需求描述
日常使用Wireguard,用于在外面登录自己家里,管理家庭内部的网络设备,非常稳定可靠,下面介绍配置和用法
Wireguard官网https://www.wireguard.com/
安装也都是比较简单的,参考https://www.wireguard.com/install/,有详细的步骤
我这里的家里的主机用的Debian 10,配置过程如下:
第一步, 添加backports源
添加deb http://deb.debian.org/debian buster-backports main 到/etc/apt/sources.list
第二步, 执行更新
root@ServerX:~# apt-get update
第三步, 执行安装
root@ServerX:~# apt install wireguard
第四步, 生成密钥
root@ServerX:~# cd ~ root@ServerX:~# umask 077 root@ServerX:~# wg genkey > server_privatekey root@ServerX:~# wg pubkey < server_privatekey > server_publickey root@ServerX:~# wg genkey > client_privatekey root@ServerX:~# wg pubkey < client_privatekey > client_publickey
第五步, 开启系统转发
root@ServerX:~# 添加 net.ipv4.ip_forward = 1 到 /etc/sysctl.conf root@ServerX:~# sysctl -p
第六步, 添加服务端的配置文件,我这里只自己一个人连接,客户端只配置一个IP
服务端的配置 名字 ~/wg0.conf [Interface] Address = 10.12.6.1/24 ListenPort = 11111 PrivateKey = 服务器私钥字符串 [Peer] PublicKey = 客户端公钥字符串 AllowedIPs = 10.12.6.8/32 客户端的配置 名字 ~/wg92.conf [Interface] Address = 10.12.6.8/32 PrivateKey = 客户端私钥字符串 [Peer] PublicKey = 服务器公钥字符串 AllowedIPs = 0.0.0.0/0, ::0/0 Endpoint = 118.12.3.25:11111 PersistentKeepalive = 25
第七步, 增加iptables转发,其中enp4s0需要修改到你自己的网卡名字
root@ServerX:~# iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE root@ServerX:~# iptables -A FORWARD -i wg0 -j ACCEPT root@ServerX:~# iptables -A FORWARD -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT root@ServerX:~# iptables -A FORWARD -i wg0 -o enp4s0 -j ACCEPT root@ServerX:~# iptables -A FORWARD -i enp4s0 -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT
第七步, 启动wireguard服务端,增加开机启动
root@ServerX:~# wg-quick up wg0 root@ServerX:~# systemctl enable wg-quick@wg0
备注, 安装Wireguard的常见报错及处理
故障情景,启动wireguard时候,报不支持的操作,
我这次报错是因为
已安装的linux-header版本为linux-headers-4.19.0-16-amd64
已安装的linux-image版本linux-image-4.19.0-9-amd64
解决的办法为: 安装一致的linux-image和linux-header
故障的样子:
root@ServerX:~# wg-quick up wg0 [#] ip link add wg0 type wireguard RTNETLINK answers: Operation not supported Unable to access interface: Protocol not supported [#] ip link delete dev wg0 Cannot find device "wg0" root@ServerX:~# modprobe wireguard modprobe: FATAL: Module wireguard not found in directory /lib/modules/... root@ServerX:~#
本次修复的步骤:
root@ServerX:~# dpkg --get-selections | grep linux binutils-x86-64-linux-gnu install console-setup-linux install firmware-linux-free install libselinux1:amd64 install linux-base install linux-compiler-gcc-8-x86 install linux-headers-4.19.0-16-amd64 install linux-headers-4.19.0-16-common install linux-headers-amd64 install linux-image-4.19.0-9-amd64 install linux-image-amd64 install linux-kbuild-4.19 install linux-libc-dev:amd64 install util-linux install root@ServerX:~# root@ServerX:~# apt-cache search linux-image-4.19.0-16-amd64 linux-headers-4.19.0-16-amd64 - Header files for Linux 4.19.0-16-amd64 linux-image-4.19.0-16-amd64-dbg - Debug symbols for linux-image-4.19.0-16-amd64 linux-image-4.19.0-16-amd64-unsigned - Linux 4.19 for 64-bit PCs linux-image-4.19.0-16-amd64 - Linux 4.19 for 64-bit PCs (signed) root@ServerX:~# apt-get install linux-image-4.19.0-16-amd64 root@ServerX:~# update-grub root@ServerX:~# reboot root@ServerX:~# dpkg -l | grep linux-image root@ServerX:~# apt-get -y remove linux-image-4.19.0-9-amd64 root@ServerX:~# update-grub
附录1、如果系统是Debian 9 ，则需要添加一下
apt update apt upgrade apt install linux-headers-$(uname -r) echo "deb http://deb.debian.org/debian/ unstable main" | tee /etc/apt/sources.list.d/unstable-wireguard.list echo -e "Package: *\nPin: release a=unstable\nPin-Priority: 150\n" | tee /etc/apt/preferences.d/limit-unstable apt update apt upgrade apt install wireguard-dkms wireguard-tools
附录2、也可把IPv6加进来，且把防火墙重定向数据包的iptables命令写在配置文件里
服务端参考如下
[Interface] PrivateKey = your server_private.key here Address = 10.10.0.1/24 Address = fd86:ea04:1111::1/64 ListenPort = 51820 PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o ens3 -j MASQUERADE PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o ens3 -j MASQUERADE SaveConfig = true
附录3、可在客户端配置中，指定DNS
参考配置如下
[Interface] Address = 10.10.0.2/32 Address = fd86:ea04:1111::2/128 SaveConfig = true PrivateKey = your client_private.key here DNS = 1.1.1.1 [Peer] PublicKey = your server_public.key here Endpoint = your server public ip:51820 AllowedIPs = 0.0.0.0/0, ::/0
