forked from DevOps/deploy.stack
89 lines
2.1 KiB
Markdown
89 lines
2.1 KiB
Markdown
## 部署 WireGuard VPN
|
||
|
||
---yaml
|
||
updated: 2025-12-13 09:11:21
|
||
tetle: install wireguard on Debian
|
||
---
|
||
|
||
以下是 WireGuard 部署步骤; 全部为手动配置
|
||
|
||
## wireguard 官网 [官网](https://www.wireguard.com/)
|
||
|
||
### 安装 WireGuard 服务端
|
||
|
||
建议有固定公网IP的ECS
|
||
|
||
```bash
|
||
apt install wireguard
|
||
modprobe wireguard
|
||
lsmod | grep wireguard
|
||
echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
|
||
sysctl -p
|
||
|
||
cd /etc/wireguard/
|
||
umask 077
|
||
wg genkey | tee server_private.key | wg pubkey > server_public.key
|
||
vim /etc/wireguard/wg0.conf
|
||
```
|
||
|
||
```ini
|
||
[Interface]
|
||
# 服务端在VPN网络中的私有IP地址
|
||
Address = 10.8.0.2/24
|
||
|
||
# 服务端监听的UDP端口，确保阿里云安全组已开放此端口
|
||
ListenPort = 51820
|
||
# 服务端的私钥
|
||
PrivateKey = <server_privatekey>
|
||
|
||
# 核心配置：配置路由和NAT转发 ！！！
|
||
# 当WireGuard启动后执行的命令（启用IP转发和MASQUERADE）
|
||
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
||
# 当WireGuard停止后执行的命令（清理规则）
|
||
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
|
||
|
||
# 可选项：持久化Keepalive，有助于穿越NAT
|
||
#PersistentKeepalive = 25
|
||
|
||
# [Peer] 部分，每个客户端一个。我们先留空，等生成客户端配置后再添加。
|
||
[Peer]
|
||
# 公司客户端
|
||
PublicKey = <CLIENT_PublicKey>
|
||
# 允许来自这个客户端的IP范围：客户端的虚拟IP + 公司内网的真实网段
|
||
AllowedIPs = 10.8.0.3/32
|
||
```
|
||
|
||
```
|
||
systemctl enable wg-quick@wg0
|
||
systemctl start wg-quick@wg0
|
||
wg show
|
||
```
|
||
|
||
### 安装 WireGuard 客户端
|
||
|
||
```shell
|
||
apt install wireguard
|
||
modprobe wireguard
|
||
lsmod | grep wireguard
|
||
cd /etc/wireguard/
|
||
umask 077
|
||
wg genkey | tee client_private.key | wg pubkey > client_public.key
|
||
vim /etc/wireguard/wg0.conf
|
||
```
|
||
|
||
```
|
||
[Interface]
|
||
Address = 10.8.0.3/24
|
||
PrivateKey = <client_private.key>
|
||
|
||
[Peer]
|
||
PublicKey = <server_public.key>
|
||
Endpoint = <server_public_IP>:51820
|
||
AllowedIPs = 10.8.0.0/24
|
||
PersistentKeepalive = 25
|
||
```
|
||
|
||
```
|
||
systemctl enable wg-quick@wg0
|
||
systemctl start wg-quick@wg0
|
||
``` |