Tilmaamaha Hawlgalinta Server-ka AmneziaWG

Dad badan ayaa maamula VPN-kooda halkii ay ku tiirsanaan lahaayeen adeegyo lacag bixin ah oo diyaar ah: way ka jaban tahay, way ka fiican tahay asturnaanta, waxayna ku siinaysaa xakamaynta buuxda ee server-ka. Mid ka mid ah xulashooyinka ugu waxtarka badan ee gobollada leh xannibaadda shabakadda ee gardarrada leh waa AmneziaWG, oo ah borotokool ay samaysay mashruuca Amnezia oo ku yaal dusha sare ee WireGuard.

WireGuard-ka caadiga ah waa mid degdeg ah oo la isku halleyn karo, laakiin wuxuu leeyahay qaab-dhismeed baakad go'an iyo gacan-qabasho la saadaalin karo, kaas oo nidaamyada DPI (Deep Packet Inspection) ay si kalsooni leh u faragelin karaan oo u xannibi karaan. AmneziaWG waxay tan xallisaa: waxay ku dartaa baakadaha qashinka ah xiriirka caadiga ah ee WireGuard, waxay si aan kala sooc lahayn u dhigtaa cinwaannada, waxayna beddeshaa cabbirka goobaha gacan-qabashada - sidaa darteed saxiixa astaamaha WireGuard wuu baaba'ayaa oo gaadiidku mar dambe kama soocan yahay taraafikada caadiga ah ee UDP.

Horeyba ma u shaqeyneysay tunnel caadi ah oo aad isweydiineysaa inay u qalanto in la beddelo? Isbarbardhig tan dejinta OpenVPN/PPTP ee caadiga ah ee ku jirta dejinta server-ka VPN ee Linux: PPTP ama OpenVPN?, ama ka dhanka ah vanilla WireGuard (ma jiro wax xannibaya) ee ku jira Sida loo dejiyo Wireguard VPN server-kaaga.

Hagahan wuxuu gacanta ku dejiyaa server AmneziaWG ah, iyada oo aan lahayn Docker ama guddi shabakadeed - raadadka ugu yar ee suurtagalka ah ee VPS laftiisa, oo gebi ahaanba laga soo habeeyay khadka taliska. Waa ikhtiyaarka ugu fudud miisaankana si fiican ayuu ugu shaqeeyaa VPS miisaaniyadaysan, maadaama uusan u baahnayn GUI, xog kayd ah, iyo wakiil gadaal ah. Adeegaha tusaalaha ah ee hoose wuxuu isticmaalaa cinwaanka IP-ga ee booska haysta - ku beddel cinwaankaaga VPS meel kasta oo uu ka muuqdo.

Waxaad u baahan doontaa: VPS oo ku shaqeeya Ubuntu 22.04/24.04 ama Debian 11/12, marin u helidda xididka, iyo cinwaanka IP-ga ee VPS-gaaga. Magaca domainka looma baahna - AmneziaWG ma isticmaalo shahaadooyin, markaa ma jiraan wax la cusboonaysiin karo iyo wax DPI ah oo loogu calaamadeeyo gacan-qaad TLS ah.

Ma haysatid server weli? Eeg Sida loo dalbado server

Ku xidhidda Server-ka

Daaqadaha (PuTTY)

Fur PuTTY, geli cinwaankaaga IP-ga VPS-ga ee goobta Magaca Martida, u deji dekedda 22, oo gal asal ahaan adoo isticmaalaya erayga sirta ah ee uu bixiyahaaga VPS kuu soo diray email ahaan.

Cinwaanka IP-ga ee server-ka: cinwaanka IP-gaaga

gal sida: root

Furaha sirta ah: eraygaaga sirta ah

1. Fur PuTTY, geli cinwaankaaga IP-ga VPS-ga ee ku yaal goobta Magaca Marti-geliyaha.  

2. Dekedda u deji 22. 

3. Geli gal asal ahaan. 

4. Adeegsiga erayga sirta ah ee bixiyahaaga VPS uu kuu soo diray email.

Natiijadu waa inay noqotaa sidan soo socota:

Wixii faahfaahin dheeraad ah oo ku saabsan isku xirka iyada oo loo marayo PuTTY/SSH, fiiri Sida loogu xidho server-ka Linux iyada oo loo marayo SSH.

