Logo
Posts Projects Friend Photos

本文介绍了在Debian9服务器上部 署WireGuard VPN的配置过程，包括密钥生 成、服务端与客户端配置文件创 建，以及通过iptables实现双端内网 互通的进阶设置方法。

Debian 部署 wireguard
2 mins
Linux

环境h2

设备说明
Debian9 4.9 内核 vulrt 日本服务器部署 wireguard 程序
OpenWrt x86 64内网网关
Windows10内网设备

部署 wireguard 服务器h2

配置 wireguard 软件源, 并且安装 wireguard 程序

Terminal window
apt-get install wireguard wireguard-tools
Terminal window
# --> 准备工作目录
cd  /etc/wireguard/

生成双端秘钥h3

Terminal window
mkdir server;wg genkey | tee server/privatekey | wg pubkey > server/publickey
mkdir client;wg genkey | tee client/privatekey | wg pubkey > client/publickey

创建配置文件h3

Terminal window
cat > wg0.conf  <<-EOF
[Interface]
Address = 172.16.220.1/24
SaveConfig = false
PostUp = (echo 1 > /proc/sys/net/ipv4/ip_forward);iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o  ens5  -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens5 -j MASQUERADE
ListenPort = 12138
PrivateKey = `cat server/privatekey`


[Peer]  #Client
PublicKey = `cat client/publickey`
AllowedIPs = 172.16.220.2/32
EOF
Terminal window
cat > client.conf <<-EOF
[Interface]
PrivateKey = `cat client/privatekey`
Address = 172.16.220.2/24
DNS = 8.8.8.8
MTU = 1420


[Peer]
PublicKey = `cat server/publickey`
# AllowedIPs = 0.0.0.0/0      # 全部路由都走server
AllowedIPs = 172.16.220.0/24  # wireguard虚拟网段互通
Endpoint =   net200.mooo.com:12138
PersistentKeepalive = 25
EOF
qrencode -t ansiutf8 < client.conf
Terminal window
# 生成二维码
qrencode -t ansiutf8 < client.conf

多个client 就创建多个client peer配置就行了

进阶玩法h2

wireguard 双端内网互通

主机ipwg ip内部网段作用
ServerA172.21.161.34172.16.220.1172.21.161.34/20公网服务器, 部署wg服务端
ClientB192.168.2.142172.16.220.3192.168.2.0/24内网服务器, 部署wg客户端
ClientC192.168.2.102无192.168.2.0/24内网服务器
目标是让ServerA 能够直接访问 ClientC的192.168.2.102 ip

ServerA配置h3

7d0a12cffb67e56e89bbd1e9caf41c64
Terminal window
# 把server的配置改为本机的ip
# AllowedIPs = 172.16.220.3/32,192.168.2.0/24
AllowedIPs = 192.168.2.0/24
 ip route add 172.21.161.34/32 via 192.168.2.142
Terminal window
# 允许所有流量转发（从192.168.2.0/24到其他网络）
sudo iptables -A FORWARD -d 192.168.2.0/24 -j ACCEPT


# 允许 NAT 转换，确保源地址在路由转发后是正确的
sudo iptables -t nat -A POSTROUTING -s 172.21.161.34/32 -d 192.168.2.0/24 -j MASQUERADE