WireGuard PersistentKeepalive: gcina imephu ye-NAT iphila
Uma ukuxhumana okuphambene kusebenza kuphela ngokushesha ngemva kokuba uzakwabo ethumele ithrafikhi, imephu iyaphela. Setha i-keepalive ngemuva kwerutha bese ufunda isikhathi sokulinda sangempela.
Ibhokisi lasekhaya livula umgudu futhi lifinyelela iseva yefu ngaphandle kwenkinga. Iseva yefu ingafinyelela uhlelo lwasekhaya iminithi eyodwa noma ezimbili ngemva kokuba ibhokisi lasekhaya ligcine ukuthumela okuthile, bese liyeka. Akukho lutho olubonakalayo kulogi ye-WireGuard, akukho phutha lokuxhawula okubikwayo, futhi ukuqalisa kabusha umgudu kuyalungisa okwesikhashana. Leyo phethini iwumephu ephelayo, hhayi umgudu ophukile, futhi umhlahlandlela ongezansi uyaqinisekisa lokho ngaphambi kokushintsha noma yini.
Qinisekisa ukuthi iphethini ukuphela ngesikhathi sokungenzi lutho
Imininingwane ehlukanisayo isikhathi. Uma ukuxhumana okuphambene kusebenza ngokushesha ngemva kokuba uzakwabo wasekhaya ethumele ithrafikhi futhi kwehluleka ngemva kwesikhathi sokuthula, indlela ilungile futhi isimo esiphakathi asilungile. Uma kungakaze kusebenze, ngisho nangokushesha ngemva kwethrafikhi, lokhu ukuxilongwa okungalungile.
sudo wg show wg0 latest-handshakes
sudo wg show wg0 endpoints
sudo wg show wg0 transferSebenzisa ezimbili zokuqala ngokushesha ngemva kokuba uzakwabo wasekhaya ethumele okuthile, linda iminithi emihlanu bese uphinda uzisebenzise. Isigxivizo sesikhathi sokuxhawula esivuselelwa ngokohlelo ngaphandle kwendawo yokugcina entsha sitshela ukuthi umgudu uyaphila. Okwashintshayo yikhono lamaphakethe angacelwanga ukufika kusuka ngaphandle, okuyisici sendlela hhayi somgudu.
Bese wenza umzamo ophambene futhi ubheke izibali zokudlulisa. Uma uhlangothi lwefu luthumela amabhayithi futhi uhlangothi lwasekhaya alutholi nelilodwa, iphakethe lashiya ifu futhi lafa kudivayisi egcina isimo endleleni. Yilowo mphawu owufunayo. Uma zombili izibali zihamba, umgudu uthumele iphakethe futhi uhlelo olusolwayo.
Beka i-keepalive kuzakwabo ongemuva kwerutha
Ama-keepalive anomphela agcina imephu ye-NAT nanoma yisiphi isimo se-firewall siphila ngokuthumela iphakethe elincane eliqinisekisiwe ngokohlelo. Isilungiselelo singesomshini ongemuva kwerutha, kunkomba yaso yozakwabo okude, ngoba yilolo hlangothi iphakethe laso eliphumayo elidala isimo.
[Peer]
PublicKey = <cloud peer public key>
AllowedIPs = 10.71.0.1/32
PersistentKeepalive = 25Hlanganisa nesigaba sozakwabo esikhona. Ukungeza ibhulokhi yesibili ngokhiye ofanayo womphakathi akusiyo indlela evumelekile yokwengeza izinketho, futhi i-wg-quick ngeke izihlanganise kuwe. Amasekhondi angu-25 abhaliwe ayisibonelo esikhethwe ukuze sibe ngaphansi kwezikhathi ezijwayelekile ze-UDP, hhayi inani elinencazelo ekhethekile.
Ukubeka umyalo ofanayo ohlangothini lwefu akusizi kule nkinga. Amaphakethe alolo zakwabo aseza kakade kusuka kukheli lomphakathi, ngakho akukho mephu okufanele igcinwe endleleni ebalulekile. Kuneza ithrafikhi futhi akushintshi lutho.