Linux / macOS (terminal)

ssh root@YOUR_SERVER_IP

Dhammaan amarrada hoose waxaa lagu maamulaa server-ka, isla kalfadhigan SSH - kaas oo daboolaya Qaybaha 2 ilaa 5, oo lagu daray hubinta dhinaca server-ka ee Qaybta 9. Qaybaha 6-8 (rakibidda iyo habaynta macmiilka VPN) waxay ka dhacaan qalabkaaga Windows/macOS/Linux, maadaama taasi tahay qalabka VPN u baahan yahay inuu ku shaqeeyo; mid kasta oo ka mid ah qaybahaas ayaa si cad u sheegaya khadadka, haddii ay jiraan, ee weli taabanaya server-ka.

Diyaarinta Server-ka

Cusbooneysii nidaamka

Kahor intaadan wax rakibin, cusbooneysii liiska xirmada oo cusbooneysii xirmooyinka la rakibay:

apt update -y && apt upgrade -y

Haddii tani ay kor u qaaddo kernel-ka, dib u bilow ka hor inta aadan dhisin module-ka kernel-ka AmneziaWG ee Qaybta 3aad, haddii kale DKMS waxay ka dhisi kartaa madaxyada kernel-ka ee khaldan module-kuna wuu ku guuldareysan doonaa inuu soo baxo. (Si aad u hesho dib u eegis ku saabsan apt iyo sida maamulayaasha xirmooyinka Linux u shaqeeyaan, eeg Maamulayaasha Xirmooyinka Linux .) Hubi:

cat /var/run/reboot-required

Daar gudbinta IP-ga

Dejintani waxay u oggolaanaysaa adeegaha inuu baakadaha macaamiisha u gudbiyo internetka - la'aanteed, tunnelku wuu soo bixi doonaa laakiin ma jiri doono wax taraafiko ah oo dhex mari doona.

echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/00-amnezia.conf
sysctl --system

Amarka koowaad wuxuu abuuraa fayl habayn ah oo gaar ah; kan labaadna wuxuu ku dabaqayaa iyada oo aan dib loo bilaabin server-ka.

Hagaaji dab-damiska (UFW)

Wixii dheeraad ah oo ku saabsan xeerarka UFW, fiiri Habaynta Dab-damiska Linux

Fur labada dekedood ee aad u baahan doonto: 22/tcp SSH (ka bood xeerkan waxaadna halis ugu jirtaa inaad lumiso marin u helidda server-ka) iyo 42666/udp, dekedda AmneziaWG ayaa dhegaysan doonta.

apt install ufw -y
ufw allow 22/tcp
ufw allow 42666/udp
ufw --force enable
ufw status

Labada xeerba waa inay muujiyaan sida ALLOW ee wax soo saarka xaaladda ufw.

Ku rakibidda AmneziaWG

Debian si toos ah uma taageerto PPA-yada qaabka Ubuntu, sidaa darteed kaydka waa in lagu daraa gacanta halkii lagu dari lahaa add-apt-repository. Tani waxay si la mid ah uga shaqeysaa Ubuntu.

