Jagorar Shigar da Sabar AmneziaWG

Mutane da yawa suna gudanar da VPN nasu maimakon dogaro da ayyukan da aka biya, waɗanda aka riga aka shirya: yana da rahusa, ya fi kyau don sirri, kuma yana ba ku cikakken iko akan sabar. Ɗaya daga cikin zaɓuɓɓuka mafi inganci ga yankuna masu toshe hanyar sadarwa mai ƙarfi shine AmneziaWG, wata yarjejeniya da aikin Amnezia ya ƙirƙira a saman WireGuard.

Classic WireGuard yana da sauri kuma abin dogaro, amma yana da tsarin fakiti mai tsayayye da kuma musabaha mai iya yiwuwa, wanda tsarin DPI (Deep Packet Inspection) zai iya yin sawun yatsa da toshewa cikin aminci. AmneziaWG yana magance wannan: yana ƙara fakitin shara zuwa haɗin WireGuard na yau da kullun, yana sanya kanun labarai bazuwar, kuma yana canza girman filayen musabaha - don haka sa hannun WireGuard ya ɓace kuma zirga-zirgar ba ta sake bambanta da zirga-zirgar UDP na yau da kullun ba.

Kun riga kun fara gudanar da ramin gargajiya kuma kuna mamakin ko ya cancanci canzawa? Kwatanta wannan da saitin OpenVPN/PPTP mai sauƙi a cikin saitin sabar VPN akan Linux: PPTP ko OpenVPN?, ko da vanilla WireGuard (babu ɓoyewa) a cikin Yadda ake saita Wireguard VPN akan sabar ku.

Wannan jagorar tana saita uwar garken AmneziaWG da hannu, ba tare da Docker ko kwamitin yanar gizo ba - mafi ƙarancin sawun da za a iya samu akan VPS ɗin kanta, wanda aka tsara gaba ɗaya daga layin umarni. Ita ce zaɓin mafi sauƙi kuma tana aiki da kyau akan VPS mai kasafin kuɗi, tunda ba ta buƙatar GUI, babu bayanai, da kuma wakili na baya. Misalin uwar garken da ke ƙasa yana amfani da adireshin IP mai riƙe wuri - maye gurbinsa da adireshin VPS ɗinku duk inda ya bayyana.

Abin da za ku buƙaci: VPS mai gudanar da Ubuntu 22.04/24.04 ko Debian 11/12, tushen shiga, da adireshin IP na VPS ɗinku. Ba a buƙatar sunan yanki ba - AmneziaWG ba ya amfani da takaddun shaida, don haka babu abin da za a sabunta kuma babu abin da DPI za ta yi alama a matsayin musayar hannu ta TLS.

Ba ku da sabar tukuna? Duba Yadda ake yin odar sabar

Haɗawa zuwa sabar

Windows (PuTTY)

Buɗe PuTTY, shigar da adireshin IP na VPS ɗinku a cikin filin Sunan Mai masaukin baki, saita tashar jiragen ruwa zuwa 22, kuma shiga azaman tushen ta amfani da kalmar sirri da mai ba da sabis na VPS ɗinku ya aiko muku da imel.

Adireshin IP na uwar garken: adireshin IP ɗinka

shiga kamar haka: tushen

Kalmar sirri: kalmar sirrinka

1. Buɗe PuTTY, shigar da adireshin IP na VPS ɗinku a cikin filin Sunan Mai masauki.  

2. Saita tashar jiragen ruwa zuwa 22. 

3. Shigar da log in a matsayin tushen. 

4. Amfani da kalmar sirri da mai ba da sabis na VPS ɗinku ya aiko muku da imel.

Sakamakon ya kamata ya zama kamar haka:

Don ƙarin bayani game da haɗin kai ta hanyar PuTTY/SSH, duba Yadda ake haɗawa zuwa sabar Linux ta hanyar SSH

Linux / macOS (Terminal)

ssh root@YOUR_SERVER_IP

Duk umarnin da ke ƙasa ana gudanar da su ne a kan sabar, a cikin wannan zaman SSH ɗaya - wanda ya shafi Sashe na 2 zuwa 5, tare da duba ɓangaren sabar a Sashe na 9. Sashe na 6-8 (shigarwa da saita abokin ciniki na VPN) suna faruwa ne a kan na'urar Windows/macOS/Linux ɗinku, tunda wannan ita ce na'urar da VPN ke buƙatar kunnawa a kai; kowanne daga cikin waɗannan sassan yana faɗi a sarari waɗanne layuka, idan akwai, har yanzu suna taɓa sabar.

