ืื ืฆืืื ืืื ืืขืงืืืขื ืืืขื VPN ืืื ื ืื ืืขืจ ืึท ืขืงืืึธืืืฉ ืืขืฆืืึทื ืคืื ืืืจืืึทื ืกืืกืืขื ืึทืืืื ืืกืืจืึทืืึธืจืก. ืืืืขืจื ืืึธืื ืคืึทืจืฉืืืขื ืข ืืึทืกืงืก, ืึธืืขืจ ืืขืจ ืคืึทืงื ืืื ืึทื ืึทืืขืืขื ืืึทืจืฃ ืึท VPN.
ืื ืคึผืจืึธืืืขื ืืื ืงืจืึทื ื ืืืคึผื ืกืึทืืืฉืึทื ื ืืื ืึทื ืืื ืืขื ืขื ืฉืืืขืจ ืฆื ืงืึทื ืคืืืืขืจ ืจืืืืืง, ืืืึทืขืจ ืฆื ืืืึทื ืขื ืืื ืืขื ืขื ืคืื ืคืื ืืขืืึทื ืงืึธื ืคืื ืคึผืจืึธืืืขืืึทืืืฉ ืงืืืึทืืืืขื.
ืืื ืขืืืืืข ืืืจ ืฆืืจืืง ืืื ืืขืจ ืงืื ืืืืฉืขืจ ืืื ืคืืจืืืฆืืข ืกืขืงืืืจืืื ืืืืืข, Jason A. Donenfeld ืืึทืฉืืึธืกื ืื ืขืจ ืืื ืืขื ืื ืืขืจืคืื ืืื ืื ืืขืืืืื ืืจืืขืื ืืืืฃ . WireGuard ืืื ืืืฆื ืฆืืืขืืจืืื ืคึฟืึทืจ ืื ืงืืืืฉืึทื ืืื ืื ืืื ืืงืก ืงืขืจื ืืื ืืื ืืคืืื ืืืงืืืขื ืืืื ืคืื ืืื .
ืงืืืืื ืึทืืืืึทื ืืืืืฉืื ืคืื WireGuard ืืืืขืจ ืื ืืขืจืข VPN ืกืึทืืืฉืึทื ื:
- ืืจืื ื ืฆื ื ืืฆื.
- ื ืืฆื ืืึธืืขืจื ืงืจืืคึผืืึธืืจืึทืคื: ืจืึทืฉ ืคึผืจืึธืืึธืงืึธื ืคืจืืืืืืขืจืง, Curve25519, ChaCha20, Poly1305, BLAKE2, SipHash24, HKDF, ืขืืง.
- ืกืึธืืื, ืืืื ืขืืืืืง ืงืึธื, ืืจืื ืืขืจ ืฆื ืคืึธืจืฉื ืคึฟืึทืจ ืืืึทืื ืขืจืึทืืืืืืื.
- ืืืื ืคืึธืจืฉืืขืืื ื.
- ืงืืึธืจ ืืื ืคึผืจืึธืืื .
ืืื ืืขื ืืขืคืื ืขื ื ืืืืืขืจื ืขืจ ืงืืื? ืืื ืขืก ืฆืืื ืฆื ืืึทืืจืึธืื OpenVPN ืืื IPSec? ืืื ืืึธื ืืึทืฉืืึธืกื ืฆื ืืึทื ืืืขื ืืื ืืขื, ืืื ืืื ืืขืจ ืืขืืืืงืขืจ ืฆืืึทื ืืื ืืึธื .
ืืจืืขืื ืคึผืจืื ืกืึทืคึผืึทืื
ืื ืึทืคึผืขืจืืืืื ื ืคึผืจืื ืฆืืคึผื ืงืขื ืขื ืืืื ืืืกืงืจืืืื ืขืคึผืขืก ืืื ืืึธืก:
- ื WireGuard ืฆืืืื ื ืืื ืืืฉืืคื ืืื ืึท ืคึผืจืืืืึทื ืฉืืืกื ืืื IP ืึทืืจืขืก ืืขื ืขื ืึทืกืืื ื ืฆื ืขืก. ืื ืกืขืืืื ืืก ืคืื ืื ืืขืจืข ืคึผืืจื ืืขื ืขื ืืึธืืืื: ืืืืขืจ ืฆืืืืจ ืฉืืืกืืขื, IP ืึทืืจืขืกืขืก, ืขืืง.
