WireGuard: imigwaqo emibili engxenye ne-0.0.0.0/0 ku-wg-quick

Amaqembu amabili e-/1 ahlanganisa amakheli e-IPv4 afanayo ncamashi ne-/0 elilodwa, futhi lokho kulingana kusebenza kuphela ngaphakathi kohlu lwamaqembu avunyelwe omphele. Kuyeka ukusebenza ngesikhathi ithuluzi lokusetha linquma ukuthi kuzohanjiswa kanjani, ngoba i-Linux wg-quick ibheka isiqalo esizenzakalelayo njengendaba ekhethekile hhayi njengezibalo. Igatsha elikhethekile lifaka ithebula elikhethiwe, imithetho emibili yenqubomgomo, uphawu lwesokhethi kanye nezilungiselelo zendlela ebuyayo umbhangqwana wemigwaqo engxenye ongeke uwasithola. Ngakho-ke lapho ummeleli noma isiphequluli siyeka ukusebenza ngemva kokuhlela, amaqembu awo yizingxenye ezingathandeki kakhulu zoshintsho.

Uhlu lwamaqembu akusona sonke isakhiwo

AllowedIPs wenza imisebenzi emibili ngesikhathi esisodwa, futhi munye kuphela oxhumana nokuhlanganiswa. Ku-WireGuard uqobo uhlu luyindlela yokuhambisa ngokhiye wokubhala: lunquma ukuthi iziphetho ziphi ezibhalwa zibheke kumphele nokuthi yimaphi amakheli omsuka umphele angawasebenzisa. Ku-wg-quick uhlu olufanayo lusebenza futhi njengesicaciso sendlela, futhi indlela eyenzayo incike ekutheni uhlu luhlangana naluphi ugatsha ngengozi. Ngakho-ke ukuhlanganiswa okufanayo ezinhlotsheni ezimbili zohlu ezihlukile akusho lutho mayelana nesimo somsingathi esifanayo.

Isakhiwo esizenzakalelayo sithatha leso sinqumo ezandleni zakho, ngoba i-Table ngokuzenzakalela iyazenzakalela futhi ithuluzi lizikhethela ngokwalo ukuthi imigwaqo izofika kuphi. Omunye umphathi wenethiwekhi, isembozo sokuhlinzeka noma inani le-Table elenziwe ngokwezifiso kushintsha futhi umphumela, yingakho iseluleko esibhalelwe umsingathi owodwa singabonakala singalungile kwelandelayo.

Yini igatsha elizenzakalelayo elengezayo ngaphezu komgwaqo

Umgenelo we-/0 uthumela i-wg-quick endleleni yayo yomgwaqo ozenzakalelayo: ithebula elihlukile lokuhambisa lamukela okuzenzakalelayo, umthetho owodwa wenqubomgomo uthumela ukuhamba okungenalo uphawu lapho, umthetho wesibili ugcina imigwaqo eqondile kakhulu yethebula eliyinhloko inegunya, futhi isixhumi samukela uphawu lodonga lomlilo kusokhethi yaso. Lowo phawu ungumlindi womjikelezo. Ama-datagramu abhaliwe athwala ukuhamba komhubhe aphuma nophawu lubekiwe, ukuze umthetho ohambisa konke okunye ungene emhubheni ungagwinyi amaphakethe okuthutha omhubhe uqobo.

Esikhundleni salokho, umbhangqwana wemigenelo ye-/1 uthatha indlela evamile yomgwaqo. Imigwaqo emibili ifika ethebuleni elisethiwe, futhi akukho ngxenye yomshini ozungezile ebonakalayo, hhayi ngoba ingadingeki kodwa ngoba leyondlela yekhodi ayikaze ingeniswe.