Shirya Sabar

Sabunta tsarin

Kafin shigar da wani abu, sabunta jerin fakitin kuma haɓaka fakitin da aka shigar:

apt update -y && apt upgrade -y

Idan wannan ya inganta kernel, sake kunna kafin gina tsarin kernel na AmneziaWG a Sashe na 3, in ba haka ba DKMS na iya ginawa akan kanun kernel da ba daidai ba kuma tsarin zai kasa lodawa. (Don ƙarin bayani game da apt da yadda manajojin fakitin Linux ke aiki, duba Manajan Fakitin Linux .) Duba tare da:

cat /var/run/reboot-required

Kunna tura IP

Wannan saitin yana bawa uwar garken damar tura fakitin abokan ciniki zuwa intanet - ba tare da shi ba, ramin zai fito amma babu zirga-zirgar da za ta ratsa ta.

echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/00-amnezia.conf
sysctl --system

Umarni na farko yana ƙirƙirar fayil ɗin tsari na musamman; na biyu yana amfani da shi ba tare da sake kunna sabar ba.

Saita maɓallin wuta (UFW)

Don ƙarin bayani game da ƙa'idodin UFW, duba Saita Firewall akan Linux

Buɗe tashoshin jiragen ruwa guda biyu da za ku buƙaci: 22/tcp don SSH (ku tsallake wannan doka kuma kuna fuskantar haɗarin rasa damar shiga sabar) da 42666/udp, tashar jiragen ruwa ta AmneziaWG za ta saurara.

apt install ufw -y
ufw allow 22/tcp
ufw allow 42666/udp
ufw --force enable
ufw status

Dole ne duka ƙa'idodin su nuna kamar ALLOW a cikin fitowar yanayin ufw.

Shigar da AmneziaWG

Debian ba ya goyon bayan PPAs na Ubuntu kai tsaye, don haka dole ne a ƙara wurin ajiyar da hannu maimakon a ƙara shi da wurin ajiyar add-apt. Wannan yana aiki iri ɗaya a Ubuntu.

Ƙara ma'ajiyar da hannu

echo "deb [arch=amd64] https://ppa.launchpadcontent.net/amnezia/ppa/ubuntu jammy main" > /etc/apt/sources.list.d/amnezia.list

apt install -y gnupg2
gpg --keyserver keyserver.ubuntu.com --recv-keys 57290828
gpg --export 57290828 | tee /usr/share/keyrings/amnezia.gpg > /dev/null
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/amnezia.gpg] https://ppa.launchpadcontent.net/amnezia/ppa/ubuntu jammy main" > /etc/apt/sources.list.d/amnezia.list

apt update
apt install -y amneziawg

Tabbatar da module ɗin da aka ɗora

modprobe amneziawg
lsmod | grep amnezia

Samar da Sabar da Tsarin Abokin Ciniki

Shigar da kayan aikin taimako

Shigar da dogaro da qrcode, sannan ƙirƙirar kundin adireshi na aiki na musamman kuma saukar da rubutun mai samar da saitin al'umma a ciki:

apt install -y python3-qrcode
mkdir -p ~/awg && cd ~/awg
wget -O awgcfg.py \
  https://gist.githubusercontent.com/remittor/8c3d9ff293b2ba4b13c367cc1a69f9eb/raw/awgcfg.py

Idan python3-qrcode bai samu a wurin ajiyar bayanai na distro ɗinku ba, koma zuwa pip3 install qrcode --break-system-packages (ana buƙatar tutar akan Debian 12+/Ubuntu 24.04, wanda ke toshe shigarwar pip mara sarrafawa ta tsohuwa). Kada ku gudanar da shigarwar biyu - zaɓi ɗaya.

Haɗa tsarin sabar

Ƙirƙiri /etc/amnezia/amneziawg/awg0.conf. Za ka iya barin subnet na ciki na ramin da tashar UDP a matsayin tsoho ko kuma ka saita naka:

python3 awgcfg.py --make /etc/amnezia/amneziawg/awg0.conf \
  -i 10.10.8.1/24 -p 42666

Tutar -i tana saita adireshin cibiyar sadarwa ta ciki da abin rufe fuska na ramin; -p tana saita tashar UDP ta uwar garken (wanda aka buɗe a mataki na 2.3).