- ืึทืืข IP ืคึผืึทืงืืฅ ืืืึธืก ืงืืืขื ืฆื ืื WireGuard ืฆืืืื ื ืืขื ืขื ืขื ืงืึทืคึผืกืึทืืืืืื ืืื UDP ืืื ืื ืืขืจืข ืคึผืืจื.
- ืงืืืืึทื ืฅ ืกืคึผืขืฆืืคืืฆืืจื ืื ืขืคื ืืืขื IP ืึทืืจืขืก ืคืื ืื ืกืขืจืืืขืจ ืืื ืื ืกืขืืืื ืืก. ืืขืจ ืกืขืจืืืขืจ ืืืืืึธืืึทืืืฉ ืื ืขืจืงืขื ื ืื ืคืื ืืจืืืกื ืืืง ืืืขื ืื ืคืื ืงืืืืึทื ืฅ ืืืขื ืจืืืืืง ืึธืืขื ืืึทืงืืืืึทื ืืึทืื ืืขื ืขื ืืืงืืืขื ืคืื ืืื.
- ืืขืจ ืกืขืจืืืขืจ ืงืขื ืขื ืืืืฉื ืื ืขืคื ืืืขื IP ืึทืืจืขืก ืึธื ืื ืืขืจืึทืคึผืืื ื ืืืื ืึทืจืืขื. ืืื ืืขืจ ืืขืืืืงืขืจ ืฆืืื, ืขืก ืืืขื ืฉืืงื ืึท ืคืืื ืง ืฆื ืงืึธื ื ืขืงืืขื ืงืืืืึทื ืฅ ืืื ืืื ืืืขืื ืืขืจืืืึทื ืืืงื ืืืืขืจ ืงืึทื ืคืืืืขืจืืืฉืึทื ืืืืฃ ืื ืคืืืขื.
- ืืขืจ ืืึทืืจืืฃ ืคืื ืจืืืื ื ืืื ืืขื ืืฆื . WireGuard ืึทืงืกืขืคึผืฅ ืืื ืกืขื ืื ืคึผืึทืงืืฅ ืืืืืจื ืืืืฃ ืื ืืึทื ืงืืงื ืก ืฆืืืืจ ืฉืืืกื. ืืืขื ืืขืจ ืกืขืจืืืขืจ ืืขืงืจืืคึผื ืึท ืจืืืืืง ืึธืืขื ืืึทืงืืืืึทื ืคึผืึทืงืึทื, ืืืื src ืคืขืื ืืื ืึธืคึผืืขืฉืืขืื. ืืืื ืขืก ืฉืืืขืืขืืขื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื
allowed-ipsืึธืืขื ืืึทืงืืืืึทื ืืึทื ืงืืงื , ืื ืคึผืึทืงืึทื ืืื ืืืงืืืขื ืืืจื ืื WireGuard ืฆืืืื ื. ืืืขื ืฉืืงื ืึท ืึทืืืืึธืืื ื ืคึผืึทืงืึทื, ืื ืงืึธืจืึทืกืคึผืึทื ืืื ื ืคึผืจืึธืฆืขืืืจ ืึทืงืขืจื: ืื ืืกื ืคืขืื ืคืื ืื ืคึผืึทืงืึทื ืืื ืืขื ืืืขื ืืื, ืืืืืจื ืืืืฃ ืขืก, ืื ืงืึธืจืึทืกืคึผืึทื ืืื ื ืืึทื ืงืืงื ืืื ืืืืกืืขืงืืืื, ืื ืคึผืึทืงืึทื ืืื ืืขืืชืืขื ืืื ืืืื ืฉืืืกื, ืื ืงืจืืคึผืืื ืืื ืื ืืึทื ืงืืงื ืก ืฉืืืกื ืืื ืืขืฉืืงื ืฆื ืื ืืืืึทื ืขื ืืคึผืืื ื. .