Ku dar kaydka gacantaada

echo "deb [arch=amd64] https://ppa.launchpadcontent.net/amnezia/ppa/ubuntu jammy main" > /etc/apt/sources.list.d/amnezia.list

apt install -y gnupg2
gpg --keyserver keyserver.ubuntu.com --recv-keys 57290828
gpg --export 57290828 | tee /usr/share/keyrings/amnezia.gpg > /dev/null
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/amnezia.gpg] https://ppa.launchpadcontent.net/amnezia/ppa/ubuntu jammy main" > /etc/apt/sources.list.d/amnezia.list

apt update
apt install -y amneziawg

Xaqiiji moduleka la raray

modprobe amneziawg
lsmod | grep amnezia

Sameynta Server-ka iyo Habaynta Macmiilka

Ku rakib adeegyada caawinta

Ku rakib ku-tiirsanaanta qrcode, ka dibna samee buug shaqo oo u gaar ah oo soo dejiso qoraalka habaynta-soo-saaraha bulshada:

apt install -y python3-qrcode
mkdir -p ~/awg && cd ~/awg
wget -O awgcfg.py \
  https://gist.githubusercontent.com/remittor/8c3d9ff293b2ba4b13c367cc1a69f9eb/raw/awgcfg.py

Haddii python3-qrcode uusan ku jirin kaydkaaga distro, dib ugu noqo pip3 install qrcode --break-system-packages (calanka ayaa looga baahan yahay Debian 12+/Ubuntu 24.04, kaas oo xannibaya rakibaadda pip ee aan la maamulin si caadi ah). Ha socodsiin labada rakibaadba - mid dooro.

Samee habaynta server-ka

Samee /etc/amnezia/amneziawg/awg0.conf. Waxaad ka tagi kartaa shabakadda gudaha ee tunnel-ka iyo dekedda UDP marka ay caadi yihiin ama aad dejisan kartaa middaada:

python3 awgcfg.py --make /etc/amnezia/amneziawg/awg0.conf \
  -i 10.10.8.1/24 -p 42666

Calanka -i wuxuu dejiyaa cinwaanka shabakadda gudaha iyo maaskarada godka; -p wuxuu dejiyaa dekedda UDP ee server-ka (isla kan ayaa furmay tallaabada 2.3).

Samee qaab-dhismeedka habaynta macmiilka

python3 awgcfg.py --create

Tani waxay ku kaydisaa qaab-dhismeed isla faylka ay ka samaysan yihiin habaynta macmiilka shaqsiga ah - waxay horeyba uga koobnayd furaha dadweynaha ee server-ka, cinwaankiisa IP-ga, iyo xuduudaha daah-furka (Jc, Jmin, Jmax, S1, S2, H1–H4) kuwaas oo kala sooca AmneziaWG iyo WireGuard-ka caadiga ah.

Ku dar macaamiisha

Hal gelitaan qalabkiiba - magacu wuxuu noqon karaa wax kasta, tusaale ahaan magaca aaladda:

python3 awgcfg.py -a "laptop"
python3 awgcfg.py -a "phone"

Samee faylasha macaamiisha iyo koodhadhka QR

python3 awgcfg.py -c -q

Faylka ~/awg hadda wuxuu ka koobnaan doonaa faylal sida laptop.conf iyo phone.conf, iyo sidoo kale koodhadhka PNG QR ee la midka ah oo aad si toos ah ugu sawiri karto abka moobaylka.

Faylka ~/awg hadda wuxuu ka koobnaan doonaa faylal sida laptop.conf iyo phone.conf, iyo sidoo kale koodhadhka PNG QR ee la midka ah oo aad si toos ah ugu sawiri karto abka moobaylka.

Bilaabidda Adeegga iyo Hirgelinta Bilaabidda Auto

Soo qaado interface-ka awg0 oo u suurtageli inuu si toos ah u bilaabo marka dib loo bilaabo:

systemctl enable --now awg-quick@awg0
systemctl restart [email protected]
systemctl status [email protected]

Xaaladdu waa inay muujisaa firfircoon (baxsan) iyadoo cutubku shaqeynayo marka la bilaabayo. Haddii konsole-ku u muuqdo inuu "laalayo" isagoo muujinaya diiwaannada, riix Q si aad uga baxdo.