Ƙirƙiri samfurin saitin abokin ciniki

python3 awgcfg.py --create

Wannan yana adana samfuri a cikin babban fayil ɗin da aka gina saitunan abokin ciniki daga ciki - ya riga ya haɗa da maɓallin jama'a na uwar garken, adireshin IP ɗinsa, da sigogin ɓoyewa (Jc, Jmin, Jmax, S1, S2, H1–H4) waɗanda ke bambanta AmneziaWG daga WireGuard mai sauƙi.

Ƙara abokan ciniki

Ƙirƙiri shigarwa ɗaya ga kowace na'ura — sunan zai iya zama komai, misali sunan na'urar:

python3 awgcfg.py -a "laptop"
python3 awgcfg.py -a "phone"

Haɗa fayilolin abokin ciniki da lambobin QR

python3 awgcfg.py -c -q

Fayil ɗin ~/awg yanzu zai ƙunshi fayiloli kamar laptop.conf da phone.conf, tare da lambobin PNG QR masu dacewa da za ku iya duba kai tsaye cikin manhajar wayar hannu.

Fayil ɗin ~/awg yanzu zai ƙunshi fayiloli kamar laptop.conf da phone.conf, tare da lambobin PNG QR masu dacewa da za ku iya duba kai tsaye cikin manhajar wayar hannu.

Fara Sabis da Kunna Farawa ta atomatik

Kawo hanyar haɗin awg0 kuma ka kunna shi don farawa ta atomatik lokacin sake kunnawa:

systemctl enable --now awg-quick@awg0
systemctl restart [email protected]
systemctl status [email protected]

Ya kamata yanayi ya nuna aiki (fita) tare da na'urar da aka kunna a lokacin farawa. Idan na'urar ta bayyana "raguwa" tana nuna rajistan ayyukan, danna Q don fita.

Duba jerin abokan aiki masu aiki da zirga-zirgar kowane abokin aiki tare da:

awg show

Haɗawa daga Windows

Duk abin da ke cikin wannan sashe yana faruwa ne akan kwamfutarka ta Windows, ba ta hanyar SSH ba - dole ne a shigar da abokin ciniki na VPN akan na'urar da za ta yi amfani da ramin. Mataki ɗaya tilo da zai taɓa sabar shine saukar da scp a cikin 6.2, har ma da wannan umarnin ana rubuta shi akan kwamfutarka, yana jawo fayil ɗin da sabar ta riga ta samar a Sashe na 4.

Shigar abokin ciniki

AmneziaWG tana da manhajar Windows ta musamman - hanyar sadarwarta tana kama da ta WireGuard ta yau da kullun amma tana fahimtar sigogin ɓoye bayanai. Sauke mai sakawa daga ma'ajiyar aikin hukuma:

https://github.com/amnezia-vpn/amneziawg-windows-client/releases

Haɗin da ke sama shine shafin fitarwa na abokin ciniki na Windows da aka kiyaye - zazzage sabon kadarar .msi/.exe daga can. Wannan shafi ne da za a buɗe a cikin burauzarka, ba umarni don liƙa a cikin tashar ba.

Gudar da mai sakawa kuma ka bi hanyar saitin maye; ba sai an canza tsoffin saitunan ba.

Shigo da tsarin

Kwafi fayil ɗin saitin abokin ciniki daga sabar zuwa kwamfutarka — hanya mafi sauƙi ita ce scp, gudanar da PowerShell akan kwamfutarka, ba sabar ba:

scp root@YOUR_SERVER_IP:~/awg/laptop.conf .

A cikin manhajar AmneziaWG, danna "Shigo da rami(s) daga fayil", zaɓi laptop.conf, sannan ka kunna maɓallin da ke kusa da sabon ramin.

Haɗawa daga macOS

Akwai zaɓuɓɓuka guda biyu da aka tallafa:

• AmneziaWG (Mac App Store): abokin ciniki mai sauƙi, yana aiki akan macOS 12 da kuma daga baya. Bincika "AmneziaWG" a cikin App Store, shigar da shi, sannan yi amfani da "Shigo da rami(s) daga fayil" kuma zaɓi fayil ɗin .conf ɗinku - aiki iri ɗaya da na abokin ciniki na Windows.
• AmneziaVPN (cikakken manhaja, macOS 14+): Sauke .pkg daga github.com/amnezia-vpn/amnezia-client/releases/latest idan kana son amfani da cikakken manhajar Amnezia maimakon mai sauƙin amfani da AmneziaWG kawai.

Da farko kwafi tsarin abokin ciniki idan ana buƙata, kamar yadda yake a mataki na 6.2:

scp root@YOUR_SERVER_IP:~/awg/laptop.conf .