ืึทืืข ืคืื โโโโWireGuard ืก ืืึทืจืฅ ืืึธืืืง ื ืขืื ืืืืื ืืงืขืจ ืืื 4 ืืืืื ื ืฉืืจืืช ืคืื ืงืึธื, ืืฉืขืช OpenVPN ืืื IPSec ืืึธืื ืืื ืืขืจืืขืจ ืคืื ืืืืื ืืขืจ ืคืื ืฉืืจืืช. ืฆื ืฉืืืฆื ืืึธืืขืจื ืงืจืืคึผืืึธืืจืึทืคืืง ืึทืืืขืจืืืึทืื, ืขืก ืืื ืคืืจืืขืืืืื ืฆื ืึทืจืืึทื ื ืขืืขื ืึท ื ืืึท ืงืจืืคึผืืึธืืจืึทืคืืง ืึทืคึผื ืืื ืื ืืื ืืงืก ืงืขืจื . ืขืก ืืื ืืขืจืืืืึทื ืึท ืืืกืงืืกืืข ืืืขืื ืฆื ืืึธืก ืืื ืึท ืืื ืืขืืึทื ืง.
ืคืึธืจืฉืืขืืื ื
ืื ืืึทืงืกืืืื ืคืึธืจืฉืืขืืื ื ืืืึทืืข (ืงืึทืืคึผืขืจื ืืื OpenVPN ืืื IPSec) ืืืขื ืืืื ืืืืขืจืงื ืืืืฃ ืืื ืืงืก ืกืืกืืขืืขื, ืืื ื WireGuard ืืื ืืืคึผืืึทืืขื ืึทื ืืื ืึท ืงืขืจื ืืึธืืืืข ืืึธืจื. ืืื ืึทืืืฉืึทื, macOS, Android, iOS, FreeBSD ืืื OpenBSD ืืขื ืขื ืืขืฉืืืฆื, ืึธืืขืจ WireGuard ืืืืคื ืืื ืื ืืึทื ืืฆืขืจ ืคึผืืึทืฅ ืืื ืึทืืข ืื ืงืึทื ืกืึทืงืืืขื ืกืึทื ืคืื ืคืึธืจืฉืืขืืื ื. Windows ืฉืืืฆื ืืื ืืขืจืืื ืฆื ืืืื ืืืกืืฃ ืืื ืืขื ืืขืื ืฆืืงืื ืคึฟื.
ืืขื ืืฉืืึทืจืง ืจืขืืืืืึทืื ืืื :
ืืืึทื ืืึทื ืืฅ ืืขืจืคืึทืจืื ื
ืืื ืืื ื ืืฉื ืึท VPN ืืืืื. ืืื ืึทืืึธื ืืึทืฉืืขืืืงื OpenVPN ืืึทื ืืืึทืื ืืื ืขืก ืืื ืืขืืืขื ืืืืขืจ ืืืืืึทืก, ืืื ืืื ืืื ื ืืฉื ืืคืืื ืคึผืจืืืืจื IPSec. ืขืก ืืขื ืขื ืฆื ืคืืืข ืืืกืืืฉืึทื ื ืฆื ืืึทืื, ืขืก ืืื ืืืืขืจ ืืจืื ื ืฆื ืืจืืืขื ืืื ืืื ืื ืคึฟืืก. ืืขืจืืืขืจ, ืืื ืฉืืขื ืืืง ืืขืืืืื ื ืคืึทืจืืืง ืกืงืจืืคึผืก ืฆื ืงืึทื ืคืืืืขืจ ืื ืกืขืจืืืขืจ.
ืึทืืื, WireGuard, ืคึฟืื ืืืื ืคืื ื ืคืื ืืืื ืื ื, ืืื ืืืื ืืืขืึทื ืคึฟืึทืจ ืื ืืึทื ืืฆืขืจ. ืื ื ืืืขืจืืง-ืืืจืื ืืืกืืืฉืึทื ื ืืขื ืขื ืืขืืืื ืืื ืื ืืึทืฉืจืืึทืืื ื, ืึทืืื ืืขืจ ืคึผืจืึธืฆืขืก ืคืื ืคึผืจืืคึผืขืจืื ื ืึท ืืืคึผืืฉ ืืืคึผื ืื ืคืจืึทืกืืจืึทืงืืฉืขืจ ื ืขืื ืืืืื ืึท ืืืกื ืืื ืื. ืขืก ืืื ืึผืืขื ืืืืืขืืืขื ืฆื ืึธืคึผื ืึทืจื ืืื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื.