Lapho izinhlelo ezimbili zihlukana khona

Umehluko ubonakala kuqala njengokuphindaphinda. Lapho imigwaqo engxenye isetheluleni eliyinhloko, ikheli lokuthutha lomphele uqobo liwela ngaphakathi kwesiqalo somhubhe, ngakho iphakethe okufanele lithwale umhubhe lihlangana nomgwaqo okhombisa ngaphakathi komhubhe. Kukhona okufanele kukukhulule: umgwaqo womsingathi wendawo yokugcina yamanje, uphawu olubekwe ngesandla noma umthetho oqondene nesixhumi. Umgwaqo womsingathi usebenza kuze kushintshe ikheli lendawo yokugcina, okwenzeka ezindaweni zokugcina ezisekelwe ku-DNS, kumakhasimende azulazulayo kanye nasezakhiweni ezinabalingani abaningi.

Okwesibili, noma yini ecabanga ngophawu ishintsha ukuziphatha. Ummeleli osobala ohambisa kabusha izixhumo endaweni yasekhaya wenza amasokhethi amasha okungafani kwawo uphawu nemithombo eyahlukile kusukela kokugeleza koqobo komkhasimende, futhi imithetho yenqubomgomo ekhiqizwa yigatsha elizenzakalelayo yayiyingxenye yalokho okwahlukanisa lokho kugeleza. Ukufunda uxhumo lwangaphandle lommeleli uqobo kungomunye umsebenzi wokuzilolonga kunokuhlola ukuthi indawo yokuqala iyafinyeleleka yini.

Funda imithetho nezimpawu ngaphambi kokuhlela

Thwebula isimo samanje ngesikhathi umhubhe uphilile, bese uphinda ngemva koshintsho, bese uqhathanisa izinto ezimbili ezikhiqiziwe esikhundleni sokucabanga kusukela kufayela lesakhiwo. Faka imithetho yenqubomgomo, ithebula ngalinye, uphawu lwesixhumi kanye nezindawo zokugcina ezirekhodiwe.

ip rule show
ip -4 route show table all | grep -E 'default|wg1'
wg show wg1 fwmark
wg show wg1 endpoints

Uma umugqa wokuqala wokukhiphayo ulahlekelwe umthetho wokuhamba okungenalo uphawu futhi ithebula elikhethiwe lingenalutho, igatsha elizenzakalelayo alisebenzi futhi asikho isibalo sesiqalo esizobuyisela imiphumela yaso. Uphawu luka-zero esixhumeni ebesinophawu ngaphambili luwuphawu olufanayo, lubonakala enanini elilodwa.

Zilolonge ekulahlekelweni komhubhe ngaphambi kokukhipha

Uma isakhiwo semigwaqo engxenye siwukukhetha okwenziwe ngamabomu, kumele sinikeze izingxenye ezingekho ngokusobala: indlela yendawo yokugcina emelana nokushintsha kwamakheli, ukuziphatha okuhlosiwe lapho umhubhe uwela khona kanye nokuphathwa okulinganayo kwe-IPv6. Zibhale njengezidingo esikhundleni sokuzithola ngesikhathi sokuphazamiseka. Bese uzilolonga ukwehluleka, ngoba umhubhe ogcwele obuyela buthule emgqeni wangempela womhlaba mubi kunalowo oyeka ukusebenza.

sudo ip -4 route add 198.51.100.20/32 via 192.0.2.1 dev eth0
ip -4 route get 198.51.100.20
sudo wg-quick down wg1

Ukusesha komgwaqo kufanele kuxazulule indawo yokugcina isuka esixhumeni somhlaba ngaphandle kokuwela umhubhe, futhi ukwehlisa isixhumi kufanele kushiye umsingathi esimweni okwathenjiswa yisakhiwo. Ummeleli osebenza ngemva kokushintshwa ufakazela ukuthi isimo somsingathi esikhiqiziwe sasibalulekile; akufakazeli ukuthi ukuvimbela umjikelezo nokuziphatha esimweni esicishiwe kwasinda ekuhleleni.