WireGuard VPN 安装和使用

发布时间： 更新时间： 总字数：1112 阅读时间：3m 作者：IP：上海 网址

WireGuard VPN 安装和使用。WireGuard 是点对点网络，通过非对称加密实现安全通信。

安装

服务端和客户端安装方式相同

CentOS8

  • Method 1: a signed module is available as built-in to CentOS’s kernel-plus:
bash 
$ sudo yum install yum-utils epel-release
$ sudo yum-config-manager --setopt=centosplus.includepkgs="kernel-plus, kernel-plus-*" --setopt=centosplus.enabled=1 --save
$ sudo sed -e 's/^DEFAULTKERNEL=kernel-core$/DEFAULTKERNEL=kernel-plus-core/' -i /etc/sysconfig/kernel
$ sudo yum install kernel-plus wireguard-tools
$ sudo reboot
  • Method 2: the easiest way is via ELRepo’s pre-built module:
bash 
$ sudo yum install elrepo-release epel-release
$ sudo yum install kmod-wireguard wireguard-tools
  • Method 3: users running non-standard kernels may wish to use the DKMS package instead:
bash 
$ sudo yum install epel-release
$ sudo yum config-manager --set-enabled PowerTools
$ sudo yum copr enable jdoss/wireguard
$ sudo yum install wireguard-dkms wireguard-tools

Redhat8

  • Method 1: the easiest way is via ELRepo’s pre-built module:
bash 
$ sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm https://www.elrepo.org/elrepo-release-8.el8.elrepo.noarch.rpm
$ sudo yum install kmod-wireguard wireguard-tools
  • Method 2: users running non-standard kernels may wish to use the DKMS package instead:
bash 
$ sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
$ sudo subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
$ sudo yum copr enable jdoss/wireguard
$ sudo yum install wireguard-dkms wireguard-tools

CentOS7

  • Method 1: a signed module is available as built-in to CentOS’s kernel-plus:
bash 
$ sudo yum install yum-utils epel-release
$ sudo yum-config-manager --setopt=centosplus.includepkgs=kernel-plus --enablerepo=centosplus --save
$ sudo sed -e 's/^DEFAULTKERNEL=kernel$/DEFAULTKERNEL=kernel-plus/' -i /etc/sysconfig/kernel
$ sudo yum install kernel-plus wireguard-tools
$ sudo reboot
  • Method 2: users wishing to stick with the standard kernel may use ELRepo’s pre-built module:
bash 
$ sudo yum install epel-release elrepo-release
$ sudo yum install yum-plugin-elrepo
$ sudo yum install kmod-wireguard wireguard-tools
  • Method 3: users running non-standard kernels may wish to use the DKMS package instead:
bash 
$ sudo yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
$ sudo curl -o /etc/yum.repos.d/jdoss-wireguard-epel-7.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo
$ sudo yum install wireguard-dkms wireguard-tools

Ubuntu

bash 
sudo apt update
sudo apt install wireguard

服务端配置

开启转发

bash 
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sudo sysctl -p

key 生成

bash 
umask 077
wg genkey | tee /etc/wireguard/privatekey | wg pubkey | tee /etc/wireguard/publickey

wg genpsk > /etc/wireguard/sharekey
  • privatekey : 服务端私钥
  • publickey : 服务端公钥
  • sharekey : 预共享密钥（PresharedKey），在握手基础上额外增加一层对称加密以增强安全性（提供抗量子攻击防护）

配置文件

  • 创建 /etc/wireguard/wg0.conf
ini 
[Interface]
Address = 10.8.0.1/24
SaveConfig = true
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE
  1. Address 逗号分隔，wg0 地址
  2. ListenPort udp 需要在防火墙方向
  3. SERVER_PRIVATE_KEY 从服务端（本机） cat /etc/wireguard/privatekey 获取
  4. 注意修改 ens3 为自己的网卡地址，可以通过命令 ip -o -4 route show to default | awk '{print $5}' 获取
  • 修改文件权限
bash 
sudo chmod 600 /etc/wireguard/{privatekey,wg0.conf}
  • 创建 wg0 接口
bash 
$ wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.8.0.1/24 dev wg0
[#] ip link set mtu 8921 up dev wg0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
  • 查看接口状态
bash 
$ wg show wg0
interface: wg0
  public key: NlQbgRFUCrM85ePjwZpjZ56gU78j2G3jvfw+dKxVfk4=
  private key: (hidden)
  listening port: 51820
$ ip a show wg0
3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 8921 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none
    inet 10.8.0.1/24 scope global wg0
       valid_lft forever preferred_lft forever
  • 使用 systemctl 管理
bash 
systemctl enable wg-quick@wg0
systemctl start wg-quick@wg0

客户端

和服务端很像

key 生成

bash 
umask 077
wg genkey | tee /etc/wireguard/privatekey | wg pubkey | tee /etc/wireguard/publickey
  • privatekey : 客户端私钥
  • publickey : 客户端公钥

配置文件

  • 创建 /etc/wireguard/wg0.conf
ini 
[Interface]
Address = 10.8.0.2/24
PrivateKey = CLIENT_PRIVATE_KEY
DNS = 1.1.1.1,8.8.8.8

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = SERVER_IP_ADDRESS:51820
AllowedIPs = 0.0.0.0/0
  1. Address 逗号分隔，wg0 地址
  2. CLIENT_PRIVATE_KEY 从客户端 cat /etc/wireguard/privatekey 获取
  3. SERVER_PUBLIC_KEY 从服务端 cat /etc/wireguard/publickey 获取
  4. SERVER_IP_ADDRESS 是服务端公网 ip 地址
  5. AllowedIPs 本地那些流程走 VPN 隧道，0.0.0.0/0 表示所有流量
  • 修改文件权限
bash 
sudo chmod 600 /etc/wireguard/{privatekey,wg0.conf}

服务端操作

  • 将客户端 IP 添加到服务器中
bash 
wg set wg0 peer CLIENT_PUBLIC_KEY allowed-ips 10.8.0.2
  1. CLIENT_PUBLIC_KEY 从客户端 cat /etc/wireguard/publickey 获取

创建 wg0 接口

客户端

bash 
$ wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.8.0.2/24 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] wg set wg0 fwmark 51820
[#] ip -4 route add 0.0.0.0/0 dev wg0 table 51820
[#] ip -4 rule add not fwmark 51820 table 51820
[#] ip -4 rule add table main suppress_prefixlength 0
[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
[#] iptables-restore -n

删除端口

bash 
$ wg-quick down wg0
[#] ip -4 rule delete table 51820
[#] ip -4 rule delete table main suppress_prefixlength 0
[#] ip link delete dev wg0
[#] resolvconf -d tun.wg0 -f
[#] iptables-restore -n

FAQ

Error: Unknown device type

bash 
$ sudo ip link add dev wg0 type wireguard
Error: Unknown device type

解决方法：

bash 
$ modprobe wireguard
$ lsmod | grep wireguard
wireguard             212992  0
ip6_udp_tunnel         16384  1 wireguard
udp_tunnel             20480  1 wireguard

resolvconf: command not found

bash 
wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.8.0.2/24 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a wg0 -m 0 -x
/usr/bin/wg-quick: line 32: resolvconf: command not found
[#] ip link delete dev wg0

解决方法：

bash 
apt install resolvconf

容器安装

参考

  1. https://www.wireguard.com/install/
    最新评论