ืืึทื ืืึธื ืืืจืื ื ืคึผืจืึธืฆืขืก ืืืืฃ ืืขืจ ืืึทืึทืืืขืจ ืืืขืืืืึทืื, ืืื ืืืึธืื ืืื ืฆื ืกืขืคึผืขืจืึทืืื ืืึธื ืื ืืืกืืขืฆืืืื ื .
ืขื ืงืจืืคึผืฉืึทื ืฉืืืกืืขื ืืขื ืขื ืืืฉืขื ืขืจืืืืึทื ืืืจื ืื ื ืืฆื wg:
SERVER_PRIVKEY=$( wg genkey )
SERVER_PUBKEY=$( echo $SERVER_PRIVKEY | wg pubkey )
CLIENT_PRIVKEY=$( wg genkey )
CLIENT_PUBKEY=$( echo $CLIENT_PRIVKEY | wg pubkey )ืืืืึทืืขืจ, ืืืจ ืืึทืจืคึฟื ืฆื ืฉืึทืคึฟื ืึท ืกืขืจืืืขืจ ืงืึทื ืคืืืืขืจืืืฉืึทื /etc/wireguard/wg0.conf ืืื ืื ืคืืืืขื ืืข ืืื ืืึทืื:
[Interface]
Address = 10.9.0.1/24
PrivateKey = $SERVER_PRIVKEY
[Peer]
PublicKey = $CLIENT_PUBKEY
AllowedIPs = 10.9.0.2/32ืืื ืืึทืคึผื ืืขื ืืื ืขื ืืื ืึท ืฉืจืืคื wg-quick:
sudo wg-quick up /etc/wireguard/wg0.confืืืืฃ ืกืืกืืขืืขื ืืื ืกืืกืืขืื ืืืจ ืงืขื ืขื ื ืืฆื ืืขื ืึทื ืฉืืึธื sudo systemctl start [email protected].
ืืืืฃ ืืขื ืงืืืขื ื ืืึทืฉืื, ืฉืึทืคึฟื ืึท ืงืึธื ืคืื /etc/wireguard/wg0.conf:
[Interface]
PrivateKey = $CLIENT_PRIVKEY
Address = 10.9.0.2/24
[Peer]
PublicKey = $SERVER_PUBKEY
AllowedIPs = 0.0.0.0/0
Endpoint = 1.2.3.4:51820 # ะะฝะตัะฝะธะน IP ัะตัะฒะตัะฐ
PersistentKeepalive = 25 ืืื ืืึทืคึผื ืืขื ืืื ืขื ืืื ืื ืืขืืืข ืืืขื:
sudo wg-quick up /etc/wireguard/wg0.confืึทืืข ืืืึธืก ืืืืืื ืืื ืฆื ืงืึทื ืคืืืืขืจ NAT ืืืืฃ ืื ืกืขืจืืืขืจ ืึทืืื ืึทื ืงืืืืึทื ืฅ ืงืขื ืขื ืึทืงืกืขืก ืื ืืื ืืขืจื ืขื, ืืื ืืืจ ื ืืืึธ!
ืื ืื ืคืื ื ืืฆื ืืื ืงืึทืืคึผืึทืงืื ืึทืก ืคืื ืื ืงืึธื ืืึทืืข ืืื ืึทืืฉืืืื ืืืจื ืืืืืึทื ืืืืื ื ืื ืฉืืืกื ืคืึทืจืฉืคึผืจืืืืื ื ืคืึทื ืืงืฉืึทื ืึทืืืื. ืขืก ืืื ืงืืื ืงืึธืืคึผืืขืงืก ืืึทืืืืึทืื ืกืืกืืขื ืืื ืึทืืข ืืขื ืคึฟืืจืืข ืืจืืื; ืงืืจืฅ ืขื ืงืจืืคึผืฉืึทื ืฉืืืกืืขื ืืขื ืขื ืคืื ืื ืืขืจืืขืืืืื ืคืื ืืื SSH ืฉืืืกืืขื. ืึธืืขืจ ืืึธืก ืืื ืึท ืคึผืจืึธืืืขื: WireGuard ืืืขื ื ืืฉื ืืืื ืึทืืื ืืจืื ื ืฆื ืื ืกืืจืืืขื ื ืืืืฃ ืขืืืขืืข ืืืืืกืืื ื ื ืขืืืืึธืจืงืก.
