Mokhoa oa ho theha Hailbytes VPN bakeng sa Tikoloho ea hau ea AWS
Selelekela
Sehloohong sena, re tla bua ka mokhoa oa ho theha HailBytes VPN marang-rang a hau, VPN e bonolo le e sireletsehileng le firewall bakeng sa marang-rang a hau. Lintlha tse ling le litlhaloso tse tobileng li ka fumanoa ho litokomane tsa rona tsa moqapi tse hokahaneng Mona.
ho lokisetsa
1. Litlhoko tsa Mohloli:
- Re khothaletsa ho qala ka 1 vCPU le 1 GB ea RAM pele u phahamisa.
- Bakeng sa li-deployments tse thehiloeng ho Omnibus ho li-server tse nang le memori e ka tlase ho 1 GB, o lokela ho bulela swap ho qoba kernel ea Linux hore e se ke ea bolaea mekhoa ea Firezone ka tšohanyetso.
- 1 vCPU e lokela ho lekana ho tlatsa sehokelo sa 1 Gbps bakeng sa VPN.
2. Theha rekoto ea DNS: Firezone e hloka lebitso le nepahetseng la domain bakeng sa tšebeliso ea tlhahiso, mohlala firezone.company.com. Ho tla hlokahala ho theha rekoto e nepahetseng ea DNS joalo ka A, CNAME, kapa AAAA.
3. Theha SSL: O tla hloka setifikeiti sa SSL se sebetsang ho sebelisa Firezone boemong ba tlhahiso. Firezone e ts'ehetsa ACME bakeng sa ho fana ka setifikeiti sa SSL ka bohona bakeng sa lits'ebetso tse thehiloeng ho Docker le Omnibus.
4. Bula likou tsa firewall: Firezone e sebelisa likou tsa 51820/udp le 443/tcp bakeng sa sephethephethe sa HTTPS le WireGuard ka ho latellana. U ka fetola likou tsena hamorao faeleng ea tlhophiso.
Tsamaisa ho Docker (E khothalelitsoe)
1. Lintho tse hlokahalang:
- Netefatsa hore o sethaleng se tšehelitsoeng se nang le docker-compose version 2 kapa e kenyellelitsoeng holimo.
- Etsa bonnete ba hore ho fetisa ka port ho lumelletsoe ho firewall. Li-default li hloka hore likou tse latelang li buloe:
o 80/tcp (ho ikhethela): Ho fana ka setifikeiti sa SSL ka bohona
o 443/tcp: Fumana UI ea tepo
o 51820/udp: Sephethephethe sa VPN se mamelang boema-kepe
2. Kenya Kgetho ya I ya Seva: Ho Kenngwa ka Motlakase (E kgothaletswa)
- Run installation script: bash <(curl -fsSL https://github.com/firezone/firezone/raw/master/scripts/install.sh) 1889d1a18e090c-0ec2bae288f1e2-26031d51-144000-1889d1a18e11c6c
- E tla u botsa lipotso tse 'maloa mabapi le tlhophiso ea pele pele u khoasolla sampole docker-compose.yml faele. U tla batla ho e lokisa ka likarabo tsa hau, le ho hatisa litaelo tsa ho kena ho Web UI.
- Aterese ea kamehla ea Firezone: $HOME/.firezone.
2. Kenya Seva Kgetho II: Ho kenya ka letsoho
- Khoasolla template ea ho etsa li-docker bukeng ea tšebetso ea lehae
- Linux: curl -fsSL https://raw.githubusercontent.com/firezone/firezone/master/docker-compose.prod.yml -o docker-compose.yml
- macOS kapa Windows: curl -fsSL https://raw.githubusercontent.com/firezone/firezone/master/docker-compose.desktop.yml -o docker-compose.yml
- Hlahisa liphiri tse hlokahalang: docker run –rm firezone/firezone bin/gen-env > .env
- Fetola lintlha tsa DEFAULT_ADMIN_EMAIL le EXTERNAL_URL. Fetola liphiri tse ling ha ho hlokahala.
- Tsamaisa database: docker compose run -rm firezone bin/migrate
- Theha ak'haonte ea admin: docker compose run -rm firezone bin/create-or-reset-admin
- Hlahisa lits'ebeletso: docker compose up -d
- U lokela ho khona ho fihlella UI ea Firezome ho latela EXTERNAL_URL e hlalositsoeng ka holimo.
3. Bulela booting (boikhethelo):
- Netefatsa hore Docker e nolofalitsoe qalong: sudo systemctl thusa docker
- Litšebeletso tsa Firezone li lokela ho ba le ho qala bocha: kamehla kapa ho qala bocha: ntle le haeba khetho e emisitsoeng e boletsoeng faeleng ea docker-compose.yml.
4. Numella Tsamaiso ea Setjhaba ya IPv6 (boikhethelo):
- Kenya tse latelang ho /etc/docker/daemon.json ho thusa IPv6 NAT le ho hlophisa phepelo ea IPv6 bakeng sa lijana tsa Docker.
- Numella litsebiso tsa router ho boot bakeng sa sebopeho sa hau sa kamehla sa egress: egress=`ip route show default 0.0.0.0/0 | grep -oP '(?<=dev ).*' | khaola -f1 -d'' | tr -d '\n'` sudo bash -c “echo net.ipv6.conf.${egress}.accept_ra=2 >> /etc/sysctl.conf”
- Qala hape 'me u leke ka ho penya ho Google ho tsoa ka har'a sets'oants'o sa docker: docker run -rm -t busybox ping6 -c 4 google.com
- Ha ho na tlhoko ea ho kenyelletsa melaoana ea li-iptables ho thusa IPv6 SNAT/masquerading bakeng sa sephethephethe sa tunnel. Firezone e tla sebetsana le sena.
5. Kenya lisebelisoa tsa bareki
Hona joale o ka eketsa basebelisi marang-rang a hau mme o hlophisa litaelo ho theha seboka sa VPN.
Ho Seta ha poso
Kea u lebohela, u qetile ho seta! U kanna ua batla ho sheba litokomane tsa rona tsa ntlafatso bakeng sa litlhophiso tse ling, lintlha tsa ts'ireletso, le likarolo tse tsoetseng pele: https://www.firezone.dev/docs/
