基于Wireguard技术的个人虚拟网络搭建

手动安装Wireguard

安装Wireguard（ubuntu20.04）

#root权限
sudo -i

#安装wireguard软件
apt install wireguard resolvconf -y

#开启IP转发
echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
sysctl -p

进入配置路径，调整目录权限

cd /etc/wireguard/
chmod 0777 /etc/wireguard

#调整目录默认权限
umask 077

生成服务器秘钥

#生成私钥
wg genkey > server.key

#通过私钥生成公钥
wg pubkey < server.key > server.key.pub

生成客户端(client)秘钥

#生成私钥
wg genkey > client.key

#通过私钥生成公钥
wg pubkey < client.key > client.key.pub

显示所有生成的秘钥

cat server.key && cat server.key.pub && cat client.key && cat client.key.pub

自动创建服务器配置文件

echo "
[Interface]
PrivateKey = $(cat server.key) # 填写本机的privatekey 内容
Address = 10.0.8.1 #本机虚拟局域网IP

PostUp   = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
#注意eth0需要为本机网卡名称

ListenPort = 50814 # 监听端口
DNS = 8.8.8.8
MTU = 1420
[Peer]
PublicKey =  $(cat client.key.pub)  #自动client的公钥
AllowedIPs = 10.0.8.10/32 #客户端所使用的IP" > wg0.conf

设置服务器开机自启动

systemctl enable wg-quick@wg0

启动wireguard

#启动wg0
wg-quick up wg0
#关闭wg0
wg-quick down wg0

手动创建服务器配置文件（待完成）

nano /etc/wireguard/wg0.conf

wireguard客户端下载地址

https://www.wireguard.com/install/

客户端配置

[Interface]
PrivateKey = 6M8HEZioew+vR3i53sPc64Vg40YsuMzh4vI1Lkc88Xo= #此处为client1的私钥
Address = 10.0.8.10 #此处为peer规定的客户端IP
MTU = 1500

[Peer]
PublicKey = Tt5WEa0Vycf4F+TTjR2TAHDfa2onhh+tY8YOIT3cKjI= #此处为server的公钥
AllowedIPs = 10.0.8.0/24 #此处为允许的服务器IP
Endpoint = 114.132.56.178:50814 #服务器对端IP+端口

增加服务器客户端节点client2

#生成私钥
wg genkey > client2.key

#通过私钥生成公钥
wg pubkey < client2.key > client2.key.pub

#将peer公钥加入wg0.conf配置
echo "
[Peer]
PublicKey =  $(cat client2.key.pub)  #自动client2的公钥
AllowedIPs = 10.0.8.11/32 #客户端Client2所使用的IP" >> wg0.conf

使用Docker安装Wireguard

通过容器安装wg-easy

docker run -d \
  --name=wg-easy \
  -e WG_HOST=111.111.111.111 (🚨这里输入服务器的公网IP) \
  -e PASSWORD=passwd111 (🚨这里输入你的密码) \
  -e WG_DEFAULT_ADDRESS=10.0.8.x （🚨默认IP地址）\
  -e WG_DEFAULT_DNS=114.114.114.114 （🚨默认DNS）\
  -e WG_ALLOWED_IPS=10.0.8.0/24 （🚨允许连接的IP段）\
  -e WG_PERSISTENT_KEEPALIVE=25 （🚨重连间隔）\
  -v ~/.wg-easy:/etc/wireguard \
  -p 51820:51820/udp \
  -p 51821:51821/tcp \
  --cap-add=NET_ADMIN \
  --cap-add=SYS_MODULE \
  --sysctl="net.ipv4.conf.all.src_valid_mark=1" \
  --sysctl="net.ipv4.ip_forward=1" \
  --restart unless-stopped \
  weejewel/wg-easy

更新容器命令

docker stop wg-easy
docker rm wg-easy
docker pull weejewel/wg-easy

通过compose安装wg-easy

volumes:
  etc_wireguard: null
services:
  wg-easy:
    environment:
      # Change Language:
      # (Supports: en, ua, ru, tr, no, pl, fr, de, ca, es, ko, vi, nl, is, pt, chs, cht, it, th, hi, ja, si)
      - LANG=chs
      - WG_HOST=公网IP地址
      - PASSWORD_HASH=$$2a$$12$$qi7AePT/4d8MNeJi1hSVveE84qYCkNw8j6g.kOY5f7O.6JPjKsDuy
      - PORT=51821
      - WG_PORT=51820
      - WG_CONFIG_PORT=92820
      - WG_DEFAULT_ADDRESS=10.91.91.x
      - WG_DEFAULT_DNS=10.10.17.1
      - WG_MTU=1420
      - WG_ALLOWED_IPS=0.0.0.0/0
      - WG_PERSISTENT_KEEPALIVE=25
      # - WG_PRE_UP=echo "Pre Up" > /etc/wireguard/pre-up.txt
      # - WG_POST_UP=echo "Post Up" > /etc/wireguard/post-up.txt
      # - WG_PRE_DOWN=echo "Pre Down" > /etc/wireguard/pre-down.txt
      # - WG_POST_DOWN=echo "Post Down" > /etc/wireguard/post-down.txt
      # - UI_TRAFFIC_STATS=true
      # - UI_CHART_TYPE=0 # (0 Charts disabled, 1 # Line chart, 2 # Area chart, 3 # Bar chart)
      # - WG_ENABLE_ONE_TIME_LINKS=true
      # - UI_ENABLE_SORT_CLIENTS=true
      # - WG_ENABLE_EXPIRES_TIME=true
      # - ENABLE_PROMETHEUS_METRICS=false
      # - PROMETHEUS_METRICS_PASSWORD=$$2a$$12$$vkvKpeEAHD78gasyawIod.1leBMKg8sBwKW.pQyNsq78bXV3INf2G # (needs double $$, hash of 'prometheus_password'; see "How_to_generate_an_bcrypt_hash.md" for generate the hash)

    image: ghcr.io/wg-easy/wg-easy
    container_name: wg-easy
    volumes:
      - ./etc_wireguard:/etc/wireguard
    ports:
      - 51820:51820/udp
      - 51821:51821/tcp
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
networks: {}