Funda izikhathi kunokuba uqagele isikhala
Ama-keepalive asebenza ngoba afika kaningi kunokuba isimo siphele. Lokho kwenza isikhathi sokulinda sibe inombolo oyidingayo ngempela, futhi ku-Linux ingafundwa kudivayisi eyenza ukuhumusha:
sysctl net.netfilter.nf_conntrack_udp_timeout
sysctl net.netfilter.nf_conntrack_udp_timeout_stream
sudo conntrack -L -p udp --dport 51820Inani lokuqala isikhathi sokulinda somfudumalo we-UDP obonwe ohlangothini olulodwa kuphela, kanti elesibili lisebenza ngemva kokubonwa kwezimpendulo. Womabili ngokuvamile mafushane, futhi imephu ethulayo izolandela lokho okusebenza kumfudumalo wakho.
Qhathanisa leyo nombolo nesikhala sakho. I-keepalive yamasekhondi angu-25 ngaphansi kwesikhathi sokulinda samasekhondi angu-30 iyasebenza; i-keepalive efanayo ngaphansi kwesikhathi samasekhondi angu-15 ayisebenzi. Noma zingaki izimo zokuphinda, lokho kubala akushintshi. Amanye amarutha abathengi nezinkampani zamaselula asebenzisa amanani amafushane kakhulu kunokwe-Linux, yingakho ukuhlelwa okusebenza kunethiwekhi eyodwa kwehluleka kwesinye.
| Observation | What it means | Reasonable response |
|---|---|---|
| Works after traffic, dies when idle | Mapping or firewall state expiring | Lower the keepalive interval |
| Never works, even immediately | No return route, listener or firewall | Stop tuning keepalive |
| Works for hours, then dies once | Carrier-side translation or address change | Check the endpoint and logs together |
Hlola isilaleli ne-firewall ngokwehlukana
Imephu ephilayo iyadingeka futhi ayanele. Uhlelo olusebhokisini lasekhaya kufanele lilalele kukheli elifanele, futhi i-firewall yomsingathi kufanele ivumele iphakethe ngemva kokulukuhliswa.
sudo ss -lntup | grep 8080
sudo wg show wg0 allowed-ips
curl -sS -m 5 http://10.71.0.2:8080/healthUma isokhethi iboshelwe kukheli lesixhumi esibonakalayo kuphela hhayi kukheli lomgudu, amaphakethe afika kumgudu ayaphonswa ngaphambi kokuba i-firewall ibuzwe. Lokho kwehluleka kusuka ohlangothini lwefu kubonakala kufana nkinga yemephu, futhi kuyasinda kunoma yikuphi ukulungiswa kwe-keepalive.
Ukuhlolwa kohlu oluvunyelwe kubalulekile ngokufanayo ohlangothini olunye. Uzakwabo wefu kufanele avumele ikheli lomgudu wasekhaya njengomthombo uma ezophendula, futhi uzakwabo wasekhaya kufanele avumele ikheli lefu njengendawo yokuyisa. Amaphakethe e-keepalive ayithrafikhi eqinisekisiwe futhi asebenzisa imithetho efanayo, yingakho i-keepalive ebonakala isebenza ingahlala nehlelo elingasebenzi.
Sethula ushintsho futhi wazi imikhawulo yalo
Faka isilungiselelo, qalisa kabusha isixhumi uma kuyindlela yakho yokubuyekeza, bese uphinda ukuhlolwa kokungenzi lutho esikhundleni sokuhlolwa ngokushesha. Linda isikhathi eside kunaleso sokulinda osifunde ngaphambilini, yenza isicelo esiphambene bese uqinisekisa ukuthi izibali zahamba kuzo zombili iziphetho.
Bhala isikhala nesikhathi sokulinda esilinganiselwe eceleni kwakho. Ushintsho lwesikhathi esizayo kufirmware yerutha, noma ukufudukela ekuxhumaneni kweselula, kungashintsha isikhathi sokulinda. Inothi liyilokho okuvumela othile ukuthi aphinde athole inani esikhundleni sokulikopisha. Izinombolo ezimbili emgqeni owodwa zonga uphenyo lonke kamuva.
Ama-keepalive anomphela avikela isimo. Awavuli imbobo, awanezi okufakiwe ohlwini oluvunyelwe, futhi awenzi isilaleli sivele. Uma ukuxhumana okuphambene kungasebenzi nhlobo, iphutha likwenye yalezo zintathu, futhi isiqalo esisheshayo se-WireGuard sichaza isilungiselelo se-keepalive ngaso sona sikhathi esincane.