Haɗawa daga Linux

apt install -y amneziawg
cp laptop.conf /etc/amnezia/amneziawg/awg0.conf
awg-quick up awg0

Gudanar da wannan lambar don cire haɗin.

awg-quick down awg0 

Don kawo ramin ta atomatik lokacin shiga, kunna shi azaman sabis:

systemctl enable --now awg-quick@awg0

Tabbatar da Haɗin

Da ramin yana aiki daga Sashe na 6, 7, ko 8, koma zuwa na'urarka (ba zaman SSH ba) kuma buɗe duk wani mai duba "menene IP dina" a cikin mai bincike - adireshin da aka nuna ya kamata ya dace da adireshin IP na VPS ɗinka. Don tabbatarwa daga cikin zaman SSH maimakon haka, gudanar da awg show akan sabar kuma tabbatar da cewa abokin ciniki ya nuna musabaha kwanan nan da zirga-zirga mara sifili.

reference:

S1/S2 da H1–H4 ne kawai ke buƙatar su kasance iri ɗaya a ƙarshen ramin biyu; Jc, Jmin, da Jmax suna magana ne kawai game da yadda kowane gefe ke rufe nasa shara, don haka ƙimar abokin ciniki da uwar garken na iya bambanta bisa ga doka, kamar yadda suke yi a misalin da ke sama.

Kammalawa

Bin wannan jagorar yana barin VPS ɗinku yana gudanar da sabar AmneziaWG ta kansa: wata yarjejeniya mai jituwa da WireGuard tare da toshe zirga-zirga wanda a bayyane yake da wahala ga tsarin DPI su bambanta da zirga-zirgar UDP na yau da kullun fiye da WireGuard mai sauƙi. Sabis ɗin yana aiki azaman sashin tsarin awg-quick@awg0 kuma yana tsira daga sake kunna sabar ba tare da wani aiki daga ɓangarenku ba.

Fayilolin .conf da lambobin QR da ke cikin ~/awg ba wai kawai suna aiki tare da abokin ciniki na Windows ba, har ma ana iya shigo da su cikin manhajojin AmneziaWG ko Amnezia don Android, iOS, macOS, da Linux, da kuma na'urorin sadarwa na Keenetic da OpenWrt.

Ƙara sabbin abokan ciniki a kowane lokaci ta hanyar maimaita matakai 4.4–4.5 (python3 awgcfg.py -a "suna", sannan awgcfg.py -c -q) sannan sake kunna hanyar haɗin tare da sake farawa da tsarin systemctl [email protected].

Wasu halaye da suka cancanci ci gaba da bin su idan uwar garken yana aiki:

• A ci gaba da gyara tsarin. Sake kunna apt update -y && apt upgrade -y lokaci-lokaci, kuma a sake kunna bayan haɓaka kernel don DKMS ya sake gina tsarin amneziawg akan sabon kernel.
• Ajiyewa ~/awg. Yana riƙe da maɓallin sirri na kowane abokin ciniki da kuma maɓallin uwar garken a cikin awg0.conf; rasa shi yana nufin sake samar da saitunan kowace na'ura.
• Cire na'urorin da suka ɓace da sauri. Cire toshewar [Peer] mai dacewa daga /etc/amnezia/amneziawg/awg0.conf kuma gudanar da sake kunnawa systemctl [email kariya].

Idan haɗin bai fito ba, duba tsari:

• matsayin sabis (matsayin systemctl) [email kariya])
• ƙa'idodin firewall (matsayin ufw - dole ne tashar jiragen ruwa 42666/udp ta kasance a buɗe)
• Matsayin DKMS/module idan hanyar haɗin ba ta ma fara ba (matsayin dkms, lsmod | grep amnezia)
• jerin abokan aiki masu aiki akan sabar (awg show)
• cewa saitin abokin ciniki yana nuna adireshin IP na uwar garken waje daidai

Kwatanta AmneziaWG da wasu zaɓuɓɓuka kafin yin aiki? Duba saitin uwar garken VPN akan Linux: PPTP ko OpenVPN? da kuma Yadda ake saita Wireguard VPN akan sabar ku . Idan kuna buƙatar wakili mai sauƙi kawai maimakon cikakken ramin VPN, tsarin wakili na 3 akan CentOS/ArchLinux madadin mai sauƙi ne. Don taurarewar uwar garken gabaɗaya da zarar VPN ya kasance kai tsaye, duba Masu Amfani da Linux: Gudanarwa da Izini.