Hubi liiska asxaabta firfircoon iyo taraafikada shaqsiga ah adigoo isticmaalaya:

awg show

Ku xidhitaanka Windows

Wax kasta oo qaybtan ku jira waxay ka dhacaan Windows PC-gaaga, ee maaha SSH - macmiilka VPN waa in lagu rakibaa qalabka dhab ahaantii isticmaali doona tunnel-ka. Tallaabada kaliya ee taabata server-ka waa soo dejinta scp ee 6.2, xitaa amarkaas waxaa lagu qoraa PC-gaaga, iyadoo la jiidayo fayl server-ku horey uga soo saaray Qaybta 4.

Ku rakib macmiilka

AmneziaWG waxay leedahay barnaamij Windows ah oo u gaar ah - is-dhexgalkeedu wuxuu la mid yahay macmiilka caadiga ah ee WireGuard laakiin wuxuu fahmaa xuduudaha qarsoon. Ka soo dejiso rakibaha kaydka rasmiga ah ee mashruuca:

https://github.com/amnezia-vpn/amneziawg-windows-client/releases

Xiriirka kore waa bogga sii deynta ee macmiilka Windows ee la ilaaliyo - kala soo bax hantida .msi/.exe ee ugu dambeysay halkaas. Kani waa bog laga furi karo biraawsarkaaga, ee ma aha amar lagu dhejiyo terminal.

Ku socodsii rakibaha oo dhex mar saaxirka dejinta; kuwa caadiga ah looma baahna in la beddelo.

Soo dejiso habaynta

Nuqul ka samee faylka habaynta macmiilka ee ka soo jeeda server-ka una wareeji kombiyuutarkaaga — habka ugu fudud waa scp, ku socodsii PowerShell kombiyuutarkaaga, ee ma aha server-ka:

scp root@YOUR_SERVER_IP:~/awg/laptop.conf .

Barnaamijka AmneziaWG, dhagsii "Ka soo dejiso tunnel(yada) faylka", dooro laptop.conf, oo shid badhanka ku xiga tunnel-ka cusub.

Ku xidhitaanka macOS

Laba ikhtiyaar oo la taageero ayaa jira:

• AmneziaWG (Mac App Store): macaamiil fudud, wuxuu ka shaqeeyaa macOS 12 iyo wixii ka dambeeya. Ka raadi "AmneziaWG" App Store-ka, ku rakib, ka dibna isticmaal "Soo dejiso tunnel(yada) faylka" oo dooro faylkaaga .conf - isla shaqada macmiilka Windows.
• AmneziaVPN (abka oo dhan, macOS 14+): kala soo deg .pkg github.com/amnezia-vpn/amnezia-client/releases/latest haddii aad doorbideyso inaad isticmaasho abka Amnezia ee buuxa halkii aad ka isticmaali lahayd macmiilka fudud ee AmneziaWG.

Marka hore koobi ka samee habaynta macmiilka haddii loo baahdo, sida ku xusan tallaabada 6.2:

scp root@YOUR_SERVER_IP:~/awg/laptop.conf .

Ku xidhitaanka Linux

apt install -y amneziawg
cp laptop.conf /etc/amnezia/amneziawg/awg0.conf
awg-quick up awg0

Ku socodsii koodkan si aad u go'do.

awg-quick down awg0 

Si aad si toos ah u soo dejiso tunnel-ka marka aad soo gasho, u suurtageli adeeg ahaan:

systemctl enable --now awg-quick@awg0

Xaqiijinta Xidhiidhka

Iyadoo tunnelku ka shaqeynayo Qaybta 6, 7, ama 8, ku noqo qalabkaaga (ma aha kalfadhiga SSH) oo fur hubiye kasta oo "waa maxay IP-gayga" biraawsarka - cinwaanka la muujiyay waa inuu la mid noqdaa cinwaanka IP-ga ee VPS-gaaga. Si aad uga xaqiijiso kalfadhiga SSH, ku socodsii awg show server-ka oo xaqiiji in saaxiibka macmiilku uu muujiyay is-gacan qaad dhawaan dhacay iyo taraafiko aan eber ahayn.

