I-WireGuard isebenza kudatha yeselula kodwa hhayi kuyi-wifi efanayo
Isicelo esisuka ngaphakathi kwe-LAN siya ekhelini lomphakathi lerawutha sithatha umzila ohlukile kunesicelo sedatha yeselula. Hlola ngaphandle bese ukhetha umzila wasekhaya.
Ithumbe liyaphuma kudatha yeselula bese lihlala kuxhumeka ekhaya, ngephrofayili efanayo, ngokhiye we-peer ofanayo futhi kungabanga khona ushintsho lokucwangisa phakathi. Umehluko usohambweni: isicelo esisuka ngaphakathi kwe-LAN siya ekhelini lomphakathi lerawutha akulona uhambo olufanayo nesicelo esifika livela ku-inthanethi. Iningi lamageyithi asekhaya aliwusebenzisi umzila wokubuyela noma luwusebenzisa kuphela kumaphrothokholi athile. Lokho kwenza uphawu lubonakale njengokhiye ophukile kuyilapho kungenamizuzu ekhona okushintshile kokhiye. Thola ukuthi yimuphi umzila ohlulekile ngaphambi kokuthinta ukhiye, ukudlulisela iphothi noma iphrofayili yeklayenti.
Ikheli elilodwa, imizila emibili ehlukene
Kusuka ngaphandle, iphakethe lifinyelela ikheli lomphakathi lerawutha futhi umthetho wokudlulisela iphothi ulinikeza isilaleli se-WireGuard kumphetheli wangaphakathi. Kusuka ngaphakathi, iklayenti lishaya ikheli lomphakathi elifanayo, ngakho iphakethe liphuma eklayenti, lifinyelela kurawutha futhi kufanele liphendulwe libuyiselwe ngase-LAN. Kukho lokho kuphenduka lapho imizila emibili ihlukana khona, ngoba irawutha kufanele ihumushe ukugeleza okukhuluphala futhi okungena futhi ngesikhathi esifanayo ngesikhungo esifanayo. Izinhlelo eziningi ziyakulahla esikhundleni sokukuhumusha, futhi iklayenti libe selilindela isandla sokubingelela esingakaze sithunyelwe.
Le nkambiso ivame ukubizwa nge-NAT loopback noma i-hairpinning, futhi ingeyerawutha hhayi eye-WireGuard; i-RFC 4787 ibeka amacala okuhumusha lapho igeyithi ingase isekele noma ingasekelanga. I-WireGuard ngokwayo ayinalo umbono ngomzila, ngoba ibona kuphela amaphakethe afinyelela esikhungweni sayo. Lapho irawutha ilahla ukugeleza, idaemon ayikaze ithole lutho, iklayenti libika isikhathi sokuphela sesandla sokubingelela, futhi ilogi yeseva ihlala ingenalutho. Ilogi engenalutho ngakho-ke iyinkomba yokuthi iphakethe lama kuphi, hhayi ubufakazi bokuthi iseva iphansi. Yiso futhi isizathu sokuthi ukufaka kabusha akushintshi lutho.
Okuphambene nakho kubalulekile: ilogi yeseva ebonisa umzamo wesandla sokubingelela ovela ekhelini le-LAN ifakazela ukuthi iphakethe lafika futhi umzila ulungile, okuhambisa uphenyo kukhiye namakheli avunyelwe. Funda ilogi ngalokho ekufakazelayo, hhayi ngalokho obukade ulindele ukukubona.
Khiqiza kabusha ngaphambi kokushintsha noma yini
Hlola kusuka kunethiwekhi yangaphandle egunyaziwe ngedivayisi efanayo nangephrofayili efanayo, bese uphinda ukuhlola ngaphakathi kwe-LAN ngaphandle kokuhlela lutho. Isandla sokubingelela esiqediwe ngaphandle neklayenti okungaphakathi elingasoze lishiye idivayisi kukhiqiza kabusha isimo esikhundleni sokusiqagela. Yomibili imizamo kufanele isebenzise iphrofayili efanayo, kungenjalo ukuqhathanisa akufakazeli lutho.
Bese ubheka ukuthi igama lendawo yokugcina lixazululela ini kule divayisi. Le mithetho emithathu elandelayo ibonisa futhi ukuthi iyiphi ikheli iklayenti elishaye ngempela:
wg show wg0 endpoints
dig +short vpn.example.net A
resolvectl query vpn.example.netUmyalo wokuqala ubika indawo yokugcina esetshenziswa isikhungo njengamanje, futhi eminye emibili ibonisa ukuthi igama lixazululela ini kulo mshini. Iklayenti elishaya ikheli lomphakathi ngesikhathi lihlezi kunethiwekhi efanayo neseva lisebenzisa umzila we-hairpin. Iklayenti elishaya ikheli le-LAN alikwenzi lokho, futhi ukwehluleka lapho kungokophenyo olunye. Lowo mehluko unquma ukuthi ingxenye elandelayo iyasebenza yini.
Izindlela ezisekelwayo zokufinyelela iseva eseduze
Ukuhlelwa okuhlanzekile kakhulu yimpendulo ye-horizon ehlukanisiwe: igama lomphakathi lixazululela ekhelini lomphakathi ku-inthanethi nasekhelini le-LAN leseva kumaklayenti angaphakathi. Iphrofayili igcina igama elilodwa lendawo yokugcina futhi isixazululi sikhetha umzila. Lokho kudinga ukulawula impendulo ye-DNS yangaphakathi, irawutha yasekhaya evame ukuyinikeza futhi inhlangano ingayihlela ngamabomu. Ngaphandle kwalokho kulawula, izinketho ezisele yisici serawutha noma iphrofayili yesibili.
Isici serawutha ukubonakaliswa: igeyithi ihumusha ukugeleza kusuka ngaphakathi kuya ngaphandle futhi ikubuyisela ngaphakathi. Lapho kusebenza khona akudingi ushintsho lweklayenti, futhi lapho kungasebenzi khona asikho isilungiselelo seklayenti esizosihlenga. Kuyihlole ngokubuka ilogi yeseva ngesikhathi somzamo wangaphakathi esikhundleni sokufunda uhlu lwezici zerawutha.
Ukuhlela iphrofayili iye ekhelini langasese kuwukuxilonga, hhayi ukuklama. Kufakazela ukuthi iseva iyaphendula ku-LAN, futhi kwephula iphrofayili efanayo ngesikhathi ilaphuthophu ishiya ikhaya.
| Approach | What it depends on | Where it fails |
|---|---|---|
| Split-horizon name | Control of the internal DNS answer | Clients that resolve through a server outside the zone |
| Router reflection | Gateway support for hairpin translation | Routers that drop the flow silently |
| Private address in the profile | Nothing beyond the LAN | Every network except the one at home |
Gcina iphrofayili isebenziseka kude nekhaya
Noma yimuphi umzila owukhethayo, shiya ukuhlolwa kobuwena kuthule. Ikheli lendawo yokugcina akulona ubuwena be-peer, futhi ushintsho lwekheli alunakulungisela neze ukwamukela ukhiye womphakathi ongahlobene ovame ukuphendula. I-WireGuard iqinisekisa ngokhiye, ngakho umphetheli ongafanele wehluleka esandleni sokubingelela esikhundleni sokunikeza ukufinyelela kokuthile okungalindelekile.
Uma ikheli lomphakathi lihamba, i-DNS eguquguqukayo iyona egcina igama liwusizo, futhi indlela yeklayenti yokuvuselela inquma ukuthi ushintsho lufika ngokushesha okungakanani. Hlola lokho kusuka ngaphandle ngemuva koshintsho lwekheli, ngoba icala le-LAN alikwazi ukukuqinisekisa. Qaphela isixazululi esigcina impendulo endala ngale kwempilo yerekhodi. Igama elisakhomba ekhelini langaphambilini libonakala lifana ncamashi neseva ewile.
Bhala phansi ukuthi iphrofayili isebenzisa liphi igama nokuthi lixazululela ini ohlangothini ngalunye lomngcele. Iphrofayili encike esicini serawutha okungekho muntu okubhalile iwucingo losizo olulindele ukubuyekezwa kwefirmware okulandelayo. Inothi futhi iyona etshela umuntu olandelayo ukuthi ukwehluleka kwangaphakathi yicala le-hairpin elaziwayo noma into entsha.