_forward=1, futhi i-firewall kufanele yamukele ukugeleza okudlulisiwe: ukungena ku-wg0, ukuphuma ku-wg0, kusuka ekhelini lomhubhe womthumeli kuye kwelomamukeli. Iphutha elivamile iwukuthi umthetho wokungena owamukela i-UDP 51820 kodwa awukho umthetho wokudlulisela], ngakho ukuxhawulana kuyaphumelela futhi umthwalo uyafa. Bhala imithetho esebenzayo nge-sudo nft list ruleset noma okulingana nakho kumphathi wakho we-firewall.

Bese uhlola impendulo. Umphathi wendawo ekuyiwa kuyo kufanele abe nendlela ebuyela kumthumeli, kungaba nge-hub noma ngegesango lakhe. Uma i-hub futhi yenza i-NAT kusubneti yomhubhe, qinisekisa ukuthi ukuhumusha kusebenza ekugelezeni okudlulisiwe nokuthi impendulo ifinyelela i-hub ngaphambi kokuphela kwesimo. Iphutha elihambisa ohlangothini olulodwa elibonakala njengenkinga yokhiye ngokuvamile liyile ndlela ebuyayo.

Ekugcineni, hlukanisa ukuxhawulana nedatha. I-peer eqeda ukuxhawulana kodwa ime ekudluliseni okukhulu ngokuvamile inenkinga ye-MTU noma ye-MSS kuleyo ndlela, hhayi inkinga ye-AllowedIPs. Hlola nge-ping encane kuqala, bese ngomkhulu ogcwele, bese uqhathanisa ama-peer womabili.

Isinyathelo 5: Shintsha into eyodwa futhi ugcine i-peer esebenzayo ingalimalanga

Yenza ushintsho olulodwa endleleni ehlulekayo bese uphinda uhlole ama-peer womabili. Ukushintsha i-AllowedIPs ye-peer ngayinye nge-0.0.0.0/0 iyindlela eshesha kakhulu yokuphula i-peer ebiyayisebenza, ngoba ishintsha isinqumo sokuhambisa sayo yonke ithrafikhi kuleyo interface. Hlela lowo mbhalo owodwa, layisha kabusha bese ufunda isimo esibukhoma.

Bhala ukuthi iyiphi indlela ephumelele, ephi ehlulekile, kanye nokuphuma komlayeto okuqondile kwakho kokubili. Lokho kuqhathanisa kubiza ngaphezu kombiko ojwayelekile wokuthi i-VPN iphukile, futhi yikho okuqala umuntu olandelayo azokubuza khona.