Tixraaca:

Kaliya S1/S2 iyo H1–H4 waa inay isku mid noqdaan labada daraf ee tunnel-ka; Jc, Jmin, iyo Jmax waxay si cad ugu saabsan yihiin sida dhinac kastaa u daboolo taraafikada qashinka ee u gaarka ah, sidaa darteed qiimaha macmiilka iyo server-ku si sharci ah ayay u kala duwanaan karaan, sida ay ku sameeyaan tusaalaha kore.

Ugu Dambeyn

Raacitaanka hagahan wuxuu ka tagayaa VPS-gaaga inuu maamulo server-kiisa AmneziaWG: hab-maamuus la jaan qaadaya WireGuard oo leh xannibaadda taraafikada oo si la dareemi karo u adag in nidaamyada DPI ay kala saaraan taraafikada caadiga ah ee UDP marka loo eego WireGuard-ka caadiga ah. Adeeggu wuxuu u shaqeeyaa sidii cutubka nidaamka awg-quick@awg0 wuxuuna ka badbaaday dib-u-bilaabid server iyada oo aan wax tallaabo ah lagaa qaadin.

Faylasha .conf iyo koodhadhka QR ee ka soo baxa ~/awg kuma shaqeeyaan oo keliya macaamiisha Windows laakiin sidoo kale waxaa lagu soo gelin karaa barnaamijyada AmneziaWG ama Amnezia ee loogu talagalay Android, iOS, macOS, iyo Linux, iyo sidoo kale router-yada Keenetic iyo OpenWrt.

Ku dar macaamiil cusub wakhti kasta adoo ku celinaya tallaabooyinka 4.4–4.5 (python3 awgcfg.py -a "magac", ka dibna awgcfg.py -c -q) oo dib u bilaabaya is-dhexgalka iyadoo la adeegsanayo dib-u-bilaabista systemctl [email protected].

Caadooyin yar oo mudan in la ilaaliyo marka server-ku shaqeynayo:

• Nidaamka ha la hagaajiyo. Dib u socodsii cusbooneysiinta apt -y && apt upgrade -y marmar, oo dib u bilow ka dib casriyeynta kernel si DKMS ay dib ugu dhisto moduleka amneziawg marka loo eego kernel-ka cusub.
• Dib u soo celi ~/awg. Waxay haysaa furaha gaarka ah ee macmiil kasta iyo lammaanaha furaha ee server-ka ee awg0.conf; luminta macnaheedu waa dib u soo noolaynta habaynta qalab kasta.
• Si dhakhso ah uga noqo aaladaha lumay. Ka saar xannibaadda [Peer] ee u dhiganta /etc/amnezia/amneziawg/awg0.conf oo socodsii dib u bilow systemctl [emailka waa la ilaaliyay].

Haddii xiriirku soo bixi waayo, hubi kala horraysiinta:

• xaaladda adeegga (xaaladda systemctl) [emailka waa la ilaaliyay])
• xeerarka dab-damiska (xaaladda ufw - dekedda 42666/udp waa inay furan tahay)
• Xaaladda DKMS/module haddii is-dhexgalku xitaa uusan bilaaban (xaaladda dkms, lsmod | grep amnezia)
• liiska asxaabta firfircoon ee ku jira server-ka (awg show)
• in habaynta macmiilku ay tilmaamayso cinwaanka IP-ga ee server-ka dibadda ee saxda ah

Isbarbardhigga AmneziaWG iyo xulashooyinka kale ka hor intaadan ballan qaadin? Eeg dejinta server-ka VPN ee Linux: PPTP ama OpenVPN? iyo Sida loo dejiyo Wireguard VPN server-kaaga . Haddii aad u baahan tahay oo keliya wakiil fudud halkii aad ka isticmaali lahayd tunnel VPN oo buuxa, habaynta 3proxy ee CentOS/ArchLinux waa beddel fudud. Adkaynta guud ee server-ka marka VPN-ku shaqeeyo, fiiri Isticmaalayaasha Linux: Maareynta iyo Ogolaanshaha.