Ithuneli elihlukanisiwe le-WireGuard: lihlele ngaphandle komzila ojwayelekile

Ithuneli elihlukanisiwe lichazwa yilokho okushiya ngaphandle, futhi i-WireGuard ithatha leso sinqumo endaweni eyodwa. I-AllowedIPs yohlangothi lweklayenti ikhetha ngasikhathi sinye ukuthi yiziphi izindawo ezidlula ethunelini futhi ihlunga ukuthi yimaphi amakheli omthombo angaphakathi amukelwayo, kanti i-wg-quick iguqula uhlu olufanayo lube imizila yomsingathi. Uma uhlu lungalungile, ithuneli ligwinya konke noma alithwali lutho.

Qala ngokunquma uhlu lweziqalo

Bhala phansi izindawo okufanele zisebenzise ithuneli ngaphambi kokuthinta ifayela lokuhlela. Ama-subnet asehhovisi, ibanga ledathabhezi, inethiwekhi yokuphatha: ngayinye iyisiqalo esinesizathu. Konke okungekho ohlwini kuhlala emzileni womzimba, futhi lokho kuyinjongo yonke yokuklama.

Uma uhlu luqukethe i-0.0.0.0/0 noma i-::/0, wakhe ithuneli eliphelele futhi kufanele usho lokho, ngoba izimo zokwehluleka kanye nokulindelwe kwe-DNS kuyahluka.

Gcina uhlu lufushane ngokwanele ukuze umhloli akwazi ukuluqhathanisa nethebula yemizila kamuva.

Ukuhlelwa kweklayenti: i-peer, i-AllowedIPs, i-DNS

Ibhlokhi ye-interface yeklayenti iqukethe ikheli layo lethuneli nokhiye wangasese. Ibhlokhi ye-peer iqukethe ukhiye womphakathi weseseva, iphoyinti lokugcina kanye neziqalo zesinyathelo sokuqala:

[Interface]
Address = 10.9.0.2/32
PrivateKey = <client-private-key>
DNS = 10.20.0.53

[Peer]
PublicKey = <server-public-key>
Endpoint = vpn.example.net:51820
AllowedIPs = 10.20.0.0/16, 10.30.0.0/24
PersistentKeepalive = 25

I-AllowedIPs kuklayenti iqoqo lezindawo ezikude, hhayi ikheli leklayenti ngokwalo. Umugqa we-DNS usebenza kuphela ngokuhlanganiswa kwesixazululi se-wg-quick, ngakho umsingathi ongenakho ukusekelwa kwe-resolvconf noma i-systemd-resolved uzokushaya indiva. I-PersistentKeepalive igcina imephu ye-NAT iphila futhi ayidingeki emzileni oqondile.

Phawula isiqalo ngasinye ngensizakalo esiyisebenzelayo, uma kungenjalo ukuhlela okulandelayo kuzoba ukuqagela.

Ukuhlelwa kweseseva: umbono ophambene

Kuseseva, umbhalo we-peer umele iklayenti, ngakho i-AllowedIPs yawo iyikheli lethuneli leklayenti, ngokuvamile i-/32. Akusona isubnet yasehhovisi. Ukukopisha uhlu lweklayenti kumbhalo weseseva iyiphutha elivame kakhulu kuthuneli elihlukanisiwe, futhi kungaba kwandisa ukufinyelela noma kwephula ukuhlolwa komthombo wangaphakathi ngesikhathi sokuxhawula.

Ikheli le-interface leseseva ngokwalo kanye nemizila eliyidingayo ebheke ehhovisi kuhlukile kunoma yimuphi umbhalo we-peer.

Amafayela amabili, imibono emibili, iqoqo elilodwa leziqalo elabiwe phakathi kwazo.

Liphakamise bese ufunda imizila

Qala i-interface ngomphathi osekelwayo, bese ubheka ukuthi yini eyifakile, hhayi ukuthi wawuhlose ukuthini. I-wg-quick ikhipha imizila ku-AllowedIPs; uma iphrofayili ibeka i-Table = off, akukho okufakiwe futhi ukuhamba kwemizila kungokwakho. Funda umzila wesiqalo ngasinye bese uqinisekisa ukuthi ukhomba ku-interface ye-WireGuard. Uhlu lwemizila olungenalutho ngokuvamile lusho ukuthi iphrofayili esetshenzisiwe akuyona leyo oyihlelile.

Bheka futhi izibali zokuxhawula, ngoba i-peer engenakho ukuxhawula inenkinga yokhiye, yephoyinti lokugcina noma yokufinyeleleka, hhayi yenkinga yemizila.

Bhala phansi umyalo oqondile owusebenzisile, ngoba umuntu olandelayo uzowusebenzisa ngaphansi kwengcindezi.

Qinisekisa izinhlangothi zombili, bese ubhala ukuhoxiswa

Hlola ikheli langasese, igama lalo langaphakathi kanye nendawo okufanele ihlale iqondile. Uma ikheli langasese lisebenza futhi indawo eqondile siphuma ethunelini, uhlu lweziqalo lubanzi kakhulu. Uma igama lihluleka ngenkathi ikheli lisebenza, umugqa we-DNS awuzange uqale ukusebenza. Ukuhoxiswa kungumyalo owodwa, futhi kungokwenothi elifanayo.

Ngemva kokuxhuma kabusha, qinisekisa ukuthi imizila isekhona, ngoba umphathi osebenzisa iphrofayili futhi angashintsha imizila yezandla.

Gcina umnikazi oyedwa wokuhlelwa, ngoba abaphathi ababili abakhiqiza i-interface efanayo bazogcina bengavumelani. Incwadi ye-wg-quick ibhala ukuziphatha kwemizila ne-DNS elikuhlinzekayo.