ืฆืืืืฉื ืื ืืืกืึทืืืืึทื ืืืืืฉืื, ืขืก ืืื ืืืื ืฆื ืืืืขืจืงื ืึทื WireGuard ืืืขื ื ืืฉื ืึทืจืืขืื ืืืจื ืึท ืืืืคึผ ืคืจืืงืกื, ืืืืึทื ืืืืื ืื UDP ืคึผืจืึธืืึธืงืึธื ืืื ืื ืืืฆื ืืื ืึท ืึทืจืืืขืจืคืืจื. ืฉืืขืื ืืื ืื ืคึฟืจืึทืืข: ืืืขื ืืขื ืงืขื ืขื ืคึฟืึทืจืฉืืึทืจืงื ืืขื ืคึผืจืึธืืึธืงืึธื? ืคืื ืงืืจืก, ืืึธืก ืืื ื ืืฉื ืื ืืืจืขืงื ืึทืจืืขื ืคืื ืึท ืืืคึผื, ืึธืืขืจ ืคึฟืึทืจ OpenVPN, ืืืฉื, ืขืก ืืขื ืขื ืืืขืื ืฆื ืคืึทืจืฉืืขืืื ื ืืื ืืื ืืืืคึผืก, ืืืึธืก ืืขืืคึผืก ืจืขืืืืึทื ืฅ ืคืื ืืึธืืึทืืืืึทืจืืึทื ืืขื ืืขืจ ืืึธืจ ื ืืฆื ืื ืืื ืืขืจื ืขื.
ืคืืื ืืื ืื
ืฆื ืกืึทืืขืจืืื, ืืึธืก ืืื ืึท ืืืืขืจ ืืฉืืงืึทืืืข ืืื ืคึผืจืึทืืึทืกืื ื ืคึผืจืืืขืงื, ืืืจ ืงืขื ืขื ืฉืืื ื ืืฆื ืขืก ืืืืฃ ืคึผืขืจืืขื ืืขื ืกืขืจืืืขืจืก. ืืืืก ืืื ืื ื ืืฅ? ืืืื ืคืึธืจืฉืืขืืื ื ืืืืฃ ืืื ืืงืก ืกืืกืืขืืขื, ืื ืคืื ืกืขืืึทืคึผ ืืื ืฉืืืฆื, ืกืึธืืื ืืื ืืืื ืขืืืืืง ืงืึธื ืืึทืืข. ืึธืืขืจ, ืขืก ืืื ืฆื ืคืจื ืฆื ืงืึทืืืฉ ืฆื ืึทืจืืืขืจืคืืจื ืึท ืงืึธืืคึผืืขืงืก ืื ืคืจืึทืกืืจืึทืงืืฉืขืจ ืฆื WireGuard; ืขืก ืืื ืืืขืจื ืฆื ืืืึทืจืื ืคึฟืึทืจ ืืืื ืื ืงืืืืฉืึทื ืืื ืื ืืื ืืงืก ืงืขืจื.
ืฆื ืจืึทืืขืืืขื ืืืื (ืืื ืืืื) ืฆืืื, ืืื ืืขืืืขืืึธืคึผืขื . ืืื ืืืื ืืืืฃ, ืืืจ ืงืขื ืขื ืฉืืขืื ืึทืจืืืฃ ืึท ืคืขืจืืขื ืืขืืข ืืืคึผื ืคึฟืึทืจ ืืื ืืื ืืืื ืคืจืขื ืื ืึธื ืืคืืื ืคึฟืึทืจืฉืืืื ืขืคึผืขืก ืืืขืื ืืื.
ืืงืืจ: www.habr.com