Wireguard

WireGuard 是一种实现加密虚拟专用网络(VPN)的通信协议和免费开源软件，通过 UDP 传递流量，旨在比IPsec和OpenVPN这两种常见的隧道协议具有更好的性能和更强大的功能，其设计目标是易于使用、高速性能和低攻击面；

安装

0. Sys Conf

# /etc/sysctl.conf
net.ipv4.ip_forward = 1

1. 安装 wireguard

apt install wireguard

2. 生成秘钥对

wg genkey | tee server_privatekey | wg pubkey > server_publickey
wg genkey | tee u01_privatekey | wg pubkey > u01_publickey
wg genkey | tee u02_privatekey | wg pubkey > u02_publickey

3. 配置文件生成

服务端

# Server: /etc/wireguard/wg0.conf
serverip=$(curl ipv4.icanhazip.com)
port=17731
eth=$(ls /sys/class/net | awk '/^e/{print}')
wg0=$(cat server_publickey)
wg0p=$(cat server_privatekey)
u01=$(cat u01_publickey)
u02=$(cat u02_publickey)
u01p=$(cat u01_privatekey)
u02p=$(cat u02_privatekey)

cat > wg0.conf <<-EOF
[Interface]
PrivateKey = $wg0p
Address = 10.0.0.1/32
PostUp   = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o $eth -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o $eth -j MASQUERADE
ListenPort = $port
DNS = 8.8.8.8
MTU = 1420

[Peer]
PublicKey = $u01
AllowedIPs = 10.0.0.10/32
[Peer]
PublicKey = $u02
AllowedIPs = 10.0.0.20/32
EOF

客户端

# Client： /etc/wireguard/u01.conf
cat > u01.conf <<-EOF
[Interface]
PrivateKey = $u01p
Address = 10.0.0.2/24
DNS = 8.8.8.8
MTU = 1420

[Peer]
PublicKey = $wg0
Endpoint = $serverip:$port
AllowedIPs = 0.0.0.0/0, ::0/0
PersistentKeepalive = 25
EOF

4. 启动（服务端与客户端）

wg-